OpenSSH use of OpenSSL in FIPS Mode

[Joshua Hill]

Joshua Hill wrote:
> I think that we agree that one could design a module that does implement
> all of the security relevant portions of a protocol.  Is it done in the
> case of Microsoft's Kernel Module?  I have no idea, and I wouldn't care
> to speculate.

Steve Marquess replied:
> A tangential observation to your discussion with Dr. Kladko: you are in 
> effect saying that open source software should be held to a higher 
> standard than proprietary software.

I'm not sure that I was saying that, but it does seem a consequence of the
open source model; anyone can "look over the shoulder" of the validation
laboratory and vendor, so anyone who has different ideas as to what
should and should not be allowed can bring issues to NIST's attention.
It's just the standard open source "many eyes" ideal, but brought to
the regulatory setting.

> Dr. Kaldko is pointing out that the actual practice of FIPS 140-2, and 
> claims of validation thereof, doesn't agree with the theory you espouse. 

If you re-read the discussion, you'll find that we're not really
disagreeing about much up to this point, only talking past each other's
points.

It is clear that the current FIPS scheme allows one to validate a module
that implements a limited set of cryptographic primitives, along with
minimal state logic and self-tests.

Further, it is clear that as long as your larger "IT device" implements
no extra FIPS 140 relevant security functionality, that you can sell a
your IT device, including the validated sub-module, into the US Federal
setting.

The central matter that is left unresolved here is this: Is it
acceptable to build larger scale FIPS relevant security protocols
using the primitives provided by the validated sub-module, _not_ seek
an additional validation on this larger scale security functionality,
and then sell your IT device into the US Federal setting?

I'm fairly certain that the answer here is "no", but it would be
interesting to see what CMVP might say on the matter.

			Josh