5 ms·

A quote in there says that customers don't care for FIPS support. I hope OpenBSD is not planning on dropping FIPS support from LibreSSL -- it seems like that wo

by Eyas 12y ago

A quote in there says that customers don't care for FIPS support. I hope OpenBSD is not planning on dropping FIPS support from LibreSSL -- it seems like that would be a huge mistake. Government agencies are among the many that are open to SSL vulnerabilities. Our tax, financial, SSN, and healthcare information are all open to vulnerabilities in buggy code. Dropping FIPS support means that government agencies whose security we (as consumers) care a whole lot about will not be benefiting from the massive improvements that the OpenBSD community hopes to bring about.

mjibson 12y ago
It appears doubtful that FIPS will be restored. See the commit: http://marc.info/?l=openbsd-cvs&m=139775148919571&w=2 http://marc.info/?l=openbsd-cvs&m=139775148919571&w=2 "Forcible certification conflicts with the goals of a free software project."
throwaway2048 12y ago
Even if OpenBSD did not drop the FIPS code, LibreSSL would not be FIPS compliant because that involves paying large amounts of money for certification, which with their limited resources, and the way FIPS nessisarily constrains development, they would be unwilling to do.
nathanvanfleet 12y ago
I wonder about if the NSA, who was supposedly aware of the bugs (and likely others), had to leave other US gov agencies open to the exploits because they would otherwise blow their cover? Or might they have had internal custom OpenSSL (or just didn't use OpenSSL)?
tobiasu 12y ago
Since when does OpenBSD (a Canadian project with a developer group all over the planet) need to care about some certification and standard bullshit by the government of the United States of America? What have the USA done for us lately? Oh yes, fought a long battle against cryptography in the hands of world citizens, spied on everyone and their dog, canceled OpenBSD funding, started multiple illegal wars and threatened every single country into submission (except for the one with nukes pointed at the White House). Does it get any more selfish? Bah.

by Eyas 12y ago

mjibson 12y ago

It appears doubtful that FIPS will be restored. See the commit: http://marc.info/?l=openbsd-cvs&m=139775148919571&w=2 http://marc.info/?l=openbsd-cvs&m=139775148919571&w=2 "Forcible certification conflicts with the goals of a free software project."

throwaway2048 12y ago

Even if OpenBSD did not drop the FIPS code, LibreSSL would not be FIPS compliant because that involves paying large amounts of money for certification, which with their limited resources, and the way FIPS nessisarily constrains development, they would be unwilling to do.

nathanvanfleet 12y ago

I wonder about if the NSA, who was supposedly aware of the bugs (and likely others), had to leave other US gov agencies open to the exploits because they would otherwise blow their cover? Or might they have had internal custom OpenSSL (or just didn't use OpenSSL)?

tobiasu 12y ago

Since when does OpenBSD (a Canadian project with a developer group all over the planet) need to care about some certification and standard bullshit by the government of the United States of America? What have the USA done for us lately? Oh yes, fought a long battle against cryptography in the hands of world citizens, spied on everyone and their dog, canceled OpenBSD funding, started multiple illegal wars and threatened every single country into submission (except for the one with nukes pointed at the White House). Does it get any more selfish? Bah.