openssh unix dev - Dec 2015 - OpenSSH FIPS 140-2 support using OpenSSL FIPS modules?

Thanks Roumen.
>Lets assume that application use OpenSSL FIPS validated module. FIPS mode
is activated in openssl command if environment variable OPENSSL_FIPS is
set. Similarly I use OPENSSL_FIPS environment variable to activate FIPS
mode. Code will call FIPS_mode_set(1) if crypto module is not FIPS mode.

Did you mean the FIPS patched OpenSSH server and client (such as
ssh-keygen) always check the environmental variable OPENSSL_FIPS to see if
the FIPS mode is activated?
Also I think for the applications which need to use OpenSSL FIPS mode will
also need to run the FIPS self tests functions (also provided by the
OpenSSL FIPS modules). Does the patched OpenSSH also run these self tests?

Thanks.

On Mon, Dec 7, 2015 at 11:39 AM, Roumen Petrov <openssh at
roumenpetrov.info>
wrote:
> security veteran wrote:
>
>> Thanks Roumen.
>>
>> I have few more questions below:
>>
>> 1. What version of OpenSSH can the patch be applied to? What branch
should
>> I check out the patch?
>>
> There is no separate patch but I offer file with all differences to
> openssh - see link (diff) on download page
> http://roumenpetrov.info/openssh/download.html
>
> 2.
>>
>>> Impact is not only for source code. Build process has to be updated
as
>>>
>> well. Red Hat is based on "fipscheck".
>> What build process should be changed? What is fipscheck?
>>
> I different way to check integrity of files(executables) -
> https://fedorahosted.org / fipscheck/ .
>
> 3. My understanding any application (such as OpenSSH) which need to use the
>> OpenSSL FIPS module will need to invoke the "FIPS_mode_set()"
function
>> first, otherwise the OpenSSL library will be operating as the non-FIPS
>> version.
>> My question is, how and when does OpenSSH server invoke the FIPS
function?
>>
> Lets assume that application use OpenSSL FIPS validated module. FIPS mode
> is activated in openssl command if environment variable OPENSSL_FIPS is
> set. Similarly I use OPENSSL_FIPS environment variable to activate FIPS
> mode. Code will call FIPS_mode_set(1) if crypto module is not FIPS mode.
>
>
> [SNIP]
>
> Roumen
>

security veteran wrote:
> Thanks Roumen.
>
>> Lets assume that application use OpenSSL FIPS validated module. FIPS
mode
> is activated in openssl command if environment variable OPENSSL_FIPS is
> set. Similarly I use OPENSSL_FIPS environment variable to activate FIPS
> mode. Code will call FIPS_mode_set(1) if crypto module is not FIPS mode.
>
> Did you mean the FIPS patched OpenSSH server and client (such as
> ssh-keygen) always check the environmental variable OPENSSL_FIPS to see if
> the FIPS mode is activated?
> Also I think for the applications which need to use OpenSSL FIPS mode will
> also need to run the FIPS self tests functions (also provided by the
> OpenSSL FIPS modules). Does the patched OpenSSH also run these self tests?
Openssl os open source. The method FIPS_mode_set will call 
FIPS_module_mode_set (located in FIPS module) . Please see its code.
You may review code of apps/openssl.c.

[SNIP]

Roumen

Thanks Roumen.
>Openssl os open source. The method FIPS_mode_set will call
FIPS_module_mode_set (located in FIPS module) . Please see its code.
You may review code of apps/openssl.c.

I meant, did your OpenSSH patch actually invoke these functions (FIPS_mode_set
and FIPS_selftest)? If that's the case, when were these functions invoked?
e.g. for client application such as ssh-keygen does it always call these
functions first?

Thanks.



On Mon, Dec 7, 2015 at 12:52 PM, Roumen Petrov <openssh at
roumenpetrov.info>
wrote:
> security veteran wrote:
>
>> Thanks Roumen.
>>
>> Lets assume that application use OpenSSL FIPS validated module. FIPS
mode
>>>
>> is activated in openssl command if environment variable OPENSSL_FIPS is
>> set. Similarly I use OPENSSL_FIPS environment variable to activate FIPS
>> mode. Code will call FIPS_mode_set(1) if crypto module is not FIPS
mode.
>>
>> Did you mean the FIPS patched OpenSSH server and client (such as
>> ssh-keygen) always check the environmental variable OPENSSL_FIPS to see
if
>> the FIPS mode is activated?
>> Also I think for the applications which need to use OpenSSL FIPS mode
will
>> also need to run the FIPS self tests functions (also provided by the
>> OpenSSL FIPS modules). Does the patched OpenSSH also run these self
tests?
>>
> Openssl os open source. The method FIPS_mode_set will call
> FIPS_module_mode_set (located in FIPS module) . Please see its code.
> You may review code of apps/openssl.c.
>
> [SNIP]
>
> Roumen
>
>