[14034] in cryptography@c2.net mail archive
Re: OpenSSL *source* to get FIPS 140-2 Level 1 certification
daemon@ATHENA.MIT.EDU (Joshua Hill)
Sat Sep 6 13:52:42 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Fri, 5 Sep 2003 15:48:51 -0700
From: Joshua Hill <josh-crypto@untruth.org>
To: Wei Dai <weidai@weidai.com>
Cc: Anton Stiglic <astiglic@okiok.com>,
Rich Salz <rsalz@datapower.com>, cryptography@metzdowd.com
In-Reply-To: <20030905180209.E30928@weidai.com>; from weidai@weidai.com on Fri, Sep 05, 2003 at 06:02:10PM -0400
On Fri, Sep 05, 2003 at 06:02:10PM -0400, Wei Dai wrote:
> In fact they wouldn't even validate Crypto++ as a
> static library despite an earlier verbal agreement that a static
> library was ok. It had to be turned into a DLL at the last moment (i.e.
> during the review phase).
That's unfortunate. The answer as to the static vs dynamic library issue
seems to vary according to who at NIST reviews the report. I've never
understood NIST's general objection to static libraries.
> (We wanted to avoid making a DLL from Crypto++ since it has so many
> algorithms. With a static library the linker would only bring in the
> algorithms you use, but a DLL has to contain a pre-selected set of
> algorithms. I ended up putting only FIPS Approved algorithms in the
> DLL, and made a second static library that contains only
> non-Approved algorithms, so that both could be used together.)
So, having said that, I can say that pulling out bits of the evaluated
module won't fly. All of it would have to go in, or none of it. Further,
the module needs to have some way of checking its authenticity (for the
operating environment area requirements) and its integrity on "power up".
As such, you'll either need to be able to "locate" the module within
the resulting executable, or verify the entire resulting executable.
Josh
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
