The core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against. The obvious issue is that know

The core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against. The obvious issue is that known attacks have progressed significantly faster than FIPS has been updated, so in practice it doesn't defend against actual attackers. Compliance-based security pretty much always falls into this trap, and often is even worse because compliance with the standard is considered the maximum that can be done instead of the minimum that must be done. FIPS' fatal flaw is that in many cases it mandates a maximum security level that is now outdated. It's a lot like building or electrical codes: if they're treated as the minimum as intended things stay safe, but if they're just barely complied with then buildings tend to fall down and/or catch fire.