FIPS Reference
Module enhancements
CIQ's cryptographic modules meet the stricter requirements of FIPS 140-3 while providing capabilities beyond upstream distributions, maintaining full API/ABI compatibility:
| Module | Enhancement | Availability |
|---|---|---|
| OpenSSL | ED25519 and ED448 elliptic-curve signing support in FIPS mode | Rocky 8 and 9 |
| OpenSSL | Full TLS 1.3 validation in FIPS mode | Rocky 8 |
| libgcrypt | Enhanced implementation for stricter FIPS 140-3 requirements | Rocky 8 and 9 |
| Kernel | Validated entropy sources (SP 800-90B), full strength without caveats | Rocky 8 and 9 |
Open source transparency
CIQ's FIPS module source code is publicly available for review and debugging at github.com/ciq-rocky-fips. This transparency enables engineering and SRE teams to inspect the cryptographic implementation, debug issues, and verify the code matches certified versions.
Certification partner
CIQ partners with atsec information security, an accredited NIST Cryptographic Module Testing Laboratory, for FIPS validation. atsec develops custom security policies for CIQ's modules and provides technical expertise throughout the certification process.
ATO support
For organizations preparing Authority to Operate (ATO) packages, CIQ provides:
- Security policies: Official FIPS 140-3 security policy documents for each certified module
- Configuration guidance: Documentation for properly enabling and operating FIPS mode
- Technical expertise: Access to engineers with deep knowledge of FIPS 140-3 module requirements
Contact CIQ Support or info@ciq.com for ATO support inquiries.
Terminology
| Term | Definition |
|---|---|
| FIPS | Federal Information Processing Standards, the US government's computer security standards |
| CMVP | Cryptographic Module Validation Program, the joint NIST and Canadian Centre for Cyber Security program that validates cryptographic modules |
| FIPS 140-3 | Current FIPS standard for cryptographic modules. All CIQ certifications for Rocky Linux 8 and 9 are validated against FIPS 140-3. |
| IUT | Implementation Under Test: the lab is actively testing the module; the earliest validation stage |
| MIP | Modules In Process: the lab has approved the module and submitted it to NIST for final registration; typically 12 or more months |
| CMVP Validated | The module has completed validation and received an official NIST certificate. This is the only status that constitutes full FIPS certification. |
Frequently asked questions
What is the difference between FIPS Certified and FIPS Compliant?
FIPS Certified means the exact package version has been validated by NIST and received a certificate; to maintain it, packages must stay pinned to the certified versions. FIPS Compliant (as CIQ defines it) means the package uses identical cryptographic code to the certified version but includes non-security-relevant updates like CVE patches outside the crypto boundary, so you can receive security updates while keeping the certified cryptographic implementation.
Does Rocky Linux include FIPS mode?
Rocky Linux inherits FIPS-capable code from RHEL sources, so FIPS mode can be turned on. However, base Rocky Linux packages have not been submitted for NIST validation, so enabling FIPS mode on stock Rocky provides no CMVP validation on its own. FIPS validation requires RLC Pro with CIQ's validated (Certified or Compliant) packages.
Can CIQ's FIPS certificates be used with upstream Rocky Linux?
No. FIPS 140 certificates are issued for specific binary modules. CIQ's certificates apply only to the exact packages distributed through RLC Pro repositories.
Can I use FIPS mode while receiving security updates?
Yes. CIQ provides FIPS Compliant packages in a separate repository. These packages use the same certified cryptographic code but receive CVE patches for non-cryptographic components. This is CIQ's recommended approach for most customers.
Does FIPS certification mean my system is secure?
No. FIPS validates cryptographic implementation correctness: that algorithms like AES, SHA, and RSA are implemented per specification. It does not validate overall system security, vulnerability management, access controls, or application security. A FIPS-validated system still requires comprehensive hardening.
We need FedRAMP or CMMC compliance. Is FIPS enough?
FIPS 140 is one requirement within FedRAMP and CMMC. These frameworks add many more: access control, audit logging, incident response, configuration management, and others. RLC Pro Hardened with DISA STIG profiles addresses many of these requirements together.