On Út, 2013-12-03 at 22:28 +0100, Florian Weimer wrote:
On 12/03/2013 07:58 PM, Tomas Mraz wrote:
I'd suggest to follow the "Medium term goals" from the page. That means to choose the backend from one of the following libraries (in the order of preference). 1. NSS 2. GNUTLS (with nettle as crypto backend, but nettle never used directly by applications) 3. OpenSSL 4. libgcrypt
I hope that both OpenJDK crypto providers are acceptable as well (one is a wrapper around NSS, the other one is a separate implementation, mostly in Java).
The wrapper around NSS clearly is acceptable. On the other hand the separate implementation is not planned to be FIPS validated in Red Hat Enterprise Linux which might be a problem.