<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div><div>Kapil,</div><div><br></div><div>Erlang's cryptography is not FIPS 140-2-certified. There was a pull request to add FIPS compliance via OpenSSL in FIPS mode, but it stalled [1]. </div><div><br></div><div>Calls to OpenSSL's crypto canister must go through the Envelope (EVP) API calls. The crypto library in Erlang OTP 19 will use EVP calls (exclusively, I assume) [2]. However, EVP calls alone are not enough for FIPS 140-2 support.</div><div><br></div><div>If the only problem is terminating incoming HTTP requests, you may be able to get away with proxying the request through a FIPS 140-2 load balancer. rabbitmq-server calls crypto for password hashing. You'd need to replace calls to crypto with calls to a FIPS provider and look for calls made outside of crypto (BIFs like md5, phash). </div><div><br></div><div>- Drew</div><div><br></div><div>[1] <a href="https://github.com/erlang/otp/pull/377">https://github.com/erlang/otp/pull/377</a></div><div>[2] <a href="http://youtu.be/YlNrWxH56_E">http://youtu.be/YlNrWxH56_E</a></div><div><br>On Mar 14, 2016, at 10:19 PM, Kapil Goyal <<a href="mailto:goyalk@vmware.com">goyalk@vmware.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<div>Hi All,</div>
<div><br>
</div>
<div>We use RabbitMQ and are working on running it in FIPS compliance. According to a post on RMQ forum (<a href="https://groups.google.com/forum/#!topic/rabbitmq-users/wUzUjgDQ9M8">https://groups.google.com/forum/#!topic/rabbitmq-users/wUzUjgDQ9M8</a>), Erlang
is not FIPS compliance. Is this correct? If so, are there plans to be compliant in near future?</div>
<div><br>
</div>
<div>Thanks</div>
<div>Kapil</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>erlang-questions mailing list</span><br><span><a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a></span><br><span><a href="http://erlang.org/mailman/listinfo/erlang-questions">http://erlang.org/mailman/listinfo/erlang-questions</a></span><br></div></blockquote></body></html>