[dm-crypt] Question regarding LUKS

[dm-crypt] Question regarding LUKS

[King, Al]

[-- Attachment #1: Type: text/plain, Size: 225 bytes --]

Is LUKS FIPS 140-2 complaint?

 

Thank you

 

Al King, CISSP, CISM, CIPP/G

IT Risk Management and Compliance
McKesson Corporation

Medical-Surgical Division

Office: 404.338.6404
Cell: 678.577.4536

 


[-- Attachment #2: Type: text/html, Size: 5865 bytes --]

Re: [dm-crypt] Question regarding LUKS

[Arno Wagner]

I don't think anybody ever invested the money needed
to find out. 

As far as I understand the FIPS 140-2 requirements,
LUKS could not go above level 1 anyways, as it is
a pure software component. In a concrete implementation 
it may be possible to bring it up to higher levels,
(e.g. by having it run inside a HSM), but the 
certification would then be only for that specific 
platform.

That said, I think LUKS could be FIPS 140-2 level 1
certifiable as it is, as it folows current cryptographic
practices and is a very solid and resilient design.
That does not make it certified  FIPS 140-2 level 1
though. 

Also note that FIPS 140-2 seems to not make a 
lot of sense for software components like LUKS. It
looks to be more intended for smartcards, Hardware 
Security Modules and the like, i.e. whole devices
including software.

Arno


On Wed, Oct 19, 2011 at 04:55:18PM +0000, King, Al wrote:
> Is LUKS FIPS 140-2 complaint?
> 
>  
> 
> Thank you
> 
>  
> 
> Al King, CISSP, CISM, CIPP/G
> 
> IT Risk Management and Compliance
> McKesson Corporation
> 
> Medical-Surgical Division
> 
> Office: 404.338.6404
> Cell: 678.577.4536
> 
>  
> 

> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt


-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Question regarding LUKS

[Milan Broz]

On 10/20/2011 10:18 AM, Arno Wagner wrote:
> I don't think anybody ever invested the money needed
> to find out. 

Well, maybe you noticed some changes in dmcrypt and even
cryptsetup which were directly closely related
to this problem.

AFAIK FIPS 140-2 is always related to some hw config,
but in principle (and if you define cryptographic boundaries
properly) dm-crypt and LUKS have no serious issues here.

The main problem is proper RNG and crypto use (you have
to use only approved RNG and only certified crypto library),
and it cannot be isolated from the kernel certification etc.

So there are no principal problems I know about but
still some changes are needed (some of them are really
formal).

Milan

Re: [dm-crypt] Question regarding LUKS

[Arno Wagner]

On Thu, Oct 20, 2011 at 10:43:54AM +0200, Milan Broz wrote:
> On 10/20/2011 10:18 AM, Arno Wagner wrote:
> > I don't think anybody ever invested the money needed
> > to find out. 
> 
> Well, maybe you noticed some changes in dmcrypt and even
> cryptsetup which were directly closely related
> to this problem.

Relax. I basically said the same thing as you, just that
AFAIK nobody applied for a certification (which costs money).
And the only way to really find out is to invest that money 
and apply for certification. 

> AFAIK FIPS 140-2 is always related to some hw config,
> but in principle (and if you define cryptographic boundaries
> properly) dm-crypt and LUKS have no serious issues here.

It seems a leve-1 certification can be gotten for software
only, http://www.openssl.org/docs/fips/fipsnotes.html,
but this example is the rare (only?) example.
 
Arno

> The main problem is proper RNG and crypto use (you have
> to use only approved RNG and only certified crypto library),
> and it cannot be isolated from the kernel certification etc.
> 
> So there are no principal problems I know about but
> still some changes are needed (some of them are really
> formal).
> 
> Milan
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
> 

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier