> Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding. You should be using ECDH, EdDSA, an

> Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable oracle padding. You should be using ECDH, EdDSA, and (authenticated) stream ciphers. Padding shouldn't even be a thing. > Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. FIPS 140-2 is bullshit. Try being FIPS 140-2 compliant on a Debian Squeeze server running Apache 2.2 (i.e. TLS 1.0 is the highest you can go) while also being PCI compliant. Spoiler: The only way to be both PCI and FIPS 140-2 compliant is to use TLS 1.2 with AES-GCM and SHA2. Standards rarely make good cryptographic choices. Winners of cryptography competitions, on the other hand, do. > Verify that cryptographic modules operate in their approved mode according to their published security policies. This is so vague it's not actionable.