GEMSTASH-194 Support for FIPS Mode#195
Conversation
This updates the digest usage from MD5 to SHA256 to support hosts that are configured in FIPS mode.
|
If I understand this correctly, this change modifies the directory names for Storage's "Resources" (aka uploaded things). That would be a breaking change, right? |
|
Yes, it changes the hashing mechanism used in the storage structure to a FIPS-compliant cipher. It will break any cached resources from older versions. Upgraded systems would need to re-cache. A conversion really wouldn't be possible, because we'd be guessing at rolling back from |
|
Maybe add this as a flag at the moment and make it the default in a major version. |
|
To suggest a flag name, I read a bit about the "FIPS mode" concept. I like the MS registry key name best: It describes what we do to Gemstash when this new option is set. We choose crypto in FIPS-compliant ways. As an option name What are some better flag names? |
|
@olleolleolle what about |
|
I added a PR on top of the @ayohrling one. |
This updates the digest usage from MD5 to SHA256 to support hosts that are
configured in FIPS mode.
Fixes #194