|
 |
ae55685 |
diff -up openssl-1.0.0-beta5/README.warning openssl-1.0.0-beta5/README
|
|
|
ae55685 |
--- openssl-1.0.0-beta5/README.warning 2010-01-20 16:00:47.000000000 +0100
|
|
|
ae55685 |
+++ openssl-1.0.0-beta5/README 2010-01-21 09:06:11.000000000 +0100
|
|
|
ae55685 |
@@ -5,6 +5,35 @@
|
|
|
1d20b5f |
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
|
|
|
1d20b5f |
All rights reserved.
|
|
|
1d20b5f |
|
|
|
1d20b5f |
+ WARNING
|
|
|
1d20b5f |
+ -------
|
|
|
1d20b5f |
+
|
|
|
1d20b5f |
+ This version of OpenSSL is built in a way that supports operation in
|
|
|
1d20b5f |
+ the so called FIPS mode. Note though that the library as we build it
|
|
|
1d20b5f |
+ is not FIPS validated and the FIPS mode is present for testing purposes
|
|
|
1d20b5f |
+ only.
|
|
|
1d20b5f |
+
|
|
|
1d20b5f |
+ This version also contains a few differences from the upstream code
|
|
|
1d20b5f |
+ some of which are:
|
|
|
ae55685 |
+ * There are added changes forward ported from the upstream OpenSSL
|
|
|
ae55685 |
+ 0.9.8 FIPS branch however the FIPS integrity verification check
|
|
|
ae55685 |
+ is implemented differently from the upstream FIPS validated OpenSSL
|
|
|
ae55685 |
+ module. It verifies HMAC-SHA256 checksum of the whole shared
|
|
|
ae55685 |
+ libraries. For this reason the changes are ported to files in the
|
|
|
ae55685 |
+ crypto directory and not in a separate fips subdirectory. Also
|
|
|
ae55685 |
+ note that the FIPS integrity verification check requires unmodified
|
|
|
ae55685 |
+ libcrypto and libssl shared library files which means that it will
|
|
|
ae55685 |
+ fail if these files are modified for example by prelink.
|
|
|
1d20b5f |
+ * The module respects the kernel FIPS flag /proc/sys/crypto/fips and
|
|
|
1d20b5f |
+ tries to initialize the FIPS mode if it is set to 1 aborting if the
|
|
|
1d20b5f |
+ FIPS mode could not be initialized. It is also possible to force the
|
|
|
1d20b5f |
+ OpenSSL library to FIPS mode especially for debugging purposes by
|
|
|
1d20b5f |
+ setting the environment variable OPENSSL_FORCE_FIPS_MODE.
|
|
|
1d20b5f |
+ * If the environment variable OPENSSL_NO_DEFAULT_ZLIB is set the module
|
|
|
1d20b5f |
+ will not automatically load the built in compression method ZLIB
|
|
|
1d20b5f |
+ when initialized. Applications can still explicitely ask for ZLIB
|
|
|
1d20b5f |
+ compression method.
|
|
|
1d20b5f |
+
|
|
|
1d20b5f |
DESCRIPTION
|
|
|
1d20b5f |
-----------
|
|
|
1d20b5f |
|