New answers tagged

1

The answer is quite well explained on the FIPS 140-2 Wikipedia article. The requirements for different levels of certification are as follows (quoting directly from the article; no infringement intended): Security Level 1 provides the lowest level of security. Basic security requirements are specified for a cryptographic module (e.g., at least one ...


3

[Disclaimer: I'm a developer on a FIPS 140-2 Level 2 software module, and I'm a little disgruntled about the whole process] The main difference I've seen is that things that are FIPS 140-2 certified are at least 6 months out of date when you get them, and cannot be patched in the case of a vulnerability. Getting something FIPS / CC certified costs $$$, ...


3

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier versions). SHA-1, SHA-256 and SHA-512 are all FIPS Approved secure hash algorithms and the HMAC function based on them are thus FIPS Approved HMAC functions. ...


6

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there are some strong reasons to believe that the implementation is correct and secure and fulfils a number of security properties. Since we don't really know how to ...



Top 50 recent answers are included