AWS-LC: FIPS certification journey and how it’s used on AWS
summary
AWS-LC earns FIPS 140-3 validation and is deployed as a shared C crypto module used by s2n-tls, aws-lc-rs (Rust) and the Amazon Corretto Crypto Provider (Java), with platform validations on Graviton (ARM), x86, Android, iOS and Windows. Measured AES‑GCM throughput climbs from ~3,000 to ~4,000 to ~6,000 megabytes per second across releases and Graviton3 optimizations, and a real S3 server-side TLS handshake drops from about 9 ms to 6 ms after switching to AWS-LC FIPS.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:13The requirement
- 1:17Where do we need FIPS?
- 3:59How do we get FIPS everywhere?
- 5:21End-to-end encryption
- 6:43Application layer
- 8:40Operating environments
- 10:37FIPS can be fast
- 15:02Resources
related talks
39mExplorations of cryptography research
36mSecurity compliance: A global perspective
01h 00mCloud upgrade: Modern TLS encryption for all AWS service connections
01h 19mKeynote
32mPQC in FIPS 140-3, status and roadmap
28mAlmaLinux Security Feature Evaluation and Certifications — Efforts Toward FIPS 140-3 and CC Certification
25mFIPS 140-2 in BEAM Apps
22mEnterprise Linux crypto story