Life beyond FIPS 140-3: identity tales
summary
FIPS 140-3 removal of legacy primitives breaks Kerberos interoperability: RFC 3962-based AES/RC4 and SHA-1 combos have no overlap with the approved RFC 809 ChaCha/AES-GCM types so Active Directory and typical Linux stacks cannot interoperate unchanged. Red Hat teams use system crypto-policies, load alternative providers per-library, and add a Kerberos hint to negotiate per-connection encryption; MIT Kerberos and Heimdal lack full algorithm agility so deployments require migration steps, smartcard or PKINIT enrollment, and staged subpolicy rollouts to restore functionality.
AI-written summary · about
chapters (7)
- 0:00FIPS 140-3 journey
- 10:37FIPS 140-3 interoperability
- 22:08Modernizing for algorithm agility
- 34:43PKINIT protocol compliance
- 44:59Active Directory security
- 55:13Migration strategies
- 1:07:13Q&A
related talks
54mState of authentication and identity in Fedora
24mSystem - wide crypto policies what and why
46mBack to the Roots of Single Sign-On: Kerberos
22mEnterprise Linux crypto story
22mThe Future of Identity (Keystone)
46mAchieving Quantum Readiness: A Comprehensive Approach
24mSecurity benefits of FreeIPA/IDM
37mHow To Approach InfoSec Like a Fed(eral Auditor)