CIQ Announces FIPS 140-3 Compliance for Rocky Linux
CIQ has recently made a significant announcement regarding the FIPS 140-3 compliance for Rocky Linux, enabling users to harness the security advantages this certification brings. The compliance pertains to both community-driven Rocky Linux and Rocky Linux from CIQ, particularly for versions 8 and 9. This important achievement comes after a thorough review by CIQ's lab partner.
Benefits of FIPS 140-3 Compliance
The FIPS 140-3 certification of Rocky Linux provides several notable benefits for organizations:
1. Demonstrable Cryptographic Posture
This certification reduces liability and supports compliance with strict enterprise and government security standards. By meeting these standards, organizations can significantly mitigate risks associated with negligence.
2. Increased Operational Efficiency
With pre-configured components, organizations can minimize the time and specialized skills necessary to align their systems with demanding security requirements. This leads to smoother operations and swift adaptations to compliance necessities.
Importance of Compliance
Achieving compliance, especially with FIPS 140-3, is essential for numerous enterprises and government bodies. For those without a mandatory requirement, pursuing such compliance still enhances customer trust and confidence. This certification serves as a highly regarded option for potential customers who already utilize Enterprise Linux distributions but have limited compliant options available.
Insights from CIQ Leadership
Gregory Kurtzer, CEO and founder of CIQ, shared, "Obtaining FIPS 140-3 certification for Rocky Linux 8 and 9 is a considerable accomplishment involving a significant investment of time and effort from our team. We are incredibly proud of this achievement and happy to support both Rocky Linux and Rocky Linux from CIQ users. Our commitment to continual updates for ongoing security and compliance is only beginning."
Core Cryptographic Modules
The FIPS 140-3 standard encompasses several crucial cryptographic modules such as the kernel, NSS, Libgcrypt, OpenSSL, and GnuTLS. CIQ has enhanced these packages, ensuring they carry FIPS-compliant security patches, which are essential for achieving compliance in regulated environments. Enabling FIPS mode enforces strict algorithm restrictions, ensuring adherence to the minimum required standards for encryption strength and randomness.
Innovations in OpenSSL
Notably, CIQ has also improved the OpenSSL modules in both Rocky 8 and Rocky 9 to fully support FIPS 140-3 for the EDDSA-based elliptic curve signing algorithms ED25519 and ED448. The OpenSSL module in Rocky 8 is fully certified for TLS 1.3 in FIPS mode, showcasing CIQ's dedication to progressive security implementations.
Community Recognition
Scott Shinn, co-lead of the Compliance and Security Team for Rocky Linux, emphasized the importance of this validation, stating, "The validation that FIPS compliance offers is a substantial testament to the capabilities of Rocky Linux as a leading community-driven Enterprise Linux operating system, as well as of CIQ’s commitment to open source. This achievement indicates profound investment in community security by CIQ."
Future Directions for Cryptographic Compliance
The FIPS 140-3 standard is a significant enhancement over FIPS 140-2, implementing more rigorous algorithmic strength requirements to keep pace with evolving processing power and security challenges. As part of this, legacy algorithms such as SHA-1 digital signatures and smaller RSA keys are no longer acceptable for compliant systems.
Open Source Availability
All FIPS-related work conducted by CIQ is publicly available as open source, highlighting their commitment to transparency and community collaboration. This ongoing effort encourages shared progress in creating secure software infrastructures.
About CIQ
CIQ provides secure and highly performant software infrastructures designed to meet the demands of modern workloads, ranging from basic operations to extreme HPC and AI tasks. CIQ focuses on optimizing systems for organizational needs and contributes significantly to critical open source infrastructure projects like Rocky Linux.
Frequently Asked Questions
1. What does FIPS 140-3 compliance mean for Rocky Linux?
FIPS 140-3 compliance indicates that Rocky Linux meets stringent security standards, offering organizations assurance for their critical workloads.
2. Why is compliance important for businesses?
Compliance enhances customer trust and meets necessary regulatory requirements, especially for those in government and other sensitive sectors.
3. What improvements have been made to the OpenSSL modules?
Improvements include full FIPS 140-3 support for advanced elliptic curve signing algorithms and certification for TLS 1.3.
4. How does CIQ support Rocky Linux users?
CIQ provides ongoing updates to maintain security and compliance for both community-driven and CIQ versions of Rocky Linux.
5. Where can I find CIQ’s open source work related to FIPS?
CIQ's FIPS-related work is accessible through their public repository on GitHub, promoting transparency and community involvement.
