Re: [saag] Algorithms/modes requested by users/customers

[Randall Atkinson <[e-mail]>]

Earlier, Steve Kent wrote:
% Also, if buyers believe that a device that "could be evaluated" is
% good enough, they are being rather naive.  Experience with the
% FIPS 140 program has shown that a significant fraction of of
% products submitted for evaluation fail the process.

The quoted text above is fully consistent with my information
(and my very limited personal experience) on this topic.

% Presumably a vendor submitting a product for evaluation
% believes that the product is ready, and will pass, otherwise the
% vendor is wasting money on the evaluation effort.

Some purchasers, including some US DoD components, do not
require that a product actually be FIPS-140 certified in order
for the purchaser to buy the product.  Instead, some purchasers,
including some US DoD components, only require that a product
be "in evaluation" on the NIST web site in order to bid/sell that
product.

This can incent some vendors to submit products for FIPS-140
evaluation in order to bid/sell the product -- even if the vendor
is unsure whether the product will pass that evaluation at that
point in time.  This last is a business decision based on various
business factors, and is not necessarily a technical decision.

Separately, there is substantial documentation required to pass a
FIPS-140 evaluation, and it is not crystal clear upfront what level
of detail on which topics is required to pass the evaluation.  So,
separate from the question of whether the product itself is ready,
there is usually substantial documentation work required of the
submitter after the formal FIPS-140 evaluation commences.

The one area where I have heard concerns expressed by many
implementers is that it can be difficult/time-consuming/expensive
to "RAMP" an approved product so that a later version is
approved formally under FIPS-140.  I don't know if this is an
actual process issue or merely a perceived issue.  At least one
implementer has commented to me that their latest FIPS-approved
firmware has known-bugs fixed in subsequent non-FIPS-approved
firmware because of (real or perceived) "RAMP" process issues.

% The fact that  many products fail evaluation (for good security
% reasons), tells me that a vendor's claim that a product
% "could be evaluated" is not much of an assurance.

Agreed.  And this point has been made to me by several different
commercial/financial firms.  It is not a coincidence that the
encryptor I use at my home has an actual FIPS-140 certificate,
nor that I use that system in FIPS mode.

(And at this point, I seem a bit far from the charter of the SAAG
list, but I'm not sure where followups should go.   My apologies
to any who viewed this as excessively off-topic.)

Yours,

Ran
[e-mail]

DISCLAIMER:  I am employed by Extreme Networks, but I am never
authorised to speak for my employer.  The text from me above
is my own personal views/understanding, and must not be taken
as a position held by my employer.