V-278407

Discussion

FIPS 140-2/140-3 precludes using invalidated cryptography for the cryptographic protection of sensitive or valuable data within federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2/140-3 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2/140-3 standard. The cryptographic module used must have at least one validated digital signature function. This validated hash algorithm must be used to generate digital signatures for all cryptographic security function within the product being evaluated. Satisfies: SRG-APP-000630, SRG-APP-000635

Check Content

Verify NGINX is using OpenSSL with FIPS enabled.

For version 1.x:

# nginx -V

nginx version: nginx/1.15.2 (nginx-plus-r16)
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017"

If the response does not include "fips" in the OpenSSL version, this is a finding.

For version 3.x:

# openssl list -providers

 Providers:
  base
    name: OpenSSL Base Provider
    version: 3.2.2
    status: active
  default
    name: OpenSSL Default Provider
    version: 3.2.2
    status: active
  fips
    name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
    version: 3.2.2-622cc79c634cbbef
    status: active

If the response does not list a FIPS provider with a status of "active", this is a finding.