- security News Forums
- > NIST-certified USB Flash drives with har...
- > Re: FIPS 140 doesn't cover authentication.
Posting 
- Thread
- Reply
- New Topic
- Show Thread
Re: FIPS 140 doesn't cover authentication. 18 January 2010 16:36
(To be up-front, I work for MXI Security, a competitor to SanDisk and
the other companies affected by the password bug.)
> FIPS 140 certification only means you didn't screw up the crypto
> algorithm. Even key management and key handling are outside the
> bounds of FIPS 140.
Actually, FIPS 140-2 does cover those things. In fact, it covers
these categories (among others):
- Roles, Services, and Authentication
- Physical Security
- EMI/EMC
- Design Assurance
- Ports and Interfaces
- Finite State Model
- Key Management
- Self-Tests
- Mitigation of Other Attacks
You may be thinking about FIPS 197 or similar algorithimic standards.
> If you want a certification that covers more aspects of the system,
> you want Common Criteria.
With the right protection profile, Common Criteria can be good.
However, even with CC, a simple stamp is no guarantee.
Consider that the SanDisk Cruzer Enterprise, the device with the
serious password issue, is the only CC-certified USB drive out there
(EAL2,
http://www.sandisk.com/about-sandisk/press-room/press-releases/2009/2
009-10-21-sandisk-cruzer-enterprise-flash-drives-earn-common-criteria
-certification).
In truth, FIPS 140-2 is an excellent certification -- it all depends
on how it's leveraged. MXI offered it first, and offered it properly.
Folks chasing dollars have done less ethical things (one example at
http://www.mxisecurity.com/blog/cto/category/industry-standards/).
There are more stringent standards (for example, the CESG CAPS
standard, which effectively looks at all of a product's hardware and
all the source code to its software and firmware), and these may be
applicable to some situations, but as functions get more complex, it
can be impractical to review entire systems -- eventually, there must
be a boundary where the certification stops.
Ultimately, users need to understand a bit about how their systems
work. Certifications can't always keep up with innovation, and paying
attention is the only sure way to stay safe.
- Posting
- Thread
- Reply
- New Topic
- Show Thread
- Threaded View
- Flat View
