Will my application be FIPS 140-2 Certified under following conditions?

[Dr Paul Dale]

I have to disagree with the “decision not to make a FIPS module for the current 1.1.x series” comment.  Technically, this is true.  More practically, 3.0 is intended to be source compatible with 1.1.x.  Thus far, nothing should be broken in this respect.

If support for 1.0.2 is required beyond the end of this year, it is available: https://www.openssl.org/support/contracts.html <https://www.openssl.org/support/contracts.html>


I’d also be interested to know what is wrong with the policy page?



Pauli
-- 
Dr Paul Dale | Cryptographer | Network Security & Encryption 
Phone +61 7 3031 7217
Oracle Australia



> On 8 Jul 2019, at 2:30 pm, Jakob Bohm via openssl-users <openssl-users at openssl.org> wrote:
> 
> On 06/07/2019 16:30, Salz, Rich wrote:
>>     >> They would have to get their own validation, their own lab to verify, etc., etc.
>>>    That seems to contradict the other answer, which is that legally, the
>>>    FIPS cannister (properly built) can be used with any software outside
>>>    the cryptographic boundary, the soon-to-be-deprecated OpenSSL 1.0.2
>>>    library just being the normal default.
>>   You are correct.  My statement, which was technically incorrect, is more likely to be realistic :)
>>   
>>>    The point is that some people may soon be in a desperate need to find a
>>     FIPS-capable replacement for OpenSSL 1.0.x.
>>   It seems to me that the easiest thing to do is maintain that release of OpenSSL by themselves.
> 
> Which would be another variation of such unofficial work.
> 
>> If someone is thinking of fitting OpenSSL 1.1.x to become a user of the existing FOM, then they will probably find it easier to, well, just maintain what currently works.
>> Just because something is past "end of life" does not mean that anyone's ability to use it is revoked.  It just means that keeping it working is their responsibility.  Anyone can use the FOM until it expires (sunsets is the term used), which lasts one year beyond 1.0.2 as I recall.  See https://www.openssl.org/blog/blog/2018/05/18/new-lts/ for some more information on this.
> 
> That policy page is half the problem, the other half being the decision
> not to make a FIPS module for the current 1.1.x series.
> 
> 
> Enjoy
> 
> Jakob
> -- 
> Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
> Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
> This public discussion message is non-binding and may contain errors.
> WiseMo - Remote Service Management for PCs, Phones and Embedded

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20190708/634d36dd/attachment-0001.html>