Re: F45 Change Proposal: Disable in Kernel Crypto Userspace API (Phase 1) (self-contained)

On 7/24/26 12:15 PM, Peter Robinson wrote:
> 
> Can you provide details of where they are used in Fedora? I believe
> these would only be used if a user when out of their way to use those,
> generally via a manual install process.

What kind of argument is that?

Fedora was presented as a community OS, providing services to its users.
It is not an embedded system living with one specific, limited set of software
with default configurations.

There are a lot of users who rely on VeraCrypt containers, and many of them
use chained ciphers (AES/Serpent/Twofish).
All of these will now stop working with cryptsetup built against the OpenSSL backend.

Yes, you can install VeraCrypt itself, which does not use a crypto library but
implements the algorithms internally.

And yes, these ciphers and modes should be implemented in OpenSSL - even external
providers could do it. But that will not happen overnight.

Cryptsetup can also switch to libgcrypt, which already implements them.
It is only a configuration option. I am sure the security team at Red Hat
would appreciate that (sorry for the sarcasm, I couldn't resist).

Milan

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new