3 ms·
OpenSSL 3 made a huge improvements in getting oneself FIPS certified, by isolating the FIPS-covered code to small auditable module that doesn't have to be updat
by p_l 3y ago
OpenSSL 3 made a huge improvements in getting oneself FIPS certified, by isolating the FIPS-covered code to small auditable module that doesn't have to be updated all that much, thus letting you update OpenSSL in general while retaining CMVP-verified crypto.
Now, getting it into some of the open source code was a PITA, especially when you have things like components that depended on MD5 somewhere...
- hedora 3y agoI’ve heard this approach called the “draw an imaginary and arbitrary box in your architecture diagram” approach to FIPS compliance. Fun fact: the fips compliant stuff doesn’t have to be on the data path if you draw the rectangle correctly. In other news, my smart refrigerator has military grade encryption, so no one can steal my sandwich.