While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the highest level is actually level 4, which is only to available to government workers. Why is it only available to them and is FIPS level 3 safe from the government trying to hack into it?
When based on a standard, especially those as stringent as FIPS 140-2, you have to go through the following processes (which are time consuming and expensive):
If you take a look at the NIST Implementation Guide for FIPS PUB 140-2, along with the other documents, you can search for the Level 4 implementation which detail that this is designed to be tamper-proof.
It is considered "overkill" for most businesses and even personal use because it protects against "drilling, milling, cutting, burning, melting, grinding or dissolving the epoxy or potting material, in order to gain access to the underlying circuitry." It is also meant to protect against environmental factors. This is your doomsday USB standard, where you under no circumstances can lose or leak the data.
It is a very aggressive set of requirements that is very likely not very economical if you intend to sell it to a consumer, for the same reason a crash-proof car is feasible, but your average person is not willing to pay the price or deal with the complexities involved.
This explains why government entities can have this kind of technology:
- They are not a profit seeking entity, technically.
- They are not restricted by the requirements of making a product marketable, they are their own customer (and other governments, too).
- They have schools, renowned labs, and dedicated facilities at their beck and call to build "cool" things in the name of safety, public service, defense, or what have you.
Bear in mind that building cryptographic devices, especially at the hardware level, is not a fool's errand.
is FIPS level 3 safe from the
governmentanyone trying to hack into it?
realize the Federal Information Processing Standards publication 140-2 is a spec that something is designed and built to which then gets that certification. Per your question does FIPS 140-2 level-3 protect against hacking, I would say the real world answer is NO. Because it is up to the honesty & integrity & capability of the manufacturer building the device, and in the end the cold hard truth is there is no honesty nor ethics in the realm of (among other things) computer security, and the FIPS 140-2 level x can be used as a marketing ploy. We would have to have a huge open discussion and look for the loop holes in wording of the standard as well as background check and oversee everyone signing off stating whatever device is FIPS compliant.
Rather than take some certification sheet at face value, example off top of my head: VW said their diesel vehicles met emission standards and at one point were certified for sale but we know how that turned out - Volkswagen emissions scandal 2015. Fraud knows no bounds.
Yes there is Level 4 devices available today on the market - following PCI Crypto Express card which is FIPS 140-2 Level 4 certified, from IBM is available for purchase - for most countries and enterprises - and works with x86, Power and of course z Systems.