On 10/29/24 12:52, Jacob Champion wrote:
On Sat, Oct 26, 2024 at 11:10 AM Joe Conway <m...@joeconway.com> wrote:
Rather than depend on figuring out if we are in FIPS_mode in a portable
way, I think the GUC is simpler and sufficient. Why not do that and just
use a better name, e.g. legacy_crypto_enabled or something similar
(bike-shedding welcomed) as in the attached.
While it's definitely simpler, I read the original request as "forbid
non-FIPS crypto if the system tells us to", and I don't think this
proposal does that.
No, you just have to be able to configure the system in such a way that
the non-FIPs crypto is not available. This is entirely sufficient for that.
--
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
