Skip to content

Commit c4b8050

Browse files
justsmthjustsmth
authored
Update Readme on FIPS version changes (#636)
1 parent 14d2457 commit c4b8050

File tree

3 files changed

+82
-42
lines changed

3 files changed

+82
-42
lines changed

‎aws-lc-fips-sys/README.md

+40-26
Original file line numberDiff line numberDiff line change
@@ -3,57 +3,71 @@
33
[![crates.io](https://img.shields.io/crates/v/aws-lc-fips-sys.svg)](https://crates.io/crates/aws-lc-fips-sys)
44
[![GitHub](https://img.shields.io/badge/GitHub-awslabs%2Faws--lc--rs-blue)](https://github.com/awslabs/aws-lc-rs)
55

6-
**Autogenerated** low-level AWS-LC FIPS bindings for the Rust programming language. We do not recommend directly relying on these bindings.
6+
**Autogenerated** low-level AWS-LC FIPS bindings for the Rust programming language. We do not recommend directly relying
7+
on these bindings.
78

89
[Documentation](https://github.com/aws/aws-lc).
910

1011
## FIPS
1112

12-
This crate provides bindings to [AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
13-
FIPS validation testing by an accredited lab and has been submitted to NIST for certification. The static build of AWS-LC-FIPS
14-
is used.
13+
The aws-lc-fips-sys crate provides bindings to the latest version of the AWS-LC-FIPS module that
14+
has completed FIPS validation testing by an accredited lab and has been submitted to NIST for
15+
certification. This will continue to be the case as we periodically submit new versions of
16+
the AWS-LC-FIPS module to NIST for certification. Currently, aws-lc-fips-sys binds to
17+
[AWS-LC-FIPS 3.0.x](https://github.com/aws/aws-lc/tree/fips-2024-09-27).
1518

16-
| Supported Targets |
17-
| --- |
18-
| x86_64-unknown-linux-gnu |
19-
| aarch64-unknown-linux-gnu |
19+
Consult with your local FIPS compliance team to determine the version of AWS-LC-FIPS module that you require. Consumers
20+
needing to remain on a previous version of the AWS-LC-FIPS module should pin to specific versions of aws-lc-rs to avoid
21+
automatically being upgraded to a newer module version.
22+
(See [cargo’s documentation](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html)
23+
on how to specify dependency versions.)
2024

21-
Refer to the [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
22-
for the latest status of the static or dynamic AWS-LC Cryptographic Module. A complete list of supported operating environments will be
23-
made available in the vendor security policy once the validation certificate has been issued. We will also update our release notes
24-
and documentation to reflect any changes in FIPS certification status.
25+
| AWS-LC-FIPS module | aws-lc-rs |
26+
|--------------------|-----------|
27+
| 2.0.x | \<1.12.0 |
28+
| 3.0.x | *latest* |
2529

26-
## Release Support
30+
Refer to the
31+
[NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
32+
for the latest status of the static or dynamic AWS-LC Cryptographic Module. Please see the
33+
[FIPS.md in the aws-lc repository](https://github.com/aws/aws-lc/blob/main/crypto/fipsmodule/FIPS.md)
34+
for relevant security policies and information on supported operating environments.
35+
We will also update our release notes and documentation to reflect any changes in FIPS certification status.
2736

28-
This crate pulls in the source code of the latest AWS-LC FIPS branch to build with it. Bindings for platforms we officially support are pre-generated.
29-
The platforms which `aws-lc-fips-sys` builds on is limited to the platforms where the AWS-LC FIPS static build is supported.
37+
## Building and Bindings
38+
39+
This crate contains source code from a FIPS branch of AWS-LC for building and for bindings generation. A
40+
specialized FIPS build is performed. Bindings for some platforms are pre-generated.
3041

3142
### Pregenerated Bindings Availability
3243

33-
Targets
34-
---------------------
35-
aarch64_apple_darwin
36-
aarch64_unknown_linux_gnu
37-
aarch64_unknown_linux_musl
38-
x86_64_apple_darwin
39-
x86_64_unknown_linux_gnu
40-
x86_64_unknown_linux_musl
44+
| Targets |
45+
|----------------------------|
46+
| aarch64_apple_darwin |
47+
| aarch64_unknown_linux_gnu |
48+
| aarch64_unknown_linux_musl |
49+
| x86_64_apple_darwin |
50+
| x86_64_unknown_linux_gnu |
51+
| x86_64_unknown_linux_musl |
4152

4253
### Prebuilt NASM objects
4354

4455
Prebuilt NASM objects are *not* available for this crate.
4556

4657
### Tested AWS-LC FIPS Build Environments
4758

48-
`aws-lc-fips-sys` currently relies on the AWS-LC FIPS static build, please see our CI documentation at [AWS-LC](https://github.com/aws/aws-lc/tree/main/tests/ci#unit-tests).
59+
`aws-lc-fips-sys` currently relies on the AWS-LC FIPS static build, please see our CI documentation
60+
at [AWS-LC](https://github.com/aws/aws-lc/tree/main/tests/ci#unit-tests).
4961

5062
## Build Prerequisites
5163

52-
Since this crate builds AWS-LC as a native library, all build tools needed to build AWS-LC are applicable to `aws-lc-fips-sys` as well. This includes Go and Perl, which are hard dependencies for the AWS-LC FIPS build.
64+
Since this crate builds AWS-LC as a native library, all build tools needed to build AWS-LC are applicable to
65+
`aws-lc-fips-sys` as well. This includes Go and Perl, which are hard dependencies for the AWS-LC FIPS build.
5366

5467
[Building AWS-LC](https://github.com/aws/aws-lc/blob/main/BUILDING.md)
5568

56-
If you use a different build combination for FIPS and would like us to support it, please open an issue to us at [AWS-LC](https://github.com/aws/aws-lc/issues/new?assignees=&labels=&template=build-issue.md&title=).
69+
If you use a different build combination for FIPS and would like us to support it, please open an issue to us
70+
at [AWS-LC](https://github.com/aws/aws-lc/issues/new?assignees=&labels=&template=build-issue.md&title=).
5771

5872
## Security Notification Process
5973

‎aws-lc-rs/README.md

+21-8
Original file line numberDiff line numberDiff line change
@@ -45,17 +45,30 @@ function. This adds a requirement on `untrusted = "0.7.1"`.
4545
##### fips
4646

4747
Enable this feature to have aws-lc-rs use the [*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys)
48-
crate for the cryptographic implementations. The *aws-lc-fips-sys* crate provides bindings to
49-
[AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
50-
FIPS validation testing by an accredited lab and has been submitted to NIST for certification.
51-
The static build of AWS-LC-FIPS is used.
48+
crate for the cryptographic implementations. The aws-lc-fips-sys crate provides bindings to the
49+
latest version of the AWS-LC-FIPS module that has completed FIPS validation testing by an
50+
accredited lab and has been submitted to NIST for certification. This will continue to be the
51+
case as we periodically submit new versions of the AWS-LC-FIPS module to NIST for certification.
52+
Currently, aws-lc-fips-sys binds to
53+
[AWS-LC-FIPS 3.0.x](https://github.com/aws/aws-lc/tree/fips-2024-09-27).
54+
55+
Consult with your local FIPS compliance team to determine the version of AWS-LC-FIPS module that you require. Consumers
56+
needing to remain on a previous version of the AWS-LC-FIPS module should pin to specific versions of aws-lc-rs to avoid
57+
automatically being upgraded to a newer module version.
58+
(See [cargo’s documentation](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html)
59+
on how to specify dependency versions.)
60+
61+
| AWS-LC-FIPS module | aws-lc-rs |
62+
|--------------------|-----------|
63+
| 2.0.x | \<1.12.0 |
64+
| 3.0.x | *latest* |
5265

5366
Refer to the
5467
[NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
55-
for the latest status of the static or dynamic AWS-LC Cryptographic Module. A complete list of supported operating
56-
environments will be made available in the vendor security policy once the validation certificate has been issued. We
57-
will also update our release notes
58-
and documentation to reflect any changes in FIPS certification status.
68+
for the latest status of the static or dynamic AWS-LC Cryptographic Module. Please see the
69+
[FIPS.md in the aws-lc repository](https://github.com/aws/aws-lc/blob/main/crypto/fipsmodule/FIPS.md)
70+
for relevant security policies and information on supported operating environments.
71+
We will also update our release notes and documentation to reflect any changes in FIPS certification status.
5972

6073
##### asan
6174

‎aws-lc-rs/src/lib.rs

+21-8
Original file line numberDiff line numberDiff line change
@@ -47,17 +47,30 @@
4747
//! #### fips
4848
//!
4949
//! Enable this feature to have aws-lc-rs use the [*aws-lc-fips-sys*](https://crates.io/crates/aws-lc-fips-sys)
50-
//! crate for the cryptographic implementations. The *aws-lc-fips-sys* crate provides bindings to
51-
//! [AWS-LC-FIPS 2.x](https://github.com/aws/aws-lc/tree/fips-2022-11-02), which has completed
52-
//! FIPS validation testing by an accredited lab and has been submitted to NIST for certification.
53-
//! The static build of AWS-LC-FIPS is used.
50+
//! crate for the cryptographic implementations. The aws-lc-fips-sys crate provides bindings to the
51+
//! latest version of the AWS-LC-FIPS module that has completed FIPS validation testing by an
52+
//! accredited lab and has been submitted to NIST for certification. This will continue to be the
53+
//! case as we periodically submit new versions of the AWS-LC-FIPS module to NIST for certification.
54+
//! Currently, aws-lc-fips-sys binds to
55+
//! [AWS-LC-FIPS 3.0.x](https://github.com/aws/aws-lc/tree/fips-2024-09-27).
56+
//!
57+
//! Consult with your local FIPS compliance team to determine the version of AWS-LC-FIPS module that you require. Consumers
58+
//! needing to remain on a previous version of the AWS-LC-FIPS module should pin to specific versions of aws-lc-rs to avoid
59+
//! automatically being upgraded to a newer module version.
60+
//! (See [cargo’s documentation](https://doc.rust-lang.org/cargo/reference/specifying-dependencies.html)
61+
//! on how to specify dependency versions.)
62+
//!
63+
//! | AWS-LC-FIPS module | aws-lc-rs |
64+
//! |--------------------|-----------|
65+
//! | 2.0.x | \<1.12.0 |
66+
//! | 3.0.x | *latest* |
5467
//!
5568
//! Refer to the
5669
//! [NIST Cryptographic Module Validation Program's Modules In Progress List](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/modules-in-process/Modules-In-Process-List)
57-
//! for the latest status of the static or dynamic AWS-LC Cryptographic Module. A complete list of supported operating
58-
//! environments will be made available in the vendor security policy once the validation certificate has been issued. We
59-
//! will also update our release notes
60-
//! and documentation to reflect any changes in FIPS certification status.
70+
//! for the latest status of the static or dynamic AWS-LC Cryptographic Module. Please see the
71+
//! [FIPS.md in the aws-lc repository](https://github.com/aws/aws-lc/blob/main/crypto/fipsmodule/FIPS.md)
72+
//! for relevant security policies and information on supported operating environments.
73+
//! We will also update our release notes and documentation to reflect any changes in FIPS certification status.
6174
//!
6275
//! #### asan
6376
//!

0 commit comments

Comments
 (0)