How to apply FIPS to Microsoft Access database with custom VBA

Question

As the software engineer on a project, I have been asked to make a Microsoft Access application, with custom interfaces running custom VBA. That part is going just fine. Recently though I was asked to ensure that my Access application complies with FIPS 140-2. The deployment and maintenance of this application will be handled by another partner company, they are the ones asking for FIPS compliancy.

I have read the documentation for FIPS 140-2 and I understand its purpose. Level 1 FIPS compliance is all that is required in our situation. I have written a module in VBA to hash the passwords with SHA-1 used for logging into the application. SHA-1 is on the list of FIPS 140-2 approved algorithms.

My question is, what else does a software developer have to do to ensure FIPS 140-2 compliance, and how much falls in the shoulders of the contractor deploying the application on their systems?

The Access application is split, so the back-end file will live on a network share and regular users will only have access to the front-end file. I suppose both the back-end and front-end files could be encrypted, but that seems to be part of the deployment process.

Answer 1

As the software developer, you need to ensure that not only the chosed encryption standard is FIPS compliant, but also the cryptographic module used. AES for example is FIPS 140-2 approved as a method, but the actual implementation of the Rijndael algorithm on Windows Server 2008 [not R2] is not approved (and is therefore not FIPS compliant ... you'd have to use 3DES or something else).

For completeness, the complete list of validated modules are available here: http://csrc.nist.gov/cryptval/140-1/140val-all.htm

To ensure FIPS compliance you'll also want the system that this is running on to enforce FIPS. On a windows system this is under the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy

Change the DWORD value of ENABLED to 1. As a developer you'll want to test in this mode.

Ensuring that the communication channels and that the server/workstation/etc. running the application are FIPS compliant will be part of the deployment process where there is little that you can do should a separate contractor be working the installation.

Answer 2

A security requirement that demands FIPS140-2 for compliance only applies to security functions. When it comes to home grown software the big security functions are usually encryption of the data that is being controlled or some sort of login feature.

The best way to make compliant software is to avoid providing any security functions. So in my example;

1. Don't try to roll your own login system in to your Access app.
2. Don't store any controlled information in the database that requires encryption.

If the nature of your DB requires it handle the controlled information then your best bet is to leverage FIPS validated cryptographic providers in the OS.

You mention rolling your own SHA-1 and ask about handling everything yourself in VBA. This is unadvised because if you do then you need to apply for FIPS validation. Most software developers want avoid this long, expensive, process because it has to be repeated every time you change something or the validation expires. Why would you do all that when the OS has validated libraries you can use?