4

I am working on a centos based network device , required to pass fips 140-2 level 2. I plan to use openssl in fips mode and CTR_DRBG will use as PRNG. will this be enough for meeting NIST SP 800-90 requirments ?

Do I need to provide external source of entropy or the linux default /dev/random is enough ? Ran

Improve this question

2 Answers 2

Reset to default
2

CTR_DRBG is an approved PRNG for FIPS compliance, defined in NIST SP800-90A. Linux's /dev/random is, in principle, a suitable entropy source per NIST SP800-90B, but whether it is suitable in your particular use case depends on where the Linux kernel itself can obtain entropy. Having a hardware RNG (such as RDRAND on modern Intel CPUs) would raise fewer questions during the certification.

Beyond that, a FIPS 140 level 2 certification includes some actual security requirements (unlike level 1), so it isn't enough (but it is necessary) to use approved algorithms. Getting your product certified requires meeting all the other requirements of the certification (logging, scrubbing of data, operator authentication, pointless self-tests, etc.) and satisfying the evaluator that you've met all the requirements.

Improve this answer
2
  • Thanks. I will be using a cpu with no RDRAND - so the alternative for TRNG is an external IC that /dev/random feeds of ? going through openssl docs, it seems that one can define "Engine" for HW sources of randomness .
    – user3087632
    Commented Apr 5, 2017 at 6:05
  • @user3087632 A TRNG is not strictly necessary, but it'll be easier to go through the certification (especially if you find one that has itself already been certified) than relying on some dubious sources (with network equipment, you can't have the user wiggle the mouse). The TRNG would feed directly into the Linux kernel entropy that primes /dev/random.
    – Gilles 'SO- stop being evil'
    Commented Apr 5, 2017 at 8:37
0

CTR_DRBG(AES) using OpenSSL FIPS Object Module v2.x operating in FIPS mode should be sufficient for FIPS 140-2 level 1. Did you know that this module is already FIPS certified by the OpenSSL Software Foundation? You might be able to claim applicability of the existing CMVP certificate if your device is a close match to tested configurations listed in the Security Policy. Before you commit to undergoing your own certification, check NIST validated cryptographic modules list.

If you have to have your own FIPS certification, as part of that certification you will have to analyze entropy sources to prove that you have sufficient entropy. You will have to produce Entropy Analysis Report (EAR) describing how your entropy sources operate (/dev/random in this case). You will also have to collect actual entropy events and calculate min-entropy for each source to substantiate your claims.

Linux kernel (/drivers/char/random.c) implements multiple software entropy sources. They are add_disk_randomness(), add_input_randomness(), add_interrupt_randomness(). Depending on your hardware setup (e.g. headless system with only flash storage) you could have insufficient boot time entropy. In such cases you will have to integrate additional entropy sources to certify. One possibility is CPU sources, something like Intel’s RdSeed. Another possibility is software-only CPU Jitter.

Improve this answer
2
  • Thanks Kinill Let's say I will add an external IC ( with FIPS CMVP ) which generates TRNG, how do I integrate it to Linux RNG system ? should I create /hw/hw_rng and use rnd-tools package to seed urandom ?
    – user3087632
    Commented Apr 6, 2017 at 6:38
  • One way to do it is via /dev/hw_random. Depending on the kernel version, it might not be enabled by default. Do modprobe hw_random to check.
    – Kirill Sinitski
    Commented Apr 6, 2017 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .