Skip to main content
Cryptography

Return to Question

Notice removed Authoritative reference needed by Adam Ierymenko
Bounty Ended with Swashbuckler's answer chosen by Adam Ierymenko
added 162 characters in body
Source Link
Adam Ierymenko
Adam Ierymenko
  • 906
  • 6
  • 20

If a piece of software is running in FIPS mode and using FIPS-certified cryptographic modules, is it permitted to execute any non-FIPS algorithms even if the security of the system is not uniquely dependent on them?

Example: lets say you have a system that exchanges two ECDH key pairs: one curve25519 key pair and one NIST P-384 key pair. Key agreement is performed using both key pairs and then the resulting secrets are concatenated and hashed with SHA-384.

Cryptographically I don't see a problem since the result of SHA-384(K0 | K1) is as strong as the strongest curve. This is because SHA-384(a secret | a known value) is a secret, meaning that if an attacker cracked say curve25519 they would still not know the result of that secret hashed with another secret they don't know.

My question is whether FIPS allows this, or whether it must execute only FIPS-certified code and algorithms. Could you consider the curve25519 computed shared secret a "salt" or something?

Edit: consider that the result of the non-FIPS agreement with e.g. Curve25519 could be mixed with the "official" secret as a salt e.g. HMAC-SHA384(salt, key).

If a piece of software is running in FIPS mode and using FIPS-certified cryptographic modules, is it permitted to execute any non-FIPS algorithms even if the security of the system is not uniquely dependent on them?

Example: lets say you have a system that exchanges two ECDH key pairs: one curve25519 key pair and one NIST P-384 key pair. Key agreement is performed using both key pairs and then the resulting secrets are concatenated and hashed with SHA-384.

Cryptographically I don't see a problem since the result of SHA-384(K0 | K1) is as strong as the strongest curve. This is because SHA-384(a secret | a known value) is a secret, meaning that if an attacker cracked say curve25519 they would still not know the result of that secret hashed with another secret they don't know.

My question is whether FIPS allows this, or whether it must execute only FIPS-certified code and algorithms. Could you consider the curve25519 computed shared secret a "salt" or something?

If a piece of software is running in FIPS mode and using FIPS-certified cryptographic modules, is it permitted to execute any non-FIPS algorithms even if the security of the system is not uniquely dependent on them?

Example: lets say you have a system that exchanges two ECDH key pairs: one curve25519 key pair and one NIST P-384 key pair. Key agreement is performed using both key pairs and then the resulting secrets are concatenated and hashed with SHA-384.

Cryptographically I don't see a problem since the result of SHA-384(K0 | K1) is as strong as the strongest curve. This is because SHA-384(a secret | a known value) is a secret, meaning that if an attacker cracked say curve25519 they would still not know the result of that secret hashed with another secret they don't know.

My question is whether FIPS allows this, or whether it must execute only FIPS-certified code and algorithms. Could you consider the curve25519 computed shared secret a "salt" or something?

Edit: consider that the result of the non-FIPS agreement with e.g. Curve25519 could be mixed with the "official" secret as a salt e.g. HMAC-SHA384(salt, key).

Notice added Authoritative reference needed by Adam Ierymenko
Bounty Started worth 100 reputation by Adam Ierymenko
Tweeted twitter.com/StackCrypto/status/1415234635982938113
Became Hot Network Question
Source Link
Adam Ierymenko
Adam Ierymenko
  • 906
  • 6
  • 20

Are non-FIPS algorithms allowed to execute at all in a FIPS-compliant system?

If a piece of software is running in FIPS mode and using FIPS-certified cryptographic modules, is it permitted to execute any non-FIPS algorithms even if the security of the system is not uniquely dependent on them?

Example: lets say you have a system that exchanges two ECDH key pairs: one curve25519 key pair and one NIST P-384 key pair. Key agreement is performed using both key pairs and then the resulting secrets are concatenated and hashed with SHA-384.

Cryptographically I don't see a problem since the result of SHA-384(K0 | K1) is as strong as the strongest curve. This is because SHA-384(a secret | a known value) is a secret, meaning that if an attacker cracked say curve25519 they would still not know the result of that secret hashed with another secret they don't know.

My question is whether FIPS allows this, or whether it must execute only FIPS-certified code and algorithms. Could you consider the curve25519 computed shared secret a "salt" or something?