Hacker News new | ask | show | jobs
by sanxiyn 4433 days ago
OpenSSL FIPS certification (#1747) is for source code, not for binary. This is highly unusual indeed, but it is not the case that only binaries can be FIPS certified.

On the other hand, you can't change the source without losing the certification, so it doesn't actually matter.
2 comments
pgeorgi 4433 days ago
So any change to openssl fips has to happen as compiler patches?
link
danudey 4433 days ago
No, changing the source means you're not using FIPS-compliant source so you're breaking your terms.

This is why you might have to use old versions of OpenSSL for FIPS compliance - not all versions might be certified.

link
eslaught 4432 days ago
I think the GP is talking about a trusting trust attack on OpenSSL: Change the compiler to compile OpenSSL differently, rather than change the source itself.
link
ballard 4433 days ago
I guess it begs the question (FIPS mode seems to fail the "talk to a cryptographer rule"): why don't/aren't sec folks more involved to assure standards are meaningful? Was this a NIST-driven process or was it open to public comments?
link