Re: Migration from 1.1.1 to 3.x

Hi Darshan,

Need an additional clarification on:

OSSL_PROVIDER_load(NULL, "fips");
EVP_set_default_properties(NULL, "fips=yes");

Are above two functions adequate for FIPS compliance or if we need additional changes? Like APIs to explicitly mention "fips=yes” e.g. EVP_MD_fetch(NULL, "SHA2-256", "fips=yes");

Is there any reference checklist to ensure FIPS compliance? 

We have recently built FIPS module for iOS and since we had to generate the install-mac at runtime, had to enable default provider via openssl.cnf. Should be disable it for any accidental fallback?

Regards,
Madhu

> On 2 Jun 2025, at 10:33 AM, G Prathap <[email protected]> wrote:
> 
> Hi Darshan,
> 
> Yes, you should use OSSL_PROVIDER_load() to explicitly load the FIPS provider.
> 
> EVP_default_properties_enable_fips() alone is not sufficient to enable FIPS mode unless the FIPS provider is already loaded.
> 
> Implications of skipping OSSL_PROVIDER_load():
> 
> If the FIPS provider is not already loaded via configuration (e.g., through openssl.cnf), then EVP_default_properties_enable_fips() will silently fail to enable FIPS mode.
> 
> This may lead to non-FIPS algorithms being used unintentionally.
> 
> Thanks & Regards 
> Prathap G
> 
> On Mon, 2 Jun, 2025, 9:58 am Mody, Darshan Arvindkumar (Darshan), <darshanmody-gc/[email protected] <mailto:darshanmody-gc/[email protected]>> wrote:
>> Hi
>> 
>>  
>> 
>> We are migrating from 1.1.1 to 3.x openssl. We also need to support FIPs cipher and FIPs mode.
>> 
>>  
>> 
>> My question is do we need to use the API the OSSL_PROVIDER_load. If we directly EVP_default_properties_enable_fips what are the implications.
>> 
>>  
>> 
>> Thanks and Regards
>> 
>> Darshan
>> 
>>  
>> 
>>  
>> 
>> 
>> -- 
>> You received this message because you are subscribed to the Google Groups "openssl-users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org <mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org>.
>> To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/PH0PR15MB4526934B9B0CE1696B7785EEA762A%40PH0PR15MB4526.namprd15.prod.outlook.com <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/PH0PR15MB4526934B9B0CE1696B7785EEA762A%40PH0PR15MB4526.namprd15.prod.outlook.com?utm_medium=email&utm_source=footer>.
> 
> 
> -- 
> You received this message because you are subscribed to the Google Groups "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org <mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org>.
> To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAMHS4B64jSu_2MkphoiTm3GanLdbfi8nmStBX6ESnYxJWQwcWA%40mail.gmail.com <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAMHS4B64jSu_2MkphoiTm3GanLdbfi8nmStBX6ESnYxJWQwcWA%40mail.gmail.com?utm_medium=email&utm_source=footer>.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/9C7873DD-5799-4F1F-B6A5-9CC8C54AF066%40rimus-tech.com.