Cryptographic Documentation

COS Lite

Below, you will find the cryptographic documentation for the COS Lite solution. Its purpose is to track the exposure of charm code to cryptographic attack vectors.

What is not included in this document and regarded as out of scope:

  • Workload code (refer to the workloads’ cryptographic documentation)

  • Data at-rest encryption

The COS Lite charms have a very similar exposure. Unless specified otherwise in the charm’s own documentation, this cryptographic documentation applies to all.

Usage of cryptographic technology

COS Lite charm code uses cryptographic technology for mainly two purposes:

  • enabling TLS communication between their workloads

  • securing admin login to their workloads

Solution Internal

COS Lite charm code can use cryptographic technology to generate a private key to sign their TLS certificate requests. They do so via the tls-certificates interface which in turn uses the cryptography python library, as well as Juju secrets to exchange data with the certificate authority.

Also, charms that deal with large configuration files use SHA256 to efficiently detect differences in them.

Solution External

COS Lite charm users use passwords generated by charm code that depends on python’s secrets module. No configuration is exposed to the user.

These passwords secure admin login to the user-facing server provided by the workload. For example, in grafana-k8s.

Additionally, charms supporting basic authentication, such as Traefik, accept a <username>:<hashed-password> config option by which the user can configure basic authentication. The supported hashing algorithm are MD5, SHA1, or bcrypt, as per official documentation. Also following the official guidelines, we recommend cloud admins to use htpasswd for hashing the password and formatting the configuration string.

List of packages and cryptographic technology used

To generate private keys for setting up TLS communication, we use the rsa.generate_private_key function from the rsa package. We use the following parameters, which are hard-coded and non-configurable:

  • key_size = 2048

  • public_exponent = 65537

To generate admin passwords for user admin login, we use the secrets module from the python standard library. See for example: usage in grafana.