On 27/02/2020 20:37, Jason Schultz wrote: > Thanks for all of the responses. This question has led to other related > topics, so I have another one. According to this blog: > > https://keypair.us/2019/12/rip-fips-186-2/ > > The OpenSSL FIPS Object Module will be moved to the CMVP historical list > as of 9/1/2020. Since there is no OpenSSL 3.0 until Q4 2020, and a FIPS > Module will be after that sometime, where does this leave 1.0.2 users > who need a FIPS validated object module past that date? Going to the historic list will not impact existing deployments at all. If you already have the old module deployed you can continue to use it, even if it is on the historic list as I understand it. You will not be able to make *new* deployments if it goes historic. The problem is with FIPS 186-2 RSA Key gen. Modules now need to be FIPS 186-4 compliant. But the OpenSSL FIPS Object Module 2.0 is not 186-4 and will not updated to be so. One option is to update the validation to remove RSA as an approved algorithm (this can be done as a purely paperwork exercise). But doing that has implications for existing deployments. The OMC discussed this some months ago but decided not to take any action at that time. I'm sure it will be discussed again next time we have a f2f. Matt > > > > ------------------------------------------------------------------------ > *From:* openssl-users <openssl-users-bounces@xxxxxxxxxxx> on behalf of > Salz, Rich via openssl-users <openssl-users@xxxxxxxxxxx> > *Sent:* Thursday, February 27, 2020 1:31 PM > *To:* Matt Caswell <matt@xxxxxxxxxxx>; openssl-users@xxxxxxxxxxx > <openssl-users@xxxxxxxxxxx> > *Subject:* Re: OpenSSL 3.0 > > >> It would probably be a good idea for us to pull together a "Getting > Started" guide on the Wiki with some basic information on how to get > things going, with some links to the various man pages etc where more > detailed information is required. > > This needs to be real user documentation as part of the FIPS > deliverable, right? >
