Maniphest T6720

FIPS140-2/3 Validation
Open, HighPublicFEATURE REQUEST
Actions

Assigned To

None

Authored By

	syncer
	Sep 16 2024, 6:23 PM

Tags

Referenced Files

None

Subscribers

Global Notifications

Description

FIPS validation it's crucial for VyOS Success
This is the root task for FIPS140-2/3 Validation

Details

Version: -
Is it a breaking change?: Perfectly compatible
Issue type: Feature (new functionality)

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open	FEATURE REQUEST	None	T6720 FIPS140-2/3 Validation
		Open	FEATURE REQUEST	None	T8489 Update OpenSSL to 3.5.4
		Open	FEATURE REQUEST	None	T8494 Compile GnuTLS with the enable-fips140-mode option
		Open	FEATURE REQUEST	None	T8507 Add kernel command line option "fips=1"
		In progress	FEATURE REQUEST	Viacheslav	T8508 Update FIPS-140-3 compatible Openssl 3.1.2
		Resolved	FEATURE REQUEST	Viacheslav	T8529 Add configuration mode CLI to enable FIPS-compatible OpenSSL modules
		Open	FEATURE REQUEST	None	T8544 Wireguard disable or remove configuration options for FIPS enabled configurations
		Open	FEATURE REQUEST	None	T8591 Strongswan IPsec with FIPS option must use keyexchange=ikev2
		Open	FEATURE REQUEST	None	T8592 StrongSwan enable fips_mode if the system option fips is configured
		Open	FEATURE REQUEST	None	T8593 FIPS disable all StrongSwan IPsec default plugins enable only fips compatible
		Resolved	FEATURE REQUEST	Viacheslav	T9040 Build FIPS-provider OpenSSL version

Event Timeline

syncer created this task.Sep 16 2024, 6:23 PM

syncer triaged this task as High priority.

vyosbot added a project: Restricted Project.Oct 14 2024, 8:16 AM

dmbaturin changed Is it a breaking change? from Unspecified (possibly destroys the router) to Perfectly compatible.Oct 14 2024, 8:41 AM

dmbaturin changed Issue type from Unspecified (please specify) to Feature (new functionality).

dmbaturin removed a project: Restricted Project.Oct 14 2024, 8:49 AM

pasik subscribed.Oct 14 2024, 8:49 AM

syncer added a subscriber: Global Notifications.Nov 1 2024, 9:16 PM

giga1699 subscribed.Jan 7 2026, 4:45 AM

OpenSSL 3.5.4 submitted for FIPS 140-3 validation: https://openssl-library.org/post/2025-10-09-ossl3.5.4-fips-submission/

https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=40091

Viacheslav added a subtask: T8494: Compile GnuTLS with the enable-fips140-mode option.Apr 14 2026, 11:49 AM

Viacheslav added a subtask: T8507: Add kernel command line option "fips=1".Apr 15 2026, 12:41 PM

Viacheslav added a subtask: T8508: Update FIPS-140-3 compatible Openssl 3.1.2.Apr 15 2026, 1:17 PM

Viacheslav added a subtask: T8529: Add configuration mode CLI to enable FIPS-compatible OpenSSL modules.Apr 17 2026, 2:01 PM

Viacheslav changed the status of subtask T8529: Add configuration mode CLI to enable FIPS-compatible OpenSSL modules from Open to In progress.Apr 20 2026, 3:29 PM

Viacheslav changed the status of subtask T8508: Update FIPS-140-3 compatible Openssl 3.1.2 from Open to In progress.Apr 20 2026, 4:05 PM

Viacheslav added a subtask: T8544: Wireguard disable or remove configuration options for FIPS enabled configurations.Apr 22 2026, 2:49 PM

Viacheslav added a subtask: T8591: Strongswan IPsec with FIPS option must use keyexchange=ikev2.Apr 28 2026, 10:41 AM

Viacheslav added a subtask: T8592: StrongSwan enable fips_mode if the system option fips is configured.Apr 28 2026, 10:53 AM

Viacheslav added a subtask: T8593: FIPS disable all StrongSwan IPsec default plugins enable only fips compatible.Apr 28 2026, 11:08 AM

Viacheslav added a subtask: T9040: Build FIPS-provider OpenSSL version.Jul 1 2026, 5:23 PM

Viacheslav closed subtask T9040: Build FIPS-provider OpenSSL version as Resolved.Jul 24 2026, 10:38 AM

Viacheslav closed subtask T8529: Add configuration mode CLI to enable FIPS-compatible OpenSSL modules as Resolved.Jul 28 2026, 12:45 PM