Advanced

Open Source encryption module loses FIPS certification

Posted by dcparris on · 6 comments
GCN.com; By William Jackson
Mail this story
Print this story

The National Institute of Standards and Technology has revoked certification of the open-source encryption tool OpenSSL under the Federal Information Processing Standard.

[Hmmm... One wonders at just how the re-evaluation process, which should have noted corrections to the original problem, wound up leading to a revocation. One assumes that the problems will be made known to the OpenSSL folks - if it's so proprietary that even they can't find out what's wrong, someone needs to examine the process. - dcparris]

Full Story

  Nav
» Read more about: Story Type: News Story; Groups: Community

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (6)

"Weathersby said OpenSSL has been challenged by companies with competing proprietary encryption technologies, and that those challenges are aided by the open-source model, which makes source code for the tools publicly available.

“Now the opposing forces have the luxury of going in and trying to pick us apart,” he said. “That’s fine. That’s fair. This is about dollars and cents. This is not about technology.” "

this speaks volumes - sort of reminds of Massachusetts and odf. hmm-

this should make openssl stronger in the end though. but this makes me wonder about the process and the other proprietary products and how good they actually are.
>this should make openssl stronger in the end though

Challenge is the only reliable way to develop security. The open approaches are thus likely to be more secure than proprietary alternatives -- at least in the long run.

Unless, of course, no software company has ever had a disgruntled, dishonest, fired, etc employee.
dino,

Well, all the software developers I've ever heard of were highly paid, well respected, and content, so it shouldn't be a problem.

Oh, wait - I forgot to add "... cue dream sequence ..." to the beginning of my post.
Holy SCO, Batman!

"There is a big problem and your butt is grass." "What is the problem?" "If you don't know, we're certainly not going to tell you."
#$%^& government. Someone with money got to them and bought them off just like government has always been bought off.

I wonder whose feathers OpenSSL was ruffling the most. Hmmm...
Quoting: Holy SCO, Batman!

"There is a big problem and your butt is grass." "What is the problem?" "If you don't know, we're certainly not going to tell you."


I don't think that's the case here. I think that the OpenSSL team does know the reasons and probabely keeps it under wraps untill they issue a patch.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post