1
$\begingroup$

We have a native C++ application that supports Windows XP SP3.

Recently we've decided to change our crypto algorithms to FIPS 140-2 compliant ones. We are planning to use the following algorithms in Enhanced RSA and AES Cryptographic Provider:

  1. AES256 for encryption
  2. SHA1 for hashing
  3. RSA for key exchange with max key size

Is this setup going to work on WinXP SP3? Is it going to be FIPS 140-2 compliant? In my understanding, the answer to both questions in 'yes', but I want to be sure.

$\endgroup$

closed as off-topic by user6961, B-Con, figlesquidge, rath, AFS Jan 16 '14 at 22:00

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

3
$\begingroup$

I can't help you with your Windows question, however I can chime in on FIPS:

Is it going to be FIPS 140-2 compliant?

It might not be. The problem is the "SHA1 for hashing"; SHA1 is no longer approved as a collision resistant hash function. On the other hand, HMAC-SHA1 is still approved as a Message Authentication Code.

That is, if you are using SHA1 (within HMAC) to perform integrity checking, this is not an issue. However, if you are using straight SHA1 as a part of (say) RSA signatures, this won't work; you'll need to switch to one of the SHA-2 algorithms (or SHA-3 when that is finalized).

$\endgroup$
2
$\begingroup$

It is possible to have product based on this algorithm suite, which is FIPS 140-2 compliant. However, there are special considerations for use of SHA-1 and RSA.


The algorithm suite is partially considered obsolete and not FIPS 140-2 approved. For information on NIST transition to 112 bit cryptography you can read G.14 at FIPS 140-2 Implementation Guidance.

The algorithm suite is:

  1. AES256 for encryption
  2. SHA1 for hashing
  3. RSA for key exchange with max key size

Restrictions (as per FIPS 140-2 and NIST SP 800-131A)

  1. AES256 is fine, if it is used on ECB, CBC, CFB, OFB, CTR, CCM, GCM, XTS, or KW (as long as appropriate guidance from NIST SP 800-38A/B/C/D/E/F documents is also followed).
  2. SHA-1 usage that is clearly disallowed in FIPS 140-2 is signing digital signatures using SHA1. Signatures signed previously (in 2013 or earlier) are allowed to be verified. Schneier considered SHA-1 broken almost 9 years ago, so does many other experts.
  3. RSA key exchange needs to meet certain requirements in Implementation Guidance (See above) D.8 or D.9. The most important restriction is that the modulus length must be at least 2048 bits.

There are existing FIPS 140-2 validated modules, supporting Windows XP, which you can use to add algorithms, like SHA-256 in case you need to substitute SHA-1.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.