Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

What is the strategy for introducing bug fixes into the FIPS OpenSSL?

April 26, 2017bug FIPS Fixes OpenSSL strategy

0

10 Posted

What is the strategy for introducing bug fixes into the FIPS OpenSSL?

1 Answer

0

10 Posted

Changes within the cryptographic module need to be evaluated on a case-by-case basis. NIST/CSE permit some degree of modification without requiring a full re-validation, based on a vendor affirmation and/or testing lab review of the extent of changes. The fine print on how much work is required is fairly involved. To date we have no direct experience with any such “letter change” modifications.