> (as for "possibly not the FIPS provider", that's exactly right. That
one *will* be a loadable module and nothing else, and will only be
validated as such... meaning that noone can stop you from hacking
around and have it linked in statically, but that would make it
invalid re FIPS)
To be pedantic: this is true only *if you are using the OpenSSL validation.* If you are getting your own validation (such as using OpenSSL in an HSM device or whatnot), this is not true.
> - If permitted by the CMVP rules, allow an option for
> application provided (additional) entropy input to the RNG
> from outside the module boundary.
This is allowed, but it does not count toward the "minimum entropy" requirements. Anything after the first seeding falls into that category.
