4 ms·
OpenSSL is FIPS-certified. It supports everything and its mother. LibreSSL also breaks ABI pretty regularly. Finally, OpenSSL is the standard: no one ever go
by da_big_ghey 6y ago
OpenSSL is FIPS-certified. It supports everything and its mother. LibreSSL also breaks ABI pretty regularly. Finally, OpenSSL is the standard: no one ever got fired for buying IBM, or for using OpenSSL.
- toast0 6y agoIs FIPS certification a good thing? Does anyone actually run in FIPS mode? I mean, I wouldn't be surprised if it lets you check a box on PCI checklist; but only people who are forced to use that checklist.
- hannob 6y agoFIPS and similar certifications (Common Criteria) have a pretty bad reputation. Plenty of pretty severe crypto vulns that should've been caught by certifications were missed, and more importantly that didn't lead to any critical reflection on the side of the certification bodies. But it's common that if you work with governments that FIPS certification is a requriement.
- kjetijor 6y ago3DES is still an approved security function for FIPS 140-2 :) So yea - great stuff!
- X-Istence 6y agoYes, there are plenty of regulated environments (whether government or commercial) that require FIPS because it means the specified ciphers are all approved and the libraries are to have passed certification. It's a pain in the ass at times because it means things like Ed25519 and ECDSA not over NIST certified curves is not allowed...