Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ensure that my Access application complies with FIPS 140-2. The deployment and maintenance of this application will be handled by another partner company, they are the ones asking for FIPS compliancy.

I have read the documentation for FIPS 140-2 and I understand its purpose. Level 1 FIPS compliance is all that is required in our situation. I have written a module in VBA to hash the passwords with SHA-1 used for logging into the application. SHA-1 is on the list of FIPS 140-2 approved algorithms.

My question is, what else does a software developer have to do to ensure FIPS 140-2 compliance, and how much falls in the shoulders of the contractor deploying the application on their systems?

The Access application is split, so the back-end file will live on a network share and regular users will only have access to the front-end file. I suppose both the back-end and front-end files could be encrypted, but that seems to be part of the deployment process.

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

As the software developer, you need to ensure that not only the chosed encryption standard is FIPS compliant, but also the cryptographic module used. AES for example is FIPS 140-2 approved as a method, but the actual implementation of the Rijndael algorithm on Windows Server 2008 [not R2] is not approved (and is therefore not FIPS compliant ... you'd have to use 3DES or something else).

For completeness, the complete list of validated modules are available here: http://csrc.nist.gov/cryptval/140-1/140val-all.htm

To ensure FIPS compliance you'll also want the system that this is running on to enforce FIPS. On a windows system this is under the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

Change the DWORD value of ENABLED to 1. As a developer you'll want to test in this mode.

Ensuring that the communication channels and that the server/workstation/etc. running the application are FIPS compliant will be part of the deployment process where there is little that you can do should a separate contractor be working the installation.

share|improve this answer
    
So do I HAVE to bring in a 3rd party tool so that the cryptographic module used is compliant or can I accomplish everything myself from VBA? –  Justin C Mar 14 '11 at 18:49
1  
You can ensure your app is compliant from within VBA. The MSFT offered SHA and 3DES modules are FIPS compliant. For testing, you'll want to ensure to enable the enforcement of FIPS compliance on your box (the registry key above) [to ensure you don't accidentally use any non FIPS component ... it will throw an exception if you do]. I added the link to the complete list of modules to my answer. –  iivel Mar 14 '11 at 20:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.