Support crypto agility - Githubissues

evan2645 commented 7 months ago

There are many cases in which crypto agility is desirable, including PQC and certain kinds regulated usages. Supporting it would be very powerful, but also complicated. In this issue, we'll work towards a design to understand the scope and sequencing of the work that will be needed

Here is a list of things that come to mind when I think about this work, as a starting point. To move forward, I think we want to 1) keep the below list updated with open questions and answers, and 2) ensure each open question has an answer gained through consensus on how we should solve it ... then, we can figure out sequencing of that work and create issues.

Workload key generation (where does it happen)
Workload API transmission of key (I think the spec calls for PKCS8 encoding on the key material ... how do we transmit arbitrary key type)
Server KeyManager interface - currently, it has knowledge of the signature types. Can we move to a more opaque interface?
Both X.509 and JWT SVID types have key and signature type information encoded into the document. Pluggable crypto will probably operate as a signing oracle? Does core need to know about the sig type? Perhaps related to above question
Server and agent SVIDs are used for mTLS between each other, which will use the pluggable key types, which means they'll need to be able to negotiate TLS with these keys. Do the pluggable mechanisms then need to be able to take this on as well?

What else am I not thinking of?

This issue is spun out of https://github.com/spiffe/spire/issues/4483 @itomsawyer

yuvrajsingh79 commented 5 months ago

Hi @evan2645 , I would highly appreciate if we have any track on the progress of this issue.

evan2645 commented 5 months ago

Hi @yuvrajsingh79 thank you for pinging. @itomsawyer had originally raised their hand to work on this but we haven't heard from them since we transitioned this issue from #4483 ... I think it is a lot of work but I also still feel it's valuable, assuming we can get it right.

yuvrajsingh79 commented 5 months ago

thanks @evan2645 for the prompt response. Let me know if I can be of any help, as I would love to contribute to it.

spiffe / spire

Support crypto agility #4698