Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but then I noticed the "I.G. 9.10 issue".

However, This document states that "The I.G. 9.5 issue has effectively precluded consideration of new validations for much of 2013, but with the July 25 2013 update of the Implementation Guidance (I.G.) document such validations appear to be feasible again.", so it's still unclear for me, if I can use OpenSSL FIPS Object Module 2.0 (#1747).

The question is: can I built an application based on OpenSSL FIPS Object Module 2.0 (#1747) and get it approved by CMVP? If no, what are possible alternatives to it?

share|improve this question
up vote 3 down vote accepted

Currently in order to get your OpenSSL module validated you have two options: 1) modify the OpenSSL code (or create some other mechanism/modification) to create a "Default Entry Point" (DEP) which ensures self-tests are run first, before allowing any other data output from any other function call. 2) have your lab submit the test report prior to Dec. 31, 2013 with a request for an exemption from 9.10.

share|improve this answer
That's what I was afraid of.. Thank you. – KBart Oct 11 '13 at 10:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.