Epic: FIPS 140-3 for the grid gateway

Open
  • Is something wrong?
#508 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
10/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
docker, github-actions, helm, kubernetes, rust
Domain
backend, ci-cd, cryptography, devops, security

Research direction

This epic coordinates FIPS 140-3 support via sub-issues #503, #502, #506, #504, #505, #507; read those to locate the specific files or CI jobs to change. Done means a -fips UBI 9 gateway image linking system OpenSSL dynamically that starts under PRAXIS_REQUIRE_FIPS on a FIPS host with no bundled crypto.

Written by the indexing model from the issue text.

Description

area/security epic triage/accepted

The grid gateway is not FIPS 140-3 capable today. Praxis does all of its cryptography in the system OpenSSL and ships a FIPS build. The gateway takes praxis with the policy engine on, which brings aws-lc-rs and RustCrypto hashing into the binary. Praxis refuses to start such a binary under PRAXIS_REQUIRE_FIPS. The image is Alpine with a static OpenSSL, the chart cannot ask for FIPS, CI never builds a FIPS gateway, and nothing has run on a FIPS host.

Done means a -fips gateway image on UBI 9 that links the system OpenSSL dynamically and starts under PRAXIS_REQUIRE_FIPS on a FIPS host. The release binary carries no bundled crypto. A run on that host refuses a non-approved input.

Issues

  • #503 gateway build without the policy engine
  • #502 chart value that renders PRAXIS_REQUIRE_FIPS
  • #506 Containerfile.ubi9 that is the FIPS build
  • #504 gateway in the fips CI job
  • #505 release binary gated on no bundled crypto
  • #507 proof on a FIPS host and the operating doc

Upstream dependency

The FIPS build drops api-key auth with the policy engine. Keeping it needs praxis-proxy/praxis#1359 and a praxis FIPS blocker that knows which builtins a binary carries. That is praxis work and does not block this epic.

Dominant language
Rust
Stars
10
Forks
24
Avg merge
1d 12h
Merged PRs (30d)
155

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from praxis-proxy/grid

All issues in praxis-proxy/grid

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.