FIPS 140-2 encryption using Istio

[gyliu513]

Describe the feature request
Some discussion here https://groups.google.com/forum/#!topic/istio-users/Zk82Wxu4Zrc

Describe alternatives you've considered
Envoy already support FIPS with x86, we should enable Istio use the latest envoy to support FIPS encryption. Checkout here https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/ssl#fips-140-2 for detail.

FYI @morvencao @clyang82 @linsun

[linsun]

cc @johnma14

[gyliu513]

@johnma14 @linsun can you please share some plan or progress for this? Thanks.

[johnma14]

@gyliu513 I haven't gotten a chance so far to look at this in detail since I have been trying to complete some PR's for the 1.1 release. I hope to start work on this next week onwards if that is ok.

[linsun]

Target this for post 1.2 given it is not in 1.2 roadmap and requires a need and socialize with security WG.

[dghant1024]

@linsun Thanks for the heads up ... I know that dates are irrelevant in what we do, but I'm curious when you think FIPS 140-2 will make it into an RC?

[clyang82]

Guidance about how to enable FIPS support for power - envoyproxy/envoy#7221

[linsun]

chatted with @PiotrSikora offline and he has done some investigation on this, looking forward to seeing those.

Also, added this topic to the security WG agenda tmr for folks who are interested in it.

[coreywagehoft]

Any movement on this being added to the Istio roadmap?

[linsun]

A quick update on this topic:

A couple of us have discussed this topic at an Istio security WG mtg few weeks back:

• Build envoy and istio proxy with the boringssl=fips option.  Note: this option is only avail on Linux-x86_64.  This will use BoringCrypto module (which is open source, a general purpose cryptographic library that provides FIPS 140-2 approved cryptographic algorithms to serve boringSSL and other user-space application).   If we go with this option, need to ensure using only approved algorithms at runtime.  Is specify at build time sufficient?  Seems not.  This will require changes in Pilot to do the proper sidecar configuration.

(An alternative being discussed: Redhat has an open source github repository that is a fork of envoy proxy and replaced boringSSL with openSSL for FIPS 140-2 compliance. And in this mode, no sidecar config is needed thus no pilot code change is needed.)

• Need to ensure private keys are generated by a module operating in FIPS-approved mode.  
  a.    We are using crypto/rsa module to generate private keys.  see related code:  https://github.com/istio/istio/blob/master/security/pkg/pki/util/generate_csr.go#L35.  Based on discussion in security WG meeting, this is not FIPS approved yet.
  b.    Need to rebuild pilot, citadel, mixer and galley with crypto module that pass FIPS 140-2 certification.

• Dependency issue: since istio also talks to K8s API, it is also needed to ensure k8s API pass FIPS 140-2 certification.

[gramidt]

Thank you so much for the update, @linsun!

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[linsun]

Marking as staleproof as this issue still exists.

[gramidt]

@linsun - I would love to help drive this forward, as FIPS 140-2 compliance is becoming increasingly more important for industry-wide adoption. Is the Security WG owning this?

[jeffb4]

Dependency issue: since istio also talks to K8s API, it is also needed to ensure k8s API pass FIPS 140-2 certification.

This isn't a true dependency. For audit purposes if you care about istio using a FIPS 140-2 crypto module you probably also care about apiserver/kubelet/etc. using a FIPS module, but istio itself doesn't need to be concerned with whether the endpoint it connects to is itself FIPS.

Which is convenient because there's not really a way to ensure that an endpoint a FIPS module client connects to is using a FIPS module server.

[coreywagehoft]

Azure Kubernetes Service is now FedRAMP moderate and high authorized. I agree with @jeffb4 that FIPS 140-2 certification of the k8s API server should not be a concern for Istio.

[chaturvedia]

Is there more progress and update on Istio support for FIPS 140-2? What are the steps to build and enable it via Istio?

[gramidt]

I'll be making rounds and communicating with all of the Security WG and Networking WG leaders to help provide an update on this.

[ntap-joshuap]

@gramidt

Any news to share ?

[jennbergs]

I would also be very interested in hearing updates on the status of this!

[nilesh27602816]

I second @jennbergs. FIPS compliance is becoming important as we move critical and sensitive workloads to our applications running on K8S. I am wondering if K8S itself is FIPS compliant, meaning is K8S using only BoringCrypto algorithms for key/token/secret management and API authentication ?
We are trying to avoid maintaining our own version of Istio just to be FIPS compliant.
Thank you and appreciate your time.

[nilesh27602816]

Any update on this ?

[antweiss]

Redhat has an open source github repository that is a fork of envoy proxy and replaced boringSSL with openSSL for FIPS 140-2 compliance. And in this mode, no sidecar config is needed thus no pilot code change is needed.

@linsun would be very grateful for a link to that github repo. Couldn't find it myself.

[coreywagehoft]

Banzai Cloud have FIPS 140-2 working in the latest version of Istio..

https://banzaicloud.com/blog/istio-fips/

Unfortunately it doesn't seem like they will be offering this open source..

[alexbklein91]

I see that this was prioritized as a P1, any idea, on relative timeframe when this would be supported?

[dcberg]

Circling back to this one once again. We need to get this item prioritized for an upcoming release.
Do we know what is required? Is the primary work to build the sidecar proxy (envoy) using the proper FIPS module? Anything else?

[sdake]

Ensuring the proper fips library is in the container built properly is another challenge.

[sdake]

https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#fips-140-2

envoyproxy/envoy#3404

[linsun]

@dcberg @sdake I looked at this 1 year ago, and I think what needs to be done remains the same, except we have istiod vs a few cp components. Also, this is just to use FIPS 140-2 compliant modules which doesn't mean it has FIPS 140-2 compliant certification.

#11723 (comment)

[san360]

Any tentative plan to incorporate this in upcoming release?

[uromahn]

Redhat has an open source github repository that is a fork of envoy proxy and replaced boringSSL with openSSL for FIPS 140-2 compliance. And in this mode, no sidecar config is needed thus no pilot code change is needed.

@linsun would be very grateful for a link to that github repo. Couldn't find it myself.

@antweiss while this might not be a RedHat repo, I think this is what you might be looking for: https://github.com/envoyproxy/envoy-openssl

I haven't really checked if the referenced OpenSSL is FIPS 140-2 compliant but that should be relatively easy to do.

Also, if you don't care about QUIC, Envoy can now be build with a FIPS 140-2 compliant BoringSSL version as described here: https://www.envoyproxy.io/docs/envoy/v1.16.0/intro/arch_overview/security/ssl.html?highlight=fips#fips-140-2

[infa-jowoods]

Hi, instead of recompiling Istio linking against a FIPS mode version of BoringSSL, would it not be possible to simply, restrict the crypto used by Istio to FIPs primitives.. i.e. (AES, ECDSA, RSA, SHA2), for example by changing ciphersuites... or indeed, is Istio using non-compliant crypto elsewhere that is non-configurable?

[ntap-joshuap]

Hi, instead of recompiling Istio linking against a FIPS mode version of BoringSSL, would it not be possible to simply, restrict the crypto used by Istio to FIPs primitives.. i.e. (AES, ECDSA, RSA, SHA2), for example by changing ciphersuites... or indeed, is Istio using non-compliant crypto elsewhere that is non-configurable?

No. It is not sufficient to limit algorithms and cipher suites. You must use a library that has been certified by NIST's Cryptographic Module Validation Program. See below link. Note that there are both BoringSSL and OpenSSL modules which have been validated.

https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules/Search

[infa-jowoods]

Thanks @ntap-joshuap .

[dshuvar]

Any tentative plan to incorporate this in upcoming release?

UP. Same question, anybody knows when boringssl will be provided as an option in upstream?

[deva26]

Tetrate offers open source FIPS compliant istio and supported much longer. For details please take a look at - https://getistio.io/getistio-cli

[nirajshrestha]

They also have distroless fips enabled version if someone is looking for distroless. Just need to use tag 1.9.0-tetratefips-v1-distroless

[darkdatter]

Is there any update on official istio FIPS images as of yet? I see there are 3rd-party offerings and such

[jeesmon]

If you are looking to build one from source: #37118 (comment)