[openssl-users] FIPS Certification

[Steve Marquess]

On 01/27/2016 11:34 AM, Imran Ali wrote:
> I might be asking asking a very basic question so do apologies
> upfront but I need to have  a clear understanding on this.
> 
> The platforms mentioned under #1747 and #2473 does not contain the
> latest versions of Operating System e.g. Windows 2012 R2 and Windows
> 10. Does this have any impact on the certification or these libraries
> can now be used on any OS.

That's actually a rather tricky question.

First off, the one OpenSSL FIPS module (for a significant overlap of
revisions) is covered by three validations; #1747, #2398, and #2473. The
set of formally tested platforms (Operational Environments or "OEs") for
that module is the union of the platforms listed for each of those three
validations.

Roughly speaking, your platform of interest matches one of those "OEs" if:

1) The OS name matches to the first two "dot-rev" levels of the revision
number. For instance, "AcmeOS 1.2", "AcmeOS 1.2.3", "AcmeOS 1.2.3.4" are
all the same OS.

2) ...and the virtualization environment (ESXi, Hyper-V, Xenserver,
etc.), if any, matches to two dot-rev levels.

3) ...and the "processor architecture" is the same. Roughly speaking,
that means the binary FIPS module built for the specific OE processor
runs as-is on our platform, with the same "code path". So for instance
all x86 processors without AES-NI are equivalent to one another, as are
all x86 processors with AES-NI.  Ditto ARMv7 with/without NEON.

Lacking such a direct match, you still have "user affirmation" per FIPS
140-2 scripture (section G.5 of the Implementation Guidance document).
That basically says that you as a vendor can "affirm" the use of the
FIPS module on your platform of interest assuming you can build it per
the mandated process (which in particular means *no* source code tweaks).

As with everything FIPS 140-2, there are no "bright line" rules here.
My usual advice is that you ask your customers what their expectations
are. Some customers don't like user affirmation, and some (in DoD for
instance) impose additional requirements. On the other hand, some
customers are fine with liberal use of user affirmation.

As a last resort, if you determine that an important customer requires a
specific "OE" match (or if source code tweaks are necessary), you can
fund addition of your platform(s) of interest to one of the validations.
That is how the list of formally tested platforms has over time grown to
more than 120 "OEs", more than any other validated module.

-Steve M.

-- 
Steve Marquess
OpenSSL Software Foundation
1829 Mount Ephraim Road
Adamstown, MD  21710
USA
+1 877 673 6775 s/b
+1 301 874 2571 direct
marquess at openssl.com
gpg/pgp key: http://openssl.com/docs/0x6D1892F5.asc