FIPS 140-3

[mpurg]

Several rules require the system to be compliant with the FIPS standard, where the "140-2" standard is often hardcoded in the descriptions and titles, including in:

• sshd_use_approved_ciphers
• sshd_use_approved_ciphers_ordered_stig
• sshd_use_approved_kex_ordered_stig
• sshd_use_approved_macs
• sshd_use_approved_macs_ordered_stig
• harden_sshd_ciphers_openssh_conf_crypto_policy
• harden_sshd_ciphers_opensshserver_conf_crypto_policy
• harden_sshd_macs_openssh_conf_crypto_policy
• harden_sshd_macs_opensshserver_conf_crypto_policy
• aide_use_fips_hashes
• installed_OS_is_FIPS_certified

As that the latest standard is 140-3, I'm wondering if there is already a plan on how these rules will be refactored to introduce the new standard?

[Mab879]

I don't know of any plans for that moment.

It does bring up some interesting questions. How will be handle OSes that stay FIPS 140-2 when the first 140-3 certificates come out? Should we just change to "FIPS 140 Certified"?

Happy to hear others thoughts.