Contents
What does it take to be FIPS 140-2 compliant?
To be FIPS 140-2 certified or validated, the software (and hardware) must be independently validated by one of 13 NIST specified laboratories. The process takes weeks. Sometimes the software fails and must be fixed and then the testing process repeated. This takes time and money.
How do you become FIPS compliant?
To become FIPS compliant, a U.S. government agency or contractor’s computer systems must meet requirements outlined in the FIPS publications numbered 140, 180, 186, 197, 198, 199, 200, 201, and 202. FIPS 140 covers cryptographic module and testing requirements in both hardware and software.
Is FIPS 140-2 NSA approved?
The NIST’s FIPS publications, including FIPS 140-2, are approved by the U.S. Secretary of Commerce, so whether FIPS 140-2 is approved by the NSA is immaterial because there’s no official NSA approval process for FIPS publications.
How do you fix a FIPS error?
The issue can be resolved with the following steps:
- On each server in the environment, open the Registry Editor (regedit.exe).
- Navigate to Changed this registry key to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\fipsalgorithmpolicy\Enabled.
- Change the value of the key from 1 to 0.
- Reboot the server.
What is the difference between FIPS 140 1 and FIPS 140-2?
FIPS 140-1 is one of NIST’s most successful standards and forms the very foundation of the Cryptographic Module Validation Program. FIPS 140-2 addresses lessons learned from questions and comments and reflects changes in technology. The standard was strengthened, but not changed in focus or emphasis.
What does FIPS 140-2 compliance mean?
Being FIPS 140-2 compliant means that you adhere to the requirements set in the standard . Examples of companies who must adhere to FIPS 140-2 isn’t just the manufacturers of physical products. Private customer data is often in great need of security and usually requires FIPS 140-2 compliancy.
Is FIPS 140-2 actively harmful to software?
Darren Moffat, a Senior Principal Software Engineer based in the UK, vented about his experience in a post titled ‘Is FIPS 140-2 actively harmful to software? Before we go any further, the answer is no. FIPS 140-2 is definitely not harmful.
What does ‘FIPS 140-2 Level 2 certified’ mean for security?
The FIPS 140-2 standard is an information technology security approval program for cryptographic modules produced by private sector vendors who seek to have their products certified for use in government departments and regulated industries (such as financial and health-care institutions) that collect, store, transfer, share and disseminate sensitive but unclassified (SBU) information.
Is pivkey FIPS 140-2 certified?
Built on Infineon’s newest SLE78 chip, the PIVKey C980 Security Chip and OS are validated to U.S. government security standard FIPS 140-2, Level 3 and certified to Common Criteria EAL 6+ (high). All PIVKey cards are based on dedicated smart card security processors, designed to be physically & logically tamper resistant.