On 12/12/2012 09:59 PM, bhagyalekshmi r wrote: > Hi Steve, > Thank you very much once again. We have plan for FIPS 140-2 validation at > later point of time. > > For a quick method to become NIST compliance, we wanted to use > openssl-fips-2.0.2 along with OpenSSL library. > > Right now We dont want the full functionality of openssl-fips-2.0.2. We are > looking for only certain crypto operations. > Hence we are leveraging a partial code from openssl-fips-2.0.2. > > We had 2 concerns > > 1. Licensing and usage terms for openssl-fips-2.0.2 were not clear. Now you > have cleared this doubt, thank you once again. > 2. We were thinking FIPS certification is must for NIST compliance. Looks > like they are separate. So I understand from your response, we can use > openssl-fips-2.0.2 even if we are not going for FIPS 140-2 certification, > but it can be NIST compliance
What the heck is "NIST compliance"? Note FIPS 140-2 validation (n.b.: "validation" not "certification") is a U.S. government and DoD procurement requirement (and possibly of the Canadian government as well). The only way you can satisfy that requirement is by using FIPS 140-2 validated cryptography, and that means complying with the terms of the relevant Security Policy. The Security Policy for the #1747 validation clearly says no modifications, period. If you are not using FIPS 140-2 validated cryptography -- and you won't be if you make any modifications to the FIPS module source code distribution -- then there is no point in using the FIPS module. It has no technical advantages over the regular non-FIPS capable OpenSSL, in fact it is inferior in terms of performance and real-world security. So in your case don't use modified FIPS module source code, it buys you absolutely nothing and costs you unnecessary complexity. Just use OpenSSL. -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct [email protected] [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
