keylime / keylime/rust-keylime

Use system-wide crypto configuration instead of setting a local one

Open
#773 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
162
Forks
76
Avg merge
4d 17h
Merged PRs (30d)
3

Description

This is a follow-up on the discussion about using the system-wide crypto configuration instead of setting a locally. See the conclusion of the discussion: https://github.com/keylime/rust-keylime/pull/761/files#r1581052015

There is no easy way to make `rust-openssl` to use the system-wide `openssl` configuration. Following the system-wide configuration has advantages:

- No need to select and maintain the local configuration, just follow the system configuration for a sane selection
- When the system-wide configuration is updated, the crypto used by the agent would be updated automatically, without changes in the code or in the configuration
- When the system is running on FIPS mode and sets a FIPS-approved configuration, the agent would follow the configuration automatically

Normally, when the system uses `crypto-policies` which sets the `openssl` configuration, it is sufficient for the application to use the default configuration to inherit the system-wide configuration. The problem is that `rust-openssl` does not provide an easy way to use the `openssl` default configuration.

Related: #761

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the conclusion in the linked discussion on pull request #761 and review how rust-openssl currently handles OpenSSL configuration. Investigate how the agent can inherit the system-wide crypto-policies configuration, including FIPS-approved settings. Done means the agent follows the system configuration without maintaining a separate local selection.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.