Life beyond FIPS 140-3: identity tales - DevConf.CZ 2023

Speaker(s): Alexander Bokovoy; Julien Rische

FIPS 140-3 standard has been published by NIST in 2019. When an operating system environment is put into a compliance with FIPS 140 standard series, the requirements extend to applications running in the environment as well. Each FIPS 140 standard generation was bringing ground breaking changes at the time, FIPS 140-3 is no different and its enforcement is like a snow at winter: we know things will break and they get broken but at a surprising angle.

The talk will look into how FIPS 140-3 affects identity management solutions with a focus on FreeIPA and Samba AD DC. These projects implement a complex stack of protocols whose lifetime spans more than forty years. Introducing new compliance requirements highlight hidden issues that weren't addressed for decades. Many of the issues intertwine protocol design evolution and implementation details. They also affect Linux systems' administrators in surprising and unpredictable ways.