Page MenuHomeFreeBSD

openssl: Remove fips module from base system.
ClosedPublic

Authored by gordon on Aug 4 2024, 9:31 PM.
Tags
None
Referenced Files
F94595905: D46223.diff
Tue, Sep 17, 7:49 PM
Unknown Object (File)
Sat, Sep 14, 3:55 PM
Unknown Object (File)
Fri, Sep 13, 12:53 AM
Unknown Object (File)
Wed, Sep 11, 4:12 PM
Unknown Object (File)
Tue, Sep 10, 11:14 PM
Unknown Object (File)
Sun, Sep 8, 9:38 PM
Unknown Object (File)
Sat, Sep 7, 10:29 PM
Unknown Object (File)
Tue, Sep 3, 1:15 PM
Subscribers

Details

Summary

To comply with FIPS 140 guidance, you must be using a specifically
validated and approved version of the fips module. Currently, only
OpenSSL 3.0.8 and 3.0.9 have been approved by NIST for FIPS 140
validation. As such, we need to stop shipping later versions of the
module in the base system.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

gordon requested review of this revision.Aug 4 2024, 9:31 PM

Not sure who else to get this reviewed by, but we should stop shipping fips.so.

This revision was not accepted when it landed; it landed in state Needs Review.Sat, Aug 31, 4:28 PM
This revision was automatically updated to reflect the committed changes.

Thank you for doing this!