On 06/28/2012 01:17 PM, "Magosányi, Árpád" wrote: > On 06/28/2012 06:42 PM, Keith Bennett wrote: >> I do wonder if this is the proper time & place to discuss the >> implications of requiring source code to have been obtained by a >> "secure path" excluding the internet. Can an internet-enabled open >> source therefore be considered "secure" by that definition? > > The requirement for "secure path" excluding the internet seems to be > somewhat ridiculous at least at first sight. > You can sign the distributed source and the downloader can check the > signature to ensure validity. > But the above assumes the downloader already have a cryptographic > package secure enough. > Given that one definition of "secure enough cryptographich package" is > "FIPS validated", it can be argued that the requirement makes sense for > this class of software. > You cannot go with the above assumption.
Yup, that's the problem -- you need "secure installation" of that first validated product, which means any given entity is going to have to start with physical media at some point. Note that if you're using a typical desktop O/S with validated crypto -- Windows or RHEL, say -- that O/S is probably routinely patched by non-secure means (i.e. not using FIPS 140-2 validated crypto at both ends), so even if you originally installed it from physical media it quickly becomes illegitimate. Which brings you back to the snail-mailed CD. > So I would say that from a theoretical viewpoint requiring someone to > obtain cryptographic software in an off-internet path does make sense. > However I don't think the requirement have any practical impact beyond > that those in need of formally providing FIPS validated crypto subsystem > have to pay a small amount to FedEx. In this case it's USPS (United States Postal Service, handing off to international post for overseas destinations), and (at least for now) we are sending these CDs at no charge. -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct [email protected] [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
