<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
There is nothing stopping cheating.<br>
<br>
If you are going to cheat, why bother with FIPS at all? Just claim
you're FIPS.<br>
<br>
<br>
Pauli<br>
<br>
<div class="moz-cite-prefix">On 15/2/22 10:49, Ma Ar wrote:<br>
</div>
<blockquote type="cite"
cite="mid:a0980a91-d878-bc51-c016-bcfc3ad923bc@gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Maybe a dumb question too, considering that i am admittedly
just getting into this field, but I though maybe if I ask I
might learn something...is there any method of assurance that
the test were then run on the machine they are installed on?</p>
<p>If whatever those tests are attesting to to certify compliance
can be falsified by copying over 1 file, what would even be to
purpose of those tests?</p>
<p>Or are simply dependency checks?</p>
<p>Thanks for all the effort it must take in answering all these
questions every day.<br>
</p>
<div class="moz-cite-prefix">On 2/14/2022 5:31 PM, Dr Paul Dale
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0d3aa16a-d90f-6cb5-be5e-e1a03518d543@openssl.org">
Yes, this has to do with the FIPS standards. I forget which
standard it is but the self tests are mandated to be run on each
device independently.<br>
<br>
The fipsinstall process runs the self tests before generating
the configuration file. If the self tests fail, the module
doesn't install. Copying the configuration file across avoids
the self tests and therefore isn't compliant.<br>
<br>
<br>
Pauli<br>
<br>
<br>
<div class="moz-cite-prefix">On 15/2/22 02:25, Richard Dymond
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CANVKdYAfunVA6kDB+Dn9DCMSHt7C-uJ4YuxayLrmcA0EJhXfCA@mail.gmail.com">
<div dir="ltr">
<div class="gmail_default">Hi</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">Probably a dumb question, but why
must the FIPS module configuration file for OpenSSL 3.0 be
generated on every machine that it is to be used on (i.e.
must not be copied from one machine to another)?</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">I just ran 'openssl fipsinstall'
on two different machines with the same FIPS module and it
produced exactly the same output each time, so presumably
the reason has nothing to do with the config file being
unique to the machine.</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">Does it have something to do with
the FIPS standard itself?</div>
<div class="gmail_default"><br>
</div>
<div class="gmail_default">Richard<br>
</div>
</div>
</blockquote>
<br>
</blockquote>
</blockquote>
<br>
</body>
</html>