Custom crypto policies by examples
summary
System crypto policies provide a single, centrally managed way to enable or disable algorithms across OpenSSL and NSS on hundreds of machines, using policy files placed in /etc/crypto-policies/policies or modular fragments. Examples show how to disable SHA-1, block old TLS versions, add Camellia support, allow 2k RSA for compatibility, and restrict key-exchange to ECDHE/PSK. Policies are generated/applied by the crypto-policies tooling, have backend limitations, and need finer-grained controls for SHA-1 deprecation.
AI-written summary · about
chapters (13)
- 0:00Custom crypto policies intro
- 1:30Why crypto policies matter
- 2:14System crypto policy levels
- 4:31Custom policies from scratch
- 8:56Disabling SHA-1 in policies
- 11:14Disabling Camellia cipher
- 13:36Disabling TLS versions
- 15:11Future policies with RSA keys
- 16:58Restricting key exchange
- 18:46Policy modifiers at any level
- 20:30Vendor policy benefits
- 21:35SHA-1 deprecation plans
- 22:20Summary and Q&A
related talks
28mModern Cryptography
30mA Framework for Cryptographic Agility
47mPractical Security Foundations
46mAchieving Quantum Readiness: A Comprehensive Approach
27mCrypto Agility How it’s both a Critical Component and a Complex Challenge
36mUse Cryptography; Don't Learn It
32mPQC in OpenSSL Library
26mThe ABCs (Accelerated, Better and Cheaper) to Cryptographic Resilience