2
$\begingroup$

I remember reading that the RSA algorithm was only permitted for encryption when used to encrypt a symmetric key (essentially leading to hybrid encryption).

However, reading through Annex A: Approved Security Functions for FIPS PUB 140-2 this doesn't seem to be an option.

Did I mis-remember? Are there any approved asymmetric encryption algorithms?

$\endgroup$
4
$\begingroup$

There's a difference between FIPS approved and FIPS allowed algorithms. RSA is an allowed algorithm for doing key wrap and key transport, however it's not FIPS approved for that purpose. It's only approved for digital signatures.

If you're using a FIPS validated module take a look at the security policy for the module you're using and see if RSA is allowed or not for key wrap or key transport. It must be documented there. If it's not then you can't use it (and claim compliance) even if it's available in the module.

And no, there are no approved generic asymmetric encryption algorithms, they're only approved for digital signatures.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.