Investigate if OpenSSL (libcrypto) vendored in here can be FIPS certified
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- c
- Domain
- operating-systems, security
Research direction
Review the reverted OpenSSL update in commit 1d39ada8cb336d9e7c156be7526b674851fbdd40 and compare the 1.0.2k and 1.0.2g choices. Check whether the certificates that broke are stored as test cases. Done means documenting the feasibility of FIPS certification, newer OpenSSL compatibility, and contributing UEFI mode upstream.
Written by the indexing model from the issue text.
Description
Life would be easier if libcrypto inside shim was FIPS certified, as for example it would then not be needed for everyone to ship .hmac files for vmlinuz.
Looking at the code it seems like we currently reverted to using 1.0.2k OpenSSL version. Ubuntu actually has a FIPS certified 1.0.2g OpenSSL thus it would be interesting to see if this can be achieved.
I am also slightly concerned by how old our OpenSSL is, even if it is unlikely that any bugs or CVEs affect our reduced codebase.
In https://github.com/rhboot/shim/commit/1d39ada8cb336d9e7c156be7526b674851fbdd40 @vathpela reverted updates to OpenSSL due to incompatibilities with existing certs => have the certs that broke got stored somewhere as test cases? I separately ponder if we can or should work with OpenSSL upstream to contribute "UEFI" mode to OpenSSL to accept more certs.
Basically a can of worms =)
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rhboot/shim
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Similar issues
-
[adam] AdamNet network read doesn't cap to MAX_ADAM_PACKET_LEN, overflows client receive buffers Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
FujiNetWIFI/fujinet-firmware#1649 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
HarbourMasters/Shipwright#7229 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
riscv-software-src/riscv-isa-sim#2435 · 1 comment ·
-
bug Self Built Image SNAPSHOT Supported Device target/ramips
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100