FIPS 140-2 compliance implementation

Question

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we use SHA1 to hash the key. It is acceptable to use SHA1 here, or is it breaking FIPS compliance?

Thanks!

public static ServiceEncryptionKey CreateNew(ServiceEncryptionAlgorithm algorithm)
{
    byte[] keyData;
    using (var key = CreateSymmetricAlgorithm(algorithm))
    {
        key.GenerateKey();
        keyData = key.Key;
    }

    byte[] keyHash;
    using (SHA1Cng sha = new SHA1Cng())
    {
        keyHash = sha.ComputeHash(keyData);
    }
    
    try
    {
        return new ServiceEncryptionKey(algorithm, new ProtectedBytes(keyData), keyHash);
    }
    finally
    {
        Array.Clear(keyData, 0, keyData.Length);
    }
}

private ServiceEncryptionKey(ServiceEncryptionAlgorithm algorithm, ProtectedBytes keyData, byte[] keyHash)
    {
        this.Algorithm = algorithm;
        this.protectedKeyData = keyData;
        this.header = new byte[16 + keyHash.Length];
        this.KeyHash = (byte[])keyHash.Clone();
        Buffer.BlockCopy(new Guid("00000000-0000-0000-0000-000000000000").ToByteArray(), 0, this.header, 0, 16);
        Buffer.BlockCopy(keyHash, 0, this.header, 16, keyHash.Length);
    }

internal ProtectedBytes(byte[] plaintext)
    {
        this.ciphertext = new byte[(plaintext.Length + 0xF) & ~0xF];
        Buffer.BlockCopy(plaintext, 0, ciphertext, 0, plaintext.Length);
        ProtectedMemory.Protect(ciphertext, MemoryProtectionScope.SameProcess);
        this.plaintextLength = plaintext.Length;
    }

Answer 1

SHA-1 is still in approved in the latest FIPS-140-2 Annex A. However NIST SP 800-131A REV. 2 deprecated SHA-1 for some uses.

I'd investigate moving to SHA-2 or better wherever possible for future proofing (and conformance to less lenient standards).

Answer 2

Your code has problems.

At the end you clear keyData, which is good. This makes sure a memory dump will not contain the encryption key.

1. But you use ProtectedBytes. Without source code it is hard to tell what is it doing. But if the key can be extracted from this object, then this is a problem.

2. The purpose of the ServiceEncryptionKey is not clear. If you use the hash for encryption, then the effective encryption key remains in the memory and thus can be retrieved via memory dump. That's why clearing keyData at the end does not make the code any more secure.