NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing to do the work?
$\begingroup$
$\endgroup$
2
-
7$\begingroup$ I think algorithms certified by FIPS 140-2 need to have either their own FIPS or must be (in) a NIST SP. I don't think Curve25519 / Ed25519 have any such standards from NIST (yet). Rumours suggest this will change. However, you can get your implementation certified for P-256 and make it generic so that you can also run Curve25519 on it. $\endgroup$– SEJPMCommented Aug 21, 2017 at 14:19
-
1$\begingroup$ NIST claimed in late 2017 that the upcoming draft of NIST SP 800-186 would include Curve25519 and Curve448 as approved curves, and the X25519 and X448 DH functions would be considered for the next revision to NIST SP 800-56A: csrc.nist.gov/News/2017/… Unclear whether this will cover the Ed25519 and Ed448 signature schemes; unclear what the status of the alleged NIST SP 800-186 draft; no mention of this in NIST SP 800-56A rev. 3 form April 2018. $\endgroup$– Squeamish OssifrageCommented Feb 28, 2019 at 7:29
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Could a C25519/ED25519 cryptographic module be FIPS certified?
Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy.
On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; the particular curves Curve25519, Curve448, edwards25519, and edwards448; and the EdDSA signature scheme instantiated with them, as defined in RFC 7748 and RFC 8032. Comments are due by 2020-01-20.
(The updates do not cover the X25519/X448 DH functions, but NIST's late 2017 announcement of the upcoming changes also mentioned future updates to NIST SP 800-56A, which covers key agreement.)
answered Nov 2, 2019 at 1:18
$\begingroup$
$\endgroup$
As of February 3, 2023
FIPS 186-5 has been published along with NIST SP 800-186 update that include Curve25519 and Ed25519
One thing that I noticed on the NIST late 2017 transition plan blog for key establishment is this paragraph.
In addition, NIST guidelines on Elliptic Curve Cryptography are also being revised to propose the adoption of new elliptic curves specified in the Internet Engineering Task Force (IETF) RFC 7748. The upcoming draft of SP 800-186, which will specify approved elliptic curves, will include the curves currently specified in FIPS 186-4 and two additional curves: Curve25519 and Curve448. Their associated key agreement schemes, X25519 and X448, will be considered for inclusion in a subsequent revision to SP 800-56A. The CMVP does not intend to enforce compliance with SP 800-56A until these revisions are complete.
Does that mean that there now that SP 800-186 and FIPS 186-5 are published we can still get CMVP certified for x25519 while they wait for the SP 800-56A update?
that's unclear I'll try emailing the blog post address to confirm.
