The fips tag has no wiki summary.
3
votes
1answer
58 views
OpenSSL vs FIPS enabled OpenSSL
A deceptively simple question.
How does OpenSSL compare to FIPS enabled OpenSSL?
Is it any less secure? How do I tell?
If I were concerned about security, not the NIST standard, is there any real ...
3
votes
1answer
76 views
FIPS 140-1 and FIPS 140-2
I tried googling for this info but it's not easily available because FIPS 140-1 is now really old.
Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
1
vote
0answers
268 views
Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2?
I have a private key in PEM format that was generated by OpenSSL FIPS Object Module v1.2 using a proprietary third party tool (that I cannot avoid using). This third party tool encrypted the private ...
1
vote
1answer
299 views
How does Cipher Block Chaining relate to AES?
I was reading FIPS197 for a class (found here: http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf ) trying to find some sort of specific relation between CBC and AES. I guess my problem is ...
2
votes
1answer
213 views
Citation Needed for FIPS Anecdote Regarding MD5 and RC4
I've heard it mentioned many times by colleagues and other information security professionals that it is a violation of Federal Information Processing Standards (FIPS) regulations for an ...
3
votes
2answers
101 views
What drives FIPS140-2 compliance?
I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think.
What are the most common factors that drives FIPS140-2 compliance for ...
1
vote
1answer
59 views
Are there any FIPS140-2 requirements that apply when boot code is updated in the field?
FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module:
...
3
votes
1answer
184 views
Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?
Do passwords (or PINs) used for authentication of operators of a cryptographic module have to be protected (encrypted) when entered into the FIPS140-2 defined cryptographic boundary? Are the ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
4
votes
2answers
496 views
What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?
One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
2
votes
2answers
167 views
What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?
In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says:
BitLocker™ will ...
6
votes
2answers
681 views
Is BitLocker on a virtual machine still FIPS 140-2 compliant?
BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance.
In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup.
...
6
votes
2answers
805 views
Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?
A 'TPM chip' is:
a secure cryptoprocessor that can store cryptographic keys that
protect information
FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
2
votes
1answer
195 views
Does Bitlocker qualify as the 'Cryptographic Module' defined in FIPS140-2?
Wikipedia defines Bitlocker as:
BitLocker Drive Encryption is a full disk encryption feature included
with the Ultimate and Enterprise editions of Microsoft's Windows Vista
and Windows 7 ...
3
votes
1answer
148 views
Help on interpretation of FIPS-140 paragraph
This is from the FIPS 140-2 standard:
Cryptographic keys stored within a
cryptographic module shall be stored
either in plaintext form or encrypted
form. Plaintext secret and private
...
5
votes
2answers
159 views
General Question on FIPS requirements
I understand that FIPS addresses cryptographic operations.
My question is, is it addressing exactly this?
For example, can an application loading a keystore use a non-FIPS provider?
Any input or ...
10
votes
4answers
880 views
Question of importance of FIPS in security implementations
I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE).
Anyway, recently there was a discussion about FIPS compliance.
I looked into this and SUN's ...
3
votes
1answer
576 views
How to apply FIPS to Microsoft Access database with custom VBA
As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...
