Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

TripleDESCryptoServiceProvider FIPS 140-2 Compliance

I am using the System.Security.Cryptography's TripleDESCryptoServiceProvider in the following manner:

  TripleDESCryptoServiceProvider CreateCipher()
        {
            TripleDESCryptoServiceProvider cipher = new TripleDESCryptoServiceProvider();
            cipher.KeySize = 192;
            cipher.BlockSize = 64;
            cipher.Padding = PaddingMode.ISO10126;
            cipher.Mode = CipherMode.CBC;
            return cipher;
        }

I would like to know if this is FIPS 140-2 compliant. I have found numerous pages outlining different aspects of compliance, but it seems to me that Microsoft gets their compliance certificates by the platform, not by the class (make sense). In lieu of that, I have not been able to find any positive confirmation that the above cipher is FIPS 140-2 compliant. So far, the most useful links I have found:

  • Microsofts FIPs documents:
    http://technet.microsoft.com/en-us/library/cc750357.aspx http://support.microsoft.com/kb/811833

  • NIST DES information

  • Blog showing how to "dump" the sytems core libraries cryptographic modules and their compliance

  • Listing of FIPS certificates

In short, does anybody know what certificate number that this class/encryption method would fall under? Or is it platform specific? (That's what I am gleaning.)

like image 737
Simpleton Avatar asked Oct 05 '10 20:10

Simpleton


People also ask

What are the FIPS 140-2 requirements?

FIPS 140-2 requires that any hardware or software cryptographic module implements algorithms from an approved list. The FIPS validated algorithms cover symmetric and asymmetric encryption techniques as well as use of hash standards and message authentication.

How do I verify FIPS 140-2 compliance?

The easiest way to determine if your vendor is FIPS 140-2 certified is to check the NIST website. If a company's name appears in NIST's Cryptographic Module Validation Program (CMVP), they have been vetted by NIST and you should feel comfortable using the vendor's technology.

How do you know if something is FIPS compliant?

If the entire product has not been tested and approved as FIPS validated, that means the product is only FIPS compliant. All products must submit a Security Policy that outlines what the module is and how it complies with FIPS.


3 Answers

FIPS 140-2 certification applies to both algorithms and modules. Algorithm implementations get certified by passing a series of test cases. Modules get certified when they meet all FIPS requirements. One such requirement is to provide cryptographic services only with FIPS-certified algorithms (and non-FIPS-certified algorithms used in a FIPS-approved manner like Diffie-Hellman key exchange).

Triple-DES is a FIPS-certified algorithm, and therefore can obtain a FIPS certificate. That's one piece of the puzzle.

The next piece is finding out what module is providing Triple-DES, and whether that module is FIPS certified. You already linked to the page where Microsoft lists all their FIPS-approved modules. That's got all you need to know. I think as of Windows Vista everything ultimately goes through bcrypt.dll.

Of course, you can go straight to the source and search modules yourself. Take, for instance, certificate #1001 for Microsoft's bcrypt.dll in Windows Vista. You can see that this module has obtained an algorithm certificate for its Triple-DES implementation (Cert. #656), so you can use Triple-DES from this module.

So how do you know you're using the FIPS-certified module? You enable FIPS mode in Windows. If you don't enable FIPS mode, you aren't using a FIPS-certified algorithm in a FIPS-approved mode of operation. On Windows, if you try to use a non-FIPS algorithm while in FIPS mode, you'll get an exception.

Bringing me to my last point that a good way to find out whether an algorithm is approved for use in FIPS mode is to turn on FIPS mode and try it!

By the way, this Triple-DES certificate page lists all approved Triple-DES modes of operation:

ECB = TDEA Electronic Codebook
TCBC = TDEA Cipher Block Chaining
TCBC-I = TDEA Cipher Block Chaining - Interleaved
TCFB = TDEA Cipher Feedback
TCFB-P = TDEA Cipher Feedback - Pipelined
TOFB = TDEA Output Feedback
TOFB-I = TDEA Output Feedback - Interleaved

And the following Keying Options.

KO 1 = Three-key Triple DES
KO 2 = Two-key Triple DES
like image 173
indiv Avatar answered Sep 30 '22 16:09

indiv


This has a list of FIPS compliant algorithms.

FIPS compliant Algorithms:

Hash algorithms

HMACSHA1

MACTripleDES

SHA1CryptoServiceProvider

Symmetric algorithms (use the same key for encryption and decryption)

DESCryptoServiceProvider

TripleDESCryptoServiceProvider

Asymmetric algorithms (use a public key for encryption and a private key for decryption)

DSACryptoServiceProvider

RSACryptoServiceProvider

I've also asked a similar question about AES.

like image 38
SwDevMan81 Avatar answered Sep 30 '22 15:09

SwDevMan81


I personally would use AES for my encryption as it is 'lighter' and more secure than TripleDES in fact I think it is the de facto algorithm at the moment. If AES does not meet the standards I would be surprised.

like image 37
Mr. Mr. Avatar answered Sep 30 '22 15:09

Mr. Mr.