Re: [Cfrg] On "non-NIST"

[Watson Ladd <[e-mail]>]

On Mon, Mar 2, 2015 at 7:04 AM, Johannes Merkle
<[e-mail]> wrote:
> Watson Ladd schrieb am 01.03.2015 um 00:41:
>>>>> Not "the", but "an". The reason is that NIST controls what can and cannot be given a FIPS-140 certification, and that certification is considered important both by companies who want to sell to the US Govt and companies that use their certification as a statement that "we did it right". If you make an HSM that uses an algorithm not allowed by NIST, you cannot get it certified in the CMVP regime. Thus, when NIST is slow to keep up with the best practices adopted by the community, it becomes a roadblock to deploying better crypto.
>>>>
>>>> This is factually untrue: CMVP certified modules are permitted to
>>>> implement other algorithms: they just can't be in FIPS mode when those
>>>> are used.
>>>
>>> That sentence assumes a few things: an HSM that has multiple signing algorithms *and* a lab that would allow non-certified signing algorithms to be within the crypto module that gets the Level 2+ certification *and* the CMVP program allowing the lab's evaluations. To the best of my knowledge, this has never happened. (Disclaimer: NIST once paid me to become an expert on the CMVP process and how crypto vendors and labs dealt with it, but I have not kept my day-to-day knowledge of it up to date in recent years.)
>>>
>>> What you describe is quite common in devices that get Level 1 certifications, but it is not clear that something that normally is expected to have a Level 2+ validation, specifically like HSMs, would be able to do so.
>>
>> Safenet's Luna SA Network-attached HSM claims FIPS 140-2 Level 3
>> certification and support Brainpool. Granted, I only know about this
>> because it's the one Amazon provides and I had occasion to read the
>> documentation.
>>
>
> The question is how much assurance of security you get by running the HSM in non-FIPS-Mode. I know of a different vendor
> of level 2 certified HSMs that use completely different firmware to support Brainpool curves. This practice makes it
> more difficult for customers to accept the HSM running in non-FIPS mode to support Brainpool.

No assurance at all. You don't receive that from FIPS validation
either: the specified testing is geared towards correctness of
calculation rather than withstanding adversaries. But as I'm sure you
are aware, there are separate certification schemes for Brainpool
curves. Absent official communication from NIST, we don't know how our
choice will impact actions they may or may not take in the future.

Sincerely,
Watson
>
> --
> Johannes



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin