Questions tagged [fips]

Federal Information Processing Standards (FIPS) are a set of US government security standards.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

Can a PKCS12 keystore be FIPS compliant?

Is it possible to generate a PKCS12 keystore that will be FIPS compliant? In regular mode, I'm using "1.2.840.113549.1.12.1.3" - pbeWithSHAAnd3-KeyTripleDES-CBC(3) algorithm to encrypt private keys, ...
2
votes
0answers
46 views

Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL

Appreciate any help on the following. Built OpenSSL Fips Module and then 'static binaries' of FIPS capable OSSL which 'statically link to the windows run-time'. Thus, my application binary (FipsApp....
1
vote
1answer
42 views

Should I remove all non-FIPS providers from java.security to be FIPS-compliant?

I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security: security.provider.1=SUN ...
1
vote
0answers
102 views

OpenSSL and FIPS module 3.0

The version 1.0.2 of OpenSSL which is an LTS version will reach soon the end-of-life. This is the only version to be currently FIPS compliant (through the FIPS module 2.0). According to the ...
-1
votes
1answer
117 views

What is the open source equivalent to a FIPS 140-2 certification

What is the open source equivalent to FIPS 140-2?. There are businesses that use it when doing business with government. Since a lot of us wont be doing business with the government, is there a ...
2
votes
2answers
243 views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
0
votes
1answer
165 views

Difference between FIPS 196 and SSL for authentication?

I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is ...
1
vote
1answer
478 views

Windows 10 FIPS140 Bitlocker without using System Cryptography policy

We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls? ...
3
votes
2answers
3k views

Full Disk Encryption and FIPS

I've been tasked to find out what's required to use BitLocker (or any other FDE method/mechanism) in Windows 10 in "FIPS mode". This is outside the realm of my expertise (and I've advised the client ...
1
vote
0answers
259 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
3
votes
4answers
5k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
10
votes
1answer
400 views

TPM support with OpenSSL FIPS Object Module

How can I use a TPM chip along with the OpenSSL FIPS Object Module without modifying OpenSSL FIPS Object Module (to avoid Private Label certification)? Should we add an engine interface in OpenSSL ...
0
votes
3answers
468 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
2
votes
1answer
271 views

How do I share a password in a FIPS-compliant manner?

This is a really basic question, but I'm a newbie in security. What I'm wondering is: How do I share a password for an encrypted document in a FIPS 140-2 compliant manner? That is, say I have a PDF, ...
4
votes
0answers
1k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
3
votes
2answers
397 views

HSM maintenance

I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I ...
0
votes
1answer
92 views

Key Generation on FIPS device or using SW with FIPS generator

I would like to understand the difference between these two options how to generate AES key. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm AES key is ...
0
votes
1answer
121 views

Is ESP without AH considered noncompliant with FIPS 140-2?

I have a CentOS 7.4 box running kernel 3.10 that has the fips=1 parameter defined in the kernel grub statement. If I attempt to add an IPSEC SA with the following command it fails: ip xfrm state ...
1
vote
0answers
296 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
1
vote
0answers
34 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
3
votes
1answer
367 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
2
votes
2answers
132 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
4
votes
3answers
6k views

Why aren't there FIPS level 4 devices on the market?

While searching for a secure USB to use, I came across the Aegis secure key, which has FIPS Level 3 (140-2) security. I believe that it's the securest flash drive on the market. I found that the ...
6
votes
4answers
12k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
4
votes
0answers
972 views

Generating RSA keys per the FIPS 186-4 standard

my company is trying to get our OpenSSL 1.0.2l software (it's compiled in FIPS mode with the FIPS canister) FIPS certified, but I am having difficulty generating RSA keys according to the FIPS 186-4 ...
1
vote
0answers
116 views

Is Windows certificate store FIPS 140-2 level 1 certified?

I'm not really aware of FIPS 140-2 requirements, but AFAIK some MS cryptographic libraries are FIPS 140-2 level 1 certified, so here it goes my question: If I do have the following requirement: ...
2
votes
1answer
77 views

Are RFC 2104 and FIPS 198 compatible with each other?

Is the FIPS 198 specification of HMAC compatible with the RFC specification for HMAC?
0
votes
1answer
312 views

how to generate a pem certificate with Openssl using 'TLS1_ECDHE_RSA' ciphers for fips platform [closed]

I am testing some ECDHE_RSA ciphers on FIPS platform But the handshake is failing because of the cert and key I am using on Server in OpenSSL. Same cert and Key are working fine if the platform is ...
1
vote
0answers
591 views

Microsoft CryptoAPI FIPS 140-2

My customer asks me to use FIPS 140-2 validated cryptographic libraries. Currently I have AES 256 encryption using Microsoft CryptoAPI in my application. First I get the provider (HCRYPTPROV) using ...
1
vote
0answers
538 views

Ssh and fips mode

I am working on a networking device that needs to meet fips 140-2 level 2. ( runs on Ubuntu ) As for ssh, is it enough to limit the ciphers to those "allowed" by fips or should we patch openssh to ...
0
votes
1answer
835 views

SSL/TLS - Certificate chain validation result in “Invalid authentication type: DHE_RSA”

I have an application that connects to a remote web service deployed on HTTPS. Our application uses FIPS-140 Level-1 for SSL/TLS connectivity, and is based on JCE providers of RSA (the company). com....
4
votes
1answer
1k views

FIPS 140-2 ready linux distribution

We're preparing for FIPS 140-2 project and trying to minimize the effort in the software space. So - is there FIPS 140-2 ready Linux distribution that you can just install and not even touch the ...
2
votes
1answer
276 views

SELinux related to fips 140-2?

I'm preparing a CentoOS based product for FIPS 140-2 level 2 certification and I have gone through the guides on enabling FIPS mode in RHEL Distros. Is SELinux somehow related to FIPS requirements? ...
4
votes
2answers
658 views

use of PRNG in OpenSSL - fips mode

I am working on a centos based network device , required to pass fips 140-2 level 2. I plan to use openssl in fips mode and CTR_DRBG will use as PRNG. will this be enough for meeting NIST SP 800-90 ...
3
votes
1answer
667 views

In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)

There is a growing trend to utilize more In-Memory Storage for a wide variety of use cases from big data analytics (Spark) to faster processing power (MemSQL) to caching (Redis) most frequently ...
2
votes
1answer
1k views

RSA BSAFE Crypto-J JCE provider - “Server Hello” returns unassigned Named Curve

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). when I use any elliptic curve based key exchange mechanism the handshake fails ...
1
vote
1answer
242 views

Why RedHat Linux has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc?

I am wondering why RedHat Enterprise has obtained separate FIPS 140-2 certificates for OpenSSL , NSS, Kernel Crypto API etc. Is it not enough to have FIPS 140-2 certification for only one ...
1
vote
0answers
137 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
4
votes
1answer
159 views

FIPS-2 assumptions (CJIS)

I feel more like a lawyer than an IT admin today. When the CJIS Security Policy states that "The remote administrative personnel connection shall be via an encrypted (FIPS 140-2 certified) path," I'm ...
0
votes
1answer
2k views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
3
votes
2answers
732 views

What's the difference between the same model with and without FIPS 140 certification?

We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
3
votes
2answers
1k views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
4
votes
0answers
291 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
2
votes
3answers
938 views

Named curve value 0xffff in 'Server Hello' message

I'm using the RSA BSAFE Crypto-J 6.2 JCE provider in Java as SSL/TLS server (in FIPS 140 Compliant Mode for SunJSSE). It seems like at least Chrome and Firefox cannot establish a connection if ...
1
vote
0answers
252 views

OpenSSL is not giving correct result for encryption and decryption for FIPS test vector for AES -CFB1

I am running FIPS test vectors against AES-CFB. I am getting correct results for aes-cfb128 and aes-cfb8 but getting wrong results for aes-cfb1. The values being used by me for aes-cfb1 tests are: ...
8
votes
3answers
4k views

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios?

Are RADIUS and TACACS+ Ever Allowed in FIPS 140-2 Compliant Scenarios? I understand that RADIUS uses the MD5 hashing algorithm and I'm pretty sure TACACS+ does too, and I do not believe there is any ...
5
votes
2answers
3k views

FIPS 140-2 Compliance vs Validation & Products vs. Modules vs. Ciphers

Some vendors appear to advertise their products as using "FIPS 140-2 compliant algorithms & ciphers". However, some of these products cannot be found on the NIST website that lists validated ...
12
votes
2answers
5k views

Why should I choose SHA (such as SHa-512), instead of bcrypt or PBKDF2, for FIPS-compliance?

Due to regulation, my company needs to be FIPS-compliant. I was looking at the current list of FIPS-approved cryptographical methods and I notice that neither bcrypt or PBKDF2 are in this list. Does ...
1
vote
1answer
215 views

Safenet iKey 4000 RSA key pair generation in FIPS 140-2 compliant mode

I need to generate RSA key pair and show the public and private key on screen (in a secured room). The algorithm must be FIPS approved. So I would like to use iKey 4000 which is FIPS 140-2 level 3 ...
3
votes
1answer
447 views

Can my software get FIPS 140-2 certified?

I am starting the early stages of researching the possibility of getting FIPS 140-2 certified, but I have run into some confusion. To start, our software is written in Java and does not actually do ...