Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fips-140]

FIPS 140-2 is a U.S. government computer security standard used to accredit cryptographic modules.

0
votes
1answer
45 views

Any side effects of switching from Rijndael to AES in a .net application?

Our company would like to update our .Net apps so that they can run on Windows machines that require FIPS compliance. Currently we are using the System.Security.Cryptography.Rijndael class. I changed ...
1
vote
2answers
98 views

FIPS 140-2, Level 1 validation vs. compilation

I'm working on a system that needs to use cryptographic functions that must be FIPS 140-2, Level 1 validated. The challenging part is that some of this system needs to run in the browser. For ...
2
votes
1answer
171 views

How is the DUHK attack specific to the ANSI X9.31 RNG?

Recently, the DUHK attack on bad RNG implementations of hardware devices has been published. The attack is based on a (known or reverse engineerable) hardcoded key, which is used for a ANSI X9.31 ...
1
vote
2answers
280 views

Open-source usb TRNG and US standards - Help choosing [closed]

I came across the ChaosKey and I remember the time I came accros the entrypy key that was always out of stock. I would really want one to play with, I would like the best open source I can get for ...
3
votes
0answers
171 views

Could a C25519/ED25519 cryptographic module be FIPS certified?

NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing ...
0
votes
1answer
156 views

Secret Key Exchange and FIPS or Industry Standard Compliance

I am trying to collect several information regarding Security Industry Standards and the FIPS compliance to meet the security standards for our future development system. In this case, we have two ...
4
votes
2answers
341 views

Converting a C25519 curve into a NIST-supported curve for FIPS crypto

If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and ...
1
vote
0answers
102 views

Where is master password for Firefox stored. Is this password is same as the master password asked for NSS? [closed]

While working on FIPS requirement. I found that there is a master password required for LibNSS to access all primary cryptographic module. Similarly Firefox in FIPS mode also needs a master password ...
1
vote
0answers
754 views

Is ECDH(E) Key Exchange FIPS 140-2 compliant?

We have read dozens of documents now - some that contradict each other - and cannot find a solid source of truth. Does FIPS 140-2 compliance allow for the use of elliptic curve cryptography as a key ...
9
votes
1answer
1k views

“Seed” vs “seed key”

The FIPS 140-2 Derived Test Requirements has a statement: AS07.09: (Levels 1, 2, 3, and 4) The seed and seed key shall not have the same value. What is the difference between a seed and a "seed ...
2
votes
1answer
645 views

What is FIPS 140-2 for?

I've just used the FIPS 140-2 tests as implemented in rngtools, the rngtest. I ran it on a 12.3MB file of pak8 compressed ASCII text. It passed most of the tests, with a 0.2% failure rate. Monobit ...
4
votes
2answers
280 views

HSM RNG - Compliance to FIPS 186-2

If the RNG of a HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2 ?
2
votes
1answer
165 views

Where in FIPS documents stated that SHA-1 is not secure?

SHA-1 is not secured for a very long time, but I still can see it here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf Where in FIPS documents stated that SHA-1 is not secure?
6
votes
1answer
2k views

What is the major difference between FIPS 186-2 and FIPS 186-4?

Can anyone please tell me the major difference between FIPS 186-2 and FIPS 186-4? I know with FIPS 140-2 they want the DSS standard to be FIPS 186-4, but what difference does it make?
4
votes
3answers
527 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
1
vote
2answers
2k views

FIPS 140-2 Compliance Testing

Is there any tool which can be used to test that implementations follow FIPS 140-2 Compliance ?
2
votes
1answer
877 views

OpenSSL ECDH key exchange mechanism

I am using FIPS based OpenSSL module for encryption of sensitive data for my desktop socket server and client applications. I am using ECDH for key agreement.The keys public and private pair is ...
3
votes
1answer
141 views

Could a crypto system that uses non-FIPS crypto but then upgrades complete to FIPS be FIPS certified?

I know most people around here (including myself) are anti-FIPS, but I have a FIPS related question. Could a crypto system that is not FIPS, e.g. one based on primitives like Curve25519, achieve FIPS ...
1
vote
1answer
511 views

Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22?

I need to use NIST SP 800-22 approved software / hardware to generate RSA key pair. Where I can find a list of certified software / hardware RNGs compliant to NIST SP 800-22? And how is the SP 800-...
3
votes
1answer
2k views

RSA key pair generation and FIPS 140-2, 186-4

I need to securely generate RSA key pair and I need to have access to private exponent in order to process it further. What's the difference in FIPS 140-2 and FIPS 186-4 in connection with RSA key ...
1
vote
1answer
907 views

FIPS-Compliant SHA2

I want to use SHA-512 for hashing in a system that must be FIPS-compliant. When I look at the FIPS 140 list of approved providers, I don't see SHA from any provider as being an approved algorithm, I ...
5
votes
2answers
5k views

Randomness test question from FIPS 140-1 and comparison with 140-2

In FIPS 140-1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the ...
1
vote
2answers
6k views

FIPS 140-2 compliant algorithms in Enhanced RSA and AES Cryptographic Provider (Windows XP) [closed]

We have a native C++ application that supports Windows XP SP3. Recently we've decided to change our crypto algorithms to FIPS 140-2 compliant ones. We are planning to use the following algorithms in ...
2
votes
2answers
1k views

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
8
votes
2answers
6k views

Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?

We are in the processing to understand if our software applications is FIPS 140-2 compliant or not. Currently in our application, we are using our own implementation of AES algorithm. AES is a FIPS ...
8
votes
2answers
2k views

Is FIPS 140-2's “Continuous random number generator test” practical?

Section 4.9.2 of FIPS PUB 140-2 specifies, amongst other things, a "Continuous random number generator test." Here are the relavant bits: If each call to a[n] RNG produces blocks of n bits (...
2
votes
2answers
775 views

FIPS 140 compliance for encrypted files

Does FIPS 140-2 require specific key sizes, or does it have specific requirements for the data? In other words, if I encrypt a file, how I can check whether it is FIPS-compliant or not? Does only the ...
13
votes
3answers
57k views

FIPS 140-2 Compliant Algorithms

Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ...
5
votes
2answers
265 views

How long does it take to extract a key from a FIPS-140 Level 2 device?

How long does it take to extract a key from a FIPS-140 Level 2 device? What records are there of successful extraction? How much did the first extraction from a given device cost? How much would a ...