Timeline for A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 5, 2013 at 14:04 | comment | added | armb | Note that older versions of the CNG Key Storage Provider functions only dealt with asymmetric operations, and CNG only supported 3DES keys as session keys. The current documentation is a bit unclear, but msdn.microsoft.com/en-us/library/windows/desktop/… for example implies that 3DES keys will still have to use the primitive providers (BCrypt functions, rather than NCrypt). I believe it is now possible for hardware vendors to write storage providers that do offer symmetric key support - but I don't know if it's possible with Windows 2008. | |
| Jan 31, 2013 at 9:55 | answer | added | armb | timeline score: 2 | |
| Nov 26, 2012 at 8:18 | vote | accept | David Oliván | ||
| Nov 23, 2012 at 20:10 | answer | added | bethlakshmi | timeline score: 5 | |
| Jun 21, 2012 at 12:59 | comment | added | David Oliván | I don't know, Microsoft states it can be done, but no specifies if pure SW, SW + HW, only HW and CNG for calling the HSM... We have to define the requirements with our client. | |
| Jun 21, 2012 at 11:17 | comment | added | Ramhound | So you know it can be done pure Microsoft's statements. I would say based on a comment from your other question that you can do everything with software. But you don't seem to have all the requirements pure your comment about your client also. | |
| Jun 21, 2012 at 8:51 | comment | added | David Oliván | I know. The FIPS 140-2 compliance question is more related to key storage. | |
| Jun 21, 2012 at 7:58 | comment | added | logicalscope | Note that MD5 is not an approved hashing algorithm for FIPS 140-2 except in some very extreme edge cases (such as used in TLS or DTLS or, I believe, as a method to self-test the integrity of the FIPS module before it is active). | |
| Jun 21, 2012 at 7:54 | history | edited | David Oliván |
edited tags
|
|
| Jun 21, 2012 at 7:43 | comment | added | David Oliván | Microsoft says: CNG was designed to be usable as a component in a FIPS level 2 validated system. msdn.microsoft.com/en-us/library/windows/desktop/… | |
| Jun 21, 2012 at 7:42 | comment | added | David Oliván | Microsoft states that CNG can be used to build a Level 2 compliant system, but not specifies how nor if requires HW elements such as HSM. The key point is about key storage, if we need HSM to at least store keys or we can use CNG to store keys. | |
| Jun 20, 2012 at 11:01 | comment | added | Ramhound | What is your exact question? If your asking if this can be done I am sure it can, you even say it can be done, per your unnamed source. | |
| Jun 19, 2012 at 6:54 | history | asked | David Oliván | CC BY-SA 3.0 |