opendnssec/SoftHSMv2 — pull request #99 by fxdupont (2014-11-27 17:51:26+00:00)
Title: OpenSSL FIPS support

Rebase on last develop branch.
Add support for the OpenSSL FIPS, i.e., FIPS capable OpenSSL library (FIPS == certified as FIPS 140-2 level 1)
Details:
- it is hairy to build a FIPS capable OpenSSL library but it is described in the OpenSSL FIPS User Guide.
- fipsld & co is even more hairy but problems are already solved, cf. the FIPS-NOTES document.
- it works with a static library (IMHO better for security) when only the libcrypto.a is in the /lib directory.
- I tried with CentOS as RedHat provides its own FIPS capable OpenSSL library. At the exception of many extra constraints in key sizes and co, it works well.
- on WIN32 the fipld stuff is done in a perl script with many environment variables so not compatible with Visual Studio with a lot of manual things (i.e., it can work but not for the common user).
At the exception of RedHat and WIN32 environments (which can be handled in extra commits/pulls) the proposed patch supports FIPS 140-2 level 1 (the only level accessible by software) with a certified crypto module (in fact even better than the OpenSSL stuff as all PKCS#11 entry points include a check the FIPS mode was correctly entered :-).