{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/3760","labels_url":"https://api.github.com/repos/nodejs/node/issues/3760/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/3760/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/3760/events","html_url":"https://github.com/nodejs/node/issues/3760","id":116231358,"number":3760,"title":"crypto: Resolve FIPS test failures and API issues","user":{"login":"stefanmb","id":1356314,"avatar_url":"https://avatars.githubusercontent.com/u/1356314?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanmb","html_url":"https://github.com/stefanmb","followers_url":"https://api.github.com/users/stefanmb/followers","following_url":"https://api.github.com/users/stefanmb/following{/other_user}","gists_url":"https://api.github.com/users/stefanmb/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanmb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanmb/subscriptions","organizations_url":"https://api.github.com/users/stefanmb/orgs","repos_url":"https://api.github.com/users/stefanmb/repos","events_url":"https://api.github.com/users/stefanmb/events{/privacy}","received_events_url":"https://api.github.com/users/stefanmb/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/crypto","name":"crypto","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-11-11T00:06:33Z","updated_at":"2015-11-12T18:12:09Z","closed_at":null,"body":"# Issue Overview\r\n\r\nThe issue of FIPS-compliant encryption in Node.js has been brought up [before](https://github.com/nodejs/node-v0.x-archive/issues/25463)  and support for compiling with FIPS-compliant OpenSSL was [added](https://github.com/nodejs/node/pull/1890). The FIPS build instructions have recently been [modified](https://github.com/nodejs/node/issues/2242) to insure compliance with FIPS 140-2 requirements.\r\n\r\nHowever, running the Node.js test suite (“tools/test.py --verbose”) with the FIPS-compliant OpenSSL crypto module produces a large number of test failures. These failures are a  significant roadblock to adoption of Node.js in real life applications requiring FIPS compliance, because it is unclear to prospective users if Node.js can actually work correctly in this mode.\r\n\r\nI have spent some time debugging the test failures and have produced a series of pull requests to address them. These pull requests are split up under several “themes” below.\r\n\r\n# Pull Requests\r\n\r\n## Documentation Update\r\n\r\nhttps://github.com/nodejs/node/pull/3752 (Landed)\r\n\r\n## Error Checking\r\n\r\nhttps://github.com/nodejs/node/pull/3753\r\n\r\n## FIPS-incompatible API\r\n\r\nhttps://github.com/nodejs/node/pull/3754\r\n\r\n## TLS Wrap\r\n\r\nhttps://github.com/nodejs/node/pull/3755\r\n\r\n## OpenSSL Known Bug Workaround\r\n\r\nhttps://github.com/nodejs/node/pull/3756\r\n\r\n## Avoid use of disallowed Crypto (e.g. MD5, RC4)\r\n\r\nhttps://github.com/nodejs/node/pull/3757\r\n\r\n## Boost Strength of “Arbitrary” Crypto\r\n\r\nhttps://github.com/nodejs/node/pull/3758\r\n\r\n## Update Test Fixtures with FIPS Compatible Crypto\r\n\r\nhttps://github.com/nodejs/node/pull/3759\r\n"},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/156187598","html_url":"https://github.com/nodejs/node/issues/3760#issuecomment-156187598","issue_url":"https://api.github.com/repos/nodejs/node/issues/3760","id":156187598,"user":{"login":"Nibbler999","id":935710,"avatar_url":"https://avatars.githubusercontent.com/u/935710?v=3","gravatar_id":"","url":"https://api.github.com/users/Nibbler999","html_url":"https://github.com/Nibbler999","followers_url":"https://api.github.com/users/Nibbler999/followers","following_url":"https://api.github.com/users/Nibbler999/following{/other_user}","gists_url":"https://api.github.com/users/Nibbler999/gists{/gist_id}","starred_url":"https://api.github.com/users/Nibbler999/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nibbler999/subscriptions","organizations_url":"https://api.github.com/users/Nibbler999/orgs","repos_url":"https://api.github.com/users/Nibbler999/repos","events_url":"https://api.github.com/users/Nibbler999/events{/privacy}","received_events_url":"https://api.github.com/users/Nibbler999/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T18:12:09Z","updated_at":"2015-11-12T18:12:09Z","body":"Checking for -fips in the version string is not a good way to detect FIPS mode, neither is OPENSSL_FIPS. See #3077. Can you instead use process.config.variables.openssl_fips and NODE_FIPS_MODE ?"}}