3 ms·
The practical benefit of FIPS 140 is less that your crypto is better and more that your systems will fail to establish connections with anything not using FIPS
by evanjrowley 2mo ago
The practical benefit of FIPS 140 is less that your crypto is better and more that your systems will fail to establish connections with anything not using FIPS mode, thus reducing your threat exposure. A silver lining to the overall unfortunate situation that is the FIPS CMVP.
- rhyperior 2mo agoThere’s no automatic enforcement across most systems though. You can use a Thales HSM that’s configured in FIPS mode just fine from non-FIPS software.
- racingmars 2mo ago> The practical benefit of FIPS 140 is less that your crypto is better and more that your systems will fail to establish connections with anything not using FIPS mode, thus reducing your threat exposure. No, I don't think so. If I'm running, say, a TLS listener (an HTTPS web server), there is no way for you to tell if I'm using a FIPS-validated implementation of the algorithms or not. I can be using a cipher suite that is allowed by FIPS, but that doesn't mean my implementation is FIPS-validated. It's not like there's a "FIPS validated and FIPS mode enabled" flag added to the TLS spec, and even if there was, there'd be nothing stopping me from setting it to true even when using a non-validated implementation.