4

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be done with Approved algorithms.

FIPS 140-2 places very stringent requirements on the cryptographic module, and it places a very stringent test process on that cryptographic module.

What is unclear to me is when those Approved algorithms must actually be used.

For example, I cannot telnet into the device; I must use SSH. This makes perfect sense.

Similarly, I am forbidden from using HTTP to access the device's web interface. I must use HTTPS. Again, this makes perfect sense.

There are restrictions on the way I can perform remote authentication when logging into the switch. And so on and so forth...

On the other hand, when I configure syslog on the device, it is not forcing authentication and encryption upon the traffic it sends out to the collectors / relays.

Likewise with SNMP. The only thing it requires of me is that I disable SET operations. You can read from the device or receive traps all you want with no authentication or encryption. I don't even have to use SNMPv3 (which makes authentication and encryption available). It's perfectly happy to allow a read using SNMPv1 with the plaintext "public" community string.

If one wants to operate a FIPS 140-2 validated device in a FIPS-compliant manner, how do you know when you must use the Approved cryptographic algorithms the device makes available?

3

Every FIPS 140-2 device must have a publicly available non-proprietary Security Policy document which is obtainable from the FIPS 140 program web site (CMVP - http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm). Although some Security Policies are far better written than others, there is a minimum requirement for these documents that should explain how to get a module into a FIPS approved mode of operation and what cryptographic services are available while in this mode of operation.

0

I'm thinking that if the FIPS-validated and FIPS-enabled network switch will allow me to get away with something (such as not securing syslog traffic, to reference the example in my original post), then I don't need to do that something in order to be operating in a FIPS-compliant manner.

Any disagreement?

  • If you're required to be FIPS validated, then you shouldn't be assuming, you should be reading compliance documentation and following the rules. – Anti-weakpasswords Mar 3 '16 at 3:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.