I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance.

As far as I have researched in https://technet.microsoft.com/en-us/library/security/cc750357.aspx, there is a kind of validation process which consist in set a policy setting (secpol.msc) for using FIPS algorithms. The other step consist in checking that a few binaries (cng.sys, bcryptprimtive.dll) are the same version than the validated from NIST. http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#1328

I am having troubles with this last step, the thing is that I cannot find any place where it is said how to modified these binaries, e.g. hotfix, downgrade separatly these binaries, ... Could somebody help me or clarify me this issue? Is it necessary to have the versions from NIST validated list?


Is there any way which I could validate that my system is FIPS 140-2 validated? According to the first url, cng.sys version should be the same than the validated on the list. What if my cng.sys version is not contained in that list?

  • 1
    Try running the command sfc /scannow in an elevated command prompt (with administrative privileges). It will go through all protected system files and check their hash against known good hashes of those files. Basically if anything is wrong it will attempt to auto repair. If it can't fix a problem it will tell you. – Jonathan Gray Dec 16 '15 at 8:23
  • Hi Jonathan. My problem is completely different, I do not want to check the integrity of all my files. What I want is to validate if my system is using FIPS 140-2 properly. Thanks for your comment! – Víctor DMS Dec 16 '15 at 9:25
  • 1
    If your cng.sys version isn't contained in the list, it's a sign that the file itself might have been compromised/replaced with a non-legit version. That's why I suggested using the system file checker. However I just found this, which might explain the version difference: tools.cisco.com/security/center/viewAlert.x?alertId=37253 Since you're running Windows 7, the file version should start with 6.1 regardless. – Jonathan Gray Dec 16 '15 at 9:31
  • Thanks for the feedback Jonathan. It is not necessary that my cng.sys had been replaced, maybe my version had been validated for unknown reasons. A system could be FIPS compliance or not, in that list there are only the versions which FIPS have validated. – Víctor DMS Dec 17 '15 at 11:46
  • My point is, I am the owner of the system and I am not taking in count that somebody replace my binaries, that is another matter. What I want is a way which I can replace my non validated binaries with the ones that had been validated. – Víctor DMS Dec 17 '15 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.