DRBD uses openssl or gnutls? - Githubissues

LINBIT / drbd-utils

DRBD userspace utilities (for 9.x, 8.4, 8.3)

GNU General Public License v2.0

77 stars 46 forks source link

DRBD uses openssl or gnutls? #45

Open ShreyBansal22 opened 3 months ago

ShreyBansal22 commented 3 months ago

Hi, I have doubt is DRBD FIPS compliant? As DRBD uses openSSL to generate certificate but for tcp encyption consumes tlshd user land library which is dependent on GNU-TLS. Can anyone confirm what is the actual thing.

Regards, Shrey shreybansal22@gmail.com

WanzenBug commented 3 months ago

To answer your questions:

The DRBD kernel module does not do any cryptography, it instead just enables "Kernel TLS offload". If that is FIPS compliant depends on your kernel. I believe RedHat kernels are generally certified in that regard.
tlshd does the TLS handshake, and uses GnuTLS internally. So that again depends on the FIPS compliance of your GnuTLS version. Again, I believe RedHat certified it for their distributions.

So no, we do not use OpenSSL and we should be FIPS compliant provided your OS is FIPS compliant.