diff --git a/config/v1/types_tlssecurityprofile.go b/config/v1/types_tlssecurityprofile.go index 2e9be97aeb4..8d295ca5341 100644 --- a/config/v1/types_tlssecurityprofile.go +++ b/config/v1/types_tlssecurityprofile.go @@ -15,8 +15,10 @@ type TLSSecurityProfile struct { // Note that not all platform components honor the ordering: Go-based components use Go's // internal preference order and treat this list as a filter of allowed groups rather than // an ordered preference. - // Note that X25519MLKEM768 is a post-quantum hybrid group that is not - // FIPS-approved and should be ignored by components running in FIPS mode. + // Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + // FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + // (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + // FIPS-approved and are ignored by components running in FIPS mode. // // The profiles are intent based, so they may change over time as new ciphers are // developed and existing ciphers are found to be insecure. Depending on @@ -168,8 +170,10 @@ const ( // There is a one-to-one mapping between these names and the group IDs defined // in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: // https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 -// Note that X25519MLKEM768 is a post-quantum hybrid group that is not -// FIPS-approved and should be ignored by components running in FIPS mode. +// Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are +// FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups +// (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not +// FIPS-approved and are ignored by components running in FIPS mode. // // +kubebuilder:validation:Enum=X25519;secp256r1;secp384r1;secp521r1;X25519MLKEM768;SecP256r1MLKEM768;SecP384r1MLKEM1024 type TLSGroup string @@ -274,8 +278,10 @@ const ( // NOTE: The caller needs to make sure to check that these constants are valid // for their binary. Not all entries map to values for all binaries. In the case // of ties, the kube-apiserver wins. Do not fail, just be sure to include only -// valid entries and everything will be ok. In particular, X25519MLKEM768 is -// not FIPS-approved and must be omitted by components running in FIPS mode. +// valid entries and everything will be ok. In particular, only the NIST P-curves +// (secp256r1, secp384r1, secp521r1) are FIPS-approved; X25519 and the ML-KEM +// post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) +// are not FIPS-approved and must be omitted by components running in FIPS mode. var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{ TLSProfileOldType: { Ciphers: []string{ diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..5d47d93938c 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..5fdb2bb9e58 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..cd008b519e0 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..9731e5b4bb9 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..a7546882bd1 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml index 2bdf5884339..556f726c433 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index 22c41067598..f6d157f1f0d 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -662,8 +662,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml index 1d77abba1dc..9ad4892c8d6 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml @@ -397,8 +397,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml index e3b095c3aa7..67a20ac3983 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml @@ -282,8 +282,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -401,8 +403,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go index 0519119af44..5672d00ca41 100644 --- a/config/v1/zz_generated.swagger_doc_generated.go +++ b/config/v1/zz_generated.swagger_doc_generated.go @@ -3216,7 +3216,7 @@ func (TLSProfileSpec) SwaggerDoc() map[string]string { var map_TLSSecurityProfile = map[string]string{ "": "TLSSecurityProfile defines the schema for a TLS security profile. This object is used by operators to apply TLS security settings to operands.", - "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "old": "old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA384\n - ECDHE-RSA-AES256-SHA384\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES256-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA", "intermediate": "intermediate is a TLS profile for use when you do not need compatibility with legacy clients and want to remain highly secure while being compatible with most clients currently in use.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305", "modern": "modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. The supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256", diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index 3c3fbc06176..52ca0ff584a 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..87528646106 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index a3165d1d83c..d11515fda88 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..b0ecbbe1330 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index 23fec954d39..37032eccf46 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml index 66d909a97b7..43671e8e75d 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml index fae4842ea48..f8761f36587 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml @@ -281,8 +281,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml index 69807f8ea31..c560582c958 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index ef30e142d5a..e7bf8f1f302 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -21707,7 +21707,7 @@ func schema_openshift_api_config_v1_TLSSecurityProfile(ref common.ReferenceCallb Properties: map[string]spec.Schema{ "type": { SchemaProps: spec.SchemaProps{ - Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", Default: "", Type: []string{"string"}, Format: "", diff --git a/openapi/openapi.json b/openapi/openapi.json index 26bf2c9e39c..96caf3629a2 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -11719,7 +11719,7 @@ "$ref": "#/definitions/com.github.openshift.api.config.v1.OldTLSProfile" }, "type": { - "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "type": "string", "default": "" } diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml index 3a55f7bdf01..2eddfa09d90 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml @@ -2105,8 +2105,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2224,8 +2226,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3473,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 85ff60dbf83..1a9603b95f6 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -2184,8 +2184,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml index 0a638843f58..bbfa5004abf 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml @@ -2105,8 +2105,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2224,8 +2226,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3473,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 8220b5b91e4..fa7522e5071 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -2184,8 +2184,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml index 27dcb3bab60..d7b499c1e38 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml @@ -2105,8 +2105,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2224,8 +2226,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3473,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml index 0e2340ea9f7..ecaa25b7353 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml @@ -2151,8 +2151,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml index 451a1856a3a..2aa417a7d38 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml @@ -2151,8 +2151,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml index 8213d8756b4..66aea8e0539 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml @@ -2177,8 +2177,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml index 890638706b7..2620d1888b8 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml @@ -2072,8 +2072,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2191,8 +2193,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3391,8 +3395,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..5d47d93938c 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..5fdb2bb9e58 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..cd008b519e0 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..9731e5b4bb9 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..a7546882bd1 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -619,8 +619,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -738,8 +740,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index 3c3fbc06176..52ca0ff584a 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..87528646106 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index a3165d1d83c..d11515fda88 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..b0ecbbe1330 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index 23fec954d39..37032eccf46 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -202,8 +202,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -321,8 +323,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on