<p>
<ul>
-<li>OpenSSL istself is not validated, and never will be. Instead a special carefully defined software component called the
+<li>OpenSSL itself is not validated, and never will be. Instead a special carefully defined software component called the
OpenSSL FIPS Object Module has been created. This Module was designed for compatibility with OpenSSL so that products using
the OpenSSL API can be converted to use validated cryptography with minimal effort.
<p>
instructions) for your platform, then you can use it as validated cryptography on a "vendor affirmed" basis.
<p>
-<li>If even the tinest source code or build process changes are required for your intended application, you cannot use
+<li>If even the tiniest source code or build process changes are required for your intended application, you cannot use
the open source based validated module directly. You must obtain your own validation. This is a common situation, see "Private
Label" validation, below.
<p>
</ul>
Note FIPS 140-2 validation is a complicated topic that the above summary does not adequately address. You have been warned!
+<a name="privatelabel">
<h2>The "Private Label" Validation</h2>
+</a>
We refer to validations based directly on the OpenSSL FIPS Object Module as "private label" validations. These are also
sometimes referred to as "cookie cutter" validations. The usual reason for such separate validations is the need for small
financial support for that objective is intermittent at best. On the other hand many vendors are interested in private label
validations and the OSF will assist in such efforts on a paid basis. We've done enough of these to be very cost competitive
and for uncomplicated validations will work on a fixed price basis. A routine private label validation on a single commodity
-platform can cost as little as US$30,000. Private label validations satsifying the U.S. Army "level 2" requirements are also
+platform can cost as little as
+<a href="privatelabel.html">US$30,000</a>.
+ Private label validations satisfying the U.S. Army "level 2" requirements are also
possible. Contact the <a href="../../support/funding/support-contact.html">OSF</a> for more information.
-
<p>
-
+<font color="#cc3333">Update:</font> In collaboration with an accredited CMVP testing laboratory we are now offering a
+cost effective turnkey <a href="privatelabel.html">validation package</a> for routine private label validations.
+<p>
<h2>Current Validations</h2>
<font color="#cc3333">Important Note:</font> Due to upcoming changes in the FIPS 140-2 validation requirements the current v1.2 Module will
no longer be a suitable model for private label validations in its current form past the year 2010. See the NIST <a href="http://csrc.nist.gov/groups/STM/cmvp/notices.html">Notices</a>,
<a href="http://csrc.nist.gov/groups/ST/key_mgmt/documents/Transitioning_CryptoAlgos_070209.pdf">discussion paper</a> and
-<a href="http://csrc.nist.gov/publications/drafts/800-131/draft-800-131_transition-paper.pdf">Draft 800-131</a>.
+<a href="http://csrc.nist.gov/publications/drafts/800-131/draft-sp800-131_spd-june2010.pdf">SP 800-131</a>
<p>
We hope to address these new changes in the next open source based validation (see below).
the rent and thus indirectly supports all of OpenSSL. However, unless you are one of the companies directly obtaining a custom
private label validation those improvements don't give you validated cryptography that can be sold in the markets requiring such validation.
<p>
-If and when sufficient sponsor funding materializes we will move quickly and enthusiastically to
+If and when sufficient sponsor funding materialises we will move quickly and enthusiastically to
obtain a new and updated validation to satisfy the validation requirements then in effect.
Any such plans will be posted here.
<p>
--- /dev/null
+
+#use wml::openssl area=documents page=FIPS140
+
+<title>OpenSSL FIPS 140-2 Private Label Validations</title>
+
+<h1>One Stop Package Deal for Private Label Validations</h1>
+
+If you haven't already please read our <a href="fipsnotes.html">FIPS 140-2 Notes</a> page.
+
+<h2>What It Is</h2>
+
+We have found that one of the most popular commercial services offered by the
+OpenSSL Software Foundation is the <a href="fipsnotes.html#privatelabel">private label validation</a>. It's not a
+business we ever planned to be in, but as the originators of the source code based
+OpenSSL FIPS Object Module validations and with lots of practice we're gotten pretty good at it.
+The revenue we earn from these validations goes to support the OpenSSL project and for some
+validations also results in useful additions to the OpenSSL baseline.
+<p>
+
+
+<h2>What You Get</h2>
+
+For the total fixed price of US$30,000 we will take obtain a Level 1 FIPS 140-2 validation in your name using the
+OpenSSL FIPS Object Module v1.2 (certificate <a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#1051">#1051</a>)
+ with minor modifications for two common platforms. A common platform is a computing device (hardware and operating system)
+that is available and familiar to us and the test lab(s). Examples of common platforms are:
+<ul>
+ <li> Microsoft Windows (32 bit) on x86 hardware
+ <li> Microsoft Windows (64 bit) on x64 hardware
+ <li> Linux on 32 bit x86 hardware
+ <li> Linux (64 bit) on x64 hardware
+ <li> The Android operating system on some common smart phones using ARM processors
+ <li> HP-UX 11 on Itanium
+ <li> Solaris on x64 hardware
+</ul>
+<p>
+Additional common platforms can be added to your validation for US$1000 each.
+<p>
+This validation will also include Level 2 in the area of "Roles, Services, and Authentication" and
+Level 3 in the area of "Design Assurance" to satisfy the section 5a requirements of the
+<a href="https://chess.army.mil/ascp/commerce/scp/downloads/standardspolicy_files/letter_to_industry.pdf">
+May 21, 2009 Army "Letter to Industry"</a>.
+This additional requirement is a frequently requested option for private label validation.
+
+<p>
+We will handle all interaction with the accredited testing lab and the
+<a href="http://csrc.nist.gov/groups/STM/cmvp/index.html">CMVP</a>. You sign one contract with the
+OSF with half of the price due as a down payment and the remainder due only when your certificate is
+<a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm">posted</a> by the CMVP.
+
+<p>
+Within a week of of executing your contract with us your pending validation will also appear on the
+<a href="http://csrc.nist.gov/groups/STM/cmvp/inprocess.html">pre-val list</a>. The presence of your product on
+this list is sufficient to satisfy FIPS 140-2 requirements for some procurements.
+
+<p>
+<h2>What Qualifies</h2>
+<p>
+This turnkey validation package is applicable in the following circumstances:
+<ul>
+ <li>You have already confirmed that the module generated from the
+<a href="../../source/openssl-fips-1.2.tar.gz">OpenSSL FIPS Object Module v1.2</a>
+source distribution, or from a later OpenSSL 0.9.8<em>x</em> distribution, possibly with modifications, works on your platform(s).
+ <p>
+ <li>Your modifications to the OpenSSL source code, if any, are not "cryptographically significant". Roughly speaking,
+ that means the modifications do not affect the actual cryptographic algorithms. Modifications for portability, such
+ as changing includes or redefining macros, or changes to the build process such as new compiler or linker options,
+ are generally acceptable.
+ <p>
+ <li>You application does not require cross-compilation (the build system and the target platform can be the same system),
+ <em>or</em> your cross-compiled platform is one for which the complete build process including generation of the
+ integrity test digest is already known and tested.
+ <p>
+ <li>The actual platform, hardware and software, is either already available to the OSF and the lab or is supplied by you.
+ We will need at least two complete sets of platform hardware and software for customer provided equipment. This
+ equipment can be returned once the validation is awarded, though so far customers have preferred
+ to leave that equipment with us for regression testing of future revisions.
+ <p>
+ <li>You have determined that the performance of the module is satisfactory on your specific target platform. Since the
+ original #1051 validation we have made numerous performance enhancements. Some of these can be easily incorporated
+ into routine private label validations and some cannot.
+</ul>
+<p>
+Note that we can still help you if not all these circumstances apply, we'll just have to look at your specific situation
+more closely.
+<p>
+<hr>
+
+Interested? Contact the <a href="/support/funding/support-contact.html">OSF</a>.
projects / openssl-web.git / commitdiff