Comment Let's certify Linux! (Score 1) 145
We'd love to. We've been pressing our management for the past 6 months to allow us to try and evaluate Linux to C2. They dont think there would be enough interest in the results. I'm sorely tempted to insert their email addresses here, but I'm not _that_ cruel.
So far as FIPS 140 is concerned, the UK government (and I assume the US is the same) would require their own algorithms to be ported to Linux (and no, they will not release the source to them). What would be evaluated would be the interface to them. There would need to be some level of assurance that the algorithms were actually used and could not be bypassed, disabled etc.
Personally I think certifying Linux would be a very good thing. It might actually turn in the first really useful certified platform, one which would actually allow applications to be resident and not invalidate the certificate. But what do I know, I don't count beans for a living.
So far as FIPS 140 is concerned, the UK government (and I assume the US is the same) would require their own algorithms to be ported to Linux (and no, they will not release the source to them). What would be evaluated would be the interface to them. There would need to be some level of assurance that the algorithms were actually used and could not be bypassed, disabled etc.
Personally I think certifying Linux would be a very good thing. It might actually turn in the first really useful certified platform, one which would actually allow applications to be resident and not invalidate the certificate. But what do I know, I don't count beans for a living.
