FIPS compliance in OpenSSL v3.0

[Afshin Pir]

Hi

Regarding FIPS compliance, I read following statement in your README-FIPS.md:

If you need a FIPS validated module then you must ONLY generate a FIPS provider using OpenSSL versions that have valid FIPS certificates. A FIPS certificate contains a link to a Security Policy, and you MUST follow the instructions in the Security Policy in order to be FIPS compliant.

If I check security policy, I need to use https://www.openssl.org/source/openssl-3.0.0.tar.gz and configure it with 'enable-fips' option only. Now I have 2 questions: What does happen if a security hole is seen on OpenSSL? If I build FIPS module using newer source codes that resolve that security hole, my module will not have FIPS compliance? My second question is if compiling code with other options (like no-deprecated or no-engine) will also break FIPS compliance or not. Any idea?

Best Regards,
Afshin

________________________________
This email is confidential and may contain information subject to legal privilege. If you are not the intended recipient please advise us of our error by return e-mail then delete this email and any attached files. You may not copy, disclose or use the contents in any way. The views expressed in this email may not be those of Gallagher Group Ltd or subsidiary companies thereof.
________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20230208/7e619949/attachment.htm>