[openssl-users] Help needed on FIPS error 0409A09E:lib(4):func(154):reason(158).

[Jayalakshmi bhat]

Hi Tom,

Thanks  a lot for clarifying the doubt.

Regards
Jayalakshmi

On Thu, Sep 10, 2015 at 8:44 AM, Tom Francis <thomas.francis.jr at pobox.com>
wrote:

>
> > On Sep 10, 2015, at 8:44 AM, Jayalakshmi bhat <
> bhat.jayalakshmi at gmail.com> wrote:
> >
> > Hello all,
> >
> > I have a question on FIPS. We have OpenSSL FIPS module integrated with
> our product. We have an option to enable/disable FIPS at run time.  We are
> executing the following openSSL API's every time when FIPS status changes.
>
> Typically, this is not allowed; you must restart your application in order
> to switch in or out of FIPS approved mode.  Your customer’s auditor (or
> your auditor) may believe differently, but my former employer had auditors
> make it very clear that an application must never switch into or out of
> FIPS approved mode without restarting the application (and most of the
> auditors wanted us to require the user to reboot their entire system to
> make the switch; fortunately they were willing to allow the application
> with just an extra note recommending the user reboot after modifying the
> setting).
>
> > {
> >       We have mapped OpenSSL crypto locks to mutex intenally. Hence we
> delete it and create it every time when FIPS status changes.
> >       ERR_free_strings()
> >       ERR_remove_state(0);
> >       EVP_cleanup();
> >       SSL_library_init()
> >       SSLeay_add_all_algorithms()
> > }
> >
> > Without executing this we are hitting the error,
> error:0409A09E:lib(4):func(154):reason(158). I wanted to know if our
> approach is correct?
>
> IIRC you should be able to switch in and out of FIPS appoved mode by
> simply calling FIPS_mode_set() with the appropriate argument.  I know this
> worked with the FIPS 1.2 module, but I never bothered to try it with the
> 2.0 module (see above about allowed uses).  I wouldn’t recommend trying to
> uninitialize and re-initialize OpenSSL, though — while probably safe, it
> seems like a bad idea.  If this is a long-running program that can do
> multiple things at a time, it’s definitely a bad idea to allow a toggle
> like that — someone might’ve started a task, then turned on FIPS approved
> mode — if the task hasn’t done anything with OpenSSL yet, it’ll probably be
> done with FIPS approved mode, but was that the user’s intent?  I’d
> recommend that when a user changes the setting, you store the setting and
> inform the user that the new setting will take affect only after restarting
> the application.
>
> I really doubt you’ll be allowed to switch FIPS approved mode on and off
> with just a simple toggle (even if it works technically).
>
>
> > Regards
> > Jayalakshmi
> > _______________________________________________
> > openssl-users mailing list
> > To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
> _______________________________________________
> openssl-users mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150910/7157a08c/attachment-0001.html>