On 06/28/2012 12:42 PM, Keith Bennett wrote: > I do wonder if this is the proper time & place to discuss the > implications of requiring source code to have been obtained by a "secure > path" excluding the internet. Can an internet-enabled open source > therefore be considered "secure" by that definition?
As I understand it during the weeks of discussion of this topic with the test lab and the CMVP, the "trusted path" or "secure installation" requirement is (at least nominally)) applicable to all FIPS 140-2 validated cryptogrpahic modules, whether delivered in source code or binary form. See Section 6.6 of the new User Guide document for a discussion: http://openssl.org/docs/fips/UserGuide-2.0.pdf Note that one implication that came out of these discussions, and which was specifically and explicitly confirmed by the test lab, is that essentially all installations of the validated cryptographic modules in (for instance, to pick two representative examples) Microsoft Windows and Red Hat Enterprise Linux are illegitimate. -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct [email protected] [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
