14

If you are using an AES library that has not undergone the FIPS validation process, then you are not FIPS compliant (or, at least, your use of AES is not). FIPS compliant means more than "we use algorithms that FIPS likes", it means "having passed the FIPS certification process"; that is how NIST defines it. Sorry, but NIST is quite strict about this; if ...


13

"seed" and "seed key" are NIST terminology talking about the X9.31 PRNG. In particular, it has a state that consists of: A 3DES or AES key (the "seed key") A 64 or 128 bit current state (the "seed") The requirement is to check to make sure that two don't happen to be the same (and give an error indication if they are). If you're wondering "except for the ...


9

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then certify their new P256 public key using their C25519 private key, check the other party's certificate using the other party's trusted C25519 public key, and now ...


8

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. Pages 14-15 have the hash function specific information: SHA-1 for digital signature generation:      SHA-1 may only be used for digital signature generation ...


7

To clarify scope: FIPS 140-2 itself doesn't say anything about DSS, though it has 186-2 as a reference. It was published in 2001, before 186-3 and -4, and has not been superseded. After 140-3 spent 8 years in draft they recently decided to consider using ISO/IEC 19790 instead! 140-2 Annex A (Approved functions) is updated frequently and does now reference ...


6

I'm no FIPS expert but I strongly suspect the answer is no. FIPS is incredibly restrictive and laughably behind the times. To evaluate those algorithms that don't appear in FIPS, first make sure their component parts are secure (maybe even built with FIPS algorithms as subroutines). Then, if there are known answer tests anywhere, maybe from the authors of ...


5

If you fish around in your pocket, you can probably find one that costs 0.25 USD. All it takes to use one of these gizmos is a little patience, a bit of hand-eye coordination, and some confidence that there aren't any surveillance cameras watching you, which you need anyway because you just typed in your password under them to decrypt your laptop's disk. ...


5

The question mentions FIPS 140-2 Level 3 compliant. I answer this as if the question had said the intent is to validate the product as FIPS 140-2 Level 3. This may sound like hairsplitting, but there are many modules claiming to be FIPS 140-2 compliant, which factually could not be validated without large changes to functionality. FIPS 140-2 really intends ...


5

Q1: Why are these tests stroked out? These tests are stroked out on pages 57-58 of the current FIPS 140-2 because they are no longer part of the current FIPS 140-2 standard, since Change Notice 2 of 2002 December third, where these pages belong. My guess for the rationale of removing these tests is that It was realized that the very principle of ...


5

I wouldn't give much hope in finding a native Javascript crypto implementation that's FIPS certified. The reason is zeroization; FIPS is particular about knowing when CSPs [1] are zeroized; Javascript does garbage collection, which means that you're never quite sure when things are zeroized. And, if by cross-compiling, you mean taking a certified ...


4

Actually, it's there on the list, just with a different name -- the approved algorithm you want is listed as "SHS" (Secure Hashing Standard). Now, the term "SHS" doesn't distinguish between the various flavors of SHA-2 (and SHA-1, which is still approved for some uses); however if you look at this database, you can look up a specific module and see what it ...


4

Could a C25519/ED25519 cryptographic module be FIPS certified? Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy. On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; ...


4

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.


4

There's a difference between FIPS approved and FIPS allowed algorithms. RSA is an allowed algorithm for doing key wrap and key transport, however it's not FIPS approved for that purpose. It's only approved for digital signatures. If you're using a FIPS validated module take a look at the security policy for the module you're using and see if RSA is allowed ...


3

FIPS 140-2 and FIPS 186-2 (PDF) are not standards that describe RNGs. FIPS 140-2 refers the task of standardizing RNGs to SP800-90 (PDF) which specifies software-based pseudo random number generators, to which your module seems compliant. FIPS 186-2 only talks about RNGs in one place, in Appendix 3, where it says that using the RNG from appendix C of ANSI ...


3

Yes, a device that is FIPS certified need not be restricted to using only FIPS-approved algorithms. For example, in your case, FIPS has no problems with you supporting Curve25519, as long as the user can turn it off. That is, the device will need to be able to be set in a mode that it performs only FIPS approved algorithms (and the FIPS approval ...


3

No, there isn't. There are too many different systems out there to make a generic tool.


3

I can't help you with your Windows question, however I can chime in on FIPS: Is it going to be FIPS 140-2 compliant? It might not be. The problem is the "SHA1 for hashing"; SHA1 is no longer approved as a collision resistant hash function. On the other hand, HMAC-SHA1 is still approved as a Message Authentication Code. That is, if you are using SHA1 (...


3

As far as I understand it, the very same problems would arise, if a hardcoded key would be used with any of the other keyed PRNG standards (like HMAC_DRBG or CTR_DRBG). What am I missing? The issue is that, for X9.31, the key really is a long term key; it is never updated as a part of the RNG process. That is, the state of X9.31 consists of a 'current ...


3

You can convert/cross-compile the code, but that won’t port over any validation or even certification. In the end, a cross-compiled product is a new product – requiring revalidation. Unless such (re)validation happens, any cross-compilation results have to be treated as “unvalidated cryptography”. Unvalidated cryptography is viewed by NIST as providing no ...


3

are there any side effects to switching to AES that aren't readily apparent? Key sizes: AES is only defined for 128, 192, and 256 bit keys. Rijndael supports other key sizes. There is not much benefit to using the key sizes in between these two, but if you use AES they will not be available anymore. Block size: Rijndael allows a wider range block sizes than ...


3

Indeed FIPS 140-2 requires a module to validate itself, and this has no security benefit. In order for a code integrity check to have a security benefit, both the code that performs the verification and the data that it uses (hash value for a hash, MAC value and secret key for a MAC, public key for a signature) need to be integrity-protected (and with a MAC, ...


3

Start with Annex A: Approved Security Functions. That will give you a good idea of the approved functions. A few caveats: Not all modules support all approved functions, e.g. OpenSSL doesn't support quite a few of them (OpenSSL's validation isn't active anymore anyway) FIPS 140 is a constantly evolving target, so today's validated module is tomorrow's no ...


2

The rationale for no longer mandating these tests include: These tests are generally not useful against most FIPS 140-2 approved random number generators. These tests can be useful against some kind of entropy sources. These tests give frequent false positives every few thousandth block of truely random stream will fail the test. Some entropy sources are ...


2

It is possible to have product based on this algorithm suite, which is FIPS 140-2 compliant. However, there are special considerations for use of SHA-1 and RSA. The algorithm suite is partially considered obsolete and not FIPS 140-2 approved. For information on NIST transition to 112 bit cryptography you can read G.14 at FIPS 140-2 Implementation Guidance. ...


2

You could use the private Curve25519 key as the seed to a Key derivation function that allows arbitrary output lengths, such as HKDF. Use this HKDF output as the CSPRNG you would normally use to generate a NIST keypair. This should be deterministic so long as your library does not access the system RNG on its own when generating keys. You should probably ...


2

A few points:- The FIPS 140-2 tests are wrapped up within the rngtest program, available in Linux as package rng-tools5. I'll produce something like:- rngtest: starting FIPS tests... rngtest: entropy source drained rngtest: bits received from input: 8388608 rngtest: FIPS 140-2 successes: 419 rngtest: FIPS 140-2 failures: 0 rngtest: FIPS 140-2(2001-10-10) ...


2

Let's first get rid over two parameters that only have one option: the Mask Generation Function (MGF) and the trailer field. These can only be configured to MGF1 and 1 respectively in RFC 3447 which specifies RSA-PSS. You won't find a generic standard that chooses one hash over the other for MGF1 because any hash will be considered secure, including the ...


1

What's your definition of I would like the best open source I can get OneRNG is designed to be visually verified, and the one complex component can be independently sourced if you don't want to trust the lump of silicon you get in the post from China :-) Other devices concentrate on usability, form factor, etc. You can't validate that the device you ...


Only top voted, non community-wiki answers of a minimum length are eligible