Earlier quoted context omitted.
Thank you for the primer. Can anybody comment as to why FIPS mode in OpenSSL is considered harmful?
My understanding is the FIPS requires that the SSL library implements a certain suite of protocols (including the Dual EC DRBG discussed in the linked mailing list post) which have known cryptographic weaknesses.
FIPS requires that any 'approved' included crypto algorithm implementations are self-tested, and pass a verification program (just a big bunch of somewhat poorly conceived known answer tests).
It also has a list of 'allowed' algorithms, which don't need to be tested but can be offered by a FIPS crypto module.
The CSPRNG used for key generation must be of an approved construction, but there are a number of choices ranging from stupid shit nobody sane would choose (Dual EC DRBG) to ones which are trivial variations on hashes, HMAC or block ciphers in OFB or CTR mode. Sadly, it says nothing about the quality or construction of actual entropy sources.
Naturally, everything not 'approved' or 'allowed' cannot be offered by a FIPS crypto module.
On the plus side, this means vendors can't offer proprietary stupid-shit like LFSR stream ciphers. Unfortunately, the approved and allowed list rarely keeps up with good quality or fixed crypto (you'll not find any eSTREAM finalists, or EdDSA, or deterministic DSA, or curve25519 ECDH, for example).
Also, the rules are pretty poorly enforced: you'll still find new FIPS certificates issued for boxes which do TLS Source: I used to make FIPS-approved HSMs. AMA? :)