Questions tagged [fips]

Federal Information Processing Standards (FIPS) are a set of US government security standards.

Filter by
Sorted by
Tagged with
2 votes
2 answers
79 views

FIPS 140-2 compliance implementation

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we ...
3 votes
1 answer
46 views

Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?

To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
  • 251
0 votes
0 answers
22 views

Do comparable standards like FIPS exist for Germany or the European Union? [duplicate]

NIST, the National Institute of Standards and Technology, does publish FIPS, the Federal Information Processing Standards Publications. Does Germany or the European Union have their own standards? Or ...
0 votes
0 answers
48 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
0 votes
0 answers
80 views

OpenSSL 1.0.2, for 32 bit FIPS, is doing a base-address verification. Where and how is that implemented?

We build OpenSSL in FIPS mode, to be used as a DLL. According to the OpenSSL FIPS module (https://www.openssl.org/docs/fips/UserGuide-1.2.pdf), we supply a parameter to the compiler --with-baseaddr=...
  • 1
2 votes
1 answer
156 views

If I buy any FIPS 140 certified USB flash drive can I be sure that it's firmware is signed?

Does either FIPS 140-2 or FIPS 140-3 certification require USB flash drive's firmware to be signed so that malicious computer cannot overwrite flash drive's firmware? e.g. badusb attack. If I buy any ...
1 vote
2 answers
150 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
  • 113
0 votes
1 answer
575 views

FIPS compliant passwords protection/encryption?

Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
  • 191
99 votes
5 answers
48k views

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000 The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3 Over 14,000 SEK difference in price. ...
  • 477
0 votes
1 answer
180 views

What does it mean to be FIPS 140-2 compliant?

We have a product that uses Apache HTTPD, Tomcat, and MongoDB. It uses OpenSSL for HTTPS connection and Bouncy Castle library for the encryption of data in the database. What does it mean to be FIPS ...
  • 1,457
0 votes
1 answer
75 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
1 vote
1 answer
198 views

Is running software in Docker an allowable way to bypass FIPS 140-2 issues?

Someone has a service that uses a FIPS non-compatible hash in a protocol signature. When FIPS 140-2 compatibility is enabled on the hosts the service crashes (due to the hash signature being not ...
2 votes
0 answers
220 views

Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL

Appreciate any help on the following. Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'. Thus, my application binary (FipsApp....
  • 233
1 vote
0 answers
196 views

Is Yubikey HSM2 FIPS Compliant?

I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series. (https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search) ...
0 votes
1 answer
859 views

Should I remove all non-FIPS providers from java.security to be FIPS-compliant?

I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security: security.provider.1=SUN ...
  • 191
-1 votes
1 answer
493 views

What is the open source equivalent to a FIPS 140-2 certification

What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a ...
  • 107
3 votes
2 answers
1k views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
1 vote
0 answers
451 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
4 votes
4 answers
13k views

Hardware-Based Password Manager [closed]

I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I would like to ...
0 votes
4 answers
771 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
2 votes
1 answer
423 views

How do I share a password in a FIPS-compliant manner?

This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, ...
5 votes
0 answers
2k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
0 votes
1 answer
299 views

Difference between FIPS 196 and SSL for authentication?

I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is ...
  • 187
0 votes
1 answer
266 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
  • 1,099
0 votes
1 answer
230 views

Is ESP without AH considered noncompliant with FIPS 140-2?

I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails: ip xfrm state ...
1 vote
0 answers
520 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
  • 111
4 votes
1 answer
658 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
2 votes
2 answers
189 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
1 vote
0 answers
71 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
4 votes
0 answers
1k views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
  • 41
1 vote
0 answers
285 views

Is Windows certificate store FIPS 140-2 level 1 certified?

I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question: If I do have the following requirement: ...
0 votes
1 answer
710 views

how to generate a pem certificate with Openssl using 'TLS1_ECDHE_RSA' ciphers for fips platform [closed]

I am testing some ECDHE_RSA ciphers on FIPS platform But the handshake is failing because of the cert and key I am using on Server in OpenSSL. Same cert and Key are working fine if the platform is ...
  • 101
1 vote
1 answer
623 views

Windows 10 FIPS140 Bitlocker without using System Cryptography policy

We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls? ...
1 vote
0 answers
915 views

Microsoft CryptoAPI FIPS 140-2

My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
  • 143
2 votes
1 answer
115 views

Are RFC 2104 and FIPS 198 compatible with each other?

Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?
  • 147
1 vote
0 answers
705 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
0 votes
1 answer
1k views

SSL/TLS - Certificate chain validation result in "Invalid authentication type: DHE_RSA"

I have an application that connects to a remote web service deployed on HTTPS. Our application uses FIPS-140 Level-1 for SSL/TLS connectivity, and is based on JCE providers of RSA (the company). com....
5 votes
1 answer
1k views

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
  • 153
2 votes
1 answer
593 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
4 votes
2 answers
1k views

use of PRNG in OpenSSL - fips mode

I am working on a centos based network device , required to pass fips 140-2 level 2. I plan to use openssl in fips mode and CTR_DRBG will use as PRNG. will this be enough for meeting NIST SP 800-90 ...
3 votes
2 answers
4k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
  • 183
3 votes
1 answer
1k views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
1 vote
1 answer
335 views

Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?

I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
1 vote
0 answers
194 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
5 votes
3 answers
9k views

Why aren't there FIPS level 4 devices on the market?

While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the ...
  • 244
4 votes
1 answer
222 views

FIPS-2 assumptions (CJIS)

I feel more like a lawyer than an IT admin today. When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm ...
0 votes
1 answer
4k views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
  • 103
3 votes
2 answers
1k views

What's the difference between the same model with and without FIPS 140 certification?

We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
  • 9,500
4 votes
2 answers
3k views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
  • 143
4 votes
0 answers
340 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...