Hi, Based on the Cryptsetup's FAQ [^1], LUKS is FIPS compliant: > From a technical point-of-view, LUKS with the right parameters would be FIPS-140-2 compliant, but in order to make it certified, somebody has to pay real money for that. The parameter is exposed in `configure.ac`: ``` AS_HELP_STRING([--enable-fips], [enable FIPS mode restrictions])) ``` I think we could add a USE flag to sys-fs/cryptsetup to enable or not `fips` and by default it should be disabled. [^1]: https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions [^2]: https://gitlab.com/cryptsetup/cryptsetup/-/blob/maste/configure.ac#L163-179
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5ec57a0b4c6249bafb46fb7041430cc9b53e2372 commit 5ec57a0b4c6249bafb46fb7041430cc9b53e2372 Author: Mathieu Tortuyaux <mtortuyaux@microsoft.com> AuthorDate: 2022-03-10 14:27:13 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-03-21 23:44:41 +0000 sys-fs/cryptsetup: add fips useflag Closes: https://bugs.gentoo.org/834920 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com> Closes: https://github.com/gentoo/gentoo/pull/24479 Signed-off-by: Sam James <sam@gentoo.org> sys-fs/cryptsetup/cryptsetup-2.4.3-r1.ebuild | 5 +++-- sys-fs/cryptsetup/metadata.xml | 1 + 2 files changed, 4 insertions(+), 2 deletions(-)
