From: Joe Conway <mail@joeconway.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: pramod kg <pramod11287@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Is PG CE is FIPS Aware?
Date: Thu, 27 Jan 2022 10:56:22 -0500
Message-ID: <de255d4f-d339-adfd-b256-e14d7c386d0d@joeconway.com> (raw)
In-Reply-To: <2539668.1643264128@sss.pgh.pa.us>
References: <CAHkcXnxfqtSAo3J+Pbz3v8u4-73pgn5HXtoyYXxe2zTx9SrScg@mail.gmail.com>
<2536077.1643261557@sss.pgh.pa.us>
<CAHkcXnzEuJ_UMZxAtdeVR2fVKZ=YgNwQecUX2bvVq9aMP5bK7g@mail.gmail.com>
<2539668.1643264128@sss.pgh.pa.us>
On 1/27/22 12:23 AM, pramod kg wrote:
> How to determine whether PG installed in a server is FIPS aware or
> not(FIPS 140-2 compliant)? We are doing RPM based installation.
On 1/27/22 1:15 AM, Tom Lane wrote:
> pramod kg <pramod11287@gmail.com> writes:
>> I executed query. Got output.
>
>> postgres=# SELECT md5('foo');
>> md5
>> ----------------------------------
>> acbd18db4cc2f85cedef654fccc4a4d8
>> (1 row)
>
> Oh, my mistake --- that only applies in v14 and later, before
> that md5() always uses a built-in implementation.
>
> See the STIG that Imram mentioned.
Ensuring you are actually "FIPS 140-2 compliant" is much more complex
than most people imagine.
See:
https://blog.crunchydata.com/blog/postgres-and-crypto-supply-chain-of-integrity
Also, see the tip of the master branch of pgnodemx:
https://github.com/CrunchyData/pgnodemx
8<-----------------------
-- this will be in next release
-- i.e. pgnodemx v1.0.6
select openssl_version();
openssl_version
----------------------------------
OpenSSL 1.1.1k FIPS 25 Mar 2021
(1 row)
-- these are already in pgnodemx v1.0.5
select openssl_version();
openssl_version
----------------------------------
OpenSSL 1.1.1k FIPS 25 Mar 2021
(1 row)
select symbol_filename('FIPS_mode');
symbol_filename
--------------------------------
/usr/lib64/libcrypto.so.1.1.1k
(1 row)
nmx=# select fips_mode();
fips_mode
-----------
f
(1 row)
8<-----------------------
I expect pgnodemx v1.0.6 will be release very soon.
HTH,
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mail@joeconway.com, tgl@sss.pgh.pa.us, pramod11287@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Is PG CE is FIPS Aware?
In-Reply-To: <de255d4f-d339-adfd-b256-e14d7c386d0d@joeconway.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox