Hello,

I am working on FIPS-compliance for our product which uses curl/openssl. I've built and verified the FIPS-compliant OpenSSL, but the one area where we are still receiving FIPS errors is in the curl NTLM authentication functions:

 

Curl_ntlm_core_mk_lm_hash

Curl_ntlm_core_lm_resp

 

These functions use a single DES cipher which is not FIPS-approved. In looking through the latest source (version 7.47.1) this is still true.

Is there any way (perhaps configuration or another module) to enforce FIPS compliance in these functions (use Triple DES instead of Single DES)?

 

Thank you,

Paul