On Friday, 7 September 2018 16:18:48 CEST Alessandro Gherardi wrote: > Thank you for your reply. > Looking at the OpenSSL FIPS Security > Policy https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-valid > ation-program/documents/security-policies/140sp1747.pdf, I see the following > statement: > "The Module requires an initialization sequence (see IG 9.5): the calling a > pplication invokes > FIPS_mode_set(), which returns a “1” for success and “0” for failure. If F > IPS_mode_set() > fails then all cryptographic services fail from then on. The application c > an test to see if FIPS mode has been successfully performed." Therefore, > for OpenSSL to switch to FIPS mode, it is required that the application > call FIPS_mode_set(1). Can you please confirm that my understanding is now > correct? If you are using that specific openssl module, then yes, you have to manually call FIPS_mode_set() from application code. But please note that's not the only openssl FIPS module in existence, and other modules may behave differently (I know that some not only _may_ , but _will_ behave differently). Sorry for being vague, but you have not provided any information what versions you are actually running, on what versions of OS, how you acquired them, etc. All of which has quite significant impact on FIPS-worthiness of any particular module. Also, to make matters worse (more confusing), software package version is not the same thing as FIPS module version. -- Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 115, 612 00 Brno, Czech Republic
Attachment:
signature.asc
Description: This is a digitally signed message part.
-- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
