Tag Info

New answers tagged

1

My understanding of the FIPS 140-2 standards, unfortunately, aligns with your fear. As far as I understand, the FIPS 140-2 standards are about proving that you handle private keys in a responsible way. If your software lets Bouncy Castle touch the private keys, then even if you wrote the most secure software in the world, your overall product is only as ...


0

I'm thinking that if the FIPS-validated and FIPS-enabled network switch will allow me to get away with something (such as not securing syslog traffic, to reference the example in my original post), then I don't need to do that something in order to be operating in a FIPS-compliant manner. Any disagreement?


1

Every FIPS 140-2 device must have a publicly available non-proprietary Security Policy document which is obtainable from the FIPS 140 program web site (CMVP - http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm). Although some Security Policies are far better written than others, there is a minimum requirement for these documents that should ...


0

Here is a link to the FIPS 201 document on NIST's website. This is pulled from the linked document and might directly answer your question: The PIV Card shall contain security features that aid in reducing counterfeiting, are resistant to tampering, and provide visual evidence of tampering attempts. At a minimum, a PIV Card shall incorporate one such ...



Top 50 recent answers are included