On Wed, Sep 23, 2009, Pankaj Aggarwal wrote: > Ok !! > > Stephen, Could you tell me which RSA Sign Verfiy functions are available in > fips mode. The FIPS 140-2 Annexure A states that RSASSA-PKCS1-v1_5 and > RSASSA-PSS contained within PKCS#1 v2.1 can be used for sign/verify. What > are the corresponding OpenSSL function which should be used? >
Everything must go via EVP. You can't sign raw digests in FIPS mode, you must use EVP_Sign*() and EVP_Verify*(). The one exception is the SSL/TLS SHA1+MD5 signature which is permitted but not explicitly tested as part of the validation. To permit PSS some extra flags are added, see the "dgest" utility for some details. This is a bit of a hack but was the only way to support PSS in 0.9.8 without breaking binary compatibility. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager majord...@openssl.org
