4 ms·
In my experience with FIPS certification usually requires some changes that undermine security. If you need it, then you need it, but having the certification
by hedora 3y ago
In my experience with FIPS certification usually requires some changes that undermine security.
If you need it, then you need it, but having the certification is a mildly bad sign in my opinion.
I’m not the only one with this opinion. For instance, the Microsoft Windows team seems to agree:
https://techcommunity.microsoft.com/t5/microsoft-security-baselines/why-we-re-not-recommending-fips-mode-anymore/ba-p/701037 https://techcommunity.microsoft.com/t5/microsoft-security-ba...
- akyuu 3y agoIn the GitHub issue, there is a mention of replacing rustls and Go's crypto library with OpenSSL. That seems like a serious security downgrade.
- throwing_away 3y agoHaving been around a bunch of former-government people and bumping into FIPS myself a few times (like yubikeys) and reading about it, that's also been my sense, but it's nice to see a formal writeup with examples. Thanks for the link.
- bandrami 3y agoIt makes no sense if your goal is "have the most secure system feasible under your resource constraints and usage requirements", which is a reasonable goal. However, the whole FIPS and USG compliance in general mindset is not that; the goal instead is "be aware of ways in which your system is known to not be secure". The idea that a known flaw is better than an less-known fix is infuriating to devs, but from a business standpoint it makes some sense.
- hedora 3y agoThat might make sense, but I’ve never seen it with FIPS. I’ve only seen them force changes were ones that weaken or remove defenses against known attacks. I’ve never seen them require additional standard defenses, or identity and propose fixes against attacks that were not already considered and addressed by the existing system.
- bandrami 3y agoThat's... what I said. It's not about making systems more secure but about documenting known insecurities.