4

I am starting the early stages of researching the possibility of getting FIPS 140-2 certified, but I have run into some confusion. To start, our software is written in Java and does not actually do any of the encryption/decryption, currently that is done by BouncyCastle libraries and the hope is that when BouncyCastle becomes FIPS certified our product can become FIPS certified as well.

The problem I am having is right in the first line, that is what FIPS 140-2 defines as a cryptographic module, it states:

A cryptographic module shall be a set of hardware, software, firmware, or some combination thereof that implements cryptographic functions or processes, including cryptographic algorithms and, optionally, key generation, and is contained within a defined cryptographic boundary.

Since our software is not actually implementing any of these algorithms, we are just using a service provider, does this mean that our product can not be certified? Are we stuck in the FIPS complaint zone? If our software can get FIPS 140-2 certified what would the testing labs actually look at since our software does not do any of the processing?

I have gone through many of the FIPS 140-2 certified projects and it seems that my fears may be true. Most things that are certified are proprietary cryptographic libraries that are used by larger software projects such as the Windows 8 cryptographic kernels and Symantic cryptographic libraries.

Improve this question

1 Answer 1

Reset to default
2

My understanding of the FIPS 140-2 standards, unfortunately, aligns with your fear.

As far as I understand, the FIPS 140-2 standards are about proving that you handle private keys in a responsible way. If your software lets Bouncy Castle touch the private keys, then even if you wrote the most secure software in the world, your overall product is only as secure as Bouncy Castle :-(

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .