3 ms·

So I only care about it being approved if my customers are stipulating it; there’s not an inherent security value in “approved” algorithms?

by akerl_ 9mo ago

dragonwriter 9mo ago
Approval involves an assessment of security features, but it doesn’t change them, so the approval itself doesn't not have security value. Using it as part of a filter before choosing a solution may have efficiency benefits, though (assuming you are doing your own security assessment that has non-zero cost after the filter.)
- akerl_ 9mo ago
  I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. You’re choosing to ride a horse to work because somebody whacked an “approved” brand on it. I’m sure it’s a very reliable horse, but unless somebody is paying me a lot of money to hold the reins, I’m going to opt to use the advances we’ve made as an industry since then
  - dragonwriter 9mo ago
    > I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. I haven't said anything about the quality of the assessment done as part of FIPS approval. I think you are straining for things to disagree with. > Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. The current FIPS encryption standards and criteria were not decided decades ago, or based on technology adopted decades ago (FIPS 140-3 is 2019, SP 800-40 is 2023, etc.) Beyond the basic idea of “Let’s have NIST establish standards in this area”, almost nothing is from “decades ago”.

3 ms·

So I only care about it being approved if my customers are stipulating it; there’s not an inherent security value in “approved” algorithms?

by akerl_ 9mo ago

So I only care about it being approved if my customers are stipulating it; there’s not an inherent security value in “approved” algorithms?

dragonwriter 9mo ago
Approval involves an assessment of security features, but it doesn’t change them, so the approval itself doesn't not have security value. Using it as part of a filter before choosing a solution may have efficiency benefits, though (assuming you are doing your own security assessment that has non-zero cost after the filter.)
- akerl_ 9mo ago
  I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. You’re choosing to ride a horse to work because somebody whacked an “approved” brand on it. I’m sure it’s a very reliable horse, but unless somebody is paying me a lot of money to hold the reins, I’m going to opt to use the advances we’ve made as an industry since then
  - dragonwriter 9mo ago
    > I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. I haven't said anything about the quality of the assessment done as part of FIPS approval. I think you are straining for things to disagree with. > Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. The current FIPS encryption standards and criteria were not decided decades ago, or based on technology adopted decades ago (FIPS 140-3 is 2019, SP 800-40 is 2023, etc.) Beyond the basic idea of “Let’s have NIST establish standards in this area”, almost nothing is from “decades ago”.