Commit 452b337d authored by Ben Laurie's avatar Ben Laurie
Browse files

More info. 


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@190416 13f79535-47bb-0310-9956-ffa450edef68
parent e514f8b7

README-FIPS

+13 −0
Original line number Diff line number Diff line
@@ -46,3 +46,16 @@ SSLProtocol +TLSv1 
SSLCipherSuite DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:AES256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:AES128-SHAEXP1024-DHE-DSS-DES-CBC-SHA:EXP1024-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA



The cipher suites can, of course, be a subset of the above.



General: All crypto should be done via OpenSSL (or another FIPS

certified package). Any external packages using crypto must enable

FIPS mode in OpenSSL. The OpenSSL FIPS security policy must be

followed.



Note that because Apache sets FIPS mode in OpenSSL, other libraries or

modules using OpenSSL that coexist may exhibit unexpected behaviour

because of the restrictions FIPS mode imposes.



In particular, only DES, AES, RSA, DSA/DSS and SHA-1 can be

used. There is a special exception that permits the use of MD5 within

TLS, but not elsewhere.