16

Take a look at FIPS 140-2 Annex A. It lists the following: Symmetric Key AES, Triple-DES, Escrowed Encryption Standard Asymmetric Key DSA, RSA, ECDSA Hash Standards SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 Random number generators See annex c Message authentication CCM, GCM, GMAC, CMAC, HMAC


14

If you are using an AES library that has not undergone the FIPS validation process, then you are not FIPS compliant (or, at least, your use of AES is not). FIPS compliant means more than "we use algorithms that FIPS likes", it means "having passed the FIPS certification process"; that is how NIST defines it. Sorry, but NIST is quite strict about this; if ...


13

"seed" and "seed key" are NIST terminology talking about the X9.31 PRNG. In particular, it has a state that consists of: A 3DES or AES key (the "seed key") A 64 or 128 bit current state (the "seed") The requirement is to check to make sure that two don't happen to be the same (and give an error indication if they are). If you're wondering "except for the ...


9

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then certify their new P256 public key using their C25519 private key, check the other party's certificate using the other party's trusted C25519 public key, and now ...


7

Much of what NIST publishes about cryptographic algorithms is in Special Publications. In this case it is SP 800-131 (pdf) where they describe transitioning away from old algorithms and key sizes. Pages 14-15 have the hash function specific information: SHA-1 for digital signature generation:      SHA-1 may only be used for digital signature generation ...


7

To clarify scope: FIPS 140-2 itself doesn't say anything about DSS, though it has 186-2 as a reference. It was published in 2001, before 186-3 and -4, and has not been superseded. After 140-3 spent 8 years in draft they recently decided to consider using ISO/IEC 19790 instead! 140-2 Annex A (Approved functions) is updated frequently and does now reference ...


6

I'm no FIPS expert but I strongly suspect the answer is no. FIPS is incredibly restrictive and laughably behind the times. To evaluate those algorithms that don't appear in FIPS, first make sure their component parts are secure (maybe even built with FIPS algorithms as subroutines). Then, if there are known answer tests anywhere, maybe from the authors of ...


5

The question mentions FIPS 140-2 Level 3 compliant. I answer this as if the question had said the intent is to validate the product as FIPS 140-2 Level 3. This may sound like hairsplitting, but there are many modules claiming to be FIPS 140-2 compliant, which factually could not be validated without large changes to functionality. FIPS 140-2 really intends ...


5

FIPS 140-2 only certifies cryptographic modules, not entire systems. So, to tell if your system is 140-2 compliant, it must be using a 140-2 certified module. NIST publishes a list of all FIPS 140-2 certified cryptographic modules. It is important to remember, though, that 140-2 certification does not certify that the module is used in a secure manner. From ...


5

FIPS 140-2 Security Level 2 does not require any form of security measure to prevent extraction of secrets. It simply requires tamper evidence, that is, it should be possible to notice that such attack took place by looking (for instance) at some seal on the device or at a log file. To answer your question, extracting a secret may therefore take 0 seconds ...


5

Q1: Why are these tests stroked out? These tests are stroked out on pages 57-58 of the current FIPS 140-2 because they are no longer part of the current FIPS 140-2 standard, since Change Notice 2 of 2002 December third, where these pages belong. My guess for the rationale of removing these tests is that It was realized that the very principle of ...


5

If you fish around in your pocket, you can probably find one that costs 0.25 USD. All it takes to use one of these gizmos is a little patience, a bit of hand-eye coordination, and some confidence that there aren't any surveillance cameras watching you, which you need anyway because you just typed in your password under them to decrypt your laptop's disk. ...


5

I wouldn't give much hope in finding a native Javascript crypto implementation that's FIPS certified. The reason is zeroization; FIPS is particular about knowing when CSPs [1] are zeroized; Javascript does garbage collection, which means that you're never quite sure when things are zeroized. And, if by cross-compiling, you mean taking a certified ...


4

Actually, it's there on the list, just with a different name -- the approved algorithm you want is listed as "SHS" (Secure Hashing Standard). Now, the term "SHS" doesn't distinguish between the various flavors of SHA-2 (and SHA-1, which is still approved for some uses); however if you look at this database, you can look up a specific module and see what it ...


4

Could a C25519/ED25519 cryptographic module be FIPS certified? Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy. On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; ...


3

Yes, a device that is FIPS certified need not be restricted to using only FIPS-approved algorithms. For example, in your case, FIPS has no problems with you supporting Curve25519, as long as the user can turn it off. That is, the device will need to be able to be set in a mode that it performs only FIPS approved algorithms (and the FIPS approval ...


3

No, there isn't. There are too many different systems out there to make a generic tool.


3

FIPS 140-2 and FIPS 186-2 (PDF) are not standards that describe RNGs. FIPS 140-2 refers the task of standardizing RNGs to SP800-90 (PDF) which specifies software-based pseudo random number generators, to which your module seems compliant. FIPS 186-2 only talks about RNGs in one place, in Appendix 3, where it says that using the RNG from appendix C of ANSI ...


3

I can't help you with your Windows question, however I can chime in on FIPS: Is it going to be FIPS 140-2 compliant? It might not be. The problem is the "SHA1 for hashing"; SHA1 is no longer approved as a collision resistant hash function. On the other hand, HMAC-SHA1 is still approved as a Message Authentication Code. That is, if you are using SHA1 (...


3

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.


3

This page gives details of a successful extraction of a 3DES key from an IBM 4758 (FIPS 140-1 Level 4): http://www.cl.cam.ac.uk/~rnc1/descrack/. In summary, it required 20 mins of access to the device, 2 days of (offline) cracking time, and about $1000 in equipment. Not sure if this quite answers the question you were asking in that it relies on ...


3

As far as I understand it, the very same problems would arise, if a hardcoded key would be used with any of the other keyed PRNG standards (like HMAC_DRBG or CTR_DRBG). What am I missing? The issue is that, for X9.31, the key really is a long term key; it is never updated as a part of the RNG process. That is, the state of X9.31 consists of a 'current ...


3

You can convert/cross-compile the code, but that won’t port over any validation or even certification. In the end, a cross-compiled product is a new product – requiring revalidation. Unless such (re)validation happens, any cross-compilation results have to be treated as “unvalidated cryptography”. Unvalidated cryptography is viewed by NIST as providing no ...


3

are there any side effects to switching to AES that aren't readily apparent? Key sizes: AES is only defined for 128, 192, and 256 bit keys. Rijndael supports other key sizes. There is not much benefit to using the key sizes in between these two, but if you use AES they will not be available anymore. Block size: Rijndael allows a wider range block sizes than ...


2

The current list of FIPS-approved cryptographical methods is here. For encryption, we're limited to AES, 3DES (known as TDEA in FIPS-speak), and EES (Skipjack). As for signing algorithms, we have RSA, DSA and ECDSA. Note that the list of FIPS-approved algorithms does change at times; not extremely frequently, but more often than they come out with a new ...


2

The rationale for no longer mandating these tests include: These tests are generally not useful against most FIPS 140-2 approved random number generators. These tests can be useful against some kind of entropy sources. These tests give frequent false positives every few thousandth block of truely random stream will fail the test. Some entropy sources are ...


2

It is possible to have product based on this algorithm suite, which is FIPS 140-2 compliant. However, there are special considerations for use of SHA-1 and RSA. The algorithm suite is partially considered obsolete and not FIPS 140-2 approved. For information on NIST transition to 112 bit cryptography you can read G.14 at FIPS 140-2 Implementation Guidance. ...


2

You cannot tell anything related to FIPS 140 by looking at a key or by looking at a file. FIPS 140 doesn't say anything about the choice of encryption algorithm, other than requiring that all every encryption algorithm must be “approved security function” (as defined in the glossary) and there must be at least 1. FIPS 140 is all about the module, i.e. the ...


2

You could use the private Curve25519 key as the seed to a Key derivation function that allows arbitrary output lengths, such as HKDF. Use this HKDF output as the CSPRNG you would normally use to generate a NIST keypair. This should be deterministic so long as your library does not access the system RNG on its own when generating keys. You should probably ...


Only top voted, non community-wiki answers of a minimum length are eligible