Re: FIPS 140-2 certification plans

2006-05-18 Thread Wan-Teh Chang
David Stutzman wrote: From the PDF (CMVP = Cryptographic Module Validation Program for those that don't know. http://csrc.nist.gov/cryptval/ or http://www.csrc.nist.gov/pki/PKITesting.html): "The CMVP allows user porting of a validated software cryptographic module on an OS(s) and/or GPC(

Re: FIPS 140-2 certification plans

2006-05-18 Thread David Stutzman
Wan-Teh Chang wrote: Note that NIST already allows a crypto module vendor or user to recompile the source code, without modification, for another platform and *maintain the validation status*, with the caveat that NIST makes no statement about the correct operation of the crypto module on platfo

Re: FIPS 140-2 certification plans

2006-05-18 Thread Wan-Teh Chang
David Stutzman wrote: I just read an interesting article about the FIPS certification of OpenSSL which was brought on by the Defense Department’s Defense Medical Logistics Standard Support program. It says that they had the source verified instead of the binary and "Because the source code was

Re: FIPS 140-2 certification plans

2006-05-18 Thread Wan-Teh Chang
David Stutzman wrote: I just noticed on the FIPS page what might be an error... http://wiki.mozilla.org/FIPS_Validation The HMAC row of the table has the following in the Modes column: KeySize < BlockSize, KeySize = BlockSize, KeySize < BlockSize Should one of those < be a >? Yes, the second

Re: FIPS 140-2 certification plans

2006-05-18 Thread David Stutzman
I just noticed on the FIPS page what might be an error... http://wiki.mozilla.org/FIPS_Validation The HMAC row of the table has the following in the Modes column: KeySize < BlockSize, KeySize = BlockSize, KeySize < BlockSize Should one of those < be a >? Let me know if there's someone/where el

FIPS 140-2 certification plans

2006-05-18 Thread David Stutzman
I just read an interesting article about the FIPS certification of OpenSSL which was brought on by the Defense Department’s Defense Medical Logistics Standard Support program. It says that they had the source verified instead of the binary and "Because the source code was validated, it could b