34
votes
Why is FIPS 140-2 compliance controversial?
I'll add to the other answer: the FIPS 140-2 certification rules for RNGs were flawed; and FIPS 140-2 change notice 2 (Dec. 2002) removed the part on self-tests. They are literally struck out from the ...
- 146k
31
votes
Accepted
Why is FIPS 140-2 compliance controversial?
Because there was previously a NIST approved random number generator (Dual_EC_DRBG) that was championed by NSA and had a flaw that is generally assumed to be an intentional backdoor created by NSA. ...
- 2,118
24
votes
Accepted
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
The question does an apple-to-orange comparison: Google's level-1 Certificate #3318 is for a "software library" , IBM's level-4 certificate #3410 is for a "PCIe Cryptographic ...
- 146k
13
votes
"Seed" vs "seed key"
"seed" and "seed key" are NIST terminology talking about the X9.31 PRNG. In particular, it has a state that consists of:
A 3DES or AES key (the "seed key")
A 64 or 128 bit current state (the "seed")
...
- 151k
10
votes
Accepted
RSA Private Exponent Generation according to FIPS 186-4 in openssl v1
FIPS 186-4's $d_1=e^{-1}\bmod m_1$ with $m_1=\operatorname{lcm}(p-1,q-1)$, and OpenSSL's $d_2=e^{-1}\bmod m_2$ with $m_2=(p-1)(q-1)$, are different with probability $>1/2$ for random choice of $p$ ...
- 146k
9
votes
Why is FIPS 140-2 compliance controversial?
You can make the best possible choice in all cases if you don't have to comply with FIPS 140-2. If you do have to comply with FIPS 140-2, you can only make the best approved choice. Thus FIPS 140-2 ...
- 4,729
9
votes
Converting a C25519 curve into a NIST-supported curve for FIPS crypto
No, conversion of an EC key pair from a curve to another of unrelated order is not possible.
One of the closest things that could be done would be that parties generate a new P256 key pair, then
...
- 146k
7
votes
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
Google (GCP) does provide level 3 with HSMs, see https://cloud.google.com/kms/docs/hsm. They apparently didn't get the validation in their own name.
- 2,118
7
votes
Why did Google Cloud accept a lower FIPS 140-2 Level compared to IBM Cloud?
I wouldn't assume that a difference in chosen FIPS 140-2 levels tells you anything at all about the relative security of two systems.
FIPS 140-2 validation is controversial in the cryptography ...
- 171
6
votes
FIPS 140-2, Level 1 validation vs. compilation
I wouldn't give much hope in finding a native Javascript crypto implementation that's FIPS certified. The reason is zeroization; FIPS is particular about knowing when CSPs [1] are zeroized; ...
- 151k
6
votes
Accepted
FIPS 140-2 compliance and RSA encryption
There's a difference between FIPS approved and FIPS allowed algorithms. RSA is an allowed algorithm for doing key wrap and key transport, however it's not FIPS approved for that purpose. It's only ...
- 2,118
5
votes
Are RSA-PSS parameters standardized?
Let's first get rid over two parameters that only have one option: the Mask Generation Function (MGF) and the trailer field. These can only be configured to MGF1 and 1 respectively in RFC 3447 which ...
- 94.5k
5
votes
Open-source usb TRNG and US standards - Help choosing
If you fish around in your pocket, you can probably find one that costs 0.25 USD.
All it takes to use one of these gizmos is a little patience, a bit of hand-eye coordination, and some confidence ...
- 49.5k
4
votes
Could a C25519/ED25519 cryptographic module be FIPS certified?
Could a C25519/ED25519 cryptographic module be FIPS certified?
Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy.
On 2019-10-31, ...
- 49.5k
4
votes
Accepted
Any side effects of switching from Rijndael to AES in a .net application?
are there any side effects to switching to AES that aren't readily apparent?
Key sizes: AES is only defined for 128, 192, and 256 bit keys. Rijndael supports other key sizes. There is not much ...
- 19.9k
4
votes
Are non-FIPS algorithms allowed to execute at all in a FIPS-compliant system?
Actually, curve25519 is well on its way to FIPS approval (NIST SP 800-186), but that's not what you're asking about.
To answer your question, yes, NIST has stated that they do allow non-approved ...
- 151k
3
votes
Accepted
FIPS 140-2 compliance across symmetric and asymmetric primitives
Start with Annex A: Approved Security Functions. That will give you a good idea of the approved functions. A few caveats:
Not all modules support all approved functions, e.g. OpenSSL doesn't ...
- 2,118
3
votes
FIPS 140-2, Level 1 validation vs. compilation
You can convert/cross-compile the code, but that won’t port over any validation or even certification. In the end, a cross-compiled product is a new product – requiring revalidation. Unless such (re)...
- 18.1k
3
votes
Accepted
How is the DUHK attack specific to the ANSI X9.31 RNG?
As far as I understand it, the very same problems would arise, if a hardcoded key would be used with any of the other keyed PRNG standards (like HMAC_DRBG or CTR_DRBG). What am I missing?
The issue ...
- 151k
3
votes
Accepted
OpenSSL FIPS integrity check
Indeed FIPS 140-2 requires a module to validate itself, and this has no security benefit.
In order for a code integrity check to have a security benefit, both the code that performs the verification ...
3
votes
Accepted
Could FIPS 186-5 A.1.6 method generate P and Q with different bit size?
Do my understanding correct?
No; when it generates $P$ (in step 5.3) and $Q$ (in step 6.3), it passes the intended key length (nlen) to the algorithm in appendix B.9. That algorithm will find a (...
- 151k
2
votes
Is ECDH(E) Key Exchange FIPS 140-2 compliant?
If you look at the FIPS Implementation Guidelines for FIPS-140-2 here
https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/fips140-2/fips1402ig.pdf
In section D....
2
votes
Could a C25519/ED25519 cryptographic module be FIPS certified?
As of February 3, 2023
FIPS 186-5 has been published along with NIST SP 800-186 update that include Curve25519 and Ed25519
One thing that I noticed on the NIST late 2017 transition plan blog for key ...
- 121
2
votes
How to test for randomness using FIPS 140-2
A few points:-
The FIPS 140-2 tests are wrapped up within the rngtest program, available in Linux as package rng-tools5. I'll ...
- 15.7k
2
votes
Python code for 'Verifiable Canonical Generation of the Generator g', FIPS 186-4, returns False
The closest to a cryptographic reason the code does not work is that it does not implement the prescription
index is a bit string of length 8
when it does
...
- 146k
2
votes
Why is FIPS 140-2 compliance controversial?
My thoughts are too long for commenting, so I'll wrap them up as an answer...
There are some serious issues with the other two answers, to the extent that some of us have miss-interpreted what a ...
- 15.7k
2
votes
Accepted
Converting a C25519 curve into a NIST-supported curve for FIPS crypto
You could use the private Curve25519 key as the seed to a Key derivation function that allows arbitrary output lengths, such as HKDF. Use this HKDF output as the CSPRNG you would normally use to ...
- 2,297
2
votes
What is this meaning disconnected from processes performing key generation or zeroization in cryptography modu
It's cryptographic marketing spiel to convince end users to pay double.
This is about hardware. All it means is that the cryptographic key(s), typically generated via a true random process, is/are ...
- 15.7k
2
votes
RSA Private Exponent Generation according to FIPS 186-4 in openssl v1
To my understanding, the requirement in FIPS 186-4 to use for the calculation of the private key $d$ the least common multiple of $p-1$ and $q-1$ instead of the their product has the purpose to ...
- 1,657
Only top scored, non community-wiki answers of a minimum length are eligible