4

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be done with Approved algorithms.

FIPS 140-2 places very stringent requirements on the cryptographic module, and it places a very stringent test process on that cryptographic module.

What is unclear to me is when those Approved algorithms must actually be used.

For example, I cannot telnet into the device; I must use SSH. This makes perfect sense.

Similarly, I am forbidden from using HTTP to access the device's web interface. I must use HTTPS. Again, this makes perfect sense.

There are restrictions on the way I can perform remote authentication when logging into the switch. And so on and so forth...

On the other hand, when I configure syslog on the device, it is not forcing authentication and encryption upon the traffic it sends out to the collectors / relays.

Likewise with SNMP. The only thing it requires of me is that I disable SET operations. You can read from the device or receive traps all you want with no authentication or encryption. I don't even have to use SNMPv3 (which makes authentication and encryption available). It's perfectly happy to allow a read using SNMPv1 with the plaintext "public" community string.

If one wants to operate a FIPS 140-2 validated device in a FIPS-compliant manner, how do you know when you must use the Approved cryptographic algorithms the device makes available?

Improve this question

2 Answers 2

Reset to default
3

Every FIPS 140-2 device must have a publicly available non-proprietary Security Policy document which is obtainable from the FIPS 140 program web site (CMVP - http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm). Although some Security Policies are far better written than others, there is a minimum requirement for these documents that should explain how to get a module into a FIPS approved mode of operation and what cryptographic services are available while in this mode of operation.

Improve this answer
0

I'm thinking that if the FIPS-validated and FIPS-enabled network switch will allow me to get away with something (such as not securing syslog traffic, to reference the example in my original post), then I don't need to do that something in order to be operating in a FIPS-compliant manner.

Any disagreement?

Improve this answer
1
  • If you're required to be FIPS validated, then you shouldn't be assuming, you should be reading compliance documentation and following the rules.
    – Anti-weakpasswords
    Mar 3, 2016 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .