5 ms·
Also, I believe that only binaries can be FIPS certified, not source code, so there are times when one has to use an old, out-dated openssl binary in order to b
by ef47d35620c1 12y ago
Also, I believe that only binaries can be FIPS certified, not source code, so there are times when one has to use an old, out-dated openssl binary in order to be compliant.
- sanxiyn 12y agoOpenSSL FIPS certification (#1747) is for source code, not for binary. This is highly unusual indeed, but it is not the case that only binaries can be FIPS certified. On the other hand, you can't change the source without losing the certification, so it doesn't actually matter.
- pgeorgi 12y agoSo any change to openssl fips has to happen as compiler patches?
- danudey 12y agoNo, changing the source means you're not using FIPS-compliant source so you're breaking your terms. This is why you might have to use old versions of OpenSSL for FIPS compliance - not all versions might be certified.
- eslaught 12y agoI think the GP is talking about a trusting trust attack on OpenSSL: Change the compiler to compile OpenSSL differently, rather than change the source itself.
- ballard 12y agoI guess it begs the question (FIPS mode seems to fail the "talk to a cryptographer rule"): why don't/aren't sec folks more involved to assure standards are meaningful? Was this a NIST-driven process or was it open to public comments?