Maybe a dumb question too, considering that i am admittedly just getting into this field, but I though maybe if I ask I might learn something...is there any method of assurance that the test were then run on the machine they are installed on?
If whatever those tests are attesting to to certify compliance can be falsified by copying over 1 file, what would even be to purpose of those tests?
Or are simply dependency checks?
Thanks for all the effort it must take in answering all these
questions every day.
On 2/14/2022 5:31 PM, Dr Paul Dale
wrote:
Yes, this has to do with the FIPS standards. I forget which standard it is but the self tests are mandated to be run on each device independently.
The fipsinstall process runs the self tests before generating the configuration file. If the self tests fail, the module doesn't install. Copying the configuration file across avoids the self tests and therefore isn't compliant.
Pauli
On 15/2/22 02:25, Richard Dymond wrote:
Hi
Probably a dumb question, but why must the FIPS module configuration file for OpenSSL 3.0 be generated on every machine that it is to be used on (i.e. must not be copied from one machine to another)?
I just ran 'openssl fipsinstall' on two different machines with the same FIPS module and it produced exactly the same output each time, so presumably the reason has nothing to do with the config file being unique to the machine.
Does it have something to do with the FIPS standard itself?
Richard
