The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
54 views

How negative are virtual machines (vms) to /dev/urandom?

I looked at the questions here and here. This then piqued my interest as I've recently been involved with looking into FIPS compliance, and in my vm environment /dev/urandom compliance testing ...
0
votes
1answer
29 views

TPM support with OpenSSL FIPS Object Module

How to use TPM chip along with OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL module as ...
-1
votes
0answers
14 views

mod_ssl with FIPS mode enabled and SSLRandomSeed [migrated]

I have traced through the mod_ssl and the OpenSSL FIPS code as best I can and I believe that the SSLRandomSeed configuration parameter given in the mod_ssl.conf file simply doesn't do anything useful ...
1
vote
0answers
26 views

Full disk encryption on CentOS 6x - FIPS 140-2 compliant?

I'm using CentOS 6.5 on an existing server and am researching encryption options for compliance. SEDs are out since the controller in this older machine will not support them. That leaves full ...
5
votes
2answers
169 views

Is cloud hosting allowed for FIPS 140-2?

I am in the very early stages of making my application FIPS 140-2 compliant... so early in fact that I am not sure what level it has to be... just writing a preliminary recommendations document at ...
3
votes
1answer
4k views

What needs to be encrypted for FIPS 140-2 compliance?

We're developing a Client/Server C# .NET application that needs to be FIPS compliant.Im reading a lot about FIPS online, but am having a bit of difficulty determining the difference between the ...
2
votes
1answer
148 views

Python implementation of AES and SHA256/512 that are FIPS-140-2 validated?

For security purposes I need to use AES encryption and SHA256/512 in my Django/Python project. I know there are various libraries out there that provide different encryption methods but I can't seem ...
5
votes
2answers
475 views

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any ...
1
vote
1answer
85 views

What is the relationship between Suite B and FIPS 140-2?

What is the relationship between the Suite B algorithms and FIPS 140-2 certification? Does OpenSSL meet both criteria? From what I've read, it seems that OpenSSL's crypto library implements many ...
2
votes
0answers
178 views

OpenSSL vs NSS from FIPS-140-2 and Suite B perspective?

Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL? EDIT: In case there aren't any existing documents/articles, I would certainly ...
3
votes
1answer
803 views

Compatibility between OpenSSL 0.9.8r and OpenSSL FIPS Object Module v1.2?

I have a private key in PEM format that was generated by OpenSSL FIPS Object Module v1.2 using a proprietary third party tool (that I cannot avoid using). This third party tool encrypted the private ...
4
votes
3answers
272 views

Android and FIPS

I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric ...
3
votes
1answer
139 views

FIPS compliant application based on OpenSSL

Let's say I need to write a simple application for signing/checking some data. The hard part is, that it must be FIPS 140-2 compliant. I was thinking to do it using OpenSSL FIPS Object Module 2.0 but ...
4
votes
3answers
2k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
4
votes
2answers
1k views

FIPS Compliance for my Android project

I am working on a security-related project and have to make sure it is FIPS 140-2 compliant. According to my understanding, FIPS compliance is compliance at hardware as well as software level. ...
5
votes
1answer
2k views

OpenSSL vs FIPS enabled OpenSSL

A deceptively simple question. How does OpenSSL compare to FIPS enabled OpenSSL? Is it any less secure? How do I tell? If I were concerned about security, not the NIST standard, is there any real ...
3
votes
2answers
386 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
329 views

FIPS 140-1 and FIPS 140-2

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old. Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
1
vote
1answer
656 views

How does Cipher Block Chaining relate to AES?

I was reading FIPS197 for a class (found here: http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf ) trying to find some sort of specific relation between CBC and AES. I guess my problem is ...
3
votes
1answer
213 views

Can I enter PINs or passwords into a FIPS140-2 crytographic module in plaintext?

Do passwords (or PINs) used for authentication of operators of a cryptographic module have to be protected (encrypted) when entered into the FIPS140-2 defined cryptographic boundary? Are the ...
1
vote
1answer
69 views

Are there any FIPS140-2 requirements that apply when boot code is updated in the field?

FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module: ...
2
votes
1answer
662 views

Citation Needed for FIPS Anecdote Regarding MD5 and RC4

I've heard it mentioned many times by colleagues and other information security professionals that it is a violation of Federal Information Processing Standards (FIPS) regulations for an ...
3
votes
2answers
125 views

What drives FIPS140-2 compliance?

I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think. What are the most common factors that drives FIPS140-2 compliance for ...
4
votes
2answers
873 views

What cryptographic module does Sql Server 2008 use to run in Fips 140-2 compliant mode by default?

One can configure Sql Server 2008 to run in FIPS 140-2 compliant mode, in the same manner as running Bitlocker in FIPS 140-2 compliant mode. Which is to activate FIPS 140-2 compliant mode in the ...
2
votes
2answers
322 views

What does “if the Crypto Officer performs this operation” mean in this BitLocker security policy?

In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says: BitLocker™ will ...
6
votes
2answers
1k views

Is BitLocker on a virtual machine still FIPS 140-2 compliant?

BitLocker can be used as a cryptographic module to fulfill FIPS 140-2 security level 1 compliance. In a common setup, USB thumb drives can be used to unlock drives encrypted by BitLocker on startup. ...
8
votes
2answers
2k views

Are TPM chips or the equiavlent required for FIPS 140-2 security level 1 compliance?

A 'TPM chip' is: a secure cryptoprocessor that can store cryptographic keys that protect information FIPS 140-2 requires a cryptographic module, which can be hardware, software, or both that ...
2
votes
1answer
377 views

Does Bitlocker qualify as the 'Cryptographic Module' defined in FIPS140-2?

Wikipedia defines Bitlocker as: BitLocker Drive Encryption is a full disk encryption feature included with the Ultimate and Enterprise editions of Microsoft's Windows Vista and Windows 7 ...
3
votes
1answer
347 views

Help on interpretation of FIPS-140 paragraph

This is from the FIPS 140-2 standard: Cryptographic keys stored within a cryptographic module shall be stored either in plaintext form or encrypted form. Plaintext secret and private ...
5
votes
2answers
261 views

General Question on FIPS requirements

I understand that FIPS addresses cryptographic operations. My question is, is it addressing exactly this? For example, can an application loading a keystore use a non-FIPS provider? Any input or ...
10
votes
4answers
2k views

Question of importance of FIPS in security implementations

I am by far, no security expert but I experience on the subject working in Java (JCA,JCE and JSSE). Anyway, recently there was a discussion about FIPS compliance. I looked into this and SUN's ...
3
votes
1answer
802 views

How to apply FIPS to Microsoft Access database with custom VBA

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ...