5 ms·

I could be wrong, but it’s superseded by FIPS140-3. Anyway, compliance doesn’t necessarily imply security.

• GhettoMaestro 7y ago
  Unless you are purposely trying to pedantic, one should know that FIPS140-3 just came out. You can't even search the Cryptographic Module Validation Program (CMVP) tool for FIPS140-3 standard level yet. FIPS140-2 for all practical purposes is the current standard to measure against. And if you really are negating FIPS140-X and what it means to large organizations and government entities... you should do some reading to understand why it exists. It isn't standards hand-waving. It is fairly in-depth and aims to ensure your cryptographic primitives and low level operations are not totally fucked out of the box. It doesn't solve most security issues by a long shot, but it does try to give you some minimum levels of assurance that it doesn't totally suck crypto operations-wise. Anyways - I up-voted your reply regardless because I wanted to engage in some meaningful dialogue, and I believe we have. Cheers!
  • compuguy 7y ago
    It is great that FIPS140-3 has finally become effective. The previous standard, was getting long in the tooth (FIPS140-2)...
  • antpls 7y ago
    That post yesterday : https://news.ycombinator.com/item?id=21147865 https://news.ycombinator.com/item?id=21147865 shows a side channel attack on smartcards. In the links we can see the FIPS140-compliant affected hardwares. Maybe it contributes to show that FIPS140-02 is not as much a reference than it used to be?