[openstack-dev] Fwd: Re: [requirements][kolla][security] pycrypto vs cryptography

Luke Hinds lhinds at redhat.com
Sat Nov 19 23:14:55 UTC 2016

On Fri, Nov 18, 2016 at 3:04 PM, Jeremy Stanley <fungi at yuggoth.org> wrote:

> On 2016-11-18 14:38:22 +0000 (+0000), Luke Hinds wrote:
> [...]
> > I proposed raising bugs on launchpad for each instance discovered, so
> that
> > if anything, we at least have an idea of the extent of work needed to
> reach
> > the needed level of compliance for FIPS 140-2.
> [...]
> It's come up plenty over the years and I think a lot of the easier
> cases have already been fixed. Places where you'll have more trouble
> are the ones like https://launchpad.net/bugs/1348339 (inherited from
> Swift's use of MD5 for etags).
> --


So its been known about for two years now, and the consensus then was it
needed changing too.

Sounds to me like this topic won't just go away and we need to address it
sooner or later.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20161119/9b2b7465/attachment.html>

More information about the OpenStack-dev mailing list