The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
38 views

FIPS Compliance with iOS app

Our company is working on getting FIPS validation for the iOS app and is in the initial phase. We have decided to use a private FIPS-certified libraries for using in the crypto modules. I have some ...
0
votes
1answer
87 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
1
vote
0answers
66 views

Full disk encryption on CentOS 6x - FIPS 140-2 compliant?

I'm using CentOS 6.5 on an existing server and am researching encryption options for compliance. SEDs are out since the controller in this older machine will not support them. That leaves full ...
2
votes
1answer
206 views

Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?

For security purposes I need to use AES encryption and SHA256/512 in my Django/Python project. I know there are various libraries out there that provide different encryption methods but I can't seem ...
1
vote
1answer
160 views

What is the relationship between Suite B and FIPS 140-2?

What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria? From what I've read, it seems that OpenSSL's crypto library implements many ...
0
votes
1answer
40 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
5
votes
2answers
208 views

Is cloud hosting allowed for FIPS 140-2?

I am in the very early stages of making my application FIPS 140-2 compliant... so early in fact that I am not sure what level it has to be... just writing a preliminary recommendations document at ...
4
votes
3answers
322 views

Android and FIPS

I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric ...
5
votes
2answers
612 views

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any ...
2
votes
0answers
189 views

OpenSSL vs NSS from FIPS-140-2 and Suite B perspective?

Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL? EDIT: In case there aren't any existing documents/articles, I would certainly ...
3
votes
1answer
149 views

FIPS compliant application based on OpenSSL

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but ...
3
votes
1answer
5k views

What needs to be encrypted for FIPS 140-2 compliance?

We're developing a Client/Server C# .NET application that needs to be FIPS compliant.Im reading a lot about FIPS online, but am having a bit of difficulty determining the difference between the ...
4
votes
3answers
2k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
4
votes
2answers
1k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
5
votes
1answer
3k views

OpenSSL vs FIPS enabled OpenSSL

A deceptively simple question. How does OpenSSL compare to FIPS enabled OpenSSL? Is it any less secure? How do I tell? If I were concerned about security, not the NIST standard, is there any real ...
3
votes
1answer
358 views

FIPS 140-1 and FIPS 140-2

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old. Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
3
votes
1answer
913 views

Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2?

I have a private key in PEM format that was generated by OpenSSL FIPS Object Module v1.2 using a proprietary third party tool (that I cannot avoid using). This third party tool encrypted the private ...
1
vote
1answer
722 views

How does Cipher Block Chaining relate to AES?

I was reading FIPS197 for a class (found here: http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf ) trying to find some sort of specific relation between CBC and AES. I guess my problem is ...
2
votes
1answer
738 views

Citation Needed for FIPS Anecdote Regarding MD5 and RC4

I've heard it mentioned many times by colleagues and other information security professionals that it is a violation of Federal Information Processing Standards (FIPS) regulations for an ...
3
votes
2answers
125 views

What drives FIPS140-2 compliance?

I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think. What are the most common factors that drives FIPS140-2 compliance for ...
1
vote
1answer
69 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module: ...
3
votes
1answer
223 views

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

Do passwords (or PINs) used for authentication of operators of a cryptographic module have to be protected (encrypted) when entered into the FIPS140-2 defined cryptographic boundary? Are the ...
3
votes
2answers
403 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
4
votes
2answers
901 views

What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?

One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
2
votes
2answers
337 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLockerâ„¢ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLockerâ„¢ will ...
6
votes
2answers
1k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
8
votes
2answers
2k views

Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?

A 'TPM chip' is: a secure cryptoprocessor that can store cryptographic keys that protect information FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
2
votes
1answer
413 views

Does Bitlocker qualify as the 'Cryptographic Module' defined in FIPS140-2?

Wikipedia defines Bitlocker as: BitLocker Drive Encryption is a full disk encryption feature included with the Ultimate and Enterprise editions of Microsoft's Windows Vista and Windows 7 ...
3
votes
1answer
370 views

Help on interpretation of FIPS-140 paragraph

This is from the FIPS 140-2 standard: Cryptographic keys stored within a cryptographic module shall be stored either in plaintext form or encrypted form. Plaintext secret and private ...
5
votes
2answers
285 views

General Question on FIPS requirements

I understand that FIPS addresses cryptographic operations. My question is, is it addressing exactly this? For example, can an application loading a keystore use a non-FIPS provider? Any input or ...
10
votes
4answers
2k views

Question of importance of FIPS in security implementations

I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE). Anyway, recently there was a discussion about FIPS compliance. I looked into this and SUN's ...
3
votes
1answer
836 views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...