FIPS mode()

From OpenSSLWiki
Revision as of 16:03, 9 August 2019 by Jflopezfernandez (talk | contribs) (Added a notice indicating the version in the current release has no functionality)
Not Currently Implemented
This function as currently implemented does nothing. It is part of the currently-planned 3.0.0 release, but has not yet been written.


FIPS_mode - retrieve the current FIPS 140-2 mode of operation


#include <openssl/crypto.h>
int FIPS_mode(void);


FIPS_mode() is used to determine the FIPS mode of operation by a program utilizing the services of the validated library. The library must have been built with the FIPS Object Module, and the FIPS Object Module must have been acquired, built, and installed in accordance with the Security Policy.

The return value is either 0 to indicate that the FIPS mode of operation is not enabled, or the value used for the ONOFF parameter passed to an earlier successful call to FIPS_mode_set(). Effectively any non-zero value indicates FIPS mode; values other than 1 may have additional significance such as designating an additional restriction to Suite B algorithms.

If the library was built without support of the FIPS Object Module, then the function will return 0 with an error code of CRYPTO_R_FIPS_MODE_NOT_SUPPORTED (0x0f06d065).


A return code of non-zero indicates FIPS mode, 0 indicates non-FIPS mode. When called from a version of OpenSSL that is not "FIPS capable" (capable of utilizing an embedded FIPS Object Module), then FIPS_mode() will always return 0.


FIPS_mode_set(3), FIPS_selftest(3)


FIPS_mode() was formerly included with <openssl/fips.h>.


FIPS support was introduced in version 0.9.7 of OpenSSL.