You’re assuming FIPS improves security. It doesn’t. FIPS is a compliance thing. If you want to disable older algorithms, crypto-policies is the tool to do that. For example, run your Fedora with the DEFAULT:NO-SHA1 crypto-policy by running sudo update-crypto-policies --set DEFAULT:NO-SHA1 (update-crypto-policies is in the crypto-policies-scripts package). In fact, FIPS is very specific to the requirements of the US (and Canadian) government. It will disable all algorithms that were not invented or specified by these governments, some of which are actually considered significantly better than the algorithms allowed by FIPS.
For example, in FIPS mode your disk encryption key is derived from the disk encryption password using PBKDF2, which is a pretty dated password-based key derivation function, and potentially vulnerable to attacks by GPUs. Modern alternatives exist, and Fedora uses Argon2 by default outside of FIPS mode, because that algorithm has defenses against GPU-based attacks.
Different example, in FIPS mode your TLS connections will no longer use ChaCha20-Poly1305 for symmetric encryption, and instead fall back to AES-GCM. Now, there is no reason to assume AES-GCM is worse than ChaCha20-Poly1305 (except for the pitfall of IV reuse, which can be critical with AES-GCM, but is widely understood and mitigated), but there’s also absolutely no evidence that AES-GCM is any better than ChaCha20-Poly1305, and the latter can actually occasionally deliver better performance in systems that don’t have CPU acceleration for AES.
Another example, key exchange with curve25519 is not available in FIPS mode, neither for your SSH, nor your TLS connections. Curve25519 was designed to avoid implementation pitfalls when dealing with elliptic curves, and is fast. ECDH over the NIST ECC curves does not avoid the implementation pitfalls, and is considerably harder to implement correctly (people, never implement your own crypto, please!).
The same thing applies for Ed25519 and Ed448, which are signature algorithms. Now, NIST did actually add those to FIPS 186-5 recently, making them FIPS-compliant, but only after many people asked for that.
FIPS mode also changes the random number generator used by the kernel (although I’m honestly not sure whether those patches are even in Fedora in the first place), and places stricter requirements on re-seeding and entropy gathering, which means in practice you’ll get much slower DRBG performance in FIPS mode. We’re talking an order of magnitude here. Also, some recent improvements such as the vDSO getrandom() must be completely disabled in FIPS mode.
That is only partially correct.
Yes, FIPS is a set of crypto-algorithm policies, but those can also be set with the existing crypto-policies mechanism of Fedora.
It is also official validation by an accredited lab, but that doesn’t apply to Fedora, because we don’t do this validation for Fedora (it takes years, by the time a certificate would be issued, the version it was issued for would no longer be supported).
However, FIPS also comes with additional runtime testing requirements that have a significant impact on performance. The biggest offender here is that in FIPS mode, cryptographic libraries must test their own integrity on startup, and test their algorithms with a known-answer test before allowing their use. In practice that means that every single process that loads OpenSSL will first self-test its SHA2 implementation, then self-test its HMAC implementation, then compute an HMAC over the OpenSSL libraries, compare it against the expected value, then proceed to self-test every other algorithm it offers or you want to use. The impact on startup performance is huge.
For the reasons mentioned above, I can’t stress this enough: If you’re not required to run in FIPS mode because you’re working for the US government, don’t use FIPS mode. It does not give you what you might think it does.
Now, back to the original point made in the video:
For the FIPS section, this person does not seem to know what they’re talking about. FIPS does not come with requirements for logging, which they seem to be implying.
It only specifies requirements for implementations of cryptographic primitives. However, the validation required to be actually compliant with FIPS to be able to use it in US government environments costs a 5-6 figure sum, takes about 2.5 years, and is only valid for the specific version it was done for. This is entirely pointless for Fedora, given its release cycle.
This person does not seem to know a great deal about FIPS, and their points about FIPS compliance are wrong.
(somehow maximizing