<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Deepak<div class=""><br class=""></div><div class="">Just take note of the FIPS 140-2 sunset, and rise of FIPS 140-3</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">140-3 Takes Effect: 9/22/19</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">140-3 New Testing Begins: 9/22/20</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">140-2 Sunset: 9/21/21</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">140-3 Mandated: 9/22/21</span></div></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class="">And best of luck ;)</div><div class=""><br class=""></div><div class=""><a href="https://www.federalregister.gov/documents/2019/05/01/2019-08817/announcing-issuance-of-federal-information-processing-standard-fips-140-3-security-requirements-for" class="">https://www.federalregister.gov/documents/2019/05/01/2019-08817/announcing-issuance-of-federal-information-processing-standard-fips-140-3-security-requirements-for</a></div><div class=""><br class=""></div><div class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class="">-- <br class=""><br class="">Regards,<br class=""><br class="">Mark A. Lane <br class=""><br class="">© Mark A. Lane 1980 - 2019, All Rights Reserved.<br class="">© FooCrypt 1980 - 2019, All Rights Reserved.<br class="">© FooCrypt, A Tale of Cynical Cyclical Encryption. 1980 - 2019, All Rights Reserved.<br class="">© Cryptopocalypse 1980 - 2019, All Rights Reserved.<br class=""></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 4 Jul 2019, at 12:09, Kyle Hamilton <<a href="mailto:aerowolf@gmail.com" class="">aerowolf@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="auto" class="">Also, on question b: No. You need to build a compatible version of openssl as specified in the User Guide, and link that version. FIPS_mode_set() tells the library to always and only use the implementations in the FIPS canister; the canister does not replace the library entirely.<div dir="auto" class=""><br class=""></div><div dir="auto" class="">-Kyle H</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 3, 2019, 11:55 Dipak B <<a href="mailto:deepak.redmi2@gmail.com" class="">deepak.redmi2@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">Dear Experts,<div class=""><br class=""></div><div class="">Can you please help me with the following question?</div><div class=""><br class=""></div><div class=""><div class="">My win32 desktop application uses 'libcurl' to interact with web service, in order to get my application FIPS 140-2 certified, following is the plan which I arrived at after going through the 'User Guide' and 'Security Policy' pdfs.</div><div class=""><br class=""></div></div><div class="">Plan:</div><div class="">a. After verifying HMAC-SHA1 of openssl-fips-2.0.16.tar.gz, build it to generate fipscanister.lib (FOM) as windows static library.</div><div class="">b. Build libcurl as windows static library using above fipscanister.lib</div><div class="">c. Link my desktop application with above libcurl.lib after adding FIPS_mode_set()</div><div class=""><br class=""></div><div class="">Questions:</div><div class="">a. On following points a, b,c, can I confirm that my application is FIPS 140-2 certified?</div><div class="">b. fipscanister.lib is always static library and it can be substituted for libssl.lib / ssleay.lib?</div><div class=""><br class=""></div><div class="">Thank you,</div><div class="">Deepak</div></div>
</blockquote></div>
</div></blockquote></div><br class=""></div></body></html>