<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I have to disagree with the “decision not to make a FIPS module for the current 1.1.x series” comment. Technically, this is true. More practically, 3.0 is intended to be source compatible with 1.1.x. Thus far, nothing should be broken in this respect.<div class=""><div class=""><br class=""></div><div class="">If support for 1.0.2 is required beyond the end of this year, it is available: <a href="https://www.openssl.org/support/contracts.html" class="">https://www.openssl.org/support/contracts.html</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I’d also be interested to know what is wrong with the policy page?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Pauli<br class=""><div class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;">-- <br class="">Dr Paul Dale | Cryptographer | Network Security & Encryption <br class="">Phone +61 7 3031 7217<br class="">Oracle Australia</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><br class="Apple-interchange-newline">
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 8 Jul 2019, at 2:30 pm, Jakob Bohm via openssl-users <<a href="mailto:openssl-users@openssl.org" class="">openssl-users@openssl.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 06/07/2019 16:30, Salz, Rich wrote:<br class=""><blockquote type="cite" class=""> >> They would have to get their own validation, their own lab to verify, etc., etc.<br class=""><blockquote type="cite" class=""> That seems to contradict the other answer, which is that legally, the<br class=""> FIPS cannister (properly built) can be used with any software outside<br class=""> the cryptographic boundary, the soon-to-be-deprecated OpenSSL 1.0.2<br class=""> library just being the normal default.<br class=""></blockquote> You are correct. My statement, which was technically incorrect, is more likely to be realistic :)<br class=""> <br class=""><blockquote type="cite" class=""> The point is that some people may soon be in a desperate need to find a<br class=""></blockquote> FIPS-capable replacement for OpenSSL 1.0.x.<br class=""> It seems to me that the easiest thing to do is maintain that release of OpenSSL by themselves.<br class=""></blockquote><br class="">Which would be another variation of such unofficial work.<br class=""><br class=""><blockquote type="cite" class="">If someone is thinking of fitting OpenSSL 1.1.x to become a user of the existing FOM, then they will probably find it easier to, well, just maintain what currently works.<br class="">Just because something is past "end of life" does not mean that anyone's ability to use it is revoked. It just means that keeping it working is their responsibility. Anyone can use the FOM until it expires (sunsets is the term used), which lasts one year beyond 1.0.2 as I recall. See <a href="https://www.openssl.org/blog/blog/2018/05/18/new-lts/" class="">https://www.openssl.org/blog/blog/2018/05/18/new-lts/</a> for some more information on this.<br class=""></blockquote><br class="">That policy page is half the problem, the other half being the decision<br class="">not to make a FIPS module for the current 1.1.x series.<br class=""><br class=""><br class="">Enjoy<br class=""><br class="">Jakob<br class="">-- <br class="">Jakob Bohm, CIO, Partner, WiseMo A/S. <a href="https://www.wisemo.com" class="">https://www.wisemo.com</a><br class="">Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10<br class="">This public discussion message is non-binding and may contain errors.<br class="">WiseMo - Remote Service Management for PCs, Phones and Embedded<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>