I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one cryptographic library i.e. OpenSSL, as all the libraries are providing almost similar functionalities ?

Thanks for any response/reply,


1 Answer 1


as all the libraries are providing almost similar functionalities ?

It does not matter if they have similar functionalities because they have different implementations. The certification not only includes if a specific algorithm is implemented at all but also if it is implemented correctly.

  • Multiple libraries will definitely offer more choices and flexibility to the Red Hat user. However, It should also increase maintenance cost (re-certification after new changes are introduced for any standards etc.) and could also have effect on the performance. Why not select and support only one library e.g. NSS (as being done by Google for Chrome) ? Thanks, Jul 16, 2016 at 9:34
  • 2
    If you need to support a library, you need to support it. It may be cheaper and easier to move a system to a competing OS that does support it than to change to a different crypto system. Jul 16, 2016 at 9:52
  • @user2363993: your comment is a new question ("why have multiple crypto libraries on linux") which is mostly independent from the original one. Please don't ask new questions within comments. Jul 16, 2016 at 9:54
  • Not all libraries offer the same functionality. Red Hat doesn't control which libraries are chosen; that's up to the user. Furthermore there are plenty of products out there that already have chosen one or the other libraries. Porting those to a different runtime environment will likely be costly and may introduce vulnerabilities all by itself. Jul 16, 2016 at 14:01
  • @MaartenBodewes , Steffen and Someone Somewhere , Thanks for the clarification ! Jul 17, 2016 at 7:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .