FIPS Source Assessment¶
FIPS source assessment highlights supported FIPS-related issues and missing evidence in the scanned code. It helps prepare a compliance review by explaining the cryptographic use and the source information behind a result. It does not determine whether a deployed application or cryptographic module is FIPS validated.
Current checks¶
PostQ checks the following source uses when it can establish the necessary operation and settings:
| Source use | What the check examines |
|---|---|
| DES encryption, decryption, or key generation | Use of DES for the identified operation. |
| RSA key generation | A resolved key size below 2,048 bits. |
| RSA signature generation | A resolved key size below 2,048 bits. |
| SHA-1 signature generation | Use of SHA-1 to create a digital signature. |
These are specific checks, not a complete test of all FIPS requirements. They do not extend automatically to every use of RSA or SHA-1. If the operation or a required setting is unknown, the result can request more evidence rather than report a potential issue.
Result meanings¶
| Result shown | Report code | Meaning |
|---|---|---|
| Potential FIPS issue | SOURCE_LEVEL_VIOLATION |
A supported source check identified an issue under its applicable conditions. Review the explanation and source evidence. |
| Needs more evidence | SOURCE_EVIDENCE_GAP |
Information required for the source check is missing or unresolved. |
| No source-level violation detected | NO_SOURCE_LEVEL_VIOLATION_DETECTED |
The available checks did not identify a source-level violation. This is not a compliance or validation statement. |
| Not applicable | NOT_APPLICABLE |
FIPS source review does not apply to the assessed operation or context. |
| Not assessed | NOT_ASSESSED |
A FIPS source review was not completed for this item. Read the accompanying reason. |
Why an item may be not assessed¶
| Explanation | Meaning for the reviewer |
|---|---|
| Missing operation | The necessary action, such as encryption or signing, was not established. |
| Language not covered | There is no applicable FIPS source review for the language. |
| Use not covered | The identified use falls outside supported FIPS source review. |
| Check not covered | The algorithm and operation combination has no supported check. |
| Multiple operations | The group contains different operations that cannot be treated as one for this review. |
| Review not completed / Assessment not run | No completed source conclusion is available. |
These explanations describe review limits. They are not additional compliance verdicts.
Evidence your team must provide separately¶
PostQ does not verify a deployed module's certificate, match the operating environment to that certificate, establish approved runtime mode, or check a live validation registry. A provider name in code does not prove which module runs in production or that it is validated.
Use the result's explanation, references, and requested evidence to prepare the review. Confirm module identity, applicable validation, and deployment configuration through your organization's compliance process. For the relationship to other assessments, see Assessment Dimensions.