2 ms·

I tried looking up if there are any previous examples of FIPS 140 that allow bcrypt. I can find 37 matches when searching for "bcrypt" here: https://web.archive

I tried looking up if there are any previous examples of FIPS 140 that allow bcrypt. I can find 37 matches when searching for "bcrypt" here: https://web.archive.org/web/20141226152243/http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm https://web.archive.org/web/20141226152243/http://csrc.nist.... . Seems that BitLocker in Windows used BCrypt at one point. Author doesn't mention how old this is, but BCrypt seems to have been approved for FIPS 140-2 compliance since 2008. If the event described was after 2008, I would not hire those same auditors again...

bladegash 6y ago
There is a difference between FIPS validated and FIPS compliant. I may be mistaken, but from looking on CVMP, it does not appear that Bcrypt itself is FIPS validated algorithm. Edit: List of approved security functions for FIPS 140-2 can be found here: https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402annexa.pdf#page4 https://csrc.nist.gov/csrc/media/publications/fips/140/2/fin...