| 1 |
User guide for the FIPS Red Hat Enterprise Linux - OpenSSL Module
|
| 2 |
=================================================================
|
| 3 |
|
| 4 |
This package contains libraries which comprise the FIPS 140-2
|
| 5 |
Red Hat Enterprise Linux - OPENSSL Module.
|
| 6 |
|
| 7 |
The module files
|
| 8 |
================
|
| 9 |
/lib[64]/libcrypto.so.0.9.8e
|
| 10 |
/lib[64]/libssl.so.0.9.8e
|
| 11 |
/lib[64]/.libcrypto.so.0.9.8e.hmac
|
| 12 |
/lib[64]/.libssl.so.0.9.8e.hmac
|
| 13 |
|
| 14 |
Dependencies
|
| 15 |
============
|
| 16 |
|
| 17 |
The approved mode of operation requires kernel with /dev/urandom RNG running
|
| 18 |
with properties as defined in the security policy of the module. This is
|
| 19 |
provided by kernel packages with validated Red Hat Enterprise Linux - IPSec
|
| 20 |
Crytographic Module.
|
| 21 |
|
| 22 |
Installation
|
| 23 |
============
|
| 24 |
|
| 25 |
The RPM package of the module can be installed by standard tools recommended
|
| 26 |
for installation of RPM packages on the Red Hat Enterprise Linux system (yum,
|
| 27 |
rpm, RHN remote management tool).
|
| 28 |
|
| 29 |
For proper operation of the in-module integrity verification the prelink has to
|
| 30 |
be disabled. This can be done with setting PRELINKING=no in the
|
| 31 |
/etc/sysconfig/prelink configuration file. If the libraries were already
|
| 32 |
prelinked the prelink should be undone on all the system files with the
|
| 33 |
'prelink -u -a' command.
|
| 34 |
|
| 35 |
Usage and API
|
| 36 |
=============
|
| 37 |
|
| 38 |
The module respects kernel command line FIPS setting. If the kernel command
|
| 39 |
line contains option fips=1 the module will initialize in the FIPS approved
|
| 40 |
mode of operation automatically. To allow for the automatic initialization the
|
| 41 |
application using the module has to call one of the following API calls:
|
| 42 |
|
| 43 |
- void OPENSSL_init(void) - this will do only a basic initialization of the
|
| 44 |
library and does initialization of the FIPS approved mode without setting up
|
| 45 |
EVP API with supported algorithms.
|
| 46 |
|
| 47 |
- void OPENSSL_add_all_algorithms(void) - this API function calls
|
| 48 |
OPENSSL_init() implicitly and also adds all approved algorithms to the EVP API
|
| 49 |
in the approved mode
|
| 50 |
|
| 51 |
- void SSL_library_init(void) - it calls OPENSSL_init() implicitly and also
|
| 52 |
adds algorithms which are necessary for TLS protocol support and initializes
|
| 53 |
the SSL library.
|
| 54 |
|
| 55 |
To explicitely put the library to the approved mode the application can call
|
| 56 |
the following function:
|
| 57 |
|
| 58 |
- int FIPS_mode_set(int on) - if called with 1 as a parameter it will switch
|
| 59 |
the library from the non-approved to the approved mode. If any of the selftests
|
| 60 |
and integrity verification tests fail, the library is put into the error state
|
| 61 |
and 0 is returned. If they succeed the return value is 1.
|
| 62 |
|
| 63 |
To query the module whether it is in the approved mode or not:
|
| 64 |
|
| 65 |
- int FIPS_mode(void) - returns 1 if the module is in the approved mode,
|
| 66 |
0 otherwise.
|
| 67 |
|
| 68 |
To query whether the module is in the error state:
|
| 69 |
|
| 70 |
- int FIPS_selftest_failed(void) - returns 1 if the module is in the error
|
| 71 |
state, 0 otherwise.
|
| 72 |
|
| 73 |
To zeroize the FIPS RNG key and internal state the application calls:
|
| 74 |
|
| 75 |
- void RAND_cleanup(void)
|
Parent Directory
| 
Revision Log