I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we use SHA1 to hash the key. It is acceptable to use SHA1 here, or is it breaking FIPS compliance?

Thanks!

public static ServiceEncryptionKey CreateNew(ServiceEncryptionAlgorithm algorithm)
{
    byte[] keyData;
    using (var key = CreateSymmetricAlgorithm(algorithm))
    {
        key.GenerateKey();
        keyData = key.Key;
    }

    byte[] keyHash;
    using (SHA1Cng sha = new SHA1Cng())
    {
        keyHash = sha.ComputeHash(keyData);
    }
    
    try
    {
        return new ServiceEncryptionKey(algorithm, new ProtectedBytes(keyData), keyHash);
    }
    finally
    {
        Array.Clear(keyData, 0, keyData.Length);
    }
}

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we use SHA1 to hash the key. It is acceptable to use SHA1 here, or is it breaking FIPS compliance?

Thanks!

public static ServiceEncryptionKey CreateNew(ServiceEncryptionAlgorithm algorithm)
{
    byte[] keyData;
    using (var key = CreateSymmetricAlgorithm(algorithm))
    {
        key.GenerateKey();
        keyData = key.Key;
    }

    byte[] keyHash;
    using (SHA1Cng sha = new SHA1Cng())
    {
        keyHash = sha.ComputeHash(keyData);
    }
    
    try
    {
        return new ServiceEncryptionKey(algorithm, new ProtectedBytes(keyData), keyHash);
    }
    finally
    {
        Array.Clear(keyData, 0, keyData.Length);
    }
} 

private ServiceEncryptionKey(ServiceEncryptionAlgorithm algorithm, ProtectedBytes keyData, byte[] keyHash)
    {
        this.Algorithm = algorithm;
        this.protectedKeyData = keyData;
        this.header = new byte[16 + keyHash.Length];
        this.KeyHash = (byte[])keyHash.Clone();
        Buffer.BlockCopy(new Guid("00000000-0000-0000-0000-000000000000").ToByteArray(), 0, this.header, 0, 16);
        Buffer.BlockCopy(keyHash, 0, this.header, 16, keyHash.Length);
    }

internal ProtectedBytes(byte[] plaintext)
    {
        this.ciphertext = new byte[(plaintext.Length + 0xF) & ~0xF];
        Buffer.BlockCopy(plaintext, 0, ciphertext, 0, plaintext.Length);
        ProtectedMemory.Protect(ciphertext, MemoryProtectionScope.SameProcess);
        this.plaintextLength = plaintext.Length;
    }

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we use SHA1 to hash the key. It is acceptable to use SHA1 here, or is it breaking FIPS compliance?

Thanks!

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we use SHA1 to hash the key. It is acceptable to use SHA1 here, or is it breaking FIPS compliance?

Thanks!

public static ServiceEncryptionKey CreateNew(ServiceEncryptionAlgorithm algorithm)
{
    byte[] keyData;
    using (var key = CreateSymmetricAlgorithm(algorithm))
    {
        key.GenerateKey();
        keyData = key.Key;
    }

    byte[] keyHash;
    using (SHA1Cng sha = new SHA1Cng())
    {
        keyHash = sha.ComputeHash(keyData);
    }
    
    try
    {
        return new ServiceEncryptionKey(algorithm, new ProtectedBytes(keyData), keyHash);
    }
    finally
    {
        Array.Clear(keyData, 0, keyData.Length);
    }
}