Collaborate Disseminate
Do FIPS 140-2 or related documens specify how to protect users’ passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
Continue reading FIPS compliant passwords protection/encryption?
The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000
The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3
Over 14,000 SEK difference in price. Same company (Kingston). Same USB stan… Continue reading What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
Our product is a product that uses Apache HTTPD, Tomcat and MonodDB.
We use OpenSSL for HTTPS connection and Bouncy Castle library for the encryption of data in the database.
What does it mean to be FIPS 140-2 compliant ?
Is it enough to u… Continue reading What does it mean to be FIPS 140-2 compliant?
I have successfully built OpenSSL-FIPS according to specifications and am wondering if I configure the OpenSSL path in HAProxy (or any other reverse proxy for that matter) to use the OpenSSL-FIPS install, wouldn’t the reverse proxy also be… Continue reading HAProxy FIPS Compliance
I’m specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I’m curious what the process actually is.
Is it all internal to NIST with just the Public Comment P… Continue reading What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
I’m specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I’m curious what the process actually is.
Is it all internal to NIST with just the Public Comment P… Continue reading What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
Someone has a service that uses a FIPS non-compatible hash in a protocol signature. When FIPS 140-2 compatibility is enabled on the hosts the service crashes (due to the hash signature being not allowed by the security configuration of th… Continue reading Is running software in Docker an allowable way to bypass FIPS 140-2 issues?
Could anyone help me understand security certificates for software? Let’s suppose we’re talking about a complex application that has a desktop version and a cloud version as well. The final goal is to adjust its code to some recognized sta… Continue reading Security certificates for software [closed]
Is it possible to generate a PKCS12 keystore that will be FIPS compliant? In regular mode, I’m using “1.2.840.113549.1.12.1.3” – pbeWithSHAAnd3-KeyTripleDES-CBC(3) algorithm to encrypt private keys, while leaving the certific… Continue reading Can a PKCS12 keystore be FIPS compliant?
Appreciate any help on the following.
Built OpenSSL Fips Module and then ‘static binaries’ of FIPS capable OSSL which ‘statically link to the windows run-time’.
Thus, my application binary (FipsApp.exe) does not depend on O… Continue reading Fingerprint mismatch only for 32-bit DLL linked statically to FIPS Capable OpenSSL