[openssl-users] Comments on the recent OpenSSL 3.0.0 specification (Monday 2019-02-11)
rsalz at akamai.com
Fri Feb 15 17:35:27 UTC 2019
> (as for "possibly not the FIPS provider", that's exactly right. That
one *will* be a loadable module and nothing else, and will only be
validated as such... meaning that noone can stop you from hacking
around and have it linked in statically, but that would make it
invalid re FIPS)
To be pedantic: this is true only *if you are using the OpenSSL validation.* If you are getting your own validation (such as using OpenSSL in an HSM device or whatnot), this is not true.
> - If permitted by the CMVP rules, allow an option for
> application provided (additional) entropy input to the RNG
> from outside the module boundary.
This is allowed, but it does not count toward the "minimum entropy" requirements. Anything after the first seeding falls into that category.
More information about the openssl-users