{"id":4915,"date":"2021-10-18T14:00:19","date_gmt":"2021-10-18T06:00:19","guid":{"rendered":"https:\/\/www.progreso.com.sg\/newsite\/?post_type=all_news&p=4915"},"modified":"2021-10-18T14:00:20","modified_gmt":"2021-10-18T06:00:20","slug":"hsm-fips-2","status":"publish","type":"all_news","link":"https:\/\/www.progreso.com.sg\/newsite\/all_news\/hsm-fips-2\/","title":{"rendered":"Introduction to hardware security modules (HSM): \u201cFIPS 140-2 tested and certified\u201d"},"content":{"rendered":"\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is FIPS 140-2?<\/h2><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The requirements specified in the Federal Information Processing Standard (FIPS) PUB 140- 2 outline a total of 11 areas of design and implementation of products in applied cryptography. These areas include:<\/span>
\u2022 cryptographic module specification<\/span>
\u2022 roles, services, and authentication<\/span>
\u2022 ports and interfaces<\/span>
\u2022 operational environment<\/span>
\u2022 physical security<\/span>
\u2022 EMI \/ EMC<\/span>
\u2022 key management<\/span>
\u2022 design assurance<\/span>
To boot, every certified cryptographic module is categorized into 4 levels of security:<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Based on security requirements in the above areas, FIPS 140-2 defines 4 levels of security:
\u2022 Level 1 \u2013 The lowest security that can be applied to a cryptographic module. The sole basis of its security is the fact that it uses a cryptographic function.
\u2022 Level 2 \u2013 These modules have temper evidence as an additional security feature. This cryptographic device will allow authorized operators to open the seals and access the keys, but only after successfully authenticating.
\u2022 Level 3 \u2013 This level of security is measured by tamper detection and response, enhanced protection of private key pairs, and identity-based authentication.
\u2022 Level 4 \u2013 This is the highest level of security. To be certified a level 4 device, the module must be tamper resistant and provide environmental (voltage or temperature) failure protection.<\/p>

An example of a level 4 certified HSM is Utimaco\u2019s Hardware security modules. Every Utimaco HSMs has been laboratory-tested and certified against FIPS 140-2 standards to help you comply with the standards you need to meet.<\/span><\/p>

Reasons to use a FIPS-certified HSM<\/strong>
\u2022 To bar unauthorized users from accessing sensitive information
\u2022 To protect from any unauthorized activity in private systems
\u2022 To prevent changes from being made without your knowledge or permission
\u2022 To detect errors immediately, before sensitive information has been damaged or compromised<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Why is FIPS Compliance important?<\/h2><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The FIPS 140-2 standard is applicable to all Federal departments and agencies operate or are operated for them under contract and use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems). Additionally, FIPS compliance is required in any regulated industry that collects, stores, transfers, shares or disseminates sensitive information. This includes products in regulated industries such as Banking, Health-care institutions, and National Defense. If you want to sell into these industries and cryptography is a central component of your product, you\u2019ll need to prove FIPS compliance. To certify a cryptographic module such as an HSM, Private vendors must first undergo a series of FIPS testing by an independent, accredited Cryptographic and Security Testing (CST) laboratory, such as the National Voluntary Lab Accreditation Program. First, the CST laboratory uses the Derived Test Requirements (DTR) and Implementation Guidance (IG) to test cryptographic modules. Then they must validate the test results before issuing a certificate.\u00a0<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What are the requirements of FIPS 140-2?<\/h2><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

An FIPS 140-2 compliant cryptographic module must satisfy the following:<\/p>

  • Cryptographic Module Ports & Interfaces<\/li>
  • Roles, Services, & Authentication<\/li>
  • Finite State Model<\/li>
  • Physical Security
    • General<\/li>
    • Single Chip Crypto Modules<\/li>
    • Multi Chip Crypto Modules<\/li>
    • Multi Chip Standalone Crypto Modules<\/li>
    • Environmental Failure Protection\/Testing<\/li>
    • Operational Environment
      • Operating System Requirements<\/li>
      • Crypto Key Management<\/li>
      • Random Number Generators (RNGs)<\/li>
      • Key Generation<\/li>
      • Key Establishment<\/li>
      • Key Entry & Output<\/li>
      • Key Storage<\/li>
      • Key Zeroization<\/li>
      • EMI\/EMC Compatibility<\/li>
      • Self-Tests<\/li>
      • Design Assurance<\/li>
      • Configuration Management<\/li>
      • Mitigation of other Attacks<\/li><\/ul><\/li><\/ul><\/li><\/ul>

        The NIST specifies certain crypto algorithms as FIPS 140-2 compliant, and also identifies which algorithms can be used for symmetric, asymmetric, message authentication, and hashing cryptographic functions. The following is a list of approved cryptographic algorithms:<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t

        Symmetric<\/span><\/b><\/b><\/p><\/td>

        Asymmetric<\/span><\/b><\/p><\/td>

        Message
        Authentication<\/span><\/b><\/p><\/td>

        Hashing<\/span><\/b><\/b><\/p><\/td><\/tr>

        AES<\/span><\/p><\/td>

        DSS<\/span><\/p><\/td>

        TDES<\/span><\/p><\/td>

        SHA1<\/span><\/p><\/td><\/tr>

        TDES<\/span><\/p><\/td>

        SHS<\/span><\/p><\/td>

        AES<\/span><\/p><\/td>

        SHA-256<\/span><\/p><\/td><\/tr>

        EES<\/span><\/p><\/td>

        RNG<\/span><\/p><\/td>

        HMAC<\/span><\/p><\/td>

        SHA-512<\/span><\/p><\/td><\/tr><\/tbody><\/table><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t
        • AES= Advanced Encryption Standard<\/li>
        • TDES= Triple Data Encryption Standard<\/li>
        • EES= Escrowed Encryption Standard<\/li>
        • DSS= Digital Signature Standard<\/li>
        • SHS= Secure Hash Standard<\/li>
        • RNG= Random Number Generators<\/li>
        • HMAC= Hash Message Authentication Code<\/li><\/ul>

          The FIPS 140-2 standard is applicable to all Federal departments and any regulated industry that collects, stores, transfers, shares or disseminates sensitive information. More importantly, a cryptographic device with high security is necessary to maintain the privacy and integrity of the sensitive information protected by the module. Now that you have a general idea on the importance of FIPS 140-2 and how to comply, take some time to reflect on what you\u2019ve learned and written down any ideas that come to mind. Then when you\u2019re ready, let\u2019s continue on to Part 2 of the Comprehensive Guide to Hardware Security Modules.<\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

          What is FIPS 140-2? The requirements specified in the Federal Information Processing Standard (FIPS) PUB 140- 2 outline a total of 11 areas of design and implementation of products in applied cryptography. These areas include:\u2022 cryptographic module specification\u2022 roles, services, and authentication\u2022 ports and interfaces\u2022 operational environment\u2022 physical security\u2022 EMI \/ EMC\u2022 key management\u2022 design […]<\/p>\n","protected":false},"featured_media":0,"template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/all_news\/4915"}],"collection":[{"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/all_news"}],"about":[{"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/types\/all_news"}],"version-history":[{"count":6,"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/all_news\/4915\/revisions"}],"predecessor-version":[{"id":4923,"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/all_news\/4915\/revisions\/4923"}],"wp:attachment":[{"href":"https:\/\/www.progreso.com.sg\/newsite\/wp-json\/wp\/v2\/media?parent=4915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}