Speaker
Description
Many organizations require US Federal Information Processing Standard (FIPS) certification of the crypto code they are running. The certification process is lengthy (typically 12–18 months), but the bigger problem is that the way the crypto subsystem is built into the kernel makes the result unable to be reused across kernel updates. This is because FIPS certification is granted at the binary level by NIST. In current kernels, the crypto subsystem is built directly into the main kernel image, so even a non-crypto kernel update — a scheduler fix, a driver addition — produces a new binary and invalidates the existing certification. Distributions are then forced through the full validation cycle again, making it extremely difficult to deliver timely kernel updates while maintaining FIPS compliance.
This talk presents a solution that has shipped in kernel 6.18 on Amazon Linux 2023 and is covered in an LWN.net feature article: decoupling the crypto subsystem from the main kernel and building it as a separate loadable module. The module, rather than the entire kernel, becomes the unit of certification. A subsequent kernel update that does not touch the module leaves the existing certification intact, and loading that certified module onto the updated kernel makes it FIPS-compliant automatically. When the crypto code itself needs updating, a new module can be submitted for certification while users continue running the previously certified one on newer kernels; the old module acts as a bridge, so users never have to choose between an updated kernel and FIPS compliance.
While the existing kernel's module system already allows code to live outside the main kernel, this talk will present why the same approach cannot simply be used here, what falls short, and how the approach overcomes these obstacles in its design and implementation as shipped in production. It will also discuss what it needs to be as a unified upstream foundation that distributions can customize to satisfy different certification setting requirements.
References:
- Patch series: https://lwn.net/ml/all/20260418002032.2877-1-wanjay@amazon.com/
- LWN article: https://lwn.net/SubscriberLink/1073759/95b3d4cd28506836/