> On Sep 10, 2015, at 8:44 AM, Jayalakshmi bhat <[email protected]>
> wrote:
>
> Hello all,
>
> I have a question on FIPS. We have OpenSSL FIPS module integrated with our
> product. We have an option to enable/disable FIPS at run time. We are
> executing the following openSSL API's every time when FIPS status changes.
Typically, this is not allowed; you must restart your application in order to
switch in or out of FIPS approved mode. Your customer’s auditor (or your
auditor) may believe differently, but my former employer had auditors make it
very clear that an application must never switch into or out of FIPS approved
mode without restarting the application (and most of the auditors wanted us to
require the user to reboot their entire system to make the switch; fortunately
they were willing to allow the application with just an extra note recommending
the user reboot after modifying the setting).
> {
> We have mapped OpenSSL crypto locks to mutex intenally. Hence we delete
> it and create it every time when FIPS status changes.
> ERR_free_strings()
> ERR_remove_state(0);
> EVP_cleanup();
> SSL_library_init()
> SSLeay_add_all_algorithms()
> }
>
> Without executing this we are hitting the error,
> error:0409A09E:lib(4):func(154):reason(158). I wanted to know if our approach
> is correct?
IIRC you should be able to switch in and out of FIPS appoved mode by simply
calling FIPS_mode_set() with the appropriate argument. I know this worked with
the FIPS 1.2 module, but I never bothered to try it with the 2.0 module (see
above about allowed uses). I wouldn’t recommend trying to uninitialize and
re-initialize OpenSSL, though — while probably safe, it seems like a bad idea.
If this is a long-running program that can do multiple things at a time, it’s
definitely a bad idea to allow a toggle like that — someone might’ve started a
task, then turned on FIPS approved mode — if the task hasn’t done anything with
OpenSSL yet, it’ll probably be done with FIPS approved mode, but was that the
user’s intent? I’d recommend that when a user changes the setting, you store
the setting and inform the user that the new setting will take affect only
after restarting the application.
I really doubt you’ll be allowed to switch FIPS approved mode on and off with
just a simple toggle (even if it works technically).
> Regards
> Jayalakshmi
> _______________________________________________
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
