Ubuntu
python3.5 package

  1. Xenial (16.04)
  2. Bug #1835135
  3. Comment #4

Comment 4 for bug 1835135

Revision history for this message
Joy Latten (j-latten) wrote :

The assessment is accurate.

FIPS 140-2 does not allow MD5 except for use in PRF.

Thus the OpenSSL_add_all_digests in fips openssl does not include MD5. However, SSL_library_init() does include MD5 but only for use in calculating the PRF. Notice in tls1_P_hash() in ssl/t1_enc.c
the flag, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW, is set in the context to permit this use of MD5.
Apps wishing to calculate their own PRF can do the same.