Questions tagged [fips]
Federal Information Processing Standards (FIPS) are a set of US government security standards.
104
questions
3
votes
1
answer
299
views
When is FIPS certification important?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
- 185
1
vote
0
answers
62
views
Does openssl3.1 support UEFI target with FIPS enabled?
I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
- 111
1
vote
0
answers
287
views
How can I FIPS enable openssl3 on yocto linux?
I'm running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it.
I know FIPS is ...
- 11
2
votes
1
answer
56
views
What FIPS 140-2 expects for secret keys passed as arguments of a methods?
I don't get exactly what FIPS 140-2 expects when your method receives secret keys via arguments. For example, in a lot of FIP-compliant libraries such as OpenSSL, we have a method like this:
int ...
- 123
1
vote
0
answers
153
views
How to achieve an authentication method FIPS 140-3?
I've been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not:
1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that ...
- 11
3
votes
2
answers
2k
views
Does OpenSSL 3.0 FIPS support TLSv1 and TLSv1.1?
OpenSSL 3 migration guide doesn't mention anything about TLSv1 and TLSv1.1
FIPS provider doesn't mention it as well.
But my understanding is that TLSv1 and TLSv1.1 isn't supported by FIPS provider as ...
2
votes
2
answers
215
views
FIPS 140-2 compliance implementation
I'm quite new to the security topic and encryption.
Our software has to comply with FIPS 140-2. I have the following method (C#).
In this case, the algorithm is AES256.
What concerns me, is that we ...
3
votes
1
answer
185
views
Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?
To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
- 281
1
vote
0
answers
27
views
Do comparable standards like FIPS exist for Germany or the European Union? [duplicate]
NIST, the National Institute of Standards and Technology, does publish FIPS, the Federal Information Processing Standards Publications.
Does Germany or the European Union have their own standards?
Or ...
- 21
0
votes
0
answers
140
views
Validate the conformance of an OpenSSL created certificate with FIPs standards
Trying to test the conformance of the certificates inside our application, with the below requirement:
The application shall [selection: invoke platform-provided
functionality, implement ...
- 109
2
votes
1
answer
277
views
If I buy any FIPS 140 certified USB flash drive can I be sure that it's firmware is signed?
Does either FIPS 140-2 or FIPS 140-3 certification require USB flash drive's firmware to be signed so that malicious computer cannot overwrite flash drive's firmware? e.g. badusb attack.
If I buy any ...
- 21
1
vote
2
answers
192
views
Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?
My Challenge
My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
- 113
0
votes
1
answer
2k
views
FIPS compliant passwords protection/encryption?
Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
- 201
99
votes
5
answers
49k
views
What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000
The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3
Over 14,000 SEK difference in price. ...
- 477
0
votes
1
answer
253
views
What does it mean to be FIPS 140-2 compliant?
We have a product that uses Apache HTTPD, Tomcat, and MongoDB. It uses OpenSSL for HTTPS connection and Bouncy Castle library for the encryption of data in the database.
What does it mean to be FIPS ...
- 1,479
0
votes
1
answer
81
views
What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is.
Is it all internal ...
- 111
1
vote
1
answer
280
views
Is running software in Docker an allowable way to bypass FIPS 140-2 issues?
Someone has a service that uses a FIPS non-compatible hash in a protocol signature. When FIPS 140-2 compatibility is enabled on the hosts the service crashes (due to the hash signature being not ...
- 11
2
votes
0
answers
277
views
Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL
Appreciate any help on the following.
Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'.
Thus, my application binary (FipsApp....
- 233
1
vote
0
answers
226
views
Is Yubikey HSM2 FIPS Compliant?
I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series.
(https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search)
...
- 111
0
votes
1
answer
1k
views
Should I remove all non-FIPS providers from java.security to be FIPS-compliant?
I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security:
security.provider.1=SUN ...
- 201
-1
votes
1
answer
670
views
What is the open source equivalent to a FIPS 140-2 certification
What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a ...
- 107
3
votes
2
answers
1k
views
Is Blowfish validated against any standards?
OWASP ASVS 3.0 V7.7 states the following:
Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard.
Blowfish is not included in ...
- 33
1
vote
0
answers
463
views
Hardware-based password manager with per-password verification [closed]
I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies.
Unfortunately, the Trezor only stores a ...
4
votes
4
answers
14k
views
Hardware-Based Password Manager [closed]
I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits.
First I would like to ...
- 43
0
votes
4
answers
906
views
Token FIPS 140-2 level 3 with support for Android, iPhone and Web
I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines.
I would like to create applications that use level 3 tokens. Is ...
- 103
2
votes
1
answer
488
views
How do I share a password in a FIPS-compliant manner?
This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, ...
- 23
6
votes
1
answer
2k
views
What is the general approach to create FIPS compliant SSH?
Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant.
From what I've discussed with ...
- 281
0
votes
1
answer
342
views
Difference between FIPS 196 and SSL for authentication?
I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is ...
- 187
0
votes
1
answer
340
views
Key Generation on FIPS device or using SW with FIPS generator
I would like to understand the difference between these two options how to generate AES key.
AES key is generated directly in FIPS 140-2 Level 3 device with validated AES
algorithm
AES key is ...
- 1,119
0
votes
1
answer
277
views
Is ESP without AH considered noncompliant with FIPS 140-2?
I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails:
ip xfrm state ...
- 111
1
vote
0
answers
633
views
Weighing options for personal HSM?
I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
- 111
4
votes
1
answer
804
views
What are vendor affirmed algorithms in FIPS 140-2
FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
- 183
2
votes
2
answers
199
views
Conflicting requirements in FIPS 140-2 regarding manual key entry
Requirement 1
All output data exiting the cryptographic module via the "data output"
interface shall only pass through the output data path. The output data path shall be logically disconnected
...
- 183
1
vote
0
answers
76
views
Are protocol implementations also tested as part of FIPS certification?
I just went to CMVP website and opened a random FIPS certificate.
https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898
In the FIPS certificate, FIPS algorithms ...
- 183
4
votes
0
answers
2k
views
Generating RSA keys per the FIPS 186-4 standard
my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
- 41
1
vote
0
answers
352
views
Is Windows certificate store FIPS 140-2 level 1 certified?
I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question:
If I do have the following requirement:
...
- 2,788
0
votes
1
answer
944
views
how to generate a pem certificate with Openssl using 'TLS1_ECDHE_RSA' ciphers for fips platform [closed]
I am testing some ECDHE_RSA ciphers on FIPS platform But the handshake is failing because of the cert and key I am using on Server in OpenSSL.
Same cert and Key are working fine if the platform is ...
- 101
1
vote
1
answer
639
views
Windows 10 FIPS140 Bitlocker without using System Cryptography policy
We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls?
...
- 121
1
vote
0
answers
1k
views
Microsoft CryptoAPI FIPS 140-2
My customer asks me to use FIPS 140-2 validated cryptographic libraries.
Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
- 143
2
votes
1
answer
123
views
Are RFC 2104 and FIPS 198 compatible with each other?
Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?
- 131
1
vote
0
answers
783
views
Ssh and fips mode
I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu )
As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
- 81
0
votes
1
answer
1k
views
SSL/TLS - Certificate chain validation result in "Invalid authentication type: DHE_RSA"
I have an application that connects to a remote web service deployed on HTTPS.
Our application uses FIPS-140 Level-1 for SSL/TLS connectivity, and is based on JCE providers of RSA (the company).
com....
- 133
5
votes
1
answer
2k
views
FIPS 140-2 ready linux distribution
We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space.
So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
- 153
2
votes
1
answer
753
views
SELinux related to fips 140-2?
I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros.
Is SELinux somehow related to FIPS requirements?
...
- 81
4
votes
2
answers
1k
views
use of PRNG in OpenSSL - fips mode
I am working on a centos based network device , required to pass fips 140-2 level 2.
I plan to use openssl in fips mode and CTR_DRBG will use as PRNG.
will this be enough for meeting NIST SP 800-90 ...
- 81
3
votes
2
answers
5k
views
Full Disk Encryption and FIPS
I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
- 183
3
votes
1
answer
1k
views
In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)
There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
- 31
1
vote
1
answer
355
views
Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?
I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
- 123
1
vote
0
answers
205
views
If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?
If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
5
votes
3
answers
10k
views
Why aren't there FIPS level 4 devices on the market?
While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the ...
- 244