David Stutzman wrote:
I just read an interesting article about the FIPS certification of
OpenSSL which was brought on by the Defense Department’s Defense Medical
Logistics Standard Support program. It says that they had the source
verified instead of the binary and "Because the source code was
validated, it could be compiled for any platform, be it Linux, Microsoft
Windows or some obscure operating system."
The article:
http://www.gcn.com/print/25_12/40733-1.html
After reading on the FIPS page of the NSS wiki:
http://wiki.mozilla.org/FIPS_Validation
It seems you guys are not going after source validation because you list
specific platforms for the validated toolkit. Is that correct? If so,
are there any plans to have the full source validated so NSS could be
used as freely as OpenSSL will soon be.
Yes, that's correct. We are not going after source validation
this time. We will definitely consider source validation for
our future validations.
Note that NIST already allows a crypto module vendor or user
to recompile the source code, without modification, for another
platform and *maintain the validation status*, with the caveat
that NIST makes no statement about the correct operation of
the crypto module on platforms not listed on the certificate.
See implementation guidance (IG) G.5 in
http://csrc.nist.gov/cryptval/140-1/FIPS1402IG.pdf.
NSS source code has a lot of ifdefs for various platforms.
So even if the same source files are re-compiled on another
platform, the actual C code that's re-compiled will be
somewhat different. This is true of any portable software
crypto module, especially if it optimizes crypto performance
with assembly code. Even if the exact same C code is recompiled,
the differences in the alignments and sizes of 'long', pointers,
and other types may cause incorrect operation on some platforms.
(Just search for "implementation defined" in K&R's The C Programming
Language book.) So what do you think of source validation or
the vendor/user re-compilation allowed by IG G.5?
Wan-Teh
_______________________________________________
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
