Re: Migration from 1.1.1 to 3.x

On Mon, Jun 02, 2025 at 11:36:49AM +0530, madhu bajpai wrote:

> Need an additional clarification on:
> 
> OSSL_PROVIDER_load(NULL, "fips"); EVP_set_default_properties(NULL,
> "fips=yes");
> 
> Are above two functions adequate for FIPS compliance or if we need
> additional changes? Like APIs to explicitly mention "fips=yes” e.g.
> EVP_MD_fetch(NULL, "SHA2-256", "fips=yes");
> 
> Is there any reference checklist to ensure FIPS compliance? 
> 
> We have recently built FIPS module for iOS and since we had to
> generate the install-mac at runtime, had to enable default provider
> via openssl.cnf. Should be disable it for any accidental fallback?

Quoting README-FIPS.md:

    https://github.com/openssl/openssl/blob/master/README-FIPS.md

    If you need a FIPS validated module then you must ONLY generate a
    FIPS provider using OpenSSL versions that have valid FIPS
    certificates. A FIPS certificate contains a link to a Security
    Policy, and you MUST follow the instructions in the Security Policy
    in order to be FIPS compliant.

The security policy for the 3.0 module:

    https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4282

Can be found in:

    https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4282.pdf

You may want to consider the 3.1 (FIPS 140-3)module:

    https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4985

    https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4985.pdf

Any informal answers you get on this list are unauthoritative and should
nto be used as a basis for deciding whether your deployment is
FIPS-compliant.

-- 
    Viktor.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aD1F1h-Ay_nGkxkP%40chardros.imrryr.org.