# OpenSSL FIPS integrity check

As far as I know, FIPS requires a set of self tests (POST) to verify the cryptographic algorithms permitted and the integrity of the module.

These tests are performed at run-time, so OpenSSL does a HMAC-SHA1 of the code loaded in memory and compares its output with the HMAC-SHA1 computed at build time.

I think that an attacker could modify the source code compile it and then both hashes would match too. Also, HMAC secret key is disclosed as OpenSSL is open-source software.

Where is the security here? Keeping the HMAC key secret? Which is the most-common approach to fulfill this FIPS requirement?

• Are you thinking that the FIPS perform these online? Also, a common way is giving test vectors for the correctness of your implementation. In other words, don't spend our time if you cannot satisfy these. The next step will be, using random values. In this stage it is not under the control of the attackers. – kelalaka Jul 15 at 16:18

So treat the FIPS 140 integrity check as a compliance requirement, not as a security requirement. It's one of the many hoops through which you need to jump. Fiddle with your operating system's low-level interfaces to figure out how to read code in memory before any dynamic linking or randomization takes place. Calculate the expected MAC value and store it somewhere that isn't part of the verification (because it's infeasible to find $$v$$ such that $$\mathsf{MAC}(m) = v$$ and $$v$$ is a substring of $$m$$). Arrange for your code's initialization sequence to verify the MAC of the code against the reference value stored next to it. It's part of the cost of getting a FIPS stamp.