Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Joe Conway <mail@joeconway.com>

From: Joe Conway <mail@joeconway.com>

To: Daniel Gustafsson <daniel@yesql.se>, Robert Haas <robertmhaas@gmail.com>

Cc: Peter Eisentraut <peter@eisentraut.org>, "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>

Date: 2024-12-04T14:40:20Z

Lists: pgsql-hackers

On 12/4/24 09:33, Daniel Gustafsson wrote:
> since OpenSSL 1.1.1 cannot operate in FIPS mode.

I don't think that is correct. The RHEL 8 openssl which was FIPS 140-2 
validated is 1.1.1k. See:

https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4642.pdf

-- 
Joe Conway
PostgreSQL Contributors Team
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com

Commits

pgcrypto: Make it possible to disable built-in crypto
- 035f99cbebe5 18.0 landed
pgcrypto: Add function to check FIPS mode
- 924d89a35475 18.0 landed
citext: Allow tests to pass in OpenSSL FIPS mode
- 3c551ebede46 17.0 cited
pgcrypto: Remove non-OpenSSL support
- db7d1a7b0530 15.0 cited