Hacker News Reader

Comment by y-curious | Hacker News Reader

None of this is new to me, unfortunately. Going through getting FedRAMP High for my company and there are a lot of hoops to jump through. 80% of it is very reasonable e.g. DNSSEC, Hardware MFA. 20% of it is theater: You cannot, for example, allow AWS Govcloud to handle SSL termination for ECS. You have to manually verify S3 replication and cannot rely on their logging.

Still, echoing other commenters' sentiments, it's nice to see the government being forward-thinking on this. Jury is still out for NIST to weigh in on post-quantum encryption.

View on HN

DNSSEC isn't reasonable, and the OMB memo doesn't require it. CLOUD.GOV doesn't even support it.

NIST has standardized a set of PQC constructions; I think the jury is in there.

>NIST has standardized a set of PQC constructions; I think the jury is in there.

Published 4 days ago, thanks for the heads up. I was curious if they would delay announcing the CRYSTALS-Kyber algorithm as their choice after a paper claimed that they were able to decrypt it without quantum. I just looked the paper up and they had a bug in their code, so their claim was dropped. https://eprint.iacr.org/2024/555

>DNSSEC isn't reasonable

Memo doesn't mention it, but please enlighten me as to why you feel this way. I think it's a low-effort way to prevent a (admittedly esoteric) attack.

The NIST PQC standards were published very recently, but selected 2 years ago.

If you use the search bar below and do "DNSSEC by:tptacek", I can spare this threat a recitation of an argument I've made many times before. I would say, with some pretty solid empirical backing, that DNSSEC is more or less a dead letter at this point, most especially in North America.

Of course, "DNS encryption" (which is in the OMBZT memo) can mean a lot of things, and DoH is certainly not dead!

> You cannot, for example, allow AWS Govcloud to handle SSL termination for ECS.

Are you saying you can't terminate TLS at the ALB in FedRAMP high and instead have to terminate TLS at the node/pod level? That's the exact opposite interpretation that we have taken.

Yes, TLS all the way at every layer, but we explicitly terminate at the ALB first.

We were explicitly told that terminating at the ALB was unacceptable by the 3PAO. We had to build NGINX+ into the containers to terminate there.

I think your approach is valid, and I would have preferred to do it that way. Whatever passes the audit, I guess.

Reply on news.ycombinator.com