Please provide FIPS compliant version

[Pascal de Bruijn]

Binary package hint: openssl

It should be considered to supply the FIPS validated version of OpenSSL unless there are major disadvantages to this version.

http://www.oss-institute.org/

[Daniël van Eeden (dveeden)]

See also the FIPS 140-2 Notes: http://www.openssl.org/docs/fips/fipsnotes.html

Enabling SSLFIPS in Apache2 is needed to disable SSLv2 Upgrade support. This will only work if Apache2 uses an FIPS enabled OpenSSL version.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Roland Moriz (rmoriz)]

regarding #1

this affects nginx aswell.

[John Gibson (redshadow)]

OpenSSL's FIPS certification recently reapproved, official announcement here: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#1747
OpenSSLs FIPS validation page: http://www.openssl.org/docs/fips/fipsvalidation.html
The module itself: http://www.openssl.org/source/openssl-fips-2.0.1.tar.gz

Interestingly one of the platforms upon which it was tested was Ubuntu 10.04 (both 32 and 64 bit versions).

[Seth Arnold (seth-arnold)]

Related: http://marc.info/?l=openssl-announce&m=138747119822324&w=2 -- in short, flaws found in Dual EC DRBG in the FIPS-validated code demonstrates that the code is under-used and fixing even fairly obvious flaws isn't allowed.

I'm not keen on turning on OpenSSL's FIPS modes in our releases.

[Pascal de Bruijn (pmjdebruijn)]

In light of recent events, I won't argue :)

[Adrien Nader (adrien)]

I think this should be won't fix since there is now a FIPS version available and it's 100% sure it must not be the default version (and that it wouldn't make a lot of sense even for people who want FIPS stuff).