rust-keylime icon indicating copy to clipboard operation
rust-keylime copied to clipboard

Use system-wide crypto configuration instead of setting a local one

Open ansasaki opened this issue 1 year ago • 0 comments

This is a follow-up on the discussion about using the system-wide crypto configuration instead of setting a locally. See the conclusion of the discussion: https://github.com/keylime/rust-keylime/pull/761/files#r1581052015

There is no easy way to make rust-openssl to use the system-wide openssl configuration. Following the system-wide configuration has advantages:

  • No need to select and maintain the local configuration, just follow the system configuration for a sane selection
  • When the system-wide configuration is updated, the crypto used by the agent would be updated automatically, without changes in the code or in the configuration
    • When the system is running on FIPS mode and sets a FIPS-approved configuration, the agent would follow the configuration automatically

Normally, when the system uses crypto-policies which sets the openssl configuration, it is sufficient for the application to use the default configuration to inherit the system-wide configuration. The problem is that rust-openssl does not provide an easy way to use the openssl default configuration.

Related: #761

ansasaki avatar Apr 29 '24 09:04 ansasaki