From owner-freebsd-hackers@freebsd.org Fri Oct 27 17:11:59 2017 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 83B05E4CB06 for ; Fri, 27 Oct 2017 17:11:59 +0000 (UTC) (envelope-from bsd-lists@bsdforge.com) Received: from udns.ultimatedns.net (static-24-113-41-81.wavecable.com [24.113.41.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6262D70A40 for ; Fri, 27 Oct 2017 17:11:58 +0000 (UTC) (envelope-from bsd-lists@bsdforge.com) Received: from ultimatedns.net (localhost [127.0.0.1]) by udns.ultimatedns.net (8.14.9/8.14.9) with ESMTP id v9RHD9Bi089838 for ; Fri, 27 Oct 2017 10:13:15 -0700 (PDT) (envelope-from bsd-lists@bsdforge.com) To: "freebsd-hackers@freebsd.org" In-Reply-To: <51e5e3f85b6445ed85faf770773118bb@exch-02.redcom.com> References: <51e5e3f85b6445ed85faf770773118bb@exch-02.redcom.com> From: "Chris H" Subject: Re: Crypto overhaul Date: Fri, 27 Oct 2017 10:13:15 -0700 Content-Type: text/plain; charset=UTF-8; format=fixed MIME-Version: 1.0 Message-id: <161ecc025cd82beeca46dc7f55599b45@ultimatedns.net> Content-Transfer-Encoding: 8bit X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Oct 2017 17:11:59 -0000 On Fri, 27 Oct 2017 12:38:47 +0000 "Wall, Stephen" wrote [ re-wrapped for better readability ] > Be aware that moving away from a crypto library that has a FIPS-approved > crypto core will have a significant impact on commercial users of > FreeBSD who do business with U.S. government (and likely some other > governments and corporate sectors as well). BoringSSL is persuing/has > persued FIPS validation, but they offer this warning on their web page: > > Although BoringSSL is an open source project, it is not intended for > general use, as OpenSSL is. We don't recommend that third parties > depend upon it. Doing so is likely to be frustrating because there > are no guarantees of API or ABI stability. > > BearSSL, being a new, small project, is highly unlikely to pursue FIPS > certification. LibreSSL has deliberately stripped anything FIPS related > out of their fork, and the project has stated multiple times that it > will not come back. > > I am not opposing a change (indeed, consolidating the various crypto > sources in FreeBSD to single (FIPS-possible) library would be a good > thing) , I just prefer (strongly) that FIPS not be pushed out of the > picture. > FIPS, or not, Typhoid Mary needs to go, and the sooner the better! Given a choice of using OpenSSl because it has FIPS certification; Knowing that it will likely permit a [near] future system compromise. Or using an alternative with a long history of reliability, safety, and a great deal of scrutiny by seasoned developers, and security engineers. Should be an easy question to answer. FIPS or not. It should be an easy pitch to make -- even to those on the FIPS bandwagon. I don't think there's any reason to panic; OpenSSL will likely still remain in the ports tree, no matter *what's* decided on for $BASE, for those that *must* have it. :) > -spw --Chris > _______________________________________________ > freebsd-hackers@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-hackers > To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"