| =pod |
| |
| =head1 NAME |
| |
| fips_config - OpenSSL FIPS configuration |
| |
| =head1 DESCRIPTION |
| |
| A separate configuration file, using the OpenSSL L<config(5)> syntax, |
| is used to hold information about the FIPS module. This includes a digest |
| of the shared library file, and status about the self-testing. |
| This data is used automatically by the module itself for two |
| purposes: |
| |
| =over 4 |
| |
| =item - Run the startup FIPS self-test known answer tests (KATS). |
| |
| This is done once, at installation time. |
| |
| =item - Verify the module's checksum. |
| |
| This is done each time the module is used. |
| |
| =back |
| |
| This file is generated by the L<openssl-fipsinstall(1)> program, and |
| used internally by the FIPS module during its initialization. |
| |
| The following options are supported. They should all appear in a section |
| whose name is identified by the B<fips> option in the B<providers> |
| section, as described in L<config(5)/Provider Configuration Module>. |
| |
| =over 4 |
| |
| =item B<module-mac> |
| |
| The calculated MAC of the FIPS provider file. |
| |
| =item B<install-version> |
| |
| A version number for the fips install process. Should be 1. |
| |
| =item B<install-status> |
| |
| An indicator that the self-tests were run. |
| This should only be written after the module has |
| successfully passed its self tests during installation. |
| If this field is not present, then the self tests will run when the module |
| loads. |
| |
| =item B<install-mac> |
| |
| A MAC of the value of the B<install-status> option, to prevent accidental |
| changes to that value. |
| It is written-to at the same time as B<install-status> is updated. |
| |
| =back |
| |
| For example: |
| |
| [fips_sect] |
| install-version = 1 |
| module-mac = 41:D0:FA:C2:5D:41:75:CD:7D:C3:90:55:6F:A4:DC |
| install-mac = FE:10:13:5A:D3:B4:C7:82:1B:1E:17:4C:AC:84:0C |
| install-status = INSTALL_SELF_TEST_KATS_RUN |
| |
| =head1 SEE ALSO |
| |
| L<config(5)> |
| |
| =head1 COPYRIGHT |
| |
| Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. |
| |
| Licensed under the Apache License 2.0 (the "License"). You may not use |
| this file except in compliance with the License. You can obtain a copy |
| in the file LICENSE in the source distribution or at |
| L<https://www.openssl.org/source/license.html>. |
| |
| =cut |
