@@ -269,20 +269,46 @@ NOTE: Windows is not yet supported
269
269
It is possible to build io.js with
270
270
[ OpenSSL FIPS module] ( https://www.openssl.org/docs/fips/fipsnotes.html ) .
271
271
272
+ ** Note** that building in this way does ** not** allow you to
273
+ claim that the runtime is FIPS 140-2 validated. Instead you
274
+ can indicate that the runtime uses a validated module. See
275
+ the [ security policy]
276
+ (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf )
277
+ page 60 for more details. In addition, the validation for
278
+ the underlying module is only valid if it is deployed in
279
+ accordance with its [ security policy]
280
+ (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf ).
281
+ If you need FIPS validated cryptography it is recommended that you
282
+ read both the [ security policy]
283
+ (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf )
284
+ and [ user guide] (https://openssl.org/docs/fips/UserGuide-2.0.pdf ).
285
+
272
286
Instructions:
273
287
274
- 1 . Download and verify ` openssl-fips-x.x.x.tar.gz ` from
275
- https://www.openssl.org/source/
276
- 2 . Extract source to ` openssl-fips ` folder
277
- 3 . `` cd openssl-fips && ./config fipscanisterbuild --prefix=`pwd`/out ``
278
- (NOTE: On OS X, you may want to run
279
- `` ./Configure darwin64-x86_64-cc --prefix=`pwd`/out `` if you are going to
280
- build x64-mode io.js)
281
- 4 . ` make -j && make install `
282
- 5 . Get into io.js checkout folder
283
- 6 . ` ./configure --openssl-fips=/path/to/openssl-fips/out `
284
- 7 . Build io.js with ` make -j `
285
- 8 . Verify with ` node -p "process.versions.openssl" ` (` 1.0.2a-fips ` )
288
+ 1 . Obtain a copy of openssl-fips-x.x.x.tar.gz.
289
+ To comply with the security policy you must ensure the path
290
+ through which you get the file complies with the requirements
291
+ for a "secure intallation" as described in section 6.6 in
292
+ the [ user guide] (https://openssl.org/docs/fips/UserGuide-2.0.pdf ).
293
+ For evaluation/experimentation you can simply download and verify
294
+ ` openssl-fips-x.x.x.tar.gz ` from https://www.openssl.org/source/
295
+ 2 . Extract source to ` openssl-fips ` folder and ` cd openssl-fips `
296
+ 3 . ` ./config `
297
+ 4 . ` make `
298
+ 5 . ` make install `
299
+ (NOTE: to comply with the security policy you must use the exact
300
+ commands in steps 3-5 without any additional options as per
301
+ Appendix A in the [ security policy]
302
+ (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf ).
303
+ The only exception is that ` ./config no-asm ` can be
304
+ used in place of ` ./config ` )
305
+ 6 . Get into io.js checkout folder
306
+ 7 . ` ./configure --openssl-fips=/path/to/openssl-fips/installdir `
307
+ For example on ubuntu 12 the installation directory was
308
+ /usr/local/ssl/fips-2.0
309
+ 8 . Build io.js with ` make -j `
310
+ 9 . Verify with ` node -p "process.versions.openssl" ` (` 1.0.2a-fips ` )
311
+
286
312
287
313
## Resources for Newcomers
288
314
0 commit comments