On 12/11/2012 10:09 PM, bhagyalekshmi r wrote: > Hi All, > > I had one question regarding usage of openssl-fips-2.0.2. I want to use > openssl-fips-2.0.2 to get NIST compliance for some crypto > functionality*.* I don't want to go for FIPS 140-2 > certification/validation. I want to use > only a part of openssl-fips-2.0.2 module. Can I use some parts of > openssl-fips-2.0.2 module along with OpenSSL library to use FIPS 140-2 > functionality. Is it mandatory to get a private label if I make any changes > to openssl-fips-2.0.2 module or if I want to use part of openssl-fips-2.0.2 > module.
If you touch it you own it -- make any modifications and you will need to obtain your own FIPS 140-2 Level 1 validation. The Security Policy is pretty clear about that. Note that "private label validation" is a term for a specific kind of FIPS 140-2 validation, one based on an unmodified or only slightly modified OpenSSL FIPS Object Module 2.0. The private label validations are typically much less expensive that a typical from-scratch validation, because the test lab can refer to materials developed from the earlier open source based validation. Once you make non-trivial modifications you're looking at the more expensive kind of validation. Note the FIPS module proper isn't that big, in time or space (typically 1/2MB and <3 seconds for the POST initialization), so you need a pretty compelling reason to try cutting it down even further. The OpenSSL libcrypto shared library is about 15 times larger and a better place to look for size reduction opportunities. In general it will make more sense to use the FIPS module as-is and reference just the specific functionality you need. -Steve M. -- Steve Marquess OpenSSL Software Foundation, Inc. 1829 Mount Ephraim Road Adamstown, MD 21710 USA +1 877 673 6775 s/b +1 301 874 2571 direct [email protected] [email protected] ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
