Bug #1050210 requested addition of the OpenSSL FIPS provider to Debian
since a FIPS validation certificate is available:
https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4282

There are several issues with this new openssl-provider-fips package:

 1. It is based on OpenSSL 3.4.0 while the certificate is only valid for
    versions 3.0.8 and 3.0.9.
 2. The sources are patched, rendering the result non-compliant. Per
    Appendix B of the certificate, "compliance is maintained for other
    versions of the respective operational environments and compilers
    provided the module source code is unchanged."
    This is reiterated in the installation instructions:
https://github.com/openssl/openssl/blob/master/README-FIPS.md#installing-the-fips-provider

Due to these issues, the current package is not really FIPS compliant
and could mislead users into believing otherwise. I therefore suggest
dropping this package.

Alternatively, the openssl-provider-fips package needs to be built from
its own source package, satisfying the specific version requirements
and build instructions from the linked certificate above.

Versions 3.0.8 and 3.0.9 of the OpenSSL FIPS provider is compatible with
OpenSSL 3.4 according to https://openssl-library.org/source/

We are not saying this is a validated version. I'm not sure how useful the current version is to people. I'm not sure we can actually ship a validated version. But having something based on a validated version might make it easy to rebrand the validation.

Kurt

We really appreciate the FIPS package and see value in having it, even when it does not have the necessary certification applied to it. The overall process for FIPS certification is painfully slow and tedious. Each change is considered something worth recertifying in the FIPS world. Something that might be deemed to be unrealistic.

So I would argue that not having a validated certification is not a bug. At least it’s nothing you can fix in software.


Any way, thanks for the effort!
Best regards,
Jan