3 ms·

I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to th

by akerl_ 9mo ago

I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. You’re choosing to ride a horse to work because somebody whacked an “approved” brand on it. I’m sure it’s a very reliable horse, but unless somebody is paying me a lot of money to hold the reins, I’m going to opt to use the advances we’ve made as an industry since then

dragonwriter 9mo ago
> I think we just fundamentally disagree about the quality of the “assessment” FIPS is doing. I haven't said anything about the quality of the assessment done as part of FIPS approval. I think you are straining for things to disagree with. > Choosing to use FIPS is basically choosing to tether yourself to the finest decision-making that government agencies could muster based on the technology that existed decades ago. The current FIPS encryption standards and criteria were not decided decades ago, or based on technology adopted decades ago (FIPS 140-3 is 2019, SP 800-40 is 2023, etc.) Beyond the basic idea of “Let’s have NIST establish standards in this area”, almost nothing is from “decades ago”.