While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the highest level is actually level 4, which is only to available to government workers. Why is it only available to them and is FIPS level 3 safe from the government trying to hack into it?
3
-
2Could you add some reference to "level 4, which is only to available to government workers"? I'm asking, because current answer suggests purely economical reasons, but your wording sounds like there were some legal restrictions.– techrafJun 25, 2016 at 4:51
-
Crypto cards on IBM mainframe (z System) are Level 4 compliant.– Jon BettencourtMay 3, 2017 at 22:51
-
There are level 4 devices, you can see them by searching the CMVP page here: csrc.nist.gov/projects/cryptographic-module-validation-program/…– JimOct 25, 2021 at 17:20
Add a comment
|
3 Answers
When based on a standard, especially those as stringent as FIPS 140-2, you have to go through the following processes (which are time consuming and expensive):
- Design
- Testing
- Certification
If you take a look at the NIST Implementation Guide for FIPS PUB 140-2, along with the other documents, you can search for the Level 4 implementation which detail that this is designed to be tamper-proof.
It is considered "overkill" for most businesses and even personal use because it protects against "drilling, milling, cutting, burning, melting, grinding or dissolving the epoxy or potting material, in order to gain access to the underlying circuitry." It is also meant to protect against environmental factors. This is your doomsday USB standard, where you under no circumstances can lose or leak the data.
It is a very aggressive set of requirements that is very likely not very economical if you intend to sell it to a consumer, for the same reason a crash-proof car is feasible, but your average person is not willing to pay the price or deal with the complexities involved.
This explains why government entities can have this kind of technology:
- They are not a profit seeking entity, technically.
- They are not restricted by the requirements of making a product marketable, they are their own customer (and other governments, too).
- They have schools, renowned labs, and dedicated facilities at their beck and call to build "cool" things in the name of safety, public service, defense, or what have you.
Bear in mind that building cryptographic devices, especially at the hardware level, is not a fool's errand.
Yes there is Level 4 devices available today on the market - following PCI Crypto Express card which is FIPS 140-2 Level 4 certified, from IBM is available for purchase - for most countries and enterprises - and works with x86, Power and of course z Systems.
https://www-03.ibm.com/security/cryptocards/pciecc2/overview.shtml
-
IBM4767 are not yet certified FIPS 140-2 Level 4 : "The certification process for the IBM 4767 Cryptographic Coprocessor Security Module has begun for Level 4" Nov 2, 2017 at 20:37
-
-
It is certified....Certificate No. 3164 ...you need to understand that in order to get certification process started, the product needs to be generally available(GA) then submit paper works...as you can guess it takes many months/years to complete validation process. Every time IBM introduces new version of CryptoExpress card(s) the process begin new again...so if you see a new CEX card introduced in the market, it will take some time to get FIPS validated. If you like to get some HW that are already certified when this happens, look for one generation prior HW.– A.KimAug 22, 2018 at 21:25
is FIPS level 3 safe from the
governmentanyone trying to hack into it?
realize the Federal Information Processing Standards publication 140-2 is a spec that something is designed and built to which then gets that certification. Per your question does FIPS 140-2 level-3 protect against hacking, I would say the real world answer is NO. Because it is up to the honesty & integrity & capability of the manufacturer building the device, and in the end the cold hard truth is there is no honesty nor ethics in the realm of (among other things) computer security, and the FIPS 140-2 level x can be used as a marketing ploy. We would have to have a huge open discussion and look for the loop holes in wording of the standard as well as background check and oversee everyone signing off stating whatever device is FIPS compliant.
Rather than take some certification sheet at face value, example off top of my head: VW said their diesel vehicles met emission standards and at one point were certified for sale but we know how that turned out - Volkswagen emissions scandal 2015. Fraud knows no bounds.
