# Tag Info

13

If you are using an AES library that has not undergone the FIPS validation process, then you are not FIPS compliant (or, at least, your use of AES is not). FIPS compliant means more than "we use algorithms that FIPS likes", it means "having passed the FIPS certification process"; that is how NIST defines it. Sorry, but NIST is quite strict about this; if ...

6

Take a look at FIPS 140-2 Annex A. It lists the following: Symmetric Key AES, Triple-DES, Escrowed Encryption Standard Asymmetric Key DSA, RSA, ECDSA Hash Standards SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 Random number generators See annex c Message authentication CCM, GCM, GMAC, CMAC, HMAC

6

I'm no FIPS expert but I strongly suspect the answer is no. FIPS is incredibly restrictive and laughably behind the times. To evaluate those algorithms that don't appear in FIPS, first make sure their component parts are secure (maybe even built with FIPS algorithms as subroutines). Then, if there are known answer tests anywhere, maybe from the authors of ...

5

The question mentions FIPS 140-2 Level 3 compliant. I answer this as if the question had said the intent is to validate the product as FIPS 140-2 Level 3. This may sound like hairsplitting, but there are many modules claiming to be FIPS 140-2 compliant, which factually could not be validated without large changes to functionality. FIPS 140-2 really intends ...

5

FIPS 140-2 only certifies cryptographic modules, not entire systems. So, to tell if your system is 140-2 compliant, it must be using a 140-2 certified module. NIST publishes a list of all FIPS 140-2 certified cryptographic modules. It is important to remember, though, that 140-2 certification does not certify that the module is used in a secure manner. From ...

4

Q1: Why are these tests stroked out? These tests are stroked out on pages 57-58 of the current FIPS 140-2 because they are no longer part of the current FIPS 140-2 standard, since Change Notice 2 of 2002 December third, where these pages belong. My guess for the rationale of removing these tests is that It was realized that the very principle ...

3

To clarify scope: FIPS 140-2 itself doesn't say anything about DSS, though it has 186-2 as a reference. It was published in 2001, before 186-3 and -4, and has not been superseded. After 140-3 spent 8 years in draft they recently decided to consider using ISO/IEC 19790 instead! 140-2 Annex A (Approved functions) is updated frequently and does now reference ...

3

No, there isn't. There are too many different systems out there to make a generic tool.

3

I can't help you with your Windows question, however I can chime in on FIPS: Is it going to be FIPS 140-2 compliant? It might not be. The problem is the "SHA1 for hashing"; SHA1 is no longer approved as a collision resistant hash function. On the other hand, HMAC-SHA1 is still approved as a Message Authentication Code. That is, if you are using SHA1 ...

3

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.

3

This page gives details of a successful extraction of a 3DES key from an IBM 4758 (FIPS 140-1 Level 4): http://www.cl.cam.ac.uk/~rnc1/descrack/. In summary, it required 20 mins of access to the device, 2 days of (offline) cracking time, and about $1000 in equipment. Not sure if this quite answers the question you were asking in that it relies on ... 3 FIPS 140-2 Security Level 2 does not require any form of security measure to prevent extraction of secrets. It simply requires tamper evidence, that is, it should be possible to notice that such attack took place by looking (for instance) at some seal on the device or at a log file. To answer your question, extracting a secret may therefore take 0 seconds ... 2 The current list of FIPS-approved cryptographical methods is here. For encryption, we're limited to AES, 3DES (known as TDEA in FIPS-speak), and EES (Skipjack). As for signing algorithms, we have RSA, DSA and ECDSA. Note that the list of FIPS-approved algorithms does change at times; not extremely frequently, but more often than they come out with a new ... 2 You cannot tell anything related to FIPS 140 by looking at a key or by looking at a file. FIPS 140 doesn't say anything about the choice of encryption algorithm, other than requiring that all every encryption algorithm must be “approved security function” (as defined in the glossary) and there must be at least 1. FIPS 140 is all about the module, i.e. the ... 2 It is possible to have product based on this algorithm suite, which is FIPS 140-2 compliant. However, there are special considerations for use of SHA-1 and RSA. The algorithm suite is partially considered obsolete and not FIPS 140-2 approved. For information on NIST transition to 112 bit cryptography you can read G.14 at FIPS 140-2 Implementation ... 2 Actually, it's there on the list, just with a different name -- the approved algorithm you want is listed as "SHS" (Secure Hashing Standard). Now, the term "SHS" doesn't distinguish between the various flavors of SHA-2 (and SHA-1, which is still approved for some uses); however if you look at this more detailed list, that gives details on what vendors have ... 2 The rationale for no longer mandating these tests include: These tests are generally not useful against most FIPS 140-2 approved random number generators. These tests can be useful against some kind of entropy sources. These tests give frequent false positives every few thousandth block of truely random stream will fail the test. Some entropy sources are ... 2 Yes, a device that is FIPS certified need not be restricted to using only FIPS-approved algorithms. For example, in your case, FIPS has no problems with you supporting Curve25519, as long as the user can turn it off. That is, the device will need to be able to be set in a mode that it performs only FIPS approved algorithms (and the FIPS approval ... 1 Be very aware that "FIPS 140-2 Compliance" is misleading, and usually irrelevant. To be compliant just means that your software uses a FIPS 140-2 Certified cryptographic module, and getting your software certified costs anywhere from$20-200k and takes 6-18 months. Just because your system passes the self-tests and statistical checks mandated by the standard ...

1

The generated private key is same for both client and server is it true? No, that's not true. The key pairs and thus the private keys will be different. They will only be the same if the random number generator creates 521 identical bits for both the server and the client when the key pairs are generated. Client send its public key first or Server? ...

1

Please refer the document at NIST site pointing to the document (800-22-rev 1a ) updated on April 2010 (http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf). The list of special published (SP) documents are available at (http://csrc.nist.gov/publications/PubsSPs.html) It involves some reading, but should get your answers. Since it ...

1

FIPS 140-2 specifies conditions applicable to the environment of RSA (and other) key generation, and refers to FIPS 186-4 for the generation itself. Several recent Java Card Smart Cards can internally generate RSA-2048 key pairs per FIPS 186-4, with security policy and FIPS 140-2 level 3 certificate to attest that. Here is the one on top of the list at time ...

1

Foreword atsec IT security blog recently commented about FIPS and NIST rules with: "As technology moves on, and the pace of change increases, with no real update to the specification for a decade, FIPS 140-2 is creaking badly. To deal with this, the CMVP must issue Implementation Guidance (I.G.), which is now so complex that it is virtually impossible to ...

1

This requirement is a part of the general "continuous tests", and as such it's primary purpose is to detect "flatline" failures (if you can torture that analogy into making sense). Remember that FIPS-140 was originally written with hardware implementations in mind, so the approaches they take for testing sometimes seem odd for software since hardware ...

Only top voted, non community-wiki answers of a minimum length are eligible