Horton

Re: BUG #19457: RE: pgp_sym_encrypt silently accepts non-FIPS ciphers (bf, cast5, 3des) when OpenSSL is in FIPS mod

Joe Conway <mail@joeconway.com>

View thread View on postgr.es
From: Joe Conway <mail@joeconway.com>
To: Michael Paquier <michael@paquier.xyz>, Daniel Gustafsson <daniel@yesql.se>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, ansh01072001@gmail.com, pgsql-bugs@lists.postgresql.org
Date: 2026-04-25T00:23:45Z
Lists: pgsql-bugs 
On 4/24/26 18:32, Michael Paquier wrote:
> He has added a paragraph about the set of ciphers that are allowed
> in FIPS.  Do we actually need to mention these explicitely? Perhaps
> a link to an external source would be more adapted?  I am not
> convinced that this is a good addition for pgcrypto, but feel free
> to disagree.


+1 for a link to an external source, specifically the official NIST 
reference I would think.

-- 
Joe Conway
PostgreSQL Contributors Team
Amazon Web Services: https://aws.amazon.com

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode