Repository navigation
Conversation
gtema
commented
Oct 15, 2026
gtema
commented
Collaborator
- feat(storage-crypto): Add FIPS backend feature
- feat(storage): Add token-generated IV for PKCS#11
- fix(storage-crypto): Trim deps and document FIPS limits
Route AES-256-GCM, HKDF, HMAC and random generation through a new backend module. The default stays RustCrypto; the `fips` feature selects the FIPS 140-3 validated AWS-LC module via aws-lc-rs, and `assert_fips()` fails unless it is active. The storage crate forwards the feature. Make the EnvKek DEK wrap nonce deterministic (truncated HMAC of the DEK under a KEK-derived sub-key) so no RNG is used, matching ADR invariant 10. Reword the invariant: deterministic IVs are SP 800-38D compliant, so the rule is stricter than FIPS, not in conflict with it. Document the remaining gap: HKDF-derived state/backup nonces are not the fixed-field/counter construction. Assisted-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
Add an opt-in `pkcs11_token_generated_iv` setting. When enabled, the PKCS#11 KEK wraps the DEK through the PKCS#11 3.0 message API with CKG_GENERATE_RANDOM so the token generates the GCM IV, as FIPS 140-3 HSMs require. The wire format and unwrap path are unchanged. It is off by default and untested against real hardware (SoftHSM2 lacks the message API). Expose `random_bytes` from storage-crypto and use it for the PKCS#11 fallback IV and the snapshot nonce salt so a `fips` build draws from the validated DRBG. Document why the HKDF-derived state nonce stays: it must be identical on every node. Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com> Assisted-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Drop the unused typenum dependency and make the RustCrypto crates optional behind a default `rustcrypto` feature, so `--no-default-features --features fips` keeps them out of the tree. Fail the build when neither backend is selected. Return InvalidKeyLength for a wrong-size key in both backends. Add a test that unwraps an EnvKek blob with a foreign nonce, locking in backward compatibility with randomly wrapped blobs. Document that deterministic GCM IVs are not an approved FIPS service in the module, so `assert_fips()` proves the module, not each encrypt. Note the FIPS build prerequisites. Assisted-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
gtema
enabled auto-merge
October 15, 2026 17:01
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
|
Bencher Report| Project | keystone |
| Branch | crypto |
| Testbed | ubuntu-latest |
Click to view all benchmark results
| Benchmark | Latency | Benchmark Result nanoseconds (ns) (Result Δ%) | Upper Boundary nanoseconds (ns) (Limit %) |
|---|---|---|---|
| Command_Serde/apply/remove | 📈 view plot 🚷 view threshold | 201,530.00 ns(+47.77%)Baseline: 136,377.75 ns | 266,298.77 ns (75.68%) |
| Command_Serde/apply/set | 📈 view plot 🚷 view threshold | 207,770.00 ns(+43.84%)Baseline: 144,444.89 ns | 258,045.70 ns (80.52%) |
| Command_Serde/pack/delete | 📈 view plot 🚷 view threshold | 86.67 ns(-26.77%)Baseline: 118.36 ns | 166.93 ns (51.92%) |
| Command_Serde/pack/delete_index | 📈 view plot 🚷 view threshold | 78.92 ns(-25.73%)Baseline: 106.26 ns | 146.24 ns (53.97%) |
| Command_Serde/pack/set | 📈 view plot 🚷 view threshold | 149.02 ns(-21.69%)Baseline: 190.30 ns | 269.39 ns (55.32%) |
| Command_Serde/pack/set_index | 📈 view plot 🚷 view threshold | 78.33 ns(-26.76%)Baseline: 106.95 ns | 148.19 ns (52.86%) |
| Command_Serde/unpack/delete | 📈 view plot 🚷 view threshold | 89.89 ns(-39.03%)Baseline: 147.43 ns | 216.79 ns (41.46%) |
| Command_Serde/unpack/delete_index | 📈 view plot 🚷 view threshold | 80.60 ns(-35.82%)Baseline: 125.58 ns | 185.20 ns (43.52%) |
| Command_Serde/unpack/set | 📈 view plot 🚷 view threshold | 143.31 ns(-37.65%)Baseline: 229.84 ns | 344.74 ns (41.57%) |
| Command_Serde/unpack/set_index | 📈 view plot 🚷 view threshold | 80.68 ns(-35.30%)Baseline: 124.70 ns | 183.78 ns (43.90%) |
| Payload_encryption/pack/remove_cmd | 📈 view plot 🚷 view threshold | 75.42 ns(-31.96%)Baseline: 110.85 ns | 162.18 ns (46.51%) |
| Payload_encryption/pack/set_cmd | 📈 view plot 🚷 view threshold | 137.25 ns(-31.65%)Baseline: 200.79 ns | 301.38 ns (45.54%) |
| Payload_encryption/unpack/remove_cmd | 📈 view plot 🚷 view threshold | 94.13 ns(-37.21%)Baseline: 149.90 ns | 218.55 ns (43.07%) |
| Payload_encryption/unpack/set_cmd | 📈 view plot 🚷 view threshold | 148.57 ns(-36.40%)Baseline: 233.62 ns | 351.00 ns (42.33%) |
| Raft_1Node_Latency/prefix/1node | 📈 view plot 🚷 view threshold | 2,495,300.00 ns(-31.30%)Baseline: 3,632,323.59 ns | 8,552,239.25 ns (29.18%) |
| Raft_1Node_Latency/read/1node | 📈 view plot 🚷 view threshold | 30,130.00 ns(-13.59%)Baseline: 34,868.81 ns | 50,872.24 ns (59.23%) |
| Raft_1Node_Latency/remove/1node | 📈 view plot 🚷 view threshold | 462,280.00 ns(+33.26%)Baseline: 346,902.34 ns | 573,980.52 ns (80.54%) |
| Raft_1Node_Latency/write/1node | 📈 view plot 🚷 view threshold | 482,630.00 ns(+25.12%)Baseline: 385,745.47 ns | 752,803.91 ns (64.11%) |
| build_snapshot/default | 📈 view plot 🚷 view threshold | 1,780.10 ns(-15.72%)Baseline: 2,112.21 ns | 2,842.77 ns (62.62%) |
| fernet token/project | 📈 view plot 🚷 view threshold | 1,063.00 ns(-18.73%)Baseline: 1,307.95 ns | 1,775.97 ns (59.85%) |
| get_data_keyspace | 📈 view plot 🚷 view threshold | 0.24 ns(-19.43%)Baseline: 0.30 ns | 0.39 ns (62.42%) |
| get_db | 📈 view plot 🚷 view threshold | 0.26 ns(-13.31%)Baseline: 0.30 ns | 0.39 ns (67.16%) |
| get_fernet_token_timestamp/project | 📈 view plot 🚷 view threshold | 112.24 ns(-16.18%)Baseline: 133.90 ns | 182.21 ns (61.60%) |
| get_keyspace | 📈 view plot 🚷 view threshold | 10.82 ns(+61.78%)Baseline: 6.69 ns | 15.89 ns (68.12%) |
gtema
added a commit
that referenced
this pull request
Oct 15, 2026
The storage crate now offers opt-in stale local reads (#1532) and a FIPS backend (#1535); section 8.3 and section 20.1 still described both as missing. Local reads apply only to tier 0/1 records, and every record on the KMS's authorization and cache-fill path is tier 2 or 3, so they help for display metadata only. Update the FIPS table and rule 1 to the reworded invariant 10, and narrow open question 14 to the remaining gap: HKDF-derived state and backup nonces that must stay identical on every node. Signed-off-by: artem.goncharov <artem.goncharov@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.