On Thu, Oct 20, 2011 at 10:43:54AM +0200, Milan Broz wrote: > On 10/20/2011 10:18 AM, Arno Wagner wrote: > > I don't think anybody ever invested the money needed > > to find out. > > Well, maybe you noticed some changes in dmcrypt and even > cryptsetup which were directly closely related > to this problem. Relax. I basically said the same thing as you, just that AFAIK nobody applied for a certification (which costs money). And the only way to really find out is to invest that money and apply for certification. > AFAIK FIPS 140-2 is always related to some hw config, > but in principle (and if you define cryptographic boundaries > properly) dm-crypt and LUKS have no serious issues here. It seems a leve-1 certification can be gotten for software only, http://www.openssl.org/docs/fips/fipsnotes.html, but this example is the rare (only?) example. Arno > The main problem is proper RNG and crypto use (you have > to use only approved RNG and only certified crypto library), > and it cannot be isolated from the kernel certification etc. > > So there are no principal problems I know about but > still some changes are needed (some of them are really > formal). > > Milan > _______________________________________________ > dm-crypt mailing list > dm-crypt@xxxxxxxx > http://www.saout.de/mailman/listinfo/dm-crypt > -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@xxxxxxxxxxx GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
