5 ms·
FIPS is a double-edged sword in my experience. On one hand it does set a standard to keep total snake oil crypto out of government. On the other hand it often h
by api 7y ago
FIPS is a double-edged sword in my experience. On one hand it does set a standard to keep total snake oil crypto out of government. On the other hand it often has the side effect of mandating worse and older crypto and slowing update cycles when there's a bug. When SSL bugs are discovered vulnerable SSL libraries tend to sit around for a lot longer on FIPS-controlled hosts because they have to wait for a FIPS-validated update.
- Nursie 7y agoFIPS also ,at least a decade ago, ruled out things like PFS because actually the federal goverent wanted to be able to audit past traffic.
- jnwatson 7y agoCitation please. There are multiple standards that implement PFS in the FIPS specs.
- Nursie 7y agoFair enough, the ones I was involved with implementing/complying with (FIPS 140-2) ruled out things like DH(E) key exchange. We had to comply with that standard to sell to the federal government at the time. Things may well have changed.
- GhettoMaestro 7y agoECDHE is standard for FIPS these days.