Collaborate Disseminate
The FIPS 140-3 10.2.A Pre-operational Integrity Technique Self-test introduces new requirement. Prior to that, in FIPS 140-2, a Power On Self Test was done in order to be able to use a given part of a cryptographic module (e.g. RSA). With … Continue reading rationale for the FIPS 140-3 Pre-operational Integrity Technique Self-test
I have a number of RHEL 8 and RHEL 9 systems with FIPS mode enabled. I’m trying to use a crypto subpolicy to disable CBC ciphers, but the subpolicy seems to be ignored in FIPS mode even though it is applied correctly.
The same subpolicy wo… Continue reading RHEL in FIPS mode ignores crypto subpolicy
I am having difficulty understanding the differences between bc-prov and bc-fips jar. I understand bc-fips contains the subset of bc-prov packages as well. But I want to understand more about the below questions,
Will there be any perform… Continue reading What is the main difference between bcprov and bc-fips (bouncycastle) jar?
I was looking at YubiKeys and noticed that they sell FIPS certified keys alongside non-FIPS certified keys. Both seem to have the same feature sets, but the FIPS certified keys are more expensive. This question’s answer suggests to me that… Continue reading When is FIPS certification important?
I know that FIPS 140-1 standard is retired but if a specific device is FIPS 140-1 certified can the government institutions still buy them?
Continue reading Can government institutions still buy FIPS 140-1 certified devices? [closed]
The team is trying to decide which SSL implementation should be used in a specific embedded device. The device should be FIPS 140-3 certified. A part of the team wants to buy the license for the Mocana implementation because they worked wi… Continue reading Is there any advantage of using Mocana SSL library vs openSSL?
I am trying to build openssl 3.1 in FIPS mode for the UEFI target. But the config option enable-fips as defined in the documentation does not define the flag FIPS_MODULE for UEFI targets. Also, I notice that Makefile after configuring for … Continue reading Does openssl3.1 support UEFI target with FIPS enabled?
I’m running yocto linux, which has openssl3 installed. I manually compiled the openssl FIPS module (fips.so), generated the fipsmodule.cnf file, and modified my openssl.cnf to use it.
I know FIPS is working because if I try and use MD5, f… Continue reading How can I FIPS enable openssl3 on yocto linux?
I don’t get exactly what FIPS 140-2 expects when your method receives secret keys via arguments. For example, in a lot of FIP-compliant libraries such as OpenSSL, we have a method like this:
int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, cons… Continue reading What FIPS 140-2 expects for secret keys passed as arguments of a methods?
I’ve been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not:
1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that RADIUS uses MD5, but EAP-TLS wraps the en… Continue reading How to achieve an authentication method FIPS 140-3?