I participated in a number of meetings: OTC Face-to-Face meetings on 12/8, beginning of meeting on 12/10 FIPS Sponsors meeting on 12/7
I reviewed FIPS documents and set up a place in the otc-private repo for them. The three main documents are the security policy draft, vendor evidence draft and the finite state model. Other documents received from Acumen will be saved here as well. I will take over scheduling of FIPS meetings starting in January. The first meeting is scheduled for Jan 11 with Acumen. I have built OpenSSL 3.0.0 on my Macintosh and have experimented debugging into the FIPS module. I need to understand how the FIPS module will be built by users in the future. Right now, the user just pulls OpenSSL from a repo and builds it, then follows directions for installing the FIPS module. This seems to be only useful for the first release of OpenSSL 3.0.0. There are some inconsistencies in the FIPS documentation in the 3.0.0 master branch, and I will be addressing these in January. I worked on identifying the parts of OpenSSL that are needed to build the FIPS module. There appear to be 351 source files used to build the module including header files. There are 72 header files, 24 assembly language and 6 inc files. There are 208 files in the crypto tree, 103 in the providers tree, 38 in the include tree and 2 in the ssl tree. If we can identify only those issues that require a change to these files, we know what issues affect the FIPS module. This will be difficult but should be possible. I had a number of interactions with support customers, sending invoices. I did not handle this process well and a number of mistakes were made. Mark and I have discussed how to rectify these and I will be able to handle these tasks with much greater care in the future. Paul Nelson
