Re: [saag] Algorithms/modes requested by users/customers

[[e-mail] (Peter Gutmann)]

"Santosh Chokhani" <[e-mail]> writes:

>You are wrong about FIPS 140-1 costs being 100K for Level 1.  It is more like
>30K.

The figures I've been given, from numerous vendors going through numerous labs
over a number of years, is that their all-up cost for a level 1 software eval
was around $100K (give or take a few tens of $K).  This isn't just the final
cheque they cut to get the coloured piece of paper, this is the all-up cost of
getting their product through a FIPS 140 eval.

I realise the following may be a bit unfair since you weren't intending to
provide a price quote :-), but I'm willing to put my money where my mouth is:
If Cygnacom can get me a FIPS 140 level 1 on my code for an all-up cost of
$30K I'll send you a cheque and CDROM of the source within 24 hours (I need to
get mgt.approval first).  Just let me know where to send it and who to make
the payment out to.

>In terms of what FIPS buys is that you ensure that the algorithm is
>implemented correctly,

That a *subset* of the algorithms used are impemented correctly, in other
words a subset of what you can get for $19.95 via a TLS connect to Amazon.
And the actual crypto mechanisms don't get tested at all.

>keys will be generated in accordance with FIPS (meaning that the seed feeding
>the PRNG will have requisite entropy and PRNG will be FIPS approved).

A nice circular definition: "A FIPS evaluation guarantees that keys will be
generated as required in order to pass a FIPS evaluation".

>You also get the assurance that the keys are being managed properly in the
>crypto module.

... unless the vendor has documented away the mismanagement, e.g. CryptoAPIs
plaintext private key export.

You're not making a very convincing argument here :-).

Peter.