File gnutls-FIPS-140-3-references.patch of Package gnutls

Overview Repositories Revisions Requests Users Attributes Meta

File gnutls-FIPS-140-3-references.patch of Package gnutls (Revision cc587cbaedfb3197f0a1fb4993115381)

Currently displaying revision cc587cbaedfb3197f0a1fb4993115381 , Show latest

Index: gnutls-3.8.7/configure.ac
===================================================================
--- gnutls-3.8.7.orig/configure.ac
+++ gnutls-3.8.7/configure.ac
@@ -624,19 +624,19 @@ LT_INIT([disable-static,win32-dll,shared
 AC_LIB_HAVE_LINKFLAGS(dl,, [#include <dlfcn.h>], [dladdr (0, 0);])
 
 AC_ARG_ENABLE(fips140-mode,
-  AS_HELP_STRING([--enable-fips140-mode], [enable FIPS140-2 mode]),
+  AS_HELP_STRING([--enable-fips140-mode], [enable FIPS140-3 mode]),
     enable_fips=$enableval, enable_fips=no)
 AM_CONDITIONAL(ENABLE_FIPS140, test "$enable_fips" = "yes")
 if [ test "$enable_fips" = "yes" ];then
   if test "x$HAVE_LIBDL" = "xyes";then
-    AC_DEFINE([ENABLE_FIPS140], 1, [Enable FIPS140-2 mode])
+    AC_DEFINE([ENABLE_FIPS140], 1, [Enable FIPS140-3 mode])
     AC_SUBST([FIPS140_LIBS], $LIBDL)
     AC_ARG_WITH(fips140-key, AS_HELP_STRING([--with-fips140-key],
                                  [specify the FIPS140 HMAC key for integrity]),
             fips_key="$withval", 
             fips_key="orboDeJITITejsirpADONivirpUkvarP")
 
-    AC_DEFINE_UNQUOTED([FIPS_KEY], ["$fips_key"], [The FIPS140-2 integrity key])
+    AC_DEFINE_UNQUOTED([FIPS_KEY], ["$fips_key"], [The FIPS140-3 integrity key])
 
     AC_ARG_WITH(fips140-module-name, AS_HELP_STRING([--with-fips140-module-name],
                                  [specify the FIPS140 module name]),
Index: gnutls-3.8.7/doc/cha-gtls-app.texi
===================================================================
--- gnutls-3.8.7.orig/doc/cha-gtls-app.texi
+++ gnutls-3.8.7/doc/cha-gtls-app.texi
@@ -222,7 +222,7 @@ CPU. The currently available options are
 @end itemize
 
 @item @code{GNUTLS_FORCE_FIPS_MODE}
-@tab In setups where GnuTLS is compiled with support for FIPS140-2 (see @ref{FIPS140-2 mode})
+@tab In setups where GnuTLS is compiled with support for FIPS140-3 (see @ref{FIPS140-3 mode})
 if set to one it will force the FIPS mode enablement.
 
 @end multitable
Index: gnutls-3.8.7/doc/cha-internals.texi
===================================================================
--- gnutls-3.8.7.orig/doc/cha-internals.texi
+++ gnutls-3.8.7/doc/cha-internals.texi
@@ -14,7 +14,7 @@ happens inside the black box.
 * TLS Hello Extension Handling::
 * Cryptographic Backend::
 * Random Number Generators-internals::
-* FIPS140-2 mode::
+* FIPS140-3 mode::
 @end menu
 
 @node The TLS Protocol
@@ -529,7 +529,7 @@ For more information see @ref{Hardware s
 
 GnuTLS provides two random generators. The default, and the AES-DRBG random
 generator which is only used when the library is compiled with support for
-FIPS140-2 and the system is in FIPS140-2 mode.
+FIPS140-3 and the system is in FIPS140-3 mode.
 
 @subheading The default generator - inner workings
 
@@ -659,23 +659,23 @@ two distinct times, and being able to re
 after observing the output of the PRNG. Given the approach described
 on the above paragraph, all levels are immune to such attack.
 
-@node FIPS140-2 mode
-@section FIPS140-2 mode
+@node FIPS140-3 mode
+@section FIPS140-3 mode
 
-GnuTLS can operate in a special mode for FIPS140-2. That mode of operation
-is for the conformance to NIST's FIPS140-2 publication, which consists of policies
+GnuTLS can operate in a special mode for FIPS140-3. That mode of operation
+is for the conformance to NIST's FIPS140-3 publication, which consists of policies
 for cryptographic modules (such as software libraries). Its implementation in
 GnuTLS is designed for Red Hat Enterprise Linux, and can only be enabled
 when the library is explicitly compiled with the '--enable-fips140-mode'
 configure option.
 
-There are two distinct library states with regard to FIPS140-2: the FIPS140-2
+There are two distinct library states with regard to FIPS140-3: the FIPS140-3
 mode is @emph{installed} if @code{/etc/system-fips} is present, and the
-FIPS140-2 mode is @emph{enabled} if @code{/proc/sys/crypto/fips_enabled}
+FIPS140-3 mode is @emph{enabled} if @code{/proc/sys/crypto/fips_enabled}
 contains '1', which is typically set with the ``fips=1'' kernel command line
 option.
 
-When the FIPS140-2 mode is installed, the operation of the library is modified
+When the FIPS140-3 mode is installed, the operation of the library is modified
 as follows.
 
 @itemize
@@ -684,12 +684,12 @@ as follows.
 @item Algorithm self-tests are run on library load
 @end itemize
 
-When the FIPS140-2 mode is enabled, The operation of the library is in addition
+When the FIPS140-3 mode is enabled, The operation of the library is in addition
 modified as follows.
 
 @itemize
-@item Only approved by FIPS140-2 algorithms are enabled
-@item Only approved by FIPS140-2 key lengths are allowed for key generation
+@item Only approved by FIPS140-3 algorithms are enabled
+@item Only approved by FIPS140-3 key lengths are allowed for key generation
 @item Any cryptographic operation will be refused if any of the self-tests failed
 @end itemize
 
@@ -698,7 +698,7 @@ There are also few environment variables
 environment variable @code{GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS} will disable
 the library integrity tests on startup, and the variable
 @code{GNUTLS_FORCE_FIPS_MODE} can be set to force a value from
-@ref{gnutls_fips_mode_t}, i.e., '1' will enable the FIPS140-2
+@ref{gnutls_fips_mode_t}, i.e., '1' will enable the FIPS140-3
 mode, while '0' will disable it.
 
 The integrity checks for the dependent libraries and GnuTLS are performed
@@ -706,20 +706,20 @@ using '.hmac' files which are present at
 key for the operations can be provided on compile-time with the configure
 option '--with-fips140-key'. The MAC algorithm used is HMAC-SHA256.
 
-On runtime an application can verify whether the library is in FIPS140-2
+On runtime an application can verify whether the library is in FIPS140-3
 mode using the @funcref{gnutls_fips140_mode_enabled} function.
 
-@subheading Relaxing FIPS140-2 requirements
+@subheading Relaxing FIPS140-3 requirements
 
 The library by default operates in a strict enforcing mode, ensuring that
-all constraints imposed by the FIPS140-2 specification are enforced. However
+all constraints imposed by the FIPS140-3 specification are enforced. However
 the application can relax these requirements via @funcref{gnutls_fips140_set_mode}
 which can switch to alternative modes as in @ref{gnutls_fips_mode_t}.
 
 @showenumdesc{gnutls_fips_mode_t,The @code{gnutls_@-fips_@-mode_t} enumeration.}
 
 The intention of this API is to be used by applications which may run in
-FIPS140-2 mode, while they utilize few algorithms not in the allowed set,
+FIPS140-3 mode, while they utilize few algorithms not in the allowed set,
 e.g., for non-security related purposes. In these cases applications should
 wrap the non-compliant code within blocks like the following.
 
@@ -748,9 +748,9 @@ if (gnutls_fips140_mode_enabled())
 The reason of the @code{GNUTLS_FIPS140_SET_MODE_THREAD} flag in the
 previous calls is to localize the change in the mode. Note also, that
 such a block has no effect when the library is not operating
-under FIPS140-2 mode, and thus it can be considered a no-op.
+under FIPS140-3 mode, and thus it can be considered a no-op.
 
-Applications could also switch FIPS140-2 mode explicitly off, by calling
+Applications could also switch FIPS140-3 mode explicitly off, by calling
 @example
 gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
 @end example
@@ -768,7 +768,7 @@ performed within a given context.
 
 @showfuncD{gnutls_fips140_context_init,gnutls_fips140_context_deinit,gnutls_fips140_push_context,gnutls_fips140_pop_context}
 
-The @code{gnutls_fips140_context_t} represents the FIPS140-2 mode of
+The @code{gnutls_fips140_context_t} represents the FIPS140-3 mode of
 operation.  It can be attached to the current execution thread with
 @funcref{gnutls_fips140_push_context} and its internal state will be
 updated until it is detached with
Index: gnutls-3.8.7/doc/enums.texi
===================================================================
--- gnutls-3.8.7.orig/doc/enums.texi
+++ gnutls-3.8.7/doc/enums.texi
@@ -1204,7 +1204,7 @@ application traffic secret is installed
 @c gnutls_fips_mode_t
 @table @code
 @item GNUTLS_@-FIPS140_@-DISABLED
-The FIPS140-2 mode is disabled.
+The FIPS140-3 mode is disabled.
 @item GNUTLS_@-FIPS140_@-STRICT
 The default mode; all forbidden operations will cause an
 operation failure via error code.
@@ -1212,8 +1212,8 @@ operation failure via error code.
 A transient state during library initialization. That state
 cannot be set or seen by applications.
 @item GNUTLS_@-FIPS140_@-LAX
-The library still uses the FIPS140-2 relevant algorithms but all
-forbidden by FIPS140-2 operations are allowed; this is useful when the
+The library still uses the FIPS140-3 relevant algorithms but all
+forbidden by FIPS140-3 operations are allowed; this is useful when the
 application is aware of the followed security policy, and needs
 to utilize disallowed operations for other reasons (e.g., compatibility).
 @item GNUTLS_@-FIPS140_@-LOG
Index: gnutls-3.8.7/doc/functions/gnutls_fips140_set_mode
===================================================================
--- gnutls-3.8.7.orig/doc/functions/gnutls_fips140_set_mode
+++ gnutls-3.8.7/doc/functions/gnutls_fips140_set_mode
@@ -3,7 +3,7 @@
 
 
 @deftypefun {void} {gnutls_fips140_set_mode} (gnutls_fips_mode_t @var{mode}, unsigned @var{flags})
-@var{mode}: the FIPS140-2 mode to switch to
+@var{mode}: the FIPS140-3 mode to switch to
 
 @var{flags}: should be zero or @code{GNUTLS_FIPS140_SET_MODE_THREAD} 
 
@@ -12,13 +12,13 @@ That function is not thread-safe when ch
 behavior with no flags after threads are created is undefined.
 
 When the flag @code{GNUTLS_FIPS140_SET_MODE_THREAD}  is specified
-then this call will change the FIPS140-2 mode for this particular
+then this call will change the FIPS140-3 mode for this particular
 thread and not for the whole process. That way an application
 can utilize this function to set and reset mode for specific
 operations.
 
 This function never fails but will be a no-op if used when
-the library is not in FIPS140-2 mode. When asked to switch to unknown
+the library is not in FIPS140-3 mode. When asked to switch to unknown
 values for  @code{mode} or to @code{GNUTLS_FIPS140_SELFTESTS}  mode, the library
 switches to @code{GNUTLS_FIPS140_STRICT}  mode.
 
Index: gnutls-3.8.7/doc/gnutls.html
===================================================================
--- gnutls-3.8.7.orig/doc/gnutls.html
+++ gnutls-3.8.7/doc/gnutls.html
@@ -485,7 +485,7 @@ Documentation License&rdquo;.
     <li><a id="toc-TLS-Extension-Handling" href="#TLS-Hello-Extension-Handling">11.4 TLS Extension Handling</a></li>
     <li><a id="toc-Cryptographic-Backend-1" href="#Cryptographic-Backend">11.5 Cryptographic Backend</a></li>
     <li><a id="toc-Random-Number-Generators" href="#Random-Number-Generators_002dinternals">11.6 Random Number Generators</a></li>
-    <li><a id="toc-FIPS140_002d2-mode-1" href="#FIPS140_002d2-mode">11.7 FIPS140-2 mode</a></li>
+    <li><a id="toc-FIPS140_002d2-mode-1" href="#FIPS140_002d2-mode">11.7 FIPS140-3 mode</a></li>
   </ul></li>
   <li><a id="toc-Upgrading-from-previous-versions-1" href="#Upgrading-from-previous-versions">Appendix A Upgrading from previous versions</a></li>
   <li><a id="toc-Support-1" href="#Support">Appendix B Support</a>
@@ -9028,7 +9028,7 @@ CPU. The currently available options are
 </li><li>0x200000: Enable VIA PHE
 </li><li>0x400000: Enable VIA PHE SHA512
 </li></ul></td></tr>
-<tr><td width="30%"><code class="code">GNUTLS_FORCE_FIPS_MODE</code></td><td width="70%">In setups where GnuTLS is compiled with support for FIPS140-2 (see <a class="ref" href="#FIPS140_002d2-mode">FIPS140-2 mode</a>)
+<tr><td width="30%"><code class="code">GNUTLS_FORCE_FIPS_MODE</code></td><td width="70%">In setups where GnuTLS is compiled with support for FIPS140-3 (see <a class="ref" href="#FIPS140_002d2-mode">FIPS140-3 mode</a>)
 if set to one it will force the FIPS mode enablement.</td></tr>
 </tbody>
 </table>
@@ -18448,7 +18448,7 @@ None:
        --inline-commands-prefix=str Change the default delimiter for inline commands
        --provider=file        Specify the PKCS #11 provider library
 				- file must pre-exist
-       --fips140-mode         Reports the status of the FIPS140-2 mode in gnutls library
+       --fips140-mode         Reports the status of the FIPS140-3 mode in gnutls library
        --list-config          Reports the configuration of the library
        --logfile=str          Redirect informational messages to a specific file
        --keymatexport=str     Label used for exporting keying material
@@ -19468,7 +19468,7 @@ happens inside the black box.
 <li><a href="#TLS-Hello-Extension-Handling" accesskey="4">TLS Extension Handling</a></li>
 <li><a href="#Cryptographic-Backend" accesskey="5">Cryptographic Backend</a></li>
 <li><a href="#Random-Number-Generators_002dinternals" accesskey="6">Random Number Generators</a></li>
-<li><a href="#FIPS140_002d2-mode" accesskey="7">FIPS140-2 mode</a></li>
+<li><a href="#FIPS140_002d2-mode" accesskey="7">FIPS140-3 mode</a></li>
 </ul>
 <hr>
 <div class="section-level-extent" id="The-TLS-Protocol">
@@ -19993,7 +19993,7 @@ For more information see <a class="ref"
 <div class="section-level-extent" id="Random-Number-Generators_002dinternals">
 <div class="nav-panel">
 <p>
-Next: <a href="#FIPS140_002d2-mode" accesskey="n" rel="next">FIPS140-2 mode</a>, Previous: <a href="#Cryptographic-Backend" accesskey="p" rel="prev">Cryptographic Backend</a>, Up: <a href="#Internal-architecture-of-GnuTLS" accesskey="u" rel="up">Internal Architecture of GnuTLS</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
+Next: <a href="#FIPS140_002d2-mode" accesskey="n" rel="next">FIPS140-3 mode</a>, Previous: <a href="#Cryptographic-Backend" accesskey="p" rel="prev">Cryptographic Backend</a>, Up: <a href="#Internal-architecture-of-GnuTLS" accesskey="u" rel="up">Internal Architecture of GnuTLS</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
 </div>
 <h3 class="section" id="Random-Number-Generators"><span>11.6 Random Number Generators<a class="copiable-link" href="#Random-Number-Generators"> &para;</a></span></h3>
 
@@ -20001,7 +20001,7 @@ Next: <a href="#FIPS140_002d2-mode" acce
 
 <p>GnuTLS provides two random generators. The default, and the AES-DRBG random
 generator which is only used when the library is compiled with support for
-FIPS140-2 and the system is in FIPS140-2 mode.
+FIPS140-3 and the system is in FIPS140-3 mode.
 </p>
 <h4 class="subheading" id="The-default-generator-_002d-inner-workings"><span>The default generator - inner workings<a class="copiable-link" href="#The-default-generator-_002d-inner-workings"> &para;</a></span></h4>
 
@@ -20138,22 +20138,22 @@ on the above paragraph, all levels are i
 <p>
 Previous: <a href="#Random-Number-Generators_002dinternals" accesskey="p" rel="prev">Random Number Generators</a>, Up: <a href="#Internal-architecture-of-GnuTLS" accesskey="u" rel="up">Internal Architecture of GnuTLS</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
 </div>
-<h3 class="section" id="FIPS140_002d2-mode-1"><span>11.7 FIPS140-2 mode<a class="copiable-link" href="#FIPS140_002d2-mode-1"> &para;</a></span></h3>
+<h3 class="section" id="FIPS140_002d2-mode-1"><span>11.7 FIPS140-3 mode<a class="copiable-link" href="#FIPS140_002d2-mode-1"> &para;</a></span></h3>
 
-<p>GnuTLS can operate in a special mode for FIPS140-2. That mode of operation
-is for the conformance to NIST&rsquo;s FIPS140-2 publication, which consists of policies
+<p>GnuTLS can operate in a special mode for FIPS140-3. That mode of operation
+is for the conformance to NIST&rsquo;s FIPS140-3 publication, which consists of policies
 for cryptographic modules (such as software libraries). Its implementation in
 GnuTLS is designed for Red Hat Enterprise Linux, and can only be enabled
 when the library is explicitly compiled with the &rsquo;&ndash;enable-fips140-mode&rsquo;
 configure option.
 </p>
-<p>There are two distinct library states with regard to FIPS140-2: the FIPS140-2
+<p>There are two distinct library states with regard to FIPS140-3: the FIPS140-3
 mode is <em class="emph">installed</em> if <code class="code">/etc/system-fips</code> is present, and the
-FIPS140-2 mode is <em class="emph">enabled</em> if <code class="code">/proc/sys/crypto/fips_enabled</code>
+FIPS140-3 mode is <em class="emph">enabled</em> if <code class="code">/proc/sys/crypto/fips_enabled</code>
 contains &rsquo;1&rsquo;, which is typically set with the &ldquo;fips=1&rdquo; kernel command line
 option.
 </p>
-<p>When the FIPS140-2 mode is installed, the operation of the library is modified
+<p>When the FIPS140-3 mode is installed, the operation of the library is modified
 as follows.
 </p>
 <ul class="itemize mark-bullet">
@@ -20162,12 +20162,12 @@ as follows.
 </li><li>Algorithm self-tests are run on library load
 </li></ul>
 
-<p>When the FIPS140-2 mode is enabled, The operation of the library is in addition
+<p>When the FIPS140-3 mode is enabled, The operation of the library is in addition
 modified as follows.
 </p>
 <ul class="itemize mark-bullet">
-<li>Only approved by FIPS140-2 algorithms are enabled
-</li><li>Only approved by FIPS140-2 key lengths are allowed for key generation
+<li>Only approved by FIPS140-3 algorithms are enabled
+</li><li>Only approved by FIPS140-3 key lengths are allowed for key generation
 </li><li>Any cryptographic operation will be refused if any of the self-tests failed
 </li></ul>
 
@@ -20176,7 +20176,7 @@ modified as follows.
 environment variable <code class="code">GNUTLS_SKIP_FIPS_INTEGRITY_CHECKS</code> will disable
 the library integrity tests on startup, and the variable
 <code class="code">GNUTLS_FORCE_FIPS_MODE</code> can be set to force a value from
-<a class="ref" href="#gnutls_005ffips_005fmode_005ft">Figure 11.5</a>, i.e., &rsquo;1&rsquo; will enable the FIPS140-2
+<a class="ref" href="#gnutls_005ffips_005fmode_005ft">Figure 11.5</a>, i.e., &rsquo;1&rsquo; will enable the FIPS140-3
 mode, while &rsquo;0&rsquo; will disable it.
 </p>
 <p>The integrity checks for the dependent libraries and GnuTLS are performed
@@ -20184,13 +20184,13 @@ using &rsquo;.hmac&rsquo; files which ar
 key for the operations can be provided on compile-time with the configure
 option &rsquo;&ndash;with-fips140-key&rsquo;. The MAC algorithm used is HMAC-SHA256.
 </p>
-<p>On runtime an application can verify whether the library is in FIPS140-2
+<p>On runtime an application can verify whether the library is in FIPS140-3
 mode using the <a class="ref" href="#gnutls_005ffips140_005fmode_005fenabled">gnutls_fips140_mode_enabled</a> function.
 </p>
-<h4 class="subheading" id="Relaxing-FIPS140_002d2-requirements"><span>Relaxing FIPS140-2 requirements<a class="copiable-link" href="#Relaxing-FIPS140_002d2-requirements"> &para;</a></span></h4>
+<h4 class="subheading" id="Relaxing-FIPS140_002d2-requirements"><span>Relaxing FIPS140-3 requirements<a class="copiable-link" href="#Relaxing-FIPS140_002d2-requirements"> &para;</a></span></h4>
 
 <p>The library by default operates in a strict enforcing mode, ensuring that
-all constraints imposed by the FIPS140-2 specification are enforced. However
+all constraints imposed by the FIPS140-3 specification are enforced. However
 the application can relax these requirements via <a class="ref" href="#gnutls_005ffips140_005fset_005fmode">gnutls_fips140_set_mode</a>
 which can switch to alternative modes as in <a class="ref" href="#gnutls_005ffips_005fmode_005ft">Figure 11.5</a>.
 </p>
@@ -20199,7 +20199,7 @@ which can switch to alternative modes as
 
 <dl class="table">
 <dt><code class="code">GNUTLS_FIPS140_DISABLED</code></dt>
-<dd><p>The FIPS140-2 mode is disabled.
+<dd><p>The FIPS140-3 mode is disabled.
 </p></dd>
 <dt><code class="code">GNUTLS_FIPS140_STRICT</code></dt>
 <dd><p>The default mode; all forbidden operations will cause an
@@ -20210,8 +20210,8 @@ operation failure via error code.
 cannot be set or seen by applications.
 </p></dd>
 <dt><code class="code">GNUTLS_FIPS140_LAX</code></dt>
-<dd><p>The library still uses the FIPS140-2 relevant algorithms but all
-forbidden by FIPS140-2 operations are allowed; this is useful when the
+<dd><p>The library still uses the FIPS140-3 relevant algorithms but all
+forbidden by FIPS140-3 operations are allowed; this is useful when the
 application is aware of the followed security policy, and needs
 to utilize disallowed operations for other reasons (e.g., compatibility).
 </p></dd>
@@ -20222,7 +20222,7 @@ to a message to the audit callback funct
 </dl>
 <div class="caption"><p><strong class="strong">Figure 11.5: </strong>The <code class="code">gnutls_fips_mode_t</code> enumeration.</p></div></div>
 <p>The intention of this API is to be used by applications which may run in
-FIPS140-2 mode, while they utilize few algorithms not in the allowed set,
+FIPS140-3 mode, while they utilize few algorithms not in the allowed set,
 e.g., for non-security related purposes. In these cases applications should
 wrap the non-compliant code within blocks like the following.
 </p>
@@ -20251,9 +20251,9 @@ if (gnutls_fips140_mode_enabled())
 <p>The reason of the <code class="code">GNUTLS_FIPS140_SET_MODE_THREAD</code> flag in the
 previous calls is to localize the change in the mode. Note also, that
 such a block has no effect when the library is not operating
-under FIPS140-2 mode, and thus it can be considered a no-op.
+under FIPS140-3 mode, and thus it can be considered a no-op.
 </p>
-<p>Applications could also switch FIPS140-2 mode explicitly off, by calling
+<p>Applications could also switch FIPS140-3 mode explicitly off, by calling
 </p><div class="example">
 <pre class="example-preformatted">gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
 </pre></div>
@@ -20276,7 +20276,7 @@ performed within a given context.
 <dt><code class="code"><var class="var">int</var> <a class="ref" href="#gnutls_005ffips140_005fpop_005fcontext">gnutls_fips140_pop_context</a> ( <var class="var">void</var>)</code></dt>
 </dl>
 
-<p>The <code class="code">gnutls_fips140_context_t</code> represents the FIPS140-2 mode of
+<p>The <code class="code">gnutls_fips140_context_t</code> represents the FIPS140-3 mode of
 operation.  It can be attached to the current execution thread with
 <a class="ref" href="#gnutls_005ffips140_005fpush_005fcontext">gnutls_fips140_push_context</a> and its internal state will be
 updated until it is detached with
@@ -20649,8 +20649,8 @@ Previous: <a href="#Contributing" access
 to an auditor that the crypto component follows some best practices, such
 as unit testing and reliance on well known crypto primitives.
 </p>
-<p>GnuTLS has support for the FIPS 140-2 certification under Red Hat Enterprise Linux.
-See <a class="ref" href="#FIPS140_002d2-mode">FIPS140-2 mode</a> for more information.
+<p>GnuTLS has support for the FIPS 140-3 certification under Red Hat Enterprise Linux.
+See <a class="ref" href="#FIPS140_002d2-mode">FIPS140-3 mode</a> for more information.
 </p>
 <hr>
 </div>
@@ -24567,7 +24567,7 @@ unusable.  This function is not thread-s
 <h4 class="subheading" id="gnutls_005ffips140_005fset_005fmode-1"><span>gnutls_fips140_set_mode<a class="copiable-link" href="#gnutls_005ffips140_005fset_005fmode-1"> &para;</a></span></h4>
 <a class="anchor" id="gnutls_005ffips140_005fset_005fmode"></a><dl class="first-deftypefn first-deftypefun-alias-first-deftypefn">
 <dt class="deftypefn deftypefun-alias-deftypefn" id="index-gnutls_005ffips140_005fset_005fmode"><span class="category-def">Function: </span><span><code class="def-type">void</code> <strong class="def-name">gnutls_fips140_set_mode</strong> <code class="def-code-arguments">(gnutls_fips_mode_t <var class="var">mode</var>, unsigned <var class="var">flags</var>)</code><a class="copiable-link" href="#index-gnutls_005ffips140_005fset_005fmode"> &para;</a></span></dt>
-<dd><p><var class="var">mode</var>: the FIPS140-2 mode to switch to
+<dd><p><var class="var">mode</var>: the FIPS140-3 mode to switch to
 </p>
 <p><var class="var">flags</var>: should be zero or <code class="code">GNUTLS_FIPS140_SET_MODE_THREAD</code> 
 </p>
@@ -24576,13 +24576,13 @@ unusable.  This function is not thread-s
 behavior with no flags after threads are created is undefined.
 </p>
 <p>When the flag <code class="code">GNUTLS_FIPS140_SET_MODE_THREAD</code>  is specified
-then this call will change the FIPS140-2 mode for this particular
+then this call will change the FIPS140-3 mode for this particular
 thread and not for the whole process. That way an application
 can utilize this function to set and reset mode for specific
 operations.
 </p>
 <p>This function never fails but will be a no-op if used when
-the library is not in FIPS140-2 mode. When asked to switch to unknown
+the library is not in FIPS140-3 mode. When asked to switch to unknown
 values for  <code class="code">mode</code> or to <code class="code">GNUTLS_FIPS140_SELFTESTS</code>  mode, the library
 switches to <code class="code">GNUTLS_FIPS140_STRICT</code>  mode.
 </p>
@@ -47003,7 +47003,7 @@ Next: <a href="#Concept-Index" accesskey
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffingerprint"><code>gnutls_fingerprint</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fcontext_005fdeinit"><code>gnutls_fips140_context_deinit</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fcontext_005finit"><code>gnutls_fips140_context_init</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
-<tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fget_005foperation_005fstate"><code>gnutls_fips140_get_operation_state</code></a></td><td class="printindex-index-section"><a href="#FIPS140_002d2-mode">FIPS140-2 mode</a></td></tr>
+<tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fget_005foperation_005fstate"><code>gnutls_fips140_get_operation_state</code></a></td><td class="printindex-index-section"><a href="#FIPS140_002d2-mode">FIPS140-3 mode</a></td></tr>
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fget_005foperation_005fstate-1"><code>gnutls_fips140_get_operation_state</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fmode_005fenabled"><code>gnutls_fips140_mode_enabled</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
 <tr><td></td><td class="printindex-index-entry"><a href="#index-gnutls_005ffips140_005fpop_005fcontext"><code>gnutls_fips140_pop_context</code></a></td><td class="printindex-index-section"><a href="#Core-TLS-API">Core TLS API</a></td></tr>
Index: gnutls-3.8.7/doc/gnutls.info-3
===================================================================
--- gnutls-3.8.7.orig/doc/gnutls.info-3
+++ gnutls-3.8.7/doc/gnutls.info-3
@@ -2104,7 +2104,7 @@ to ‘more’.  Both will exit with a st
             --inline-commands-prefix=str Change the default delimiter for inline commands
             --provider=file        Specify the PKCS #11 provider library
      				- file must pre-exist
-            --fips140-mode         Reports the status of the FIPS140-2 mode in gnutls library
+            --fips140-mode         Reports the status of the FIPS140-3 mode in gnutls library
             --list-config          Reports the configuration of the library
             --logfile=str          Redirect informational messages to a specific file
             --keymatexport=str     Label used for exporting keying material
@@ -3257,7 +3257,7 @@ to know what happens inside the black bo
 * TLS Hello Extension Handling::
 * Cryptographic Backend::
 * Random Number Generators-internals::
-* FIPS140-2 mode::
+* FIPS140-3 mode::
 
 
 File: gnutls.info,  Node: The TLS Protocol,  Next: TLS Handshake Protocol,  Up: Internal architecture of GnuTLS
@@ -3785,7 +3785,7 @@ and abstract key types::.
 kernel implementation of ‘/dev/crypto’.
 
 
-File: gnutls.info,  Node: Random Number Generators-internals,  Next: FIPS140-2 mode,  Prev: Cryptographic Backend,  Up: Internal architecture of GnuTLS
+File: gnutls.info,  Node: Random Number Generators-internals,  Next: FIPS140-3 mode,  Prev: Cryptographic Backend,  Up: Internal architecture of GnuTLS
 
 11.6 Random Number Generators
 =============================
@@ -3795,7 +3795,7 @@ About the generators
 
 GnuTLS provides two random generators.  The default, and the AES-DRBG
 random generator which is only used when the library is compiled with
-support for FIPS140-2 and the system is in FIPS140-2 mode.
+support for FIPS140-3 and the system is in FIPS140-3 mode.
 
 The default generator - inner workings
 --------------------------------------
@@ -4026,7 +4026,7 @@ in *note Figure 11.5: gnutls_fips_mode_t
 Figure 11.5: The ‘gnutls_fips_mode_t’ enumeration.
 
 The intention of this API is to be used by applications which may run in
-FIPS140-2 mode, while they utilize few algorithms not in the allowed
+FIPS140-3 mode, while they utilize few algorithms not in the allowed
 set, e.g., for non-security related purposes.  In these cases
 applications should wrap the non-compliant code within blocks like the
 following.
@@ -4050,10 +4050,10 @@ are macros to simplify the following seq
 
 The reason of the ‘GNUTLS_FIPS140_SET_MODE_THREAD’ flag in the previous
 calls is to localize the change in the mode.  Note also, that such a
-block has no effect when the library is not operating under FIPS140-2
+block has no effect when the library is not operating under FIPS140-3
 mode, and thus it can be considered a no-op.
 
-Applications could also switch FIPS140-2 mode explicitly off, by calling
+Applications could also switch FIPS140-3 mode explicitly off, by calling
      gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
 
 Service indicator
@@ -4535,8 +4535,8 @@ There are certifications from national o
 practices, such as unit testing and reliance on well known crypto
 primitives.
 
-GnuTLS has support for the FIPS 140-2 certification under Red Hat
-Enterprise Linux.  See *note FIPS140-2 mode:: for more information.
+GnuTLS has support for the FIPS 140-3 certification under Red Hat
+Enterprise Linux.  See *note FIPS140-3 mode:: for more information.
 
 
 File: gnutls.info,  Node: Error codes,  Next: Supported ciphersuites,  Prev: Support,  Up: Top
@@ -9007,7 +9007,7 @@ gnutls_fips140_set_mode
 
  -- Function: void gnutls_fips140_set_mode (gnutls_fips_mode_t MODE,
           unsigned FLAGS)
-     MODE: the FIPS140-2 mode to switch to
+     MODE: the FIPS140-3 mode to switch to
 
      FLAGS: should be zero or ‘GNUTLS_FIPS140_SET_MODE_THREAD’
 
Index: gnutls-3.8.7/doc/invoke-gnutls-cli.texi
===================================================================
--- gnutls-3.8.7.orig/doc/invoke-gnutls-cli.texi
+++ gnutls-3.8.7/doc/invoke-gnutls-cli.texi
@@ -102,7 +102,7 @@ None:
        --inline-commands-prefix=str Change the default delimiter for inline commands
        --provider=file        Specify the PKCS #11 provider library
 				- file must pre-exist
-       --fips140-mode         Reports the status of the FIPS140-2 mode in gnutls library
+       --fips140-mode         Reports the status of the FIPS140-3 mode in gnutls library
        --list-config          Reports the configuration of the library
        --logfile=str          Redirect informational messages to a specific file
        --keymatexport=str     Label used for exporting keying material
Index: gnutls-3.8.7/doc/manpages/gnutls-cli.1
===================================================================
--- gnutls-3.8.7.orig/doc/manpages/gnutls-cli.1
+++ gnutls-3.8.7/doc/manpages/gnutls-cli.1
@@ -398,7 +398,7 @@ Specify the PKCS #11 provider library.
 This will override the default options in /etc/gnutls/pkcs11.conf
 .TP
 .NOP \f\*[B-Font]\-\-fips140\-mode\f[]
-Reports the status of the FIPS140-2 mode in gnutls library.
+Reports the status of the FIPS140-3 mode in gnutls library.
 .sp
 .TP
 .NOP \f\*[B-Font]\-\-list\-config\f[]
Index: gnutls-3.8.7/doc/reference/html/gnutls-gnutls.html
===================================================================
--- gnutls-3.8.7.orig/doc/reference/html/gnutls-gnutls.html
+++ gnutls-3.8.7/doc/reference/html/gnutls-gnutls.html
@@ -20870,12 +20870,12 @@ gnutls_fips140_set_mode (<em class="para
 (globally), and should be called prior to creating any threads. Its
 behavior with no flags after threads are created is undefined.</p>
 <p>When the flag <a class="link" href="gnutls-gnutls.html#GNUTLS-FIPS140-SET-MODE-THREAD:CAPS" title="GNUTLS_FIPS140_SET_MODE_THREAD"><code class="literal">GNUTLS_FIPS140_SET_MODE_THREAD</code></a> is specified
-then this call will change the FIPS140-2 mode for this particular
+then this call will change the FIPS140-3 mode for this particular
 thread and not for the whole process. That way an application
 can utilize this function to set and reset mode for specific
 operations.</p>
 <p>This function never fails but will be a no-op if used when
-the library is not in FIPS140-2 mode. When asked to switch to unknown
+the library is not in FIPS140-3 mode. When asked to switch to unknown
 values for <em class="parameter"><code>mode</code></em>
  or to <a class="link" href="gnutls-gnutls.html#GNUTLS-FIPS140-SELFTESTS:CAPS"><code class="literal">GNUTLS_FIPS140_SELFTESTS</code></a> mode, the library
 switches to <a class="link" href="gnutls-gnutls.html#GNUTLS-FIPS140-STRICT:CAPS"><code class="literal">GNUTLS_FIPS140_STRICT</code></a> mode.</p>
@@ -20890,7 +20890,7 @@ switches to <a class="link" href="gnutls
 <tbody>
 <tr>
 <td class="parameter_name"><p>mode</p></td>
-<td class="parameter_description"><p>the FIPS140-2 mode to switch to</p></td>
+<td class="parameter_description"><p>the FIPS140-3 mode to switch to</p></td>
 <td class="parameter_annotations"> </td>
 </tr>
 <tr>
@@ -25950,7 +25950,7 @@ encryption</p>
 <hr>
 <div class="refsect2">
 <a name="gnutls-fips-mode-t"></a><h3>enum gnutls_fips_mode_t</h3>
-<p>Enumeration of different operational modes under FIPS140-2.</p>
+<p>Enumeration of different operational modes under FIPS140-3.</p>
 <div class="refsect3">
 <a name="gnutls-fips-mode-t.members"></a><h4>Members</h4>
 <div class="informaltable"><table class="informaltable" width="100%" border="0">
@@ -25963,7 +25963,7 @@ encryption</p>
 <tr>
 <td class="enum_member_name"><p><a name="GNUTLS-FIPS140-DISABLED:CAPS"></a>GNUTLS_FIPS140_DISABLED</p></td>
 <td class="enum_member_description">
-<p>The FIPS140-2 mode is disabled.</p>
+<p>The FIPS140-3 mode is disabled.</p>
 </td>
 <td class="enum_member_annotations"> </td>
 </tr>
@@ -25986,8 +25986,8 @@ operation failure via error code.</p>
 <tr>
 <td class="enum_member_name"><p><a name="GNUTLS-FIPS140-LAX:CAPS"></a>GNUTLS_FIPS140_LAX</p></td>
 <td class="enum_member_description">
-<p>The library still uses the FIPS140-2 relevant algorithms but all
-forbidden by FIPS140-2 operations are allowed; this is useful when the
+<p>The library still uses the FIPS140-3 relevant algorithms but all
+forbidden by FIPS140-3 operations are allowed; this is useful when the
 application is aware of the followed security policy, and needs
 to utilize disallowed operations for other reasons (e.g., compatibility).</p>
 </td>
@@ -27627,4 +27627,4 @@ This is used by <a class="link" href="gn
 <div class="footer">
 <hr>Generated by GTK-Doc V1.34.0</div>
 </body>
-</html>
\ No newline at end of file
+</html>
Index: gnutls-3.8.7/lib/fips.c
===================================================================
--- gnutls-3.8.7.orig/lib/fips.c
+++ gnutls-3.8.7/lib/fips.c
@@ -121,7 +121,7 @@ unsigned _gnutls_fips_mode_enabled(void)
 	}
 
 	if (f1p != 0) {
-		_gnutls_debug_log("FIPS140-2 mode enabled\n");
+		_gnutls_debug_log("FIPS140-3 mode enabled\n");
 		ret = GNUTLS_FIPS140_STRICT;
 		goto exit;
 	}
@@ -130,7 +130,7 @@ unsigned _gnutls_fips_mode_enabled(void)
 	if (f2p != 0) {
 		/* a funny state where self tests are performed
 		 * and ignored */
-		_gnutls_debug_log("FIPS140-2 ZOMBIE mode enabled\n");
+		_gnutls_debug_log("FIPS140-3 ZOMBIE mode enabled\n");
 		ret = GNUTLS_FIPS140_SELFTESTS;
 		goto exit;
 	}
@@ -724,7 +724,7 @@ unsigned gnutls_fips140_mode_enabled(voi
 
 /**
  * gnutls_fips140_set_mode:
- * @mode: the FIPS140-2 mode to switch to
+ * @mode: the FIPS140-3 mode to switch to
  * @flags: should be zero or %GNUTLS_FIPS140_SET_MODE_THREAD
  *
  * That function is not thread-safe when changing the mode with no flags
@@ -732,13 +732,13 @@ unsigned gnutls_fips140_mode_enabled(voi
  * behavior with no flags after threads are created is undefined.
  *
  * When the flag %GNUTLS_FIPS140_SET_MODE_THREAD is specified
- * then this call will change the FIPS140-2 mode for this particular
+ * then this call will change the FIPS140-3 mode for this particular
  * thread and not for the whole process. That way an application
  * can utilize this function to set and reset mode for specific
  * operations.
  *
  * This function never fails but will be a no-op if used when
- * the library is not in FIPS140-2 mode. When asked to switch to unknown
+ * the library is not in FIPS140-3 mode. When asked to switch to unknown
  * values for @mode or to %GNUTLS_FIPS140_SELFTESTS mode, the library
  * switches to %GNUTLS_FIPS140_STRICT mode.
  *
@@ -750,10 +750,10 @@ void gnutls_fips140_set_mode(gnutls_fips
 	gnutls_fips_mode_t prev = _gnutls_fips_mode_enabled();
 	if (prev == GNUTLS_FIPS140_DISABLED ||
 	    prev == GNUTLS_FIPS140_SELFTESTS) {
-		/* we need to run self-tests first to be in FIPS140-2 mode */
+		/* we need to run self-tests first to be in FIPS140-3 mode */
 		_gnutls_audit_log(
 			NULL,
-			"The library should be initialized in FIPS140-2 mode to do that operation\n");
+			"The library should be initialized in FIPS140-3 mode to do that operation\n");
 		return;
 	}
 
@@ -766,7 +766,7 @@ void gnutls_fips140_set_mode(gnutls_fips
 	case GNUTLS_FIPS140_SELFTESTS:
 		_gnutls_audit_log(
 			NULL,
-			"Cannot switch library to FIPS140-2 self-tests mode; defaulting to strict\n");
+			"Cannot switch library to FIPS140-3 self-tests mode; defaulting to strict\n");
 		mode = GNUTLS_FIPS140_STRICT;
 		break;
 	default:
@@ -942,7 +942,7 @@ void _gnutls_switch_fips_state(gnutls_fi
 	}
 
 	if (!_tfips_context) {
-		_gnutls_debug_log("FIPS140-2 context is not set\n");
+		_gnutls_debug_log("FIPS140-3 context is not set\n");
 		return;
 	}
 
@@ -956,7 +956,7 @@ void _gnutls_switch_fips_state(gnutls_fi
 		if (mode != GNUTLS_FIPS140_LAX) {
 			_gnutls_audit_log(
 				NULL,
-				"FIPS140-2 operation mode switched from initial to %s\n",
+				"FIPS140-3 operation mode switched from initial to %s\n",
 				operation_state_to_string(state));
 		}
 		_tfips_context->state = state;
@@ -967,7 +967,7 @@ void _gnutls_switch_fips_state(gnutls_fi
 			if (mode != GNUTLS_FIPS140_LAX) {
 				_gnutls_audit_log(
 					NULL,
-					"FIPS140-2 operation mode switched from approved to %s\n",
+					"FIPS140-3 operation mode switched from approved to %s\n",
 					operation_state_to_string(state));
 			}
 			_tfips_context->state = state;
@@ -979,7 +979,7 @@ void _gnutls_switch_fips_state(gnutls_fi
 		if (mode != GNUTLS_FIPS140_LAX) {
 			_gnutls_audit_log(
 				NULL,
-				"FIPS140-2 operation mode cannot be switched from %s to %s\n",
+				"FIPS140-3 operation mode cannot be switched from %s to %s\n",
 				operation_state_to_string(
 					_tfips_context->state),
 				operation_state_to_string(state));
@@ -1041,7 +1041,7 @@ int gnutls_fips140_run_self_tests(void)
 	    ret < 0) {
 		_gnutls_switch_lib_state(LIB_STATE_ERROR);
 		_gnutls_audit_log(NULL,
-				  "FIPS140-2 self testing part 2 failed\n");
+				  "FIPS140-3 self testing part 2 failed\n");
 	} else {
 		/* Restore the previous library state */
 		_gnutls_switch_lib_state(prev_lib_state);
@@ -1053,7 +1053,7 @@ int gnutls_fips140_run_self_tests(void)
 		if (gnutls_fips140_pop_context() < 0) {
 			_gnutls_switch_lib_state(LIB_STATE_ERROR);
 			_gnutls_audit_log(
-				NULL, "FIPS140-2 context restoration failed\n");
+				NULL, "FIPS140-3 context restoration failed\n");
 		}
 		gnutls_fips140_context_deinit(fips_context);
 	}
Index: gnutls-3.8.7/lib/fips.h
===================================================================
--- gnutls-3.8.7.orig/lib/fips.h
+++ gnutls-3.8.7/lib/fips.h
@@ -163,7 +163,7 @@ is_cipher_algo_allowed_in_fips(gnutls_ci
 }
 
 #ifdef ENABLE_FIPS140
-/* This will test the condition when in FIPS140-2 mode
+/* This will test the condition when in FIPS140-3 mode
  * and return an error if necessary or ignore */
 #define FIPS_RULE(condition, ret_error, ...)                                            \
 	{                                                                               \
@@ -173,10 +173,10 @@ is_cipher_algo_allowed_in_fips(gnutls_ci
 				if (_mode == GNUTLS_FIPS140_LOG) {                      \
 					_gnutls_audit_log(                              \
 						NULL,                                   \
-						"fips140-2: allowing " __VA_ARGS__);    \
+						"fips140-3: allowing " __VA_ARGS__);    \
 				} else if (_mode != GNUTLS_FIPS140_LAX) {               \
 					_gnutls_debug_log(                              \
-						"fips140-2: disallowing " __VA_ARGS__); \
+						"fips140-3: disallowing " __VA_ARGS__); \
 					return ret_error;                               \
 				}                                                       \
 			}                                                               \
@@ -191,7 +191,7 @@ inline static bool is_mac_algo_allowed(g
 		switch (mode) {
 		case GNUTLS_FIPS140_LOG:
 			_gnutls_audit_log(NULL,
-					  "fips140-2: allowing access to %s\n",
+					  "fips140-3: allowing access to %s\n",
 					  gnutls_mac_get_name(algo));
 			FALLTHROUGH;
 		case GNUTLS_FIPS140_DISABLED:
@@ -213,7 +213,7 @@ inline static bool is_cipher_algo_allowe
 		switch (mode) {
 		case GNUTLS_FIPS140_LOG:
 			_gnutls_audit_log(NULL,
-					  "fips140-2: allowing access to %s\n",
+					  "fips140-3: allowing access to %s\n",
 					  gnutls_cipher_get_name(algo));
 			FALLTHROUGH;
 		case GNUTLS_FIPS140_DISABLED:
Index: gnutls-3.8.7/lib/global.c
===================================================================
--- gnutls-3.8.7.orig/lib/global.c
+++ gnutls-3.8.7/lib/global.c
@@ -339,12 +339,12 @@ static int _gnutls_global_init(unsigned
 
 #ifdef ENABLE_FIPS140
 	res = _gnutls_fips_mode_enabled();
-	/* res == 1 -> fips140-2 mode enabled
+	/* res == 1 -> fips140-3 mode enabled
 	 * res == 2 -> only self checks performed - but no failure
 	 * res == not in fips140 mode
 	 */
 	if (res != 0) {
-		_gnutls_debug_log("FIPS140-2 mode: %d\n", res);
+		_gnutls_debug_log("FIPS140-3 mode: %d\n", res);
 		_gnutls_priority_update_fips();
 
 		/* first round of self checks, these are done on the
@@ -354,7 +354,7 @@ static int _gnutls_global_init(unsigned
 		if (ret < 0) {
 			_gnutls_switch_lib_state(LIB_STATE_ERROR);
 			_gnutls_audit_log(
-				NULL, "FIPS140-2 self testing part1 failed\n");
+				NULL, "FIPS140-3 self testing part1 failed\n");
 			if (res != 2) {
 				gnutls_assert();
 				goto out;
@@ -377,7 +377,7 @@ static int _gnutls_global_init(unsigned
 		if (ret < 0) {
 			_gnutls_switch_lib_state(LIB_STATE_ERROR);
 			_gnutls_audit_log(
-				NULL, "FIPS140-2 self testing part 2 failed\n");
+				NULL, "FIPS140-3 self testing part 2 failed\n");
 			if (res != 2) {
 				gnutls_assert();
 				goto out;
Index: gnutls-3.8.7/lib/includes/gnutls/gnutls.h.in
===================================================================
--- gnutls-3.8.7.orig/lib/includes/gnutls/gnutls.h.in
+++ gnutls-3.8.7/lib/includes/gnutls/gnutls.h.in
@@ -3213,16 +3213,16 @@ typedef int (*gnutls_alert_read_func)(gn
 void gnutls_alert_set_read_function(gnutls_session_t session,
 				    gnutls_alert_read_func func);
 
-/* FIPS140-2 related functions */
+/* FIPS140-3 related functions */
 unsigned gnutls_fips140_mode_enabled(void);
 
 /**
  * gnutls_fips_mode_t:
- * @GNUTLS_FIPS140_DISABLED: The FIPS140-2 mode is disabled.
+ * @GNUTLS_FIPS140_DISABLED: The FIPS140-3 mode is disabled.
  * @GNUTLS_FIPS140_STRICT: The default mode; all forbidden operations will cause an
  *                         operation failure via error code.
- * @GNUTLS_FIPS140_LAX: The library still uses the FIPS140-2 relevant algorithms but all
- *                      forbidden by FIPS140-2 operations are allowed; this is useful when the
+ * @GNUTLS_FIPS140_LAX: The library still uses the FIPS140-3 relevant algorithms but all
+ *                      forbidden by FIPS140-3 operations are allowed; this is useful when the
  *                      application is aware of the followed security policy, and needs
  *                      to utilize disallowed operations for other reasons (e.g., compatibility).
  * @GNUTLS_FIPS140_LOG: Similarly to %GNUTLS_FIPS140_LAX, it allows forbidden operations; any use of them results
@@ -3230,7 +3230,7 @@ unsigned gnutls_fips140_mode_enabled(voi
  * @GNUTLS_FIPS140_SELFTESTS: A transient state during library initialization. That state
  *			cannot be set or seen by applications.
  *
- * Enumeration of different operational modes under FIPS140-2.
+ * Enumeration of different operational modes under FIPS140-3.
  */
 typedef enum gnutls_fips_mode_t {
 	GNUTLS_FIPS140_DISABLED = 0,
Index: gnutls-3.8.7/src/cli.c
===================================================================
--- gnutls-3.8.7.orig/src/cli.c
+++ gnutls-3.8.7/src/cli.c
@@ -1635,10 +1635,10 @@ static void cmd_parser(int argc, char **
 
 	if (HAVE_OPT(FIPS140_MODE)) {
 		if (gnutls_fips140_mode_enabled() != 0) {
-			fprintf(stderr, "library is in FIPS140-2 mode\n");
+			fprintf(stderr, "library is in FIPS140-3 mode\n");
 			exit(0);
 		}
-		fprintf(stderr, "library is NOT in FIPS140-2 mode\n");
+		fprintf(stderr, "library is NOT in FIPS140-3 mode\n");
 		exit(1);
 	}
 
Index: gnutls-3.8.7/src/gnutls-cli-options.c
===================================================================
--- gnutls-3.8.7.orig/src/gnutls-cli-options.c
+++ gnutls-3.8.7/src/gnutls-cli-options.c
@@ -843,7 +843,7 @@ usage (FILE *out, int status)
     "       --inline-commands-prefix=str Change the default delimiter for inline commands\n"
     "       --provider=file        Specify the PKCS #11 provider library\n"
     "				- file must pre-exist\n"
-    "       --fips140-mode         Reports the status of the FIPS140-2 mode in gnutls library\n"
+    "       --fips140-mode         Reports the status of the FIPS140-3 mode in gnutls library\n"
     "       --list-config          Reports the configuration of the library\n"
     "       --logfile=str          Redirect informational messages to a specific file\n"
     "       --keymatexport=str     Label used for exporting keying material\n"
Index: gnutls-3.8.7/tests/cert-tests/gost.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/gost.sh
+++ gnutls-3.8.7/tests/cert-tests/gost.sh
@@ -38,7 +38,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs12-corner-cases.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs12-corner-cases.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs12-corner-cases.sh
@@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs12-encode.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs12-encode.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs12-encode.sh
@@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs12-gost.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs12-gost.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs12-gost.sh
@@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs12.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs12.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs12.sh
@@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs8-decode.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs8-decode.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs8-decode.sh
@@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs8-eddsa.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs8-eddsa.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs8-eddsa.sh
@@ -29,7 +29,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs8-gost.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs8-gost.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs8-gost.sh
@@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cert-tests/pkcs8.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cert-tests/pkcs8.sh
+++ gnutls-3.8.7/tests/cert-tests/pkcs8.sh
@@ -28,7 +28,7 @@ if ! test -x "${CERTTOOL}"; then
 fi
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/cipher-listings.sh
===================================================================
--- gnutls-3.8.7.orig/tests/cipher-listings.sh
+++ gnutls-3.8.7/tests/cipher-listings.sh
@@ -63,7 +63,7 @@ check()
 
 ${CLI} --fips140-mode
 if test $? = 0;then
-	echo "Cannot run this test in FIPS140-2 mode"
+	echo "Cannot run this test in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/tests/testpkcs11.sh
===================================================================
--- gnutls-3.8.7.orig/tests/testpkcs11.sh
+++ gnutls-3.8.7/tests/testpkcs11.sh
@@ -26,7 +26,7 @@
 RETCODE=0
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/doc/enums/gnutls_fips_mode_t
===================================================================
--- gnutls-3.8.7.orig/doc/enums/gnutls_fips_mode_t
+++ gnutls-3.8.7/doc/enums/gnutls_fips_mode_t
@@ -3,7 +3,7 @@
 @c gnutls_fips_mode_t
 @table @code
 @item GNUTLS_@-FIPS140_@-DISABLED
-The FIPS140-2 mode is disabled.
+The FIPS140-3 mode is disabled.
 @item GNUTLS_@-FIPS140_@-STRICT
 The default mode; all forbidden operations will cause an
 operation failure via error code.
@@ -11,8 +11,8 @@ operation failure via error code.
 A transient state during library initialization. That state
 cannot be set or seen by applications.
 @item GNUTLS_@-FIPS140_@-LAX
-The library still uses the FIPS140-2 relevant algorithms but all
-forbidden by FIPS140-2 operations are allowed; this is useful when the
+The library still uses the FIPS140-3 relevant algorithms but all
+forbidden by FIPS140-3 operations are allowed; this is useful when the
 application is aware of the followed security policy, and needs
 to utilize disallowed operations for other reasons (e.g., compatibility).
 @item GNUTLS_@-FIPS140_@-LOG
Index: gnutls-3.8.7/doc/gnutls-api.texi
===================================================================
--- gnutls-3.8.7.orig/doc/gnutls-api.texi
+++ gnutls-3.8.7/doc/gnutls-api.texi
@@ -3275,7 +3275,7 @@ unusable.  This function is not thread-s
 @subheading gnutls_fips140_set_mode
 @anchor{gnutls_fips140_set_mode}
 @deftypefun {void} {gnutls_fips140_set_mode} (gnutls_fips_mode_t @var{mode}, unsigned @var{flags})
-@var{mode}: the FIPS140-2 mode to switch to
+@var{mode}: the FIPS140-3 mode to switch to
 
 @var{flags}: should be zero or @code{GNUTLS_FIPS140_SET_MODE_THREAD} 
 
@@ -3284,13 +3284,13 @@ That function is not thread-safe when ch
 behavior with no flags after threads are created is undefined.
 
 When the flag @code{GNUTLS_FIPS140_SET_MODE_THREAD}  is specified
-then this call will change the FIPS140-2 mode for this particular
+then this call will change the FIPS140-3 mode for this particular
 thread and not for the whole process. That way an application
 can utilize this function to set and reset mode for specific
 operations.
 
 This function never fails but will be a no-op if used when
-the library is not in FIPS140-2 mode. When asked to switch to unknown
+the library is not in FIPS140-3 mode. When asked to switch to unknown
 values for  @code{mode} or to @code{GNUTLS_FIPS140_SELFTESTS}  mode, the library
 switches to @code{GNUTLS_FIPS140_STRICT}  mode.
 
Index: gnutls-3.8.7/lib/ext/session_ticket.c
===================================================================
--- gnutls-3.8.7.orig/lib/ext/session_ticket.c
+++ gnutls-3.8.7/lib/ext/session_ticket.c
@@ -517,7 +517,7 @@ int gnutls_session_ticket_key_generate(g
 {
 	if (_gnutls_fips_mode_enabled()) {
 		int ret;
-		/* in FIPS140-2 mode gnutls_key_generate imposes
+		/* in FIPS140-3 mode gnutls_key_generate imposes
 		 * some limits on allowed key size, thus it is not
 		 * used. These limits do not affect this function as
 		 * it does not generate a "key" but rather key material
Index: gnutls-3.8.7/lib/libgnutls.map
===================================================================
--- gnutls-3.8.7.orig/lib/libgnutls.map
+++ gnutls-3.8.7/lib/libgnutls.map
@@ -1459,7 +1459,7 @@ GNUTLS_FIPS140_3_4 {
 	gnutls_hkdf_self_test;
 	gnutls_pbkdf2_self_test;
 	gnutls_tlsprf_self_test;
-	#for FIPS140-2 validation
+	#for FIPS140-3 validation
 	drbg_aes_reseed;
 	drbg_aes_init;
 	drbg_aes_generate;
Index: gnutls-3.8.7/lib/nettle/mac.c
===================================================================
--- gnutls-3.8.7.orig/lib/nettle/mac.c
+++ gnutls-3.8.7/lib/nettle/mac.c
@@ -270,7 +270,7 @@ static void _wrap_gmac_digest(void *_ctx
 static int _mac_ctx_init(gnutls_mac_algorithm_t algo,
 			 struct nettle_mac_ctx *ctx)
 {
-	/* Any FIPS140-2 related enforcement is performed on
+	/* Any FIPS140-3 related enforcement is performed on
 	 * gnutls_hash_init() and gnutls_hmac_init() */
 
 	ctx->set_nonce = NULL;
@@ -663,7 +663,7 @@ static void _md5_sha1_init(void *_ctx)
 static int _ctx_init(gnutls_digest_algorithm_t algo,
 		     struct nettle_hash_ctx *ctx)
 {
-	/* Any FIPS140-2 related enforcement is performed on
+	/* Any FIPS140-3 related enforcement is performed on
 	 * gnutls_hash_init() and gnutls_hmac_init() */
 	switch (algo) {
 	case GNUTLS_DIG_MD5:
Index: gnutls-3.8.7/config.h.in
===================================================================
--- gnutls-3.8.7.orig/config.h.in
+++ gnutls-3.8.7/config.h.in
@@ -104,7 +104,7 @@
 /* enable DHE */
 #undef ENABLE_ECDHE
 
-/* Enable FIPS140-2 mode */
+/* Enable FIPS140-3 mode */
 #undef ENABLE_FIPS140
 
 /* enable GOST */
@@ -147,7 +147,7 @@
 /* Define this to 1 if F_DUPFD behavior does not match POSIX */
 #undef FCNTL_DUPFD_BUGGY
 
-/* The FIPS140-2 integrity key */
+/* The FIPS140-3 integrity key */
 #undef FIPS_KEY
 
 /* The FIPS140 module name */
Index: gnutls-3.8.7/configure
===================================================================
--- gnutls-3.8.7.orig/configure
+++ gnutls-3.8.7/configure
@@ -4453,7 +4453,7 @@ Optional Features:
   --enable-fast-install[=PKGS]
                           optimize for fast installation [default=yes]
   --disable-libtool-lock  avoid locking (might break parallel builds)
-  --enable-fips140-mode   enable FIPS140-2 mode
+  --enable-fips140-mode   enable FIPS140-3 mode
   --enable-strict-x509    enable stricter sanity checks for x509 certificates
   --disable-non-suiteb-curves
                           disable curves not in SuiteB
Index: gnutls-3.8.7/doc/cha-support.texi
===================================================================
--- gnutls-3.8.7.orig/doc/cha-support.texi
+++ gnutls-3.8.7/doc/cha-support.texi
@@ -134,5 +134,5 @@ There are certifications from national o
 to an auditor that the crypto component follows some best practices, such
 as unit testing and reliance on well known crypto primitives.
 
-GnuTLS has support for the FIPS 140-2 certification under Red Hat Enterprise Linux.
-See @ref{FIPS140-2 mode} for more information.
+GnuTLS has support for the FIPS 140-3 certification under Red Hat Enterprise Linux.
+See @ref{FIPS140-3 mode} for more information.
Index: gnutls-3.8.7/src/gnutls-cli-options.json
===================================================================
--- gnutls-3.8.7.orig/src/gnutls-cli-options.json
+++ gnutls-3.8.7/src/gnutls-cli-options.json
@@ -384,7 +384,7 @@
         },
         {
           "long-option": "fips140-mode",
-          "description": "Reports the status of the FIPS140-2 mode in gnutls library"
+          "description": "Reports the status of the FIPS140-3 mode in gnutls library"
         },
         {
           "long-option": "list-config",
Index: gnutls-3.8.7/tests/pkcs11-tool.sh
===================================================================
--- gnutls-3.8.7.orig/tests/pkcs11-tool.sh
+++ gnutls-3.8.7/tests/pkcs11-tool.sh
@@ -30,7 +30,7 @@ set -x
 : ${DIFF=diff}
 
 if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then
-	echo "Cannot run in FIPS140-2 mode"
+	echo "Cannot run in FIPS140-3 mode"
 	exit 77
 fi
 
Index: gnutls-3.8.7/doc/manpages/gnutls_fips140_set_mode.3
===================================================================
--- gnutls-3.8.7.orig/doc/manpages/gnutls_fips140_set_mode.3
+++ gnutls-3.8.7/doc/manpages/gnutls_fips140_set_mode.3
@@ -8,7 +8,7 @@ gnutls_fips140_set_mode \- API function
 .BI "void gnutls_fips140_set_mode(gnutls_fips_mode_t " mode ", unsigned " flags ");"
 .SH ARGUMENTS
 .IP "gnutls_fips_mode_t mode" 12
-the FIPS140\-2 mode to switch to
+the FIPS140\-3 mode to switch to
 .IP "unsigned flags" 12
 should be zero or \fBGNUTLS_FIPS140_SET_MODE_THREAD\fP
 .SH "DESCRIPTION"
@@ -17,13 +17,13 @@ That function is not thread\-safe when c
 behavior with no flags after threads are created is undefined.
 
 When the flag \fBGNUTLS_FIPS140_SET_MODE_THREAD\fP is specified
-then this call will change the FIPS140\-2 mode for this particular
+then this call will change the FIPS140\-3 mode for this particular
 thread and not for the whole process. That way an application
 can utilize this function to set and reset mode for specific
 operations.
 
 This function never fails but will be a no\-op if used when
-the library is not in FIPS140\-2 mode. When asked to switch to unknown
+the library is not in FIPS140\-3 mode. When asked to switch to unknown
 values for  \fImode\fP or to \fBGNUTLS_FIPS140_SELFTESTS\fP mode, the library
 switches to \fBGNUTLS_FIPS140_STRICT\fP mode.
 .SH "SINCE"
Index: gnutls-3.8.7/doc/gnutls.info
===================================================================
--- gnutls-3.8.7.orig/doc/gnutls.info
+++ gnutls-3.8.7/doc/gnutls.info
@@ -619,7 +619,7 @@ Ref: fig-crypto-layers743524
 Ref: Cryptographic Backend-Footnote-1746831
 Ref: Cryptographic Backend-Footnote-2746916
 Node: Random Number Generators-internals747028
-Node: FIPS140-2 mode754484
+Node: FIPS140-3 mode754484
 Ref: gnutls_fips_mode_t757148
 Node: Upgrading from previous versions760816
 Node: Support775054

Places

File gnutls-FIPS-140-3-references.patch of Package gnutls (Revision cc587cbaedfb3197f0a1fb4993115381)

Places