To: Tom Lane <tgl@sss.pgh.pa.us>, pramod kg <pramod11287@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
References: 
 <CAHkcXnxfqtSAo3J+Pbz3v8u4-73pgn5HXtoyYXxe2zTx9SrScg@mail.gmail.com>
 <2536077.1643261557@sss.pgh.pa.us>
 <CAHkcXnzEuJ_UMZxAtdeVR2fVKZ=YgNwQecUX2bvVq9aMP5bK7g@mail.gmail.com>
 <2539668.1643264128@sss.pgh.pa.us>
From: Joe Conway <mail@joeconway.com>
Subject: Re: Is PG CE is FIPS Aware?
Message-ID: <de255d4f-d339-adfd-b256-e14d7c386d0d@joeconway.com>
Date: Thu, 27 Jan 2022 10:56:22 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <2539668.1643264128@sss.pgh.pa.us>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/de255d4f-d339-adfd-b256-e14d7c386d0d%40joeconway.com>
Precedence: bulk

On 1/27/22 12:23 AM, pramod kg wrote:
> How to determine whether PG installed in a server is FIPS aware or 
> not(FIPS 140-2 compliant)? We are doing RPM based installation.

On 1/27/22 1:15 AM, Tom Lane wrote:
> pramod kg <pramod11287@gmail.com> writes:
>> I executed query. Got output.
> 
>> postgres=# SELECT md5('foo');
>>                md5
>> ----------------------------------
>>  acbd18db4cc2f85cedef654fccc4a4d8
>> (1 row)
> 
> Oh, my mistake --- that only applies in v14 and later, before
> that md5() always uses a built-in implementation.
> 
> See the STIG that Imram mentioned.

Ensuring you are actually "FIPS 140-2 compliant" is much more complex 
than most people imagine.

See:

https://blog.crunchydata.com/blog/postgres-and-crypto-supply-chain-of-integrity

Also, see the tip of the master branch of pgnodemx:

https://github.com/CrunchyData/pgnodemx

8<-----------------------
-- this will be in next release
-- i.e. pgnodemx v1.0.6
select openssl_version();
          openssl_version
----------------------------------
  OpenSSL 1.1.1k  FIPS 25 Mar 2021
(1 row)

-- these are already in pgnodemx v1.0.5
select openssl_version();
          openssl_version
----------------------------------
  OpenSSL 1.1.1k  FIPS 25 Mar 2021
(1 row)

select symbol_filename('FIPS_mode');
         symbol_filename
--------------------------------
  /usr/lib64/libcrypto.so.1.1.1k
(1 row)

nmx=# select fips_mode();
  fips_mode
-----------
  f
(1 row)
8<-----------------------

I expect pgnodemx v1.0.6 will be release very soon.

HTH,

Joe
-- 
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development