@@ -19,7 +19,7 @@ limitations under the License.
1919
2020%CopyrightEnd%
2121-->
22- # FIPS mode
22+ # FIPS Mode
2323
2424[ ] ( ) {: #fips } This chapter describes FIPS mode support in the crypto
2525application.
@@ -36,7 +36,7 @@ only the validated algorithms provided by the Object Module are accessible,
3636other algorithms usually available in OpenSSL (like md5) or implemented in the
3737Erlang code (like SRP) are disabled.
3838
39- ## Enabling FIPS mode
39+ ## Enabling FIPS Mode
4040
4141> #### Warning {: .warning }
4242>
@@ -87,7 +87,7 @@ to use copy of OpenSSL, it is time to configure it for FIPS mode.
8787 ` status: active ` . The ` default ` can be disabled in ` openssl.cnf ` in the
8888 ` [default] ` section.
8989
90- ### Building Erlang with FIPS
90+ ### Building Erlang With FIPS
9191
92921 . Configure and build Erlang/OTP with FIPS support:
9393 ``` bash
@@ -113,7 +113,7 @@ section protected from any concurrently running crypto operations. Furthermore
113113in case of failure all crypto calls would have to be disabled from the Erlang or
114114nif code. This would be too much effort put into this not too important feature.
115115
116- ## Incompatibilities with regular builds
116+ ## Incompatibilities With Regular Builds
117117
118118The Erlang API of the crypto application is identical regardless of building
119119with or without FIPS support. However the nif code internally uses a different
@@ -124,7 +124,7 @@ functions (`hash_(init|update|final)`, `hmac_(init|update|final)` and
124124` stream_(init|encrypt|decrypt) ` ) is different and incompatible with regular
125125builds when compiling crypto with FIPS support.
126126
127- ## Common caveats
127+ ## Common Caveats
128128
129129In FIPS mode non-validated algorithms are disabled. This may cause some
130130unexpected problems in application relying on crypto.
@@ -136,32 +136,30 @@ unexpected problems in application relying on crypto.
136136> 140-2 validated cryptographic module if it uses it exclusively for every
137137> cryptographic operation.
138138
139- ### Restrictions on key sizes
139+ ### Restrictions On Key Sizes
140140
141141Although public key algorithms are supported in FIPS mode they can only be used
142142with secure key sizes. The Security Policy requires the following minimum
143143values:
144144
145145- ** RSA** - 1024 bit
146-
147146- ** DSS** - 1024 bit
148-
149147- ** EC algorithms** - 160 bit
150148
151- ### Restrictions on elliptic curves
149+ ### Restrictions On Elliptic Curves
152150
153151The Erlang API allows using arbitrary curve parameters, but in FIPS mode only
154152those allowed by the Security Policy shall be used.
155153
156- ### Avoid md5 for hashing
154+ ### Avoid MD5 For Hashing
157155
158156MD5 is a popular choice as a hash function, but it is not secure enough to be
159157validated. Try to use sha instead wherever possible.
160158
161159For exceptional, non-cryptographic use cases one may consider switching to
162160` erlang:md5/1 ` as well.
163161
164- ### Certificates and encrypted keys
162+ ### Certificates And Encrypted Keys
165163
166164As md5 is not available in FIPS mode it is only possible to use certificates
167165that were signed using sha hashing. When validating an entire certificate chain
@@ -171,14 +169,14 @@ For similar dependency on the md5 and des algorithms most encrypted private keys
171169in PEM format do not work either. However, the PBES2 encryption scheme allows
172170the use of stronger FIPS verified algorithms which is a viable alternative.
173171
174- ### SNMP v3 limitations
172+ ### SNMP v3 Limitations
175173
176174It is only possible to use ` usmHMACSHAAuthProtocol ` and ` usmAesCfb128Protocol `
177175for authentication and privacy respectively in FIPS mode. The snmp application
178176however won't restrict selecting disabled protocols in any way, and using them
179177would result in run time crashes.
180178
181- ### TLS 1.2 is required
179+ ### TLS 1.2 Is Required
182180
183181All SSL and TLS versions prior to TLS 1.2 use a combination of md5 and sha1
184182hashes in the handshake for various purposes:
0 commit comments