Cryptography
Fedora relies on cryptography to protect its users and infrastructure, from signing distributed artefacts to authenticating connections between services.
This section documents how Fedora uses cryptography, including technical details of the tooling and processes involved.
Cryptographic Signatures
Cryptographic signatures are used throughout the Fedora ecosystem to ensure the integrity and authenticity of distributed artefacts. By verifying a signature, users can confirm that an artefact was produced by the Fedora Project and has not been tampered with since it was signed.
Certificate Trust
By default, Fedora utilises the Mozilla CA certificate store to establish trust for TLS connections. Users can add custom root certificates to the system trust store, such as for an enterprise PKI, which will be compiled into various formats for different applications to use.
Cryptographic Policies
As part of providing a unified cryptography experience, all packages in Fedora are required to respect the system-wide cryptographic policies. This limits the algorithms permitted for cryptographic operations such as signing, hashing, and key exchange to a common set of algorithms that are considered secure and appropriate for the use case.
Want to help? Learn how to contribute to Fedora Docs ›