Request: Enable FIPS compliance automatically
- Dominant language
- C#
- Stars
- 11.5k
- Forks
- 960
- PR merge metrics
- No merged PRs in 30d
Description
Currently to allow `choco` to calculate checksums on a device with FIPS compliance mode enabled, the feature `useFipsCompliance` must be enabled. Given that this is something that can be determined ahead of time (as I believe it's a registry setting?), is there a good reason we _have_ a feature toggle for it and don't just enable it automatically when it's required?
## History
I did a bit of digging and turned up [this comment](https://github.com/chocolatey/choco/issues/446#issuecomment-223781712) from Rob in 2016 which cited undefined "undesirable effects". Some additional digging requiring the use of the wayback machine (the link to the blog post is now dead) dug up [this blog post from Microsoft](https://web.archive.org/web/20190312212744/https://blogs.technet.microsoft.com/secguide/2014/04/07/why-were-not-recommending-fips-mode-anymore/) which carries a clarifying comment edit made in 2017 which states:
> [Note added 3 Oct 2017 to clarify an occasional misinterpretation: at no point does this blog post recommend against using FIPS mode. As stated near the end of the post, "we’re not telling customers to turn it off – our recommendation is that it’s each customer’s decision to make."]
Apart from the obvious case of "if FIPS compliance is enabled, you can't use any _non_-FIPS-compliant algorithms in a .NET application" which Chocolatey already handles anyway (albeit in a sometimes undesirable fashion, simply telling the user to go enable the FIPS compliance feature), there does not appear to be a significant reason to _avoid_ running entirely in FIPS compliant systems, given we've already coded in a workaround (just one that has to be manually enabled, for some reason).
## Context
Part of the reason I'm raising this issue is due to this issue being raised in the chocolatey-ansible repository: https://github.com/chocolatey/chocolatey-ansible/issues/37
Given there is an ask for it to be made easier, the question was raised in discussion with @pauby and myself whether it would make more sense for `choco` itself to manage its FIPS modes automatically, rather than requiring explicit opt-in.
In a system with FIPS compliance enabled, you _cannot_ use certain features of Chocolatey without enabling the FIPS feature, so my question is -- why don't we attempt to check whether the feature is enabled, and configure Chocolatey accordingly?
/cc @pauby @gep13
Contributor guide
Research direction
Start by tracing Chocolatey's existing useFipsCompliance feature and how it handles checksum calculation, then determine how the Windows FIPS setting can be detected. Review the linked chocolatey-ansible request and prior discussion before defining the behavior; done means Chocolatey selects the correct mode automatically without breaking non-FIPS systems.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100