FIPS 140-2 in BEAM Apps
summary
Erlang/Elixir apps can run FIPS mode since Erlang/OTP 20 but simply enabling it isn’t enough: the system must use a certified OpenSSL crypto module and avoid accidental non‑FIPS code pulled in by deps or NIFs. Certificate use in federal apps requires OpenSSL FIPS module installation and often front‑end OCSP because BEAM lacks OCSP support thus OCSP requirement is typical. Watch for md5 used outside crypto, atom exhaustion, timing leaks and fix password checks with a constant-time compare. Continuous integration via Docker/CircleCI validates FIPS builds.
AI-written summary · about
chapters (15)
- 0:00Start
- 0:33Intro
- 3:45What is FIPS 140-2?
- 6:03What FIPS 140-2 isn't
- 10:17Why does it matter?
- 12:56Cryptographic Boundary
- 14:36Non-compliant Application
- 15:39Inter-node Encryption
- 17:47Concurrent FIPS Testing
- 17:57Risk Areas
- 18:11Native Implemented Functions
- 18:47Atom Exhaustion Risks
- 20:03Little Bobby Tables
- 20:24Property-based Testing
- 22:50References
related talks
43mSecuring Elixir Applications
37mSecurity of the BEAM
10mUnconference Session: From RFP to Fips
41mFireside chat on security for practitioners & academics
36mSecurity compliance: A global perspective
31mScanning for FIPS : Building confidence in Compliance from the Container up
32mDon’t let it crash: How we applied our security checks on Elixir code
37mHow To Approach InfoSec Like a Fed(eral Auditor)