Adding wolfSSL FIPS Ready Docs #117

night1rider · 2023-12-17T18:06:08Z

Adding wolfssl fips ready guide documentation based on: https://www.wolfssl.com/docs/fips-ready-user-guide/

douzzer

Some grammar suggestions, and a couple fixes.

douzzer · 2023-12-19T05:21:21Z

wolfSSL-FIPS-Ready/src/section01.md

@@ -0,0 +1,60 @@
+# wolfSSL FIPS Ready
+
+Do you have a project you'll need for a FIPS approved cryptographic library at 


This doesn't quite say what you mean -- you want something like "Do you have a project that will need a FIPS approved cryptographic library".

Changed to:
"Do you have a project that will need a FIPS approved cryptographic library at a later date, but want to be ready for it now? "

douzzer · 2023-12-19T05:24:05Z

wolfSSL-FIPS-Ready/src/section01.md

+Do you have a project you'll need for a FIPS approved cryptographic library at 
+a future date and want to be ready for it now? wolfSSL FIPS Ready is exactly 
+what you need. It is the wolfSSL Inc FIPS enabled cryptography layer code 
+included in the wolfSSL source tree that one can enable and build. You do not 


Bit of a run-on sentence here -- better something like "It is the cryptography layer from the public wolfSSL source tree, with the FIPS tooling ready to enable and build."

Changed to:
"wolfSSL FIPS Ready includes the cyrptography layer from the public wolfSSL source tree, along with the FIPS tooling enabled for a FIPS Ready build."

Whoops, spelling. LGTM otherwise.

Fixed spelling of "cyrptography " to "cryptography "

douzzer · 2023-12-19T05:26:06Z

wolfSSL-FIPS-Ready/src/section01.md

+included in the wolfSSL source tree that one can enable and build. You do not 
+get a FIPS certificate, you are not FIPS approved, but you will be Ready to go 
+through the FIPS process when the time comes. FIPS Ready means that you have 
+included the FIPS code into your build and that you are operating according to 


Need to be careful and specific here: "FIPS Ready means that you have included the FIPS tooling into your build, and are accessing the cryptography according to the FIPS requirements for applications."

Changed to:
"FIPS Ready means that the FIPS tooling is included in the build, and is accessing the cryptography according to the FIPS requirements for applications."

The point is that the application is guaranteed to be accessing the crypto per FIPS reqs. Your phrasing says that the tooling is accessing the crypto per FIPS reqs, which goes without saying.

Changes A few things based on our discussions and my misunderstanding of fips-ready.
Change initial sentence to:
"FIPS Ready allows application developers to assure that they have correctly integrated the necessary FIPS setup, and are correctly using the API and underlying protocols, providing for a seamless transition to the full FIPS certified wolfSSL library for an application."

Along with adding this to the bottom of section 1.1:
"The FIPS boundary provides confirmation about multiple aspects of your application. The processing
of private key access that will assure proper unlocking and relocking of keys according to the FIPS
specification. The assurance that no FIPS-forbidden modes or key sizes are being used, along with
proper entropy source setup. FIPS Ready also helps discover conflicts with outside sub-system integration your application needs, for example determining if other applications or devices on a network support your new FIPS Ready cipher suites for communication between each other"

douzzer · 2023-12-19T05:32:03Z

wolfSSL-FIPS-Ready/src/section01.md

+algorithm self-tests (CAST) that came with FIPS 140-3. When the time comes, 
+you can get your operating environment tested and added to the wolfSSL Inc 
+FIPS 140-3 certificate for wolfCrypt or submit for a brand new FIPS 140-3 cert 
+from scratch and all the coding work will have been done.


Need a little more run-on sentence cleanup, something like: "When the time comes, we will shepherd your operating environment through testing, and get it added to the existing wolfCrypt FIPS 140-3 certificate. In some situations, a new FIPS 140-3 certificate will be required, and we will work with you through the testing and certification process. In both scenarios, FIPS Ready assures that your application will be fully functional with wolfCrypt as certified."

Changed to:
"When the time comes, we will shepherd your operating environment through testing and add it to the wolfCrypt FIPS 140-3 certificate. In special situations, a new FIPS 140-3 certificate will be required, but we are ready to provide guidance through the testing and certification process. In both scenarios, FIPS Ready assures that your application will be fully functional with wolfCrypt as certified."

wolfSSL-FIPS-Ready/src/section01.md

wolfSSL-FIPS-Ready/src/section02.md

douzzer · 2023-12-19T05:40:35Z

wolfSSL-FIPS-Ready/src/section02.md

+## Configure the build.
+
+```
+$ ./configure --enable-fips=ready[a]


I've never seen this "[a]" before -- it doesn't work. It's just --enable-fips=ready.

This was a Copy paste mistake, [a] refers to a footnote on the original webpage. I couldn't find a good way to create a footnote that would work for both the pdf version and html so I decided to include it in section.

New text for section 2.2:

$ ./configure --enable-fips=ready CFLAGS="-DNO_STRICT_ECDSA_LEN"

This configure with the -DNO_STRICT_ECDSA_LEN CFLAG set should be considered, the strict len check causes issues with vector tests, however it is not known how it will work out with normal SSL/TLS and crypto operations.

We'll put this before a wider audience to see if we can frame it better. It's not the sort of complicated caveat we want to put in front of customers unless absolutely necessary.

Due to internal discussion for the moment the footnote has been removed due to being potentially irrelevant to the current FIPS Ready

douzzer

LGTM. Nice work!

night1rider marked this pull request as ready for review December 17, 2023 22:08

night1rider assigned night1rider and wolfSSL-Bot and unassigned wolfSSL-Bot Dec 17, 2023

night1rider force-pushed the fips-ready-documentation branch from 9aa6de7 to 2e00edf Compare December 18, 2023 16:49

night1rider assigned wolfSSL-Bot and unassigned night1rider Dec 18, 2023

night1rider force-pushed the fips-ready-documentation branch from 2e00edf to 420c94c Compare December 18, 2023 17:17

douzzer requested changes Dec 19, 2023

View reviewed changes

night1rider force-pushed the fips-ready-documentation branch 2 times, most recently from c3de592 to 40122bf Compare December 19, 2023 19:01

night1rider assigned douzzer and night1rider Dec 19, 2023

Adding wolfSSL FIPS Ready Docs

46d9303

night1rider force-pushed the fips-ready-documentation branch from 40122bf to 46d9303 Compare December 20, 2023 21:16

douzzer approved these changes Dec 21, 2023

View reviewed changes

douzzer merged commit 247079a into wolfSSL:master Dec 21, 2023
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding wolfSSL FIPS Ready Docs #117

Adding wolfSSL FIPS Ready Docs #117

night1rider commented Dec 17, 2023

douzzer left a comment

douzzer Dec 19, 2023

night1rider Dec 19, 2023

douzzer Dec 20, 2023

douzzer Dec 19, 2023

night1rider Dec 19, 2023 •

edited

Loading

douzzer Dec 20, 2023

night1rider Dec 20, 2023

douzzer Dec 19, 2023

night1rider Dec 19, 2023

douzzer Dec 20, 2023

night1rider Dec 20, 2023 •

edited

Loading

douzzer Dec 19, 2023

night1rider Dec 19, 2023

douzzer Dec 20, 2023

douzzer Dec 19, 2023

night1rider Dec 19, 2023 •

edited

Loading

douzzer Dec 20, 2023

night1rider Dec 20, 2023 •

edited

Loading

douzzer left a comment

		@@ -0,0 +1,60 @@
		# wolfSSL FIPS Ready

		Do you have a project you'll need for a FIPS approved cryptographic library at

Adding wolfSSL FIPS Ready Docs #117

Adding wolfSSL FIPS Ready Docs #117

Conversation

night1rider commented Dec 17, 2023

douzzer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

night1rider Dec 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

night1rider Dec 20, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

night1rider Dec 19, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

night1rider Dec 20, 2023 • edited Loading

Choose a reason for hiding this comment

douzzer left a comment

Choose a reason for hiding this comment

night1rider Dec 19, 2023 •

edited

Loading

night1rider Dec 20, 2023 •

edited

Loading

night1rider Dec 19, 2023 •

edited

Loading

night1rider Dec 20, 2023 •

edited

Loading