StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>FIPS 140-2 certification applies to both algorithms and modules. Algorithm implementations get certified by passing a series of test cases. Modules get certified when they meet all FIPS requirements. One such requirement is to provide cryptographic services only with FIPS-certified algorithms (and non-FIPS-certified algorithms used in a FIPS-approved manner like Diffie-Hellman key exchange).</p> <p>Triple-DES is a <a href="http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf" rel="noreferrer">FIPS-certified algorithm</a>, and therefore can obtain a FIPS certificate. That's one piece of the puzzle.</p> <p>The next piece is finding out what module is providing Triple-DES, and whether that module is FIPS certified. You already <a href="http://technet.microsoft.com/en-us/library/cc750357.aspx" rel="noreferrer">linked</a> to the page where Microsoft lists all their FIPS-approved modules. That's got all you need to know. I think as of Windows Vista everything ultimately goes through <code>bcrypt.dll</code>.</p> <p>Of course, you can go straight to the <a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm" rel="noreferrer">source</a> and search modules yourself. Take, for instance, certificate #1001 for Microsoft's <code>bcrypt.dll</code> in Windows Vista. You can see that this module has obtained an algorithm certificate for its Triple-DES implementation (Cert. #656), so you can use Triple-DES from this module.</p> <p>So how do you know you're using the FIPS-certified module? <a href="http://support.microsoft.com/kb/811833" rel="noreferrer">You enable FIPS mode in Windows</a>. If you don't enable FIPS mode, you aren't using a FIPS-certified algorithm in a FIPS-approved mode of operation. On Windows, if you try to use a non-FIPS algorithm while in FIPS mode, you'll get an exception.</p> <p>Bringing me to my last point that a good way to find out whether an algorithm is approved for use in FIPS mode is to turn on FIPS mode and try it!</p> <p>By the way, <a href="http://csrc.nist.gov/groups/STM/cavp/documents/des/tripledesval.html" rel="noreferrer">this Triple-DES certificate page</a> lists all approved Triple-DES modes of operation:</p> <pre><code>ECB = TDEA Electronic Codebook TCBC = TDEA Cipher Block Chaining TCBC-I = TDEA Cipher Block Chaining - Interleaved TCFB = TDEA Cipher Feedback TCFB-P = TDEA Cipher Feedback - Pipelined TOFB = TDEA Output Feedback TOFB-I = TDEA Output Feedback - Interleaved </code></pre> <p>And the following Keying Options.</p> <pre><code>KO 1 = Three-key Triple DES KO 2 = Two-key Triple DES </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload