Skip to content

Commit cd85ef1

Browse files
committed
Title Case in markdown
1 parent 65f3f3d commit cd85ef1

File tree

1 file changed

+11
-13
lines changed

1 file changed

+11
-13
lines changed

lib/crypto/doc/guides/fips.md

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ limitations under the License.
1919
2020
%CopyrightEnd%
2121
-->
22-
# FIPS mode
22+
# FIPS Mode
2323

2424
[](){: #fips } This chapter describes FIPS mode support in the crypto
2525
application.
@@ -36,7 +36,7 @@ only the validated algorithms provided by the Object Module are accessible,
3636
other algorithms usually available in OpenSSL (like md5) or implemented in the
3737
Erlang code (like SRP) are disabled.
3838

39-
## Enabling FIPS mode
39+
## Enabling FIPS Mode
4040

4141
> #### Warning {: .warning }
4242
>
@@ -87,7 +87,7 @@ to use copy of OpenSSL, it is time to configure it for FIPS mode.
8787
`status: active`. The `default` can be disabled in `openssl.cnf` in the
8888
`[default]` section.
8989

90-
### Building Erlang with FIPS
90+
### Building Erlang With FIPS
9191

9292
1. Configure and build Erlang/OTP with FIPS support:
9393
```bash
@@ -113,7 +113,7 @@ section protected from any concurrently running crypto operations. Furthermore
113113
in case of failure all crypto calls would have to be disabled from the Erlang or
114114
nif code. This would be too much effort put into this not too important feature.
115115

116-
## Incompatibilities with regular builds
116+
## Incompatibilities With Regular Builds
117117

118118
The Erlang API of the crypto application is identical regardless of building
119119
with or without FIPS support. However the nif code internally uses a different
@@ -124,7 +124,7 @@ functions (`hash_(init|update|final)`, `hmac_(init|update|final)` and
124124
`stream_(init|encrypt|decrypt)`) is different and incompatible with regular
125125
builds when compiling crypto with FIPS support.
126126

127-
## Common caveats
127+
## Common Caveats
128128

129129
In FIPS mode non-validated algorithms are disabled. This may cause some
130130
unexpected problems in application relying on crypto.
@@ -136,32 +136,30 @@ unexpected problems in application relying on crypto.
136136
> 140-2 validated cryptographic module if it uses it exclusively for every
137137
> cryptographic operation.
138138
139-
### Restrictions on key sizes
139+
### Restrictions On Key Sizes
140140

141141
Although public key algorithms are supported in FIPS mode they can only be used
142142
with secure key sizes. The Security Policy requires the following minimum
143143
values:
144144

145145
- **RSA** - 1024 bit
146-
147146
- **DSS** - 1024 bit
148-
149147
- **EC algorithms** - 160 bit
150148

151-
### Restrictions on elliptic curves
149+
### Restrictions On Elliptic Curves
152150

153151
The Erlang API allows using arbitrary curve parameters, but in FIPS mode only
154152
those allowed by the Security Policy shall be used.
155153

156-
### Avoid md5 for hashing
154+
### Avoid MD5 For Hashing
157155

158156
MD5 is a popular choice as a hash function, but it is not secure enough to be
159157
validated. Try to use sha instead wherever possible.
160158

161159
For exceptional, non-cryptographic use cases one may consider switching to
162160
`erlang:md5/1` as well.
163161

164-
### Certificates and encrypted keys
162+
### Certificates And Encrypted Keys
165163

166164
As md5 is not available in FIPS mode it is only possible to use certificates
167165
that were signed using sha hashing. When validating an entire certificate chain
@@ -171,14 +169,14 @@ For similar dependency on the md5 and des algorithms most encrypted private keys
171169
in PEM format do not work either. However, the PBES2 encryption scheme allows
172170
the use of stronger FIPS verified algorithms which is a viable alternative.
173171

174-
### SNMP v3 limitations
172+
### SNMP v3 Limitations
175173

176174
It is only possible to use `usmHMACSHAAuthProtocol` and `usmAesCfb128Protocol`
177175
for authentication and privacy respectively in FIPS mode. The snmp application
178176
however won't restrict selecting disabled protocols in any way, and using them
179177
would result in run time crashes.
180178

181-
### TLS 1.2 is required
179+
### TLS 1.2 Is Required
182180

183181
All SSL and TLS versions prior to TLS 1.2 use a combination of md5 and sha1
184182
hashes in the handshake for various purposes:

0 commit comments

Comments
 (0)