3 ms·
Also interesting is that the PCI SSC is now recommending FIPS 140-2. While not likely relevant to the decision in Alpine, it may be relevant downstream with re
by windexh8er 8y ago
Also interesting is that the PCI SSC is now recommending FIPS 140-2. While not likely relevant to the decision in Alpine, it may be relevant downstream with regard to choosing Alpine to develop on.
PCI Standards Security Council - Secure Software Standards v1.0 (Jan 2019)
https://www.pcisecuritystandards.org/document_library?category=sware_sec#results https://www.pcisecuritystandards.org/document_library?catego...
- Nursie 8y agoOh interesting. That said I've only ever taken devices through PCI-PTS, not worked on PCI compliant software so I have no idea how much of a departure this is from common practice. The one thing that would concern me about widespread adoption of FIPS-certified tech is that (IIRC) FIPS 140-2 essentially forbids PFS modes (DH/DHE) on TLS, presumably for traffic audit purposes in secure government environments.