3
$\begingroup$

I know most people around here (including myself) are anti-FIPS, but I have a FIPS related question.

Could a crypto system that is not FIPS, e.g. one based on primitives like Curve25519, achieve FIPS compliance if it is capable of upgrading to FIPS algorithms/implementations in a way that is complete. By complete I mean in the upgraded mode it is using only FIPS compliant crypto and the upgrade occurs in such a way that all the previous security guarantees are re-confirmed using FIPS crypto.

Or would the mere presence of non-FIPS crypto at any stage of the system invalidate it for FIPS certification?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

Yes, a device that is FIPS certified need not be restricted to using only FIPS-approved algorithms. For example, in your case, FIPS has no problems with you supporting Curve25519, as long as the user can turn it off. That is, the device will need to be able to be set in a mode that it performs only FIPS approved algorithms (and the FIPS approval documentation will have to explain precisely how to do that).

You specifically asked about 'crypto system'; if you're asking about a protocol, a protocol is not FIPS approved; FIPS approved devices, not protocols.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ That's close but not exactly my question. What if the protocol uses Curve25519 at first but then upgrades completely and cleanly? $\endgroup$
    – AdamIerymenko
    Commented Jul 6, 2015 at 17:07
  • $\begingroup$ Okay, I think I understand. A FIPS compliant "device" (which as far as I know can include a binary program) must use only FIPS-approved crypto but can speak any protocol as long as it can do so in a FIPS-approved manner. $\endgroup$
    – AdamIerymenko
    Commented Jul 6, 2015 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.