I would like to understand the difference between these two options how to generate AES key.

  1. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm
  2. AES key is generated using BouncyCastle library and SecureRandom source is provided from FIPS 140-2 Level 3 device with validated RNG.

Are these two options equivalent in terms of security?


From a technical standpoint, not really. If you want to adhere to FIPS 140-2 Level 3 requirements, absolutely not.

FIPS 140-2 Level 3 has very specific requirements, including resistance to information leakage when an attacker has some restricted level of physical access to the device. This means that a certified implementation must ensure that the implementation of key generation and the cipher itself is resistant to side-channel attacks such as power analysis and electromagnetic emissions. Level 3 devices undergo rigorous EMC testing above and beyond that of normal electronic products. By taking key material from a FIPS 140-2 Level 3 device and transforming it needlessly on a non-compliant device (e.g. a general purpose computer) you nullify the EMC protection that the device offers, and potentially offer up other side-channels in the process.

  • When I would like to adhere that the AES generation must take place in FIPS 140-2 Level 3 device, what would be the difference on generating AES in such device, or providing me with random data through its certified RNG? AES key (in case of AES-128) is a random key and my RNG is on FIPS 140-2 Level 3 device so all the key data are random generated on device which should ensure protection from side channels, etc. – user1563721 Feb 9 '18 at 16:18
  • @user1563721 The problem is that the secondary key derivation that you perform outside of the certified device may leak the random data that was provided, via side-channel vulnerabilities. You can generate random data in the world's most secure HSM using all manner of technical wizardry and defense mechanisms, but if you spit that data out to a system that immediately leaks the data then there wasn't much point of having the validated RNG. You need to keep the crytographic operations on the non-compliant system to a bare minimum. – Polynomial Feb 9 '18 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.