Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add...
by cbhl on Sunday February 23, 2014 @03:30PM
(#7287440)
FIPS 140-2 certification isn't remotely an indication of correctness of code, for better or worse.
Take, for example, the implementation Dual EC DRBG in the FIPS 140-2 certified OpenSSL module -- it was fatally flawed, and has never worked in practice. (It will be removed from the next version of the module in light of developments in the past year.)
Take, for example, the implementation Dual EC DRBG in the FIPS 140-2 certified OpenSSL module -- it was fatally flawed, and has never worked in practice. (It will be removed from the next version of the module in light of developments in the past year.)
https://lwn.net/Articles/578375/