<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thanks for the help! I really have misconceptions about FIPS 140-2. I was instructed to compile and install this module: http://openssl.com/fips/. But I cannot understand how can I use it. Can you explain its functionalities? Sorry for the dummie questions.<br><br><div>> To: openssl-users@openssl.org<br>> From: marquess@openssl.com<br>> Date: Sat, 19 Dec 2015 08:56:22 -0500<br>> Subject: Re: [openssl-users] FIPS 140-2 library<br>> <br>> On 12/19/2015 08:28 AM, Marcos Bontempo wrote:<br>> > I want to exclude the private key if there is an attempt to violation.<br>> > Has FIPS this functionality?<br>> <br>> I think you have some misconceptions about what FIPS 140-2 is and isn't.<br>> It is "magical pixie dust", not a technique or some specific type of<br>> functionality.<br>> <br>> FIPS 140-2 validation is a paper intensive formal process by which<br>> specific implementations (software and/or devices) are given an official<br>> government blessing (the "pixie dust").<br>> <br>> FIPS 140-2 validated products are *not* more secure or better, by any<br>> real-world metric, than equivalent non-validated products. In fact they<br>> are rather manifestly *less* secure, in the sense of resistance to<br>> malicious or accidental compromise. You can't do anything with FIPS<br>> 140-2 validated products you can do without, except for the entirely<br>> non-technical objective of satisfying formal policy requirements.<br>> <br>> So if you aren't forced to use validated products, just ask "how can I<br>> do X securely" and leave FIPS 140-2 out of it. If you do need validated<br>> products, then that requirement drives and constrains your choices and<br>> real-world security is a secondary consideration, instead you must ask<br>> "is there a validated product available that will allow X"? You can't<br>> code your way to FIPS 140-2 validated status, you have to find and use<br>> something that is already validated.<br>> <br>> -Steve M.<br>> <br>> -- <br>> Steve Marquess<br>> OpenSSL Software Foundation<br>> 1829 Mount Ephraim Road<br>> Adamstown, MD 21710<br>> USA<br>> +1 877 673 6775 s/b<br>> +1 301 874 2571 direct<br>> marquess@openssl.com<br>> gpg/pgp key: http://openssl.com/docs/0x6D1892F5.asc<br>> _______________________________________________<br>> openssl-users mailing list<br>> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users<br></div> </div></body>
</html>