Description
Issue Overview
The issue of FIPS-compliant encryption in Node.js has been brought up before and support for compiling with FIPS-compliant OpenSSL was added. The FIPS build instructions have recently been modified to insure compliance with FIPS 140-2 requirements.
However, running the Node.js test suite (“tools/test.py --verbose”) with the FIPS-compliant OpenSSL crypto module produces a large number of test failures. These failures are a significant roadblock to adoption of Node.js in real life applications requiring FIPS compliance, because it is unclear to prospective users if Node.js can actually work correctly in this mode.
I have spent some time debugging the test failures and have produced a series of pull requests to address them. These pull requests are split up under several “themes” below.
Pull Requests
Documentation Update
#3752 (Landed)
Error Checking
#3753 (Landed)
FIPS-incompatible API
#3754 (Landed)
TLS Wrap
#3755 (Landed)
OpenSSL Known Bug Workaround
#3756 (Landed)
Avoid use of disallowed Crypto (e.g. MD5, RC4)
#3757 (Landed)
Boost Strength of “Arbitrary” Crypto
#3758 (Landed)
Update Test Fixtures with FIPS Compatible Crypto
#3759 (Landed)