4 ms·

Yeah, the first line was intended as a joke. I didn't communicate it very well though. I think the problem with FIPS can be summed up very well as "it doesn't

Yeah, the first line was intended as a joke. I didn't communicate it very well though. I think the problem with FIPS can be summed up very well as "it doesn't require you to implement good crypto", which makes it pointless and almost certainly harmful.

firesteelrain 9mo ago
FIPS validates the crypto library, not your app design. It can still be a security upgrade for the crypto boundary, but you can build insecure stuff on top of it. The harm is when people treat “FIPS mode” as a magic security badge.
- JasonADrury 9mo ago
  You can have an utterly broken crypto library that's FIPS compliant. FIPS would be great if it actually explicitly required you to do things correctly, it does not.
  - firesteelrain 9mo ago
    FIPS 140 doesn’t prove ‘no bugs’, but it’s not meaningless either. It enforces a baseline around approved algorithms, RNG, key handling, self-tests, and module integrity. You can still misuse crypto or have non-crypto bugs, but ‘utterly broken and still FIPS’ is mostly rhetoric.
    - deleted 9mo ago
      [deleted]
    - akerl_ 9mo ago
      Why do I care if an algorithm is “approved”.
      - dragonwriter 9mo ago
        Are you in a contractual relationship with the federal government that involves handling federal data? Alternatively, do you deal with HIPAA PHI (FIPS is—unless an update since the last time I checked has changed this—part of the HITECH Act guidance specification of whether PHI is secured or unsecured, and so is a factor in whether, legally, a breach has occurred.)
        akerl_ 9mo ago
        So I only care about it being approved if my customers are stipulating it; there’s not an inherent security value in “approved” algorithms?
        dragonwriter 9mo ago
        Approval involves an assessment of security features, but it doesn’t change them, so the approval itself doesn't not have security value. Using it as part of a filter before choosing a solution may have efficiency benefits, though (assuming you are doing your own security assessment that has non-zero cost after the filter.)
        akerl_ 9mo ago
        I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. You’re choosing to ride a horse to work because somebody whacked an “approved” brand on it. I’m sure it’s a very reliable horse, but unless somebody is paying me a lot of money to hold the reins, I’m going to opt to use the advances we’ve made as an industry since then
        dragonwriter 9mo ago
        > I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. I haven't said anything about the quality of the assessment done as part of FIPS approval. I think you are straining for things to disagree with. > Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. The current FIPS encryption standards and criteria were not decided decades ago, or based on technology adopted decades ago (FIPS 140-3 is 2019, SP 800-40 is 2023, etc.) Beyond the basic idea of “Let’s have NIST establish standards in this area”, almost nothing is from “decades ago”.
- tptacek 9mo ago
  It's not in fact a security upgrade for your crypto library. It might have been in 1992 when people were still building products based on hand-rolled polyalphabetic substitution ciphers, but that era ended before 2000.

firesteelrain 9mo ago

FIPS validates the crypto library, not your app design. It can still be a security upgrade for the crypto boundary, but you can build insecure stuff on top of it. The harm is when people treat “FIPS mode” as a magic security badge.

JasonADrury 9mo ago
You can have an utterly broken crypto library that's FIPS compliant. FIPS would be great if it actually explicitly required you to do things correctly, it does not.
- firesteelrain 9mo ago
  FIPS 140 doesn’t prove ‘no bugs’, but it’s not meaningless either. It enforces a baseline around approved algorithms, RNG, key handling, self-tests, and module integrity. You can still misuse crypto or have non-crypto bugs, but ‘utterly broken and still FIPS’ is mostly rhetoric.
  - deleted 9mo ago
    [deleted]
  - akerl_ 9mo ago
    Why do I care if an algorithm is “approved”.
    - dragonwriter 9mo ago
      Are you in a contractual relationship with the federal government that involves handling federal data? Alternatively, do you deal with HIPAA PHI (FIPS is—unless an update since the last time I checked has changed this—part of the HITECH Act guidance specification of whether PHI is secured or unsecured, and so is a factor in whether, legally, a breach has occurred.)
      - akerl_ 9mo ago
        So I only care about it being approved if my customers are stipulating it; there’s not an inherent security value in “approved” algorithms?
        dragonwriter 9mo ago
        Approval involves an assessment of security features, but it doesn’t change them, so the approval itself doesn't not have security value. Using it as part of a filter before choosing a solution may have efficiency benefits, though (assuming you are doing your own security assessment that has non-zero cost after the filter.)
        akerl_ 9mo ago
        I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. You’re choosing to ride a horse to work because somebody whacked an “approved” brand on it. I’m sure it’s a very reliable horse, but unless somebody is paying me a lot of money to hold the reins, I’m going to opt to use the advances we’ve made as an industry since then
        dragonwriter 9mo ago
        > I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. I haven't said anything about the quality of the assessment done as part of FIPS approval. I think you are straining for things to disagree with. > Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. The current FIPS encryption standards and criteria were not decided decades ago, or based on technology adopted decades ago (FIPS 140-3 is 2019, SP 800-40 is 2023, etc.) Beyond the basic idea of “Let’s have NIST establish standards in this area”, almost nothing is from “decades ago”.
tptacek 9mo ago
It's not in fact a security upgrade for your crypto library. It might have been in 1992 when people were still building products based on hand-rolled polyalphabetic substitution ciphers, but that era ended before 2000.