Skip to main content

Questions tagged [fips]

Federal Information Processing Standards (FIPS) are a set of US government security standards.

Filter by
Sorted by
Tagged with
2 votes
1 answer
353 views

What is the main difference between bcprov and bc-fips (bouncycastle) jar?

I am having difficulty understanding the differences between bc-prov and bc-fips jar. I understand bc-fips contains the subset of bc-prov packages as well. But I want to understand more about the ...
Kiran Reddy's user avatar
3 votes
1 answer
866 views

When is FIPS certification important?

I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. ...
Unknown's user avatar
  • 185
1 vote
0 answers
110 views

Does openssl3.1 support UEFI target with FIPS enabled?

I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I ...
sr01853's user avatar
  • 111
1 vote
0 answers
584 views

How can I FIPS enable openssl3 on yocto linux?

I'm running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it. I know FIPS is ...
xAptive's user avatar
  • 11
2 votes
1 answer
96 views

What FIPS 140-2 expects for secret keys passed as arguments of a methods?

I don't get exactly what FIPS 140-2 expects when your method receives secret keys via arguments. For example, in a lot of FIP-compliant libraries such as OpenSSL, we have a method like this: int ...
Afshin's user avatar
  • 123
1 vote
0 answers
274 views

How to achieve an authentication method FIPS 140-3?

I've been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not: 1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that ...
r4mpz0's user avatar
  • 11
3 votes
2 answers
3k views

Does OpenSSL 3.0 FIPS support TLSv1 and TLSv1.1?

OpenSSL 3 migration guide doesn't mention anything about TLSv1 and TLSv1.1 FIPS provider doesn't mention it as well. But my understanding is that TLSv1 and TLSv1.1 isn't supported by FIPS provider as ...
Ivan Onyshchenko's user avatar
2 votes
2 answers
291 views

FIPS 140-2 compliance implementation

I'm quite new to the security topic and encryption. Our software has to comply with FIPS 140-2. I have the following method (C#). In this case, the algorithm is AES256. What concerns me, is that we ...
Valentin Vadász's user avatar
3 votes
1 answer
311 views

Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?

To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
rip...'s user avatar
  • 281
1 vote
0 answers
29 views

Do comparable standards like FIPS exist for Germany or the European Union? [duplicate]

NIST, the National Institute of Standards and Technology, does publish FIPS, the Federal Information Processing Standards Publications. Does Germany or the European Union have their own standards? Or ...
foshyboy's user avatar
0 votes
0 answers
223 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
DummyBeginner's user avatar
2 votes
1 answer
368 views

If I buy any FIPS 140 certified USB flash drive can I be sure that it's firmware is signed?

Does either FIPS 140-2 or FIPS 140-3 certification require USB flash drive's firmware to be signed so that malicious computer cannot overwrite flash drive's firmware? e.g. badusb attack. If I buy any ...
user264191's user avatar
1 vote
2 answers
231 views

Are GNU coreutils SHA digest functions FIPS-validated (in NIST's Cryptographic Module Validation Program)?

My Challenge My project has a requirement that we use only FIPS-validated modules to do anything cryptographic, including generating checksums for binaries. We've been using the SHA-2 utilities ...
Ungeheuer's user avatar
  • 113
0 votes
1 answer
2k views

FIPS compliant passwords protection/encryption?

Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
wilx's user avatar
  • 201
100 votes
5 answers
49k views

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000 The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3 Over 14,000 SEK difference in price. ...
Taeyang's user avatar
  • 487
0 votes
1 answer
292 views

What does it mean to be FIPS 140-2 compliant?

We have a product that uses Apache HTTPD, Tomcat, and MongoDB. It uses OpenSSL for HTTPS connection and Bouncy Castle library for the encryption of data in the database. What does it mean to be FIPS ...
Michael's user avatar
  • 1,469
0 votes
1 answer
109 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
joshhemphill's user avatar
1 vote
1 answer
424 views

Is running software in Docker an allowable way to bypass FIPS 140-2 issues?

Someone has a service that uses a FIPS non-compatible hash in a protocol signature. When FIPS 140-2 compatibility is enabled on the hosts the service crashes (due to the hash signature being not ...
anon289837's user avatar
2 votes
0 answers
310 views

Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL

Appreciate any help on the following. Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'. Thus, my application binary (FipsApp....
user49149's user avatar
  • 243
1 vote
0 answers
265 views

Is Yubikey HSM2 FIPS Compliant?

I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series. (https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search) ...
Sprite's user avatar
  • 111
0 votes
1 answer
1k views

Should I remove all non-FIPS providers from java.security to be FIPS-compliant?

I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security: security.provider.1=SUN ...
wilx's user avatar
  • 201
-1 votes
1 answer
768 views

What is the open source equivalent to a FIPS 140-2 certification

What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a ...
Gandalf's user avatar
  • 107
3 votes
2 answers
2k views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
Anders Frey's user avatar
1 vote
0 answers
485 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
Paranoidparrot11's user avatar
4 votes
4 answers
14k views

Hardware-Based Password Manager [closed]

I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I would like to ...
hikingnola's user avatar
0 votes
4 answers
975 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
Jonathan Barbero's user avatar
2 votes
1 answer
555 views

How do I share a password in a FIPS-compliant manner?

This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, ...
Eliza Bennet's user avatar
6 votes
1 answer
3k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
Raven's user avatar
  • 281
0 votes
1 answer
370 views

Difference between FIPS 196 and SSL for authentication?

I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is ...
Juliet's user avatar
  • 187
0 votes
1 answer
383 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
user1563721's user avatar
  • 1,129
0 votes
1 answer
313 views

Is ESP without AH considered noncompliant with FIPS 140-2?

I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails: ip xfrm state ...
dutsnekcirf's user avatar
1 vote
0 answers
704 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
Rob's user avatar
  • 111
4 votes
1 answer
877 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
Shashank V's user avatar
2 votes
2 answers
229 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
Shashank V's user avatar
1 vote
0 answers
99 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
Shashank V's user avatar
4 votes
0 answers
2k views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
Dan's user avatar
  • 41
1 vote
0 answers
401 views

Is Windows certificate store FIPS 140-2 level 1 certified?

I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question: If I do have the following requirement: ...
Jaime Hablutzel's user avatar
0 votes
1 answer
1k views

how to generate a pem certificate with Openssl using 'TLS1_ECDHE_RSA' ciphers for fips platform [closed]

I am testing some ECDHE_RSA ciphers on FIPS platform But the handshake is failing because of the cert and key I am using on Server in OpenSSL. Same cert and Key are working fine if the platform is ...
metadata's user avatar
  • 101
1 vote
1 answer
671 views

Windows 10 FIPS140 Bitlocker without using System Cryptography policy

We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls? ...
Ben Butzer's user avatar
1 vote
0 answers
1k views

Microsoft CryptoAPI FIPS 140-2

My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
Eugen's user avatar
  • 143
2 votes
1 answer
149 views

Are RFC 2104 and FIPS 198 compatible with each other?

Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?
0xcaff's user avatar
  • 131
1 vote
0 answers
845 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
user3087632's user avatar
0 votes
1 answer
1k views

SSL/TLS - Certificate chain validation result in "Invalid authentication type: DHE_RSA"

I have an application that connects to a remote web service deployed on HTTPS. Our application uses FIPS-140 Level-1 for SSL/TLS connectivity, and is based on JCE providers of RSA (the company). com....
Wand Maker's user avatar
5 votes
1 answer
2k views

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
KostaZ's user avatar
  • 153
2 votes
1 answer
865 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
user3087632's user avatar
4 votes
2 answers
1k views

use of PRNG in OpenSSL - fips mode

I am working on a centos based network device , required to pass fips 140-2 level 2. I plan to use openssl in fips mode and CTR_DRBG will use as PRNG. will this be enough for meeting NIST SP 800-90 ...
user3087632's user avatar
3 votes
2 answers
5k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
joeqwerty's user avatar
  • 183
3 votes
1 answer
1k views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
Dereksurfs's user avatar
1 vote
1 answer
379 views

Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?

I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
user2363993's user avatar
1 vote
0 answers
223 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
Tarik GUELZIM's user avatar