We are in the processing to understand if our software applications is FIPS 140-

Question

We are in the processing to understand if our software applications is FIPS 140-2 compliant or not. Currently in our application, we are using our own implementation of AES algorithm. AES is a FIPS 140-2 compliant algorithm.

The question would be whether this would render our app not FIPS 140-2 compliant since we are not using FIPS validated library (Advanced Encryption Standard Algorithm Validation List) even though we are using a FIPS compliant cryptographical algorithm.

Again, we are not try to certify our application for FIPS 140-2, rather we just want to make sure that we are FIPS 140-2 compliant.

Explanation / Answer

If you are using an AES library that has not undergone the FIPS validation process, then you are not FIPS compliant (or, at least, your use of AES is not).

FIPS compliant means more than "we use algorithms that FIPS likes", it means "having passed the FIPS certification process"; that is how NIST defines it.

Sorry, but NIST is quite strict about this; if you haven't undergone the full testing, then NIST is concerned that you haven't implemented AES correctly; there may be subtle bugs that affect the security. And, since NIST makes up the rules for what's "FIPS compliant", well, there's no point in arguing about its likelihood.

In addition, FIPS talks more than what algorithms you use; it also talks about health tests and key zeroization and other such things; the FIPS certification process checks all that as well.

If you need to be FIPS compliant, then your choices are:

Use a FIPS-certified library to perform all the FIPS-approved crypto operations

Go through the FIPS-certification process for your application (or, at least, the crypto pieces of your application).

The FIPS certification process is surprisingly complicated; I'd advise you to use a FIPS-certified library.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.