canmove, Confirmed users
937
edits
FIPS Module Specification: Difference between revisions
→Approved Mode of Operation
| Line 84: | Line 84: | ||
===Approved Mode of Operation=== | ===Approved Mode of Operation=== | ||
In order to run the NSS module in the FIPS | In order to run the NSS module in the FIPS Approved mode, an attribute must be explicitly set on the module. This can be done programmatically with a call to [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/pk11wrap/pk11util.c.dep.html#SECMOD_DeleteInternalModule SECMOD_DeleteInternalModule()] (with the module to delete being the internal module): | ||
<pre> | <pre> | ||
SECMODModule *internal; | SECMODModule *internal; | ||
| Line 98: | Line 98: | ||
} | } | ||
</pre> | </pre> | ||
or by running the NSS module utility '''modutil'''. An example command line is below | or by running the NSS module utility [http://www.mozilla.org/projects/security/pki/nss/tools/modutil.html '''modutil''']. An example command line is below: | ||
modutil -fips true -dbdir | modutil -fips true -dbdir <i>directory</i> | ||
where <code><i>directory</i></code> is the directory that contains the NSS databases. | |||
The setting is permanent for the NSS module and all subsequent invocations of NSS functions using that cert directory will be in FIPS mode. The module can be taken out of FIPS mode by substituting | The setting is permanent for the NSS module and all subsequent invocations of NSS functions using that cert directory will be in FIPS mode. The module can be taken out of FIPS mode by substituting <code>false</code> for <code>true</code> in the command above. The state of the module can be checked with: | ||
modutil -chkfips true -dbdir | modutil -chkfips true -dbdir <i>directory</i> | ||
or with a call to PK11_IsFIPS(). | where <code><i>directory</i></code> is the directory that contains the NSS databases, or with a call to [http://www.mozilla.org/projects/security/pki/nss/fips/nss-source/mozilla/security/nss/lib/pk11wrap/pk11util.c.dep.html#PK11_IsFIPS PK11_IsFIPS()]. | ||
===Design Specification=== | ===Design Specification=== | ||