Hi Steve, Thank you very much for your time and response. Your reply gave me pretty clear picture. I have one last question. I would like to know is there any license related issue if I dont go for FIPS validation, but still use part of openssl-fips-2.0.2 along with OpenSSL library.
In other words, say I am using a specific crypto algorithm from openssl-fips-2.0.2 along with OpenSSL library. Do I need to obtain a change modification letter from OpenSSL or exsting license terms of OpenSSL will hold good? Thank you very much again. Regards BR On Wed, Dec 12, 2012 at 8:17 PM, Steve Marquess < [email protected]> wrote: > On 12/11/2012 10:09 PM, bhagyalekshmi r wrote: > > Hi All, > > > > I had one question regarding usage of openssl-fips-2.0.2. I want to use > > openssl-fips-2.0.2 to get NIST compliance for some crypto > > functionality*.* I don't want to go for FIPS 140-2 > > certification/validation. I want to use > > only a part of openssl-fips-2.0.2 module. Can I use some parts of > > openssl-fips-2.0.2 module along with OpenSSL library to use FIPS 140-2 > > functionality. Is it mandatory to get a private label if I make any > changes > > to openssl-fips-2.0.2 module or if I want to use part of > openssl-fips-2.0.2 > > module. > > If you touch it you own it -- make any modifications and you will need > to obtain your own FIPS 140-2 Level 1 validation. The Security Policy is > pretty clear about that. > > Note that "private label validation" is a term for a specific kind of > FIPS 140-2 validation, one based on an unmodified or only slightly > modified OpenSSL FIPS Object Module 2.0. The private label validations > are typically much less expensive that a typical from-scratch > validation, because the test lab can refer to materials developed from > the earlier open source based validation. Once you make non-trivial > modifications you're looking at the more expensive kind of validation. > > Note the FIPS module proper isn't that big, in time or space (typically > 1/2MB and <3 seconds for the POST initialization), so you need a pretty > compelling reason to try cutting it down even further. The OpenSSL > libcrypto shared library is about 15 times larger and a better place to > look for size reduction opportunities. In general it will make more > sense to use the FIPS module as-is and reference just the specific > functionality you need. > > -Steve M. > > -- > Steve Marquess > OpenSSL Software Foundation, Inc. > 1829 Mount Ephraim Road > Adamstown, MD 21710 > USA > +1 877 673 6775 s/b > +1 301 874 2571 direct > [email protected] > [email protected] >
