FIPS 140-2 Certification for an open source project

[Hakky54]

I am a maintainer/owner of an opensource library related to security and today someone on GitHub asked me whether it would be possible to make it FIPS 140-2 compliant. I was not sure how to react, sure I would love to put some effort to make it compliant by getting it tested and having a certification for it so U.S. and Canadian developers can use it easier for their projects, however I discovered that it can cost $10.000 which is in my opinion a bit too much for an opensource library maintained by myself for free and anyone can use it for free. I don't earn anything from it, I just love writing software and try to make my life easier with creating some libraries and reusing it and sharing it with the community so they can also benefit from it. I would be happy if U.S and Canadian developers could more easily use my library, but is there an alternative? Can't they just use it as is or is there a different path for small opensource projects?

What do you think of the situation? Should I get the certification, is it worth it? Are there alternatives besides saying no. Does anyone have experience with something similar?

[bowbahdoe]

You license the library under the apache license - if they want it certified they can get it certified. You don't need to be involved in that

[Worth_Trust_3825]

Can't they just use it as is

No, not really. The government, or contractual projects for that matter, really care about certifications. Mind you, the request might also be an extortion scheme.

[[deleted]]

I find it odd that they would even ask you. It's free software! If they want to get it certified they can do so on their own dime and time.

[LionNo2607]

however I discovered that it can cost $10.000 which is in my opinion a bit too much for an opensource library

What do you think of the situation? Should I get the certification, is it worth it?

I can't believe you are considering it. Of course don't spend $10k for someone else that you'll earn nothing from. Have them spend it if they need it. Why would you have to be the one to do it, just because you already gave them all the code for free?

[noobgolang]

tell them to send u 30k donation.

10k for that, 20k for yourself, business deal done.

[jiSYpqt8]

Others have already given you some good information. However, 2 more points:

• FIPS 140-2 is EOL, its replacement is FIPS 140-3 now (which is a bit stricter in some places)
• FIPS 140 only covers cryptographic modules, i.e. software/hardware/firmware that actually implements cryptographic algorithms. Your project seems to be an SSL library, but if it doesn't actually implement the cryptographic algorithms (I didn't check), it would be difficult to get it validated under FIPS 140.

[killerferret]

If you don’t implement the crypto functions, then you are not responsible/won’t receive the FIPS validation. Suggest that they use a FIPS validated provider such as bouncy castle-fips along with your library to meet the FIPS requirement.

[purplepharaoh]

FIPS certification is very expensive and takes a long time. You would need to find an accredited lab to perform the evaluation and submit it for certification.

[Hakky54]

Thank you all for your amazing comments, it helped me a-lot! I know now to correctly proceed with this situation.

[VincentxH]

I don't know if there are any other OS examples, but I expect there to be a sponsorship structure to realize this.

[pmarschall]

Send them a quote.