FIPS feature

[Alan DeKok]

William Rettig wrote:
> My boss has asked me to add a FIPS feature to FreeRADIUS.

  OK.

> It really doesn’t amount to much at this point.  We think that FIPS mode
> requires additional two things:
>
> 1)       Use of HMAC-SHA1 MAC (vendor neutral)

  For... what?  The TLS methods?

> 2)       AES Key Wrap of the MSK in the Access-Accept (attribute format
> is vendor specific - but feature could be mostly generic).

  That won't be supported by most NASes, but OK.

> Is this something that could be supported moving forward?

  Sure.  Submit a patch.

> Would someone be willing to direct my efforts?

  My suggestion for the AES keywrap is to write a module that takes the
existing MSK, creates the keywrapped attributes, and then (possibly)
deletes the original MSK.

  Alan DeKok.