2

Does either FIPS 140-2 or FIPS 140-3 certification require USB flash drive's firmware to be signed so that malicious computer cannot overwrite flash drive's firmware? e.g. badusb attack.

If I buy any FIPS 140 certified USB flash drive can I be sure that it's firmware is signed?

2
  • USB drive (NOT a rubber ducky) firmware cannot be overwritten, that's a common misconception stemming from a decade-ago small batch of pre-USB3-spec drives that used general purpose MCUs (Phison 2303) because single-purpose USB3 thumb drive chips didn't exist at the time. They charged a lot for the drive, so an extra buck or two for the programmable micro was no biggie. Virtually every other commercial thumb drive uses dedicated ICs or ASICs which have only ROM (flash and EEPROM are costly and not needed).
    – dandavis
    Commented Aug 4, 2021 at 19:41
  • @dandavis Yes, a mask ROM inside a USB Flash Controller cannot be overwritten, but the firmware can be placed on the big flash storage chip with a small bootloader in the mask ROM. Then the program code stored in the small mask ROM is just some kind of pointer to the actual firmware, which can be overwritten.
    – user186877
    Commented Sep 4, 2021 at 16:04

1 Answer 1

1

FIPS 140-2 is available for everybody:

https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf

Page 36 you can read:

All cryptographic software and firmware shall be installed in a form that protects the software and firmware source and executable code from unauthorized disclosure and modification.

So, FIPS 140-2 doesn't enforce the how (aka using signed firmware) but it enforces the what (prevent firmware modification).

2
  • FIPS 140-2 was superseded by FIPS 140-3 in 2019. FIPS 140-3 point to and aligns with ISO/IEC 19790:2012(E) Information technology — Security techniques — Security requirements for cryptographic modules,
    – fpmurphy
    Commented Aug 3, 2021 at 13:39
  • @FPU sure, when you summarize a 26 words sentence by only 6 words , it obviously become unclear .... Please, read again (and carefully) the sentence i quoted: "All cryptographic software and firmware shall be installed in a form that protects the software and firmware source and executable code from unauthorized disclosure and modification."
    – binarym
    Commented Sep 7, 2021 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .