Endpoint Privilege Management for Unix and Linux FIPS 140-2 Compliance Statement


When you need to protect Sensitive but Unclassified data with cryptography, you want to use a cryptographic module that meets the federal government (US and Canada) security standard FIPS 140-2, so that you can trust that the module is tested and validated by independent authorities. Products validated as conforming to FIPS 140-2 are accepted by the Federal agencies of both countries for the protection of sensitive information (United States) or Protected Information (Canada).


The Federal Information Processing Standard (140-2) or FIPS, specifies the security requirements that will be satisfied by a cryptographic module, providing four increasing, qualitative levels intended to cover a wide range of potential applications and environments. The areas covered, related to the secure design and implementation of a cryptographic module, include specification; ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.

This document details the FIPS 140-2 approved third-party cryptographic modules used in BeyondTrust Endpoint Privilege Management for Unix and Linux.

Cryptographic algorithms are only used if High Security is enforced.

Third-Party Cryptographic Modules

Product Area Encryption Library Manufacturer, Version
All data encryption and network communications






FIPS compliant OpenSSL OpenSSL, 1.0.2a
Binary file checksum and Authentication HASH for REST services MD5 Source built into the product Derived from Open Source code originally written by Colin Plumb 1993