<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Here’ s the discussion on a FIPS pull request that’s now closed: <a href="https://github.com/erlang/otp/pull/377" class="">https://github.com/erlang/otp/pull/377</a><div class=""><br class=""></div><div class="">- Drew<br class=""><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Apr 21, 2015, at 12:32 PM, Niclas Eklund <<a href="mailto:nick@tail-f.com" class="">nick@tail-f.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">Hi!<br class=""><br class="">IMHO I think that it would be good if FIPS could supported by OTP, especially since the purpose of the FIPS standards are issued to ensure computer security and interoperability. I've seen a question about this at least once before on this list before - <a href="http://erlang.org/pipermail/erlang-questions/2012-April/065902.html" class="">http://erlang.org/pipermail/erlang-questions/2012-April/065902.html</a> But I don't know what became of it.<br class=""><br class="">Best regards,<br class=""><br class="">Nick<br class=""><br class=""><br class="">On 04/21/2015 03:48 PM, jonetsu wrote:<br class=""><blockquote type="cite" class="">Hello,<br class=""><br class="">We are using an Erlang-based middleware using OTP, ConfD, which<br class="">must now support FIPS mode. Briefly, FIPS is a U.S. standard<br class="">that imposes a set of crypto parameters (ciphers, algorithms,<br class="">etc...). FIPS-applications must use high-level OpenSSL<br class="">methods (The EVP set of methods) since the low-level functions<br class="">will make OpenSSL abort. The application must also call<br class="">FIPS_mode_set(1) to enable this mode for a suitable OpenSSL build<br class="">that supports FIPS.<br class=""><br class="">OTP uses low-level OpenSSL functions.<br class=""><br class="">Initially I considered replacing, for instance, the AES_* uses in<br class="">crypto.c by their EVP equivalent, while keeping the interface to<br class="">Erlang intact.<br class=""><br class="">Now, looking at the extent of the FIPS modifications to the OTP<br class="">code done last year by Dániel Szoboszlay, who worked at Ericsson<br class="">and Erlang Solutions, I wonder about my naïve approach.<br class=""><br class="">Are anyone here familiar with this FIPS OTP port ? Any comments<br class="">? To anyone also familiar with ConfD: do you know of any effort<br class="">done in using this FIPS-enabled OTP code ?<br class=""><br class="">Thanks for any comments and suggestions !<br class=""><br class="">Regards.<br class=""><br class=""><br class=""><br class=""><br class="">_______________________________________________<br class="">erlang-questions mailing list<br class=""><a href="mailto:erlang-questions@erlang.org" class="">erlang-questions@erlang.org</a><br class="">http://erlang.org/mailman/listinfo/erlang-questions<br class=""></blockquote><br class="">_______________________________________________<br class="">erlang-questions mailing list<br class=""><a href="mailto:erlang-questions@erlang.org" class="">erlang-questions@erlang.org</a><br class="">http://erlang.org/mailman/listinfo/erlang-questions<br class=""></div></blockquote></div><br class=""></div></div></body></html>