What drives FIPS140-2 compliance?

Question

I guess this questions is directed at Product Managers, but I would be very interested to learn what people in the know think.

What are the most common factors that drives FIPS140-2 compliance for hardware modules? Why do you want/need to implement FIPS140 compliant security in your products?

Here are a few reasons I can think of:

• Market Demand:

• Customer (government) demand

• Customer (individuals) demand

• Customer (corporate) demand

• Market acceptance/expectancy

• Marketing

• Corporate IT Security Policy/Security Posture; (e.g. less likely to get hacked if using FIPS140 compliant modules)

• To mitigate against present/future attacks; co mitigate past security holes

• Bragging rights; just because you can; to prove you can do it

• Because it is easy to bring into compliance

• Because it is inexpensive to bring into compliance

Answer 1

When you are protecting more than your twitter account, it would be nice to know that whatever algorithm that's being used to protect credentials, or key exchanges, or whatever other crypto that's being used, is protected in a nice professional manner. There are A LOT of vendors that could not care less how well something is implemented, as long as it's selling well. Great majority of users don't care, or does not know how to verify 'correctness' of all the devices/mechanisms they're using.

To get that FIPS cert, the product goes through a lengthy, expensive, and rather in depth process of verification. That forces vendors to do a better job developing and testing their products, than just slapping 'Now with more security!' sticker on it.

This way, a non-crypto-trained personnel can purchase products, and if it comes with a FIPS cert, it means that the assurance comes from a lab that put the product through at least some verification, and not the vendor's marketing department.

No, it's not perfect, and it is expensive and time consuming, but some things demand the 'no-kidding' security.

Answer 2

It is driven entirely by US Government demand.

FIPS stands for Federal Information Processing Standards which are US Government standards.

No one else cares about it except them. Others claim to care about it only because it is widely adopted by the "big boys". Look around at FIPS 140-2 requirements in other nations. There are virtually none except for those who wish to sell electronics or software to the North American market. Other countries do levy cryptographic requirements for localized procurement and the extent of those requirements may borrow heavily from prior work putting FIPS together, but they are different and largely non-interchangeable programs.