https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Fabio Valentini decathorpe@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |182235 (FE-Legal) Flags|needinfo?(decathorpe@gmail. | |com) |
--- Comment #6 from Fabio Valentini decathorpe@gmail.com --- Package looks good to me, with one exception.
The fiat-crypto crate ships implementations of many elliptic curves, some of which aren't explicitly listed as "permitted in Fedora" here: https://fedoraproject.org/wiki/Legal:ECC
There has been some discussion about whether any elliptic curves are actually still not "good", but we haven't received any definitive resonses from Red Hat legal: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/...
Looks like the curves implemented in fiat-crypto are:
- Curve 25519: listed as OK - p224 / secp224r1: listed as OK - p256 / secp256r1: listed as OK - p384 / secp384r1: listed as OK - p434: not listed as OK; cannot find any documentation or source for this curve - p448 / Curve 448: listed as OK - p521 / secp521r1: listed as OK - secp256k1: listed as OK
Blocking FE-Legal. We need to know whether the p434 curve is OK ...
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=182235 [Bug 182235] Fedora Legal Tracker