On 15.02.24 13:42, Koshi Shibagaki (Fujitsu) wrote:
However, crypt() and gen_salt() do not use OpenSSL as mentioned in [2].
Therefore, if we run crypt() and gen_salt() on a machine with FIPS mode enabled,
they are not affected by FIPS mode. This means we can use encryption algorithms
disallowed in FIPS.
I would like to change the proprietary implementations of crypt() and gen_salt()
to use OpenSSL API.
If it's not a problem, I am going to create a patch, but if you have a better
approach, please let me know.
The problems are:
1. All the block ciphers currently supported by crypt() and gen_salt()
are not FIPS-compliant.
2. The crypt() and gen_salt() methods built on top of them (modes of
operation, kind of) are not FIPS-compliant.
3. The implementations (crypt-blowfish.c, crypt-des.c, etc.) are not
structured in a way that OpenSSL calls can easily be patched in.
So if you want FIPS-compliant cryptography, these interfaces look like a
dead end. I don't know if there are any modern equivalents of these
functions that we should be supplying instead.
