5 ms·
OpenSSL FIPS certification (#1747) is for source code, not for binary. This is highly unusual indeed, but it is not the case that only binaries can be FIPS cert
by sanxiyn 13y ago
OpenSSL FIPS certification (#1747) is for source code, not for binary. This is highly unusual indeed, but it is not the case that only binaries can be FIPS certified.
On the other hand, you can't change the source without losing the certification, so it doesn't actually matter.
- pgeorgi 13y agoSo any change to openssl fips has to happen as compiler patches?
- danudey 13y agoNo, changing the source means you're not using FIPS-compliant source so you're breaking your terms. This is why you might have to use old versions of OpenSSL for FIPS compliance - not all versions might be certified.
- eslaught 13y agoI think the GP is talking about a trusting trust attack on OpenSSL: Change the compiler to compile OpenSSL differently, rather than change the source itself.
- ballard 13y agoI guess it begs the question (FIPS mode seems to fail the "talk to a cryptographer rule"): why don't/aren't sec folks more involved to assure standards are meaningful? Was this a NIST-driven process or was it open to public comments?