Skip to content

Commit 2ff183d

Browse files
mhdawsonFishrock123
authored andcommitted
Update FIPS instructions in README.md
Update the instructions to follow the requirements in the security policy and user guide PR-URL: #2278 Fixes: #2242 Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Rod Vagg <[email protected]>
1 parent 194eeb8 commit 2ff183d

File tree

1 file changed

+38
-12
lines changed

1 file changed

+38
-12
lines changed

README.md

+38-12
Original file line numberDiff line numberDiff line change
@@ -269,20 +269,46 @@ NOTE: Windows is not yet supported
269269
It is possible to build io.js with
270270
[OpenSSL FIPS module](https://www.openssl.org/docs/fips/fipsnotes.html).
271271

272+
**Note** that building in this way does **not** allow you to
273+
claim that the runtime is FIPS 140-2 validated. Instead you
274+
can indicate that the runtime uses a validated module. See
275+
the [security policy]
276+
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf)
277+
page 60 for more details. In addition, the validation for
278+
the underlying module is only valid if it is deployed in
279+
accordance with its [security policy]
280+
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf).
281+
If you need FIPS validated cryptography it is recommended that you
282+
read both the [security policy]
283+
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf)
284+
and [user guide] (https://openssl.org/docs/fips/UserGuide-2.0.pdf).
285+
272286
Instructions:
273287

274-
1. Download and verify `openssl-fips-x.x.x.tar.gz` from
275-
https://www.openssl.org/source/
276-
2. Extract source to `openssl-fips` folder
277-
3. ``cd openssl-fips && ./config fipscanisterbuild --prefix=`pwd`/out``
278-
(NOTE: On OS X, you may want to run
279-
``./Configure darwin64-x86_64-cc --prefix=`pwd`/out`` if you are going to
280-
build x64-mode io.js)
281-
4. `make -j && make install`
282-
5. Get into io.js checkout folder
283-
6. `./configure --openssl-fips=/path/to/openssl-fips/out`
284-
7. Build io.js with `make -j`
285-
8. Verify with `node -p "process.versions.openssl"` (`1.0.2a-fips`)
288+
1. Obtain a copy of openssl-fips-x.x.x.tar.gz.
289+
To comply with the security policy you must ensure the path
290+
through which you get the file complies with the requirements
291+
for a "secure intallation" as described in section 6.6 in
292+
the [user guide] (https://openssl.org/docs/fips/UserGuide-2.0.pdf).
293+
For evaluation/experimentation you can simply download and verify
294+
`openssl-fips-x.x.x.tar.gz` from https://www.openssl.org/source/
295+
2. Extract source to `openssl-fips` folder and `cd openssl-fips`
296+
3. `./config`
297+
4. `make`
298+
5. `make install`
299+
(NOTE: to comply with the security policy you must use the exact
300+
commands in steps 3-5 without any additional options as per
301+
Appendix A in the [security policy]
302+
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp1747.pdf).
303+
The only exception is that `./config no-asm` can be
304+
used in place of `./config` )
305+
6. Get into io.js checkout folder
306+
7. `./configure --openssl-fips=/path/to/openssl-fips/installdir`
307+
For example on ubuntu 12 the installation directory was
308+
/usr/local/ssl/fips-2.0
309+
8. Build io.js with `make -j`
310+
9. Verify with `node -p "process.versions.openssl"` (`1.0.2a-fips`)
311+
286312

287313
## Resources for Newcomers
288314

0 commit comments

Comments
 (0)