I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one cryptographic library i.e. OpenSSL, as all the libraries are providing almost similar functionalities ?

Thanks for any response/reply,



as all the libraries are providing almost similar functionalities ?

It does not matter if they have similar functionalities because they have different implementations. The certification not only includes if a specific algorithm is implemented at all but also if it is implemented correctly.

| improve this answer | |
  • Multiple libraries will definitely offer more choices and flexibility to the Red Hat user. However, It should also increase maintenance cost (re-certification after new changes are introduced for any standards etc.) and could also have effect on the performance. Why not select and support only one library e.g. NSS (as being done by Google for Chrome) ? Thanks, – user2363993 Jul 16 '16 at 9:34
  • 2
    If you need to support a library, you need to support it. It may be cheaper and easier to move a system to a competing OS that does support it than to change to a different crypto system. – SomeoneSomewhereSupportsMonica Jul 16 '16 at 9:52
  • @user2363993: your comment is a new question ("why have multiple crypto libraries on linux") which is mostly independent from the original one. Please don't ask new questions within comments. – Steffen Ullrich Jul 16 '16 at 9:54
  • Not all libraries offer the same functionality. Red Hat doesn't control which libraries are chosen; that's up to the user. Furthermore there are plenty of products out there that already have chosen one or the other libraries. Porting those to a different runtime environment will likely be costly and may introduce vulnerabilities all by itself. – Maarten Bodewes Jul 16 '16 at 14:01
  • @MaartenBodewes , Steffen and Someone Somewhere , Thanks for the clarification ! – user2363993 Jul 17 '16 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.