The Cryptographic Module Validation Program (CMVP), a joint effort of the US and Canadian governments, approved the validation of the OpenSSL open source security toolkit for implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols on Friday.

OpenSSL is already in use by companies and organizations around the world. However, validation that the toolkit meets the Federal Information Processing Standard (FIPS) 140-2 regulations means that US and Canadian government agencies that handle sensitive data can use the free, open source security software.

The CMVP is run by the US National Institute for Standards and Technology (NIST) and Canada's Communications Security Establishment (CSE) to provide testing of cryptographic modules in accredited labs, which makes sure that security software does what it is designed to do every time it's used, based on the FIPS standards.

While not yet officially validated, CMVP Director Randy Easter said validation of the open source software "is a done deal." OpenSSL is now in the finalization stage of the CMVP pre-validation process. Although a certificate must be printed and signed by representatives of both NIST and CSE, Easter said the certificate could be signed, and the validation official, as early as next week.

The link for this article located at NewsForge is no longer available.