Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use system-wide crypto configuration instead of setting a local one #773

Open
ansasaki opened this issue Apr 29, 2024 · 0 comments
Open

Comments

@ansasaki
Copy link
Contributor

This is a follow-up on the discussion about using the system-wide crypto configuration instead of setting a locally. See the conclusion of the discussion: https://github.com/keylime/rust-keylime/pull/761/files#r1581052015

There is no easy way to make rust-openssl to use the system-wide openssl configuration. Following the system-wide configuration has advantages:

  • No need to select and maintain the local configuration, just follow the system configuration for a sane selection
  • When the system-wide configuration is updated, the crypto used by the agent would be updated automatically, without changes in the code or in the configuration
    • When the system is running on FIPS mode and sets a FIPS-approved configuration, the agent would follow the configuration automatically

Normally, when the system uses crypto-policies which sets the openssl configuration, it is sufficient for the application to use the default configuration to inherit the system-wide configuration. The problem is that rust-openssl does not provide an easy way to use the openssl default configuration.

Related: #761

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant