<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
font-variant:normal !important;
color:windowtext;
text-transform:none;
font-weight:normal;
font-style:normal;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">I am using the Openssl-1.0.2 with openssl-fips-2.0.9 and have a question?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">If AES CBC Encryption is considered vulnerable to
</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">an attacker with the capability to inject arbitrary traffic into the plain-text stream, then why is it listed as an approved algorithm/option in
</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">table 4A on page 14 of the OpenSSL Security Policy:</span>
<a href="http://openssl.org/docs/fips/SecurityPolicy-2.0.9.pdf">http://openssl.org/docs/fips/SecurityPolicy-2.0.9.pdf</a><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">I am just looking for a clarification.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">Phil<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">Phil Bellino<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:#7F7F7F">Principal Software Engineer</span></b><b><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">
</span></b><b><span style="font-size:10.0pt;color:#5A4099">| </span></b><b><span style="font-size:10.0pt;color:#7F7F7F">MRV Communications Inc.<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">300 Apollo Drive
</span><b><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#8064A2">|
</span></b><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">Chelmsford, MA 01824
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">Phone: 978-674-6870</span><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:teal">
</span><b><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#8064A2">|
</span></b><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F">Fax: 978-674-6799<o:p></o:p></span></p>
<p class="MsoNormal"><a href="www.mrv.com"><span style="font-size:9.0pt;color:#7F7F7F">www.mrv.com</span></a><span style="font-size:9.0pt;color:#7F7F7F"><br>
<br>
</span><span style="font-size:9.0pt;font-family:"Verdana","sans-serif";color:#7F7F7F"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><img border="0" width="188" height="25" id="Picture_x0020_3" src="cid:image001.png@01D062E2.EE50FB80" alt="MRV-email"></span><span style="font-size:10.0pt"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">-209<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<a href="http://www.mrv.com/landing/video-datasheet-mrvs-optidriver-platform"><img src="http://www.mrv.com/images/Awards_Banner.jpg" alt="E-Banner"></a><br>
<br>
<div style="background-color:#FFFFFF; padding:.8em; ">
<p style="font-size:8pt;color:#b8b9c8; line-height:8pt; font-family:
'arial','times roman',serif;">
The contents of this message, together with any attachments, are intended only for the use of the person(s) to whom they are addressed and may contain confidential and/or privileged information. If you are not the intended recipient, immediately advise the
sender, delete this message and any attachments and note that any distribution, or copying of this message, or any attachment, is prohibited.</p>
</div>
</body>
</html>