3

I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. This question's answer suggests to me that the FIPS certification doesn't really mean much in terms of security.

Is FIPS a good measurement of security? When is it important to make sure a device has FIPS?

1 Answer 1

2

It's only really important if you're working for an organisation or under a contract that requires FIPS compliance - which usually means handling sensitive data for the US government.

It doesn't necessarily mean that the device or system or any more secure than one that isn't FIPS certified. And because the certification process is slow, it can mean that you don't have access to the latest and greatest features (often not a bad thing).

For a normal user buying Yubikeys, there is no benefit to paying extra for FIPS compliant ones.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .