Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [fips]

Federal Information Processing Standards (FIPS) are a set of US government security standards.

-1
votes
1answer
67 views

What is the open source equivalent to a FIPS 140-2 certification

What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a ...
2
votes
2answers
147 views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
1
vote
0answers
212 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
3
votes
4answers
4k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
0
votes
3answers
414 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
2
votes
1answer
224 views

How do I share a password in a FIPS-compliant manner?

This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, ...
3
votes
0answers
871 views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
0
votes
1answer
129 views

Difference between FIPS 196 and SSL for authentication?

I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is ...
0
votes
1answer
77 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
0
votes
1answer
106 views

Is ESP without AH considered noncompliant with FIPS 140-2?

I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails: ip xfrm state ...
1
vote
0answers
255 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
3
votes
1answer
328 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
2
votes
2answers
118 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
1
vote
0answers
31 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
4
votes
0answers
853 views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
1
vote
0answers
112 views

Is Windows certificate store FIPS 140-2 level 1 certified?

I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question: If I do have the following requirement: ...
0
votes
1answer
250 views

how to generate a pem certificate with Openssl using 'TLS1_ECDHE_RSA' ciphers for fips platform [closed]

I am testing some ECDHE_RSA ciphers on FIPS platform But the handshake is failing because of the cert and key I am using on Server in OpenSSL. Same cert and Key are working fine if the platform is ...
1
vote
1answer
428 views

Windows 10 FIPS140 Bitlocker without using System Cryptography policy

We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls? ...
1
vote
0answers
511 views

Microsoft CryptoAPI FIPS 140-2

My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
2
votes
1answer
72 views

Are RFC 2104 and FIPS 198 compatible with each other?

Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?
1
vote
0answers
448 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
0
votes
1answer
779 views

SSL/TLS - Certificate chain validation result in “Invalid authentication type: DHE_RSA”

I have an application that connects to a remote web service deployed on HTTPS. Our application uses FIPS-140 Level-1 for SSL/TLS connectivity, and is based on JCE providers of RSA (the company). com....
4
votes
1answer
958 views

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
2
votes
1answer
246 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
4
votes
2answers
557 views

use of PRNG in OpenSSL - fips mode

I am working on a centos based network device , required to pass fips 140-2 level 2. I plan to use openssl in fips mode and CTR_DRBG will use as PRNG. will this be enough for meeting NIST SP 800-90 ...
3
votes
2answers
2k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
2
votes
1answer
557 views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
1
vote
1answer
223 views

Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?

I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
1
vote
0answers
127 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
4
votes
3answers
5k views

Why aren't there FIPS level 4 devices on the market?

While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the ...
4
votes
1answer
144 views

FIPS-2 assumptions (CJIS)

I feel more like a lawyer than an IT admin today. When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm ...
0
votes
1answer
2k views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
2
votes
2answers
648 views

What's the difference between the same model with and without FIPS 140 certification?

We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
3
votes
2answers
1k views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
4
votes
0answers
289 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
1
vote
0answers
227 views

OpenSSL is not giving correct result for encryption and decryption for FIPS test vector for AES -CFB1

I am running FIPS test vectors against AES-CFB. I am getting correct results for aes-cfb128 and aes-cfb8 but getting wrong results for aes-cfb1. The values being used by me for aes-cfb1 tests are: ...
5
votes
2answers
3k views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
12
votes
2answers
4k views

Why should I choose SHA (such as SHa-512), instead of bcrypt or PBKDF2, for FIPS-compliance?

Due to regulation, my company needs to be FIPS-compliant. I was looking at the current list of FIPS-approved cryptographical methods and I notice that neither bcrypt or PBKDF2 are in this list. Does ...
2
votes
1answer
1k views

RSA BSAFE Crypto-J JCE provider - “Server Hello” returns unassigned Named Curve

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). when I use any elliptic curve based key exchange mechanism the handshake fails ...
2
votes
3answers
906 views

Named curve value 0xffff in 'Server Hello' message

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). It seems like at least Chrome and Firefox cannot establish a connection if ...
3
votes
1answer
401 views

Can my software get FIPS 140-2 certified?

I am starting the early stages of researching the possibility of getting FIPS 140-2 certified, but I have run into some confusion. To start, our software is written in Java and does not actually do ...
4
votes
2answers
383 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
0
votes
1answer
130 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
3
votes
2answers
372 views

HSM maintenance

I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I ...
0
votes
1answer
1k views

US FIPS equivalent of ISO 27001?

I am familiar with the US government's FIPS standards, like FIPS 140, policies and procedures; and security controls like those enumerated in SP800-53. I am less familiar with ISO 27001. A preview of ...
2
votes
1answer
448 views

How is ECIES available in FIPS Validated libraries?

ECIES is Elliptic Curve Integrated Encryption Scheme. Both Certicom's SecurityBuilder and RSA Data Security BSAFE provide ECIES. Both are FIPS 140 validated, and both clearly list ECIES in their data ...
2
votes
1answer
821 views

OpenSSL implemented AES not according to NIST?

I have been using the Encryption/Decryption code from https://wiki.openssl.org/index.php/EVP_Symmetric_Encryption_and_Decryption. The NIST test vectors (http://csrc.nist.gov/groups/STM/cavp/) for AES ...
1
vote
0answers
417 views

FIPS_mode_set failed: f06d065

I execute the following code in Netbeans and get the error : FIPS_mode_set failed: f06d065. How to enable FIPS mode and get the code running? #include <openssl/crypto.h> int main() { int mode ...
2
votes
3answers
5k views

Is it possible to wrap and export RSA private key in FIPS 140-2 Level 3 compliant hardware?

I would like to do the following on FIPS 140-3 Level 3 certified cryptographic token using PKCS#11: Generate RSA key pair on token Import AES key from multiple components Wrap and export RSA private ...
0
votes
1answer
477 views

PCI compliant RSA key generation and getting value of private exponent

Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?: Keys must be generated so that it is not feasible to determine that ...