Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but then I noticed the "I.G. 9.10 issue".

However, This document states that "The I.G. 9.5 issue has effectively precluded consideration of new validations for much of 2013, but with the July 25 2013 update of the Implementation Guidance (I.G.) document such validations appear to be feasible again.", so it's still unclear for me, if I can use OpenSSL FIPS Object Module 2.0 (#1747).

The question is: can I built an application based on OpenSSL FIPS Object Module 2.0 (#1747) and get it approved by CMVP? If no, what are possible alternatives to it?


Currently in order to get your OpenSSL module validated you have two options: 1) modify the OpenSSL code (or create some other mechanism/modification) to create a "Default Entry Point" (DEP) which ensures self-tests are run first, before allowing any other data output from any other function call. 2) have your lab submit the test report prior to Dec. 31, 2013 with a request for an exemption from 9.10.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.