Comment 3 for bug 1949197

Crypto defaults in Ubuntu should always be driven by our understanding of what is the most secure solution for our users; it should not be driven by certification standards, FIPS or otherwise. We should support FIPS compliance for encrypted volumes, but support for that should be orthogonal to the cryptsetup defaults on a system not in FIPS mode.

It sounds like cryptsetup upstream already has support for FIPS-compatible selection (and certainly, PBKDF algorithm selection is selectable from the cryptsetup commandline at LUKS container creation time), we just want to make sure FIPS mode is functional on Ubuntu. For full-disk encryption driven from the installer, because the installer does not use the FIPS kernel and therefore cryptsetup behavior will not automatically be FIPS-compliant, we would need some way to say we want the system to be FIPS-compatible post-install. This should probably be a simple toggle saying that you want FIPS mode, which would drive the options when invoking cryptsetup but could be extended later to handle other things (such as ua enablement, installing from the fips package repository, etc). I expect that should go through a process with the Design Team.