Enabling FIPS-compliant encryption

[nzakas]

For many in enterprises, regulations require the use of FIPS-compliant encryption tools. OpenSSL itself is not FIPS compliant, but does have a module that is (http://www.openssl.org/docs/fips/fipsnotes.html). It's possible to hack this into a custom build of Node.js (http://arthur-notes.youramaryllis.com/2014/12/nodejs-fips.html), but it would be nice to have it supported by Node directly (preferably starting with 0.10.x).

Someone had submitted a PR a while back for this: #6380

Is this something that would be considered?

[mhdawson]

I have had a few internal teams within IBM ask for this as well. @nzakas have you looked into the details whether simply enabling the FIPs mode in OpenSSL would be enough for consumers to use Node when FIPS compliance is required ? If you have researched/thought about this I'd be interested in setting up a time for a conversation.

[nzakas]

Are you talking about calling FIPS_mode_set(1) from somewhere?

[mhdawson]

No, I meant does simply having Node use a version of OpenSSL compiled in FIPs mode enough for users that have a FIPs requirement as there is Node specific code in the path between the request and the crypto operations that take place.

[mhdawson]

The other issue might also be if there are any patches in Node which are floated on top of OpenSSL and what that would to do the FIPs cert

[indutny]

Hello!

I have did it in bud:

• indutny/bud@bfece8c
• https://github.com/indutny/bud/blob/master/fips.gypi

It should be pretty straightforward to integrate it in node.js/io.js .

The way it works in bud is following:

1. Build the fipscanister thing in some folder.
2. Supply this folder to configure: ./configure --fips-dir=...
3. Build everything and enjoy!

There is only minor nit that will be required for this in node.js, that is not required in bud. It is patched version of fipsld that wraps premain.c with -x c and -x none, to make sure it works with C++ code.

[indutny]

TL;DR: going to port this code right now, expect a PR today or tomorrow.

[nzakas]

@mhdawson I believe so, I'll get clarification from our security folks. From my discussions with them thus far, it seems to be enough of we can prove Node.js crypto is running against the FIPS-enabled OpenSSL.

[indutny]

Yay, a PR for io.js: nodejs/node#1890 . I guess it can be easily backported to node.js.

[nzakas]

Just confirmed with our security folks that we must call FIPS_mode_set(1) to be in compliance. I'm going to ask them to chime in directly.