2

As I understand it, if you want to be FIPS-compliant you have to use FIPS-certified components. My question is how different can your use of the component by from what's on the component's validation certificate be for you to still be using a FIPS-certified component?

For example, here's a validation certificate for NSS: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140crt/140crt1280.pdf

The certificate says the NSS software version is 3.12.4 and was tested on RHELv5 on an IBM System x3550 and on a HP ProLiant DL 145.

I assume (?) that I definitely need to use version NSS 3.12.4 since that is the version that certificate says was validated. (For the moment I'm ignoring the possible existence of later certified versions of NSS -- pretend this one is the latest one if it's not).

But what about the operating system and server hardware? If I run NSS 3.12.4 in an Ubuntu installation am I still considered to be using a FIPS-certified component? What if I run it on RHELv5 but on hardware different from what was mentioned on the validation certificate?

Update:

I'll try to be clearer/more explicit...

Is NSS 3.12.4 considered validated/certified when run on any operating system or only when run on RHELv5? And how does one determine the answer to that question?

Improve this question

1 Answer 1

Reset to default
2

They certified only the module described in the document. They did not certify the ProLiant was FIPS compliant, and they did not certify that the Red Hat OS was FIPS compliant. That just happened to be the machine and environment they used when they tested the compliance of the module.

According to FIPS 140-2 paragraph 10, they allow for the certification of a hardware module, a software module, or a combination of both. It's up to the security system provider what they are requesting to certify. But the only thing that is actually certified is what they write on the certificate.

Improve this answer
2
  • 1
    I understand that they are not certifying the ProLiant or RHEL as FIPS-compliant. I'm asking the in other direction -- if I use the certified software module on, say Ubuntu, is the module still considered certified? Or is it only considered certified if it's being used with RHELv5?
    – QuantumMechanic
    Feb 13, 2015 at 16:14
  • 1
    Yes, the module is still certified if you use it in a different environment.
    – John Deters
    Feb 15, 2015 at 3:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .