X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=README.FIPS;h=859348664ef6b08db3421bedc535298520526997;hp=5197276740af8cec5c980693b6204b07b2287ca0;hb=c162a8c344f12b2e0e788920358f51181ddf168f;hpb=4d5d28675ebe00fbe2bbf89d80122625ae0c13cb diff --git a/README.FIPS b/README.FIPS index 5197276740..859348664e 100644 --- a/README.FIPS +++ b/README.FIPS @@ -1,54 +1 @@ -Preliminary status and build information for FIPS module v2.0 - -To build the module do: - -./config fipscanisterbuild -make - -Build should complete without errors. - -Run test suite: - -test/fips_test_suite - -again should complete without errors. - -Run test vectors: - -1. Download an appropriate set of testvectors from www.openssl.org/docs/fips - those for 2007 are OK. - -2. Extract the files to a suitable directory. - -3. Run the test vector perl script, for example: - - cd fips - perl fipsalgtest.pl --dir=/wherever/stuff/was/extracted - -4. It should say "passed all tests" at the end. Report full details of any - failures. - -Run symbol hiding test: - -./config fipscanisteronly -DOPENSSL_FIPSSYMS -make - -This time only the fips utilities should be built. - -Examine the external symbols in fips/fipscanister.o they should all begin -with FIPS or fips. One way to check with GNU nm is: - -nm -g --defined-only fips/fipscanister.o | grep -v -i fips - -Known issues: - -Algorithm tests are pre-2011. -The fipslagtest.pl script wont auto run new algorithm tests such as DSA2. -Usage of ECDH/DH needs review and adding appropriate self tests. -Selftests need updating with larger key sizes in some cases and redundant -tests pruned. -SP800-90 DRBG needs more work: health checks, continuous PRNG test, -entropy gathering, security checks in algorithms, add appropriate RAND method -for use by rest of OpenSSL. -No CMAC. -No CCM. +This release does not support a FIPS 140-2 validated module.