Req #54339 [Opn]: FIPS Support

Edit report at https://bugs.php.net/bug.php?id=54339&edit=1 ID: 54339 Updated by: cmb@php.net Reported by: jyerge at tenable dot com Summary: FIPS Support Status: Open Type: Feature/Change Request Package: OpenSSL related Operating System: Linux - Redhat EL5 PHP Version: 5.3.6 Block user comment: N Private report: N New Comment: That would only make sense when we drop support for OpenSSL 1.1, since there is no FIPS module available for that version[1]. And even for OpenSSL 3.0, the FIPS module has only very recently submitted for validation[2]. [1] <https://wiki.openssl.org/index.php/FIPS_modules> [2] <https://www.openssl.org/blog/blog/2021/09/22/OpenSSL3-fips-submission/> Previous Comments: ------------------------------------------------------------------------ [2011-03-21 19:21:42] jyerge at tenable dot com Description: ------------ It appears that there's no FIPS support in the OpenSSL functionality, correct me if I'm wrong. When PHP is operating as a SAPI under Apache2, any calls to RSA_public_decrypt causes the following error: SSL Library Error: 67674254 error:0408A08E:rsa routines:RSA_public_decrypt:operation not allowed in fips mode This is due to the fact that PHP is calling RSA_public_decrypt directly, which isn't allowed when Apache is operating in FIPS mode (see SSLFIPS directive in the Apache2 documentation). The workaround is to use the EVP_Verify* functions in the OpenSSL library - at least that's what I've been reading. Apache 2.2.17 PHP 5.3.6 OpenSSL 0.9.8r w/OpenSSL FIPS 1.2.2 module ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=54339&edit=1