OpenSSL Revalidated Following Suspension 51
lisah writes "Despite what looks like an organized effort to prevent it, OpenSSL has been revalidated by an independent testing agency for its ability to securely manage sensitive data and is ready for use by governmental agencies like the Department of Defense. According to the Open Source Software Institute, who has been overseeing the validation process for the last five years (something that typically only takes a few months), it seems that the idea of an open source SSL toolkit didn't sit right with proprietary vendors of similar products. A FUD campaign was launched against OpenSSL that resulted in a temporary suspension of its validation. Developers and volunteers refused to give up the ghost until the validation was reinstated, and Linux.com has the story of the project's long road to success." Linux.com and Slashdot are both owned by OSTG.
Re:Let me be the first to say... (Score:5, Insightful)
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
The only reason ANYONE does this is so they can get on that website. Getting a compliant AES routine isn't hard. There are dozens of implementation under BSD, MIT, GPL, and various other FLOSS [including public domain]. That you picked an AESVS certified implementation doesn't mean you're ap
Re: (Score:2)
No, as in my company is doing the test so we can get a cert and listed on the perdy website. We've already done it for our hardware crypto, this time around it's the software crypto.
I think you don't actually know what goes on in validation. Because if you had the slightest clue you'd just say "so what?"
Tom
Re: (Score:2)
I believe you have "the average civil servant" confused with "the average civil servant's manager."
Re: (Score:1)
Then let me be the first to answer . . . (Score:5, Insightful)
And of course, any moron can "write an insecure application" using any tools. Writing a secure application, OTOH . . .
Re: (Score:2)
Thanks for playing the "OMG there is a diff between policy and reality" game. You lose.
Tom
Please list the LibTom projects in question . . . (Score:1)
Validation exists for a reason. If you feel the criteria are too lax, you should be lobbying to have them tightened, not proclaiming "oh, well. C'est la vie!".
Then again, perhaps you have a vested interest in denigrating the validation process - by your own declaration, you have non-validated code ostensibly running where it shouldn't be? How much do you stand to lose here
Re:Please list the LibTom projects in question . . (Score:3, Interesting)
Note I should have been clearer. I said they use them, I didn't mean specifically they end up in actual fielded projects (because I don't know about the latter). But logically from the logs and support emails I get from various organizations they're at least using it for something. I do know that some folk at NIST used the projects testing CCM implementations. Heard that from former employees.
Point is, non-validated code
Re:Please list the LibTom projects in question . . (Score:2, Insightful)
How much security do you think your local municipalities roads department needs? I'm sure they keep track of what roads got plowed, and salted, and when. I wouldnt think that would be something they need under fort knox level security.
You can reply with "what if a hacker said dont plow this road then it got real icy and a car crashed and the TER
Re: (Score:2)
If road departments are anything like they are in my city, the dates when a particular section of road is coned off for resurfacing seems to be on a level of "for eyes only".
We never see the constructing crews arriving. My neighbour is convinced the road crews materialise out of a higher dimension or burrow out of the hole they are repairing in an explosion of dirt, traffic cones, workers huts and heavy duty industrial machiner
Re:Please list the LibTom projects in question . . (Score:2, Informative)
The DoD policy which requires the FIPS validation process for programs such as OpenSSL is the National Security Telecommunication and Information Systems Security Policy Number 11 (NSTISSP No. 11). Overview can be found here: http://www.enpointe.com/security/pdf/nstissp11_fac tsheet2.pdf [enpointe.com]
In short, it states that for govt/DoD to purchase/acquire any Information Assurance (IA) or IA-enabled products, they must pass through the a
Re:Please list the LibTom projects in question . . (Score:2)
Re: (Score:2, Insightful)
We sell to municipal, state, and federal levels of government, and have worked with a lot of different agencies, and the requirements are different every time. A city servant who needs a database to keep track of the flow rates of fire hydrants has different security concerns from a federal agent investigating a military colonel for embezzlement, or whatever.
Technically, the policy says OS's have to be POSIX compliant
Re: (Score:1)
Re: (Score:3, Insightful)
Validation is meaningless.
Is the government allowed to use OpenSSL if it is not validated?
If not, then I don't think the word "meaningless" means what you think it means.
Re: (Score:2)
That's what validation gets you.
Not necessarily... (Score:5, Insightful)
Re:Not necessarily... (Score:5, Insightful)
Like us: if you don't have that MCSE on your resumé, we don't want you.
Oh, wait. Yes we do...
Re:zzzz..... (Score:4, Insightful)
Validation is somewhat less meaningful for OSS because of this - anyone (assuming the proper skill level) could look at the code, and see for themselves if the criticisms have any merit. With a closed solution, all you have to go on is the validation - that stamp of approval.
You are correct though, this isnt that big a deal, it's just about OSS so it's
Re: (Score:1)
Huh? (Score:5, Insightful)
Since all of OpenSSL's source code has passed the testing process, now developers can focus on compiling binary libraries and submitting those for validation
Someone please explain to me why binaries aren't good enough for the first review, then later they are? Who says the new source code is "secure"?
Why didn't they require source code review for vendor products?
Re: (Score:2)
Re: (Score:3, Insightful)
I don't think it's a matter of one being better than the other. Certification of one thing doesn't mean related items are also certified. Just because the source code is now certified doesn't mean that all the libraries that can potentially be built by that source code are now automatically certified as well. (If B derives from A, and A is certified, it doesn't
Re: (Score:2)
They may be comfortable using it, but if they were a government agency with a requirement to use validated code it doesn't look like they could use a "uniquely configured version".
Taken from the CMVP validation list on the CMVP website.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:3, Insightful)
1. Physical security of the boxes
2. Prevention of attacks
3. Disclosure of usage, known-good protocols & keys (A Security policy)
4. Testing of (P)RNG's.
5. Known Answer tests of FIPS approved algorithms (AES, DES, etc...)
The movement towards software-only modules has brought a whole series of issues to head - meaning that some whol
m$^8 (Score:1, Interesting)
Oh wait, there are no other hostile biggies.
Misconceptions in the write-up (Score:5, Informative)
2. OpenSSL was validated as *source*. All other FIPS 140 validations are of *object code* or devices. This is the first cryptomodule to be validated in source form and contributed to the time taken to validate.
3. The OpenSSL original cert was suspended because there was a small bit crypto code that resided outside the security boundary. Confusion between sponsor, lab, and NIST contributed to the suspension. See #2.
4. Claims of vendor FUD are overblown. NSS, another Open Source cryptomodule, already has FIPS 140-1 certification (for version 3.6; 3.11 will be entering FIPS 140-2 eval soon).
Re: (Score:2)
This is very misleading. The OpenSSL code was submitted as source, but the lab still evaluated it as a binary blob (after compiling/installing it using the instructions provided). The lab did not evaluate the source anymore than they did for NSS or the MS crypt libs. etc.
who were behind the complaints .. (Score:5, Informative)
'While OSSI was not able to review each complaint the CMVP received, the ones they did see often contained redacted, or blacked-out, data about who had filed the complaint. Some documents, however, did reveal the complainant information, and Weathersby says that is how the OSSI became aware that, in some cases, proprietary software vendors [linux.com] were lodging the complaints'
Gov't Contracting Cesspool (Score:2)
The competitors intentionally draw out the certification process for the newcomer to literally exhauste them and drive the competition away. This is just one relatively small library/suite of applications. (albeit critical)
For any of you entrepreneurial developers thinking they're onto the the next great thing that gov'ts will buy, please consider this story carefully. A long career at the top of an agency you wis
Re: (Score:1)
Re:Right (Score:1)
Proprietary implementations not really valid? (Score:1)
Certainly once validity of visible source code is established it should be possible to relatively easily continue to demonstrate validity of that code. Meanwhile in the case of proprietary versions it is possible to make source changes that change the behavior of binary product in ways difficult
There was no conspiracy (Score:1)
So if (as the sensationalist headline proclaims) "the idea of an open source SSL toolkit didn't sit right with proprietary vendors of similar products." They've had 5 y
Re: (Score:1)
It was not a cheap process either... (Score:4, Informative)
http://groups.google.com/group/mailing.openssl.us
Re: (Score:1)
OpenSSL generate one-time hashes (Score:1)