Re:可能关注的牧场主政府解决方案RKE2:Corsec Security,Inc。对牧场主政府解决方案RKE2进行了分析,评估了联邦信息处理标准出版物140-2(FIPS 140-2)的产品运营。CORSEC证明RKE 2HAS合并了FIPS批准的加密服务,完全由FIPS 140验证的模块提供,并通过了CORSEC的FIPS验证过程。牧场主政府解决方案产品在FIPS 140验证的加密模块中实现所有加密功能。由国家标准技术研究所(NIST)发行,FIPS 140-2指定了安全系统中使用的加密模块必须满足的安全要求,该模块可以保护敏感但未分类(SBU)信息。CORSEC审查了在牧场主开发设施中执行的架构,功能,操作和测试结果,并提供了以下结论:
Table of Contents FIPS 140-2 Overview ............................................................................................................................................................ 6 1.Introduction ................................................................................................................................................................. 7 1.1 Scope ................................................................................................................................................................... 7 1.2 Module Overview ................................................................................................................................................. 7 1.3 Module Boundary ................................................................................................................................................ 8 2.Security Level ............................................................................................................................................................... 9 3.Tested Configurations ................................................................................................................................................ 10 4.Ports and Interfaces ................................................................................................................................................... 11 5.Physical Security......................................................................................................................................................... 15 7.Roles, Services and Authentication............................................................................................................................. 12 5.1 Roles .................................................................................................................................................................. 12 5.2 Services ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Operational Environment ........................................................................................................................................... 16 8.加密算法和钥匙管理........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 17 8.1加密算法..................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................电磁干扰/电磁兼容性(EMI/EMC)...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Self-tests .................................................................................................................................................................... 30
Table of Contents FIPS 140-2 Overview ............................................................................................................................................................ 6 1.Introduction ................................................................................................................................................................. 7 1.1 Scope ................................................................................................................................................................... 7 1.2 Module Overview ................................................................................................................................................. 7 1.3 Module Boundary ................................................................................................................................................ 8 2.Security Level ............................................................................................................................................................... 9 3.Tested Configurations ................................................................................................................................................ 10 4.Ports and Interfaces ................................................................................................................................................... 11 5.Physical Security......................................................................................................................................................... 15 7.Roles, Services and Authentication............................................................................................................................. 12 5.1 Roles .................................................................................................................................................................. 12 5.2 Services ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Operational Environment ........................................................................................................................................... 16 8.加密算法和钥匙管理........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... 17 8.1加密算法..................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................电磁干扰/电磁兼容性(EMI/EMC)...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Self-tests .................................................................................................................................................................... 30
Introduction ..................................................................................................................................................................... 3 About this Document ....................................................................................................................................................... 3免责声明...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................General ................................................................................................................................................................... 6 2.加密模块接口...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Roles, Services, and Authentication .................................................................................................................... 13 4.1 Roles ..................................................................................................................................................................... 13 4.2 Authentication ..................................................................................................................................................... 13 4.3 Services ................................................................................................................................................................. 13 5.Cryptographic Module Specification ..................................................................................................................... 7 2.1 Overall Security Design and Rules of Operation ................................................................................................. 11 2.1.1 Usage of AES-GCM .................................................................................................................................................... 11 2.1.2 RSA and ECDSA Keys ................................................................................................................................................. 11 2.1.3 CSP Sharing ............................................................................................................................................................... 11 2.1.4 Modes of Operation ................................................................................................................................................. 11 3.Software/Firmware Security ................................................................................................................................ 17 5.1 Module Format .................................................................................................................................................... 17 6.Operational Environment .................................................................................................................................... 17 7.Physical Security ................................................................................................................................................... 17 8.Non-invasive Security ........................................................................................................................................... 17 9.Sensitive Security Parameter Management ........................................................................................................ 18 10.Self-Tests .............................................................................................................................................................. 22 10.1 Pre-Operational Self-Tests ................................................................................................................................... 22 10.2 Conditional Self-Tests .......................................................................................................................................... 22 11.Life-Cycle Assurance............................................................................................................................................. 24 11.1 Installation Instructions ....................................................................................................................................... 24 11.1.1 Building for Android ............................................................................................................................................ 24 11.1.2 Building for Linux................................................................................................................................................. 25 11.1.3 Retrieving Module Name and Version ............................................................................................................... 26 12.Mitigation of Other Attacks ................................................................................................................................. 26 References and Standards ..................................................................................................................................................... 27 Acronyms ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Oracle完全致力于多样性和包容性。Oracle尊重和价值观拥有多种劳动力,从而增加了思想领导和创新。作为我们建立一种更具包容性文化的计划的一部分,对员工,客户和合作伙伴产生积极影响,我们正在努力从产品和文档中删除不敏感的术语。我们也是
要确保Citrix虚拟应用程序和台式机符合FIPS 140-2,您需要考虑部署中的每个通信渠道。以下示例部署显示了用户如何在Citrix虚拟应用程序和桌面上连接和访问具有不同组件和防火墙配置的台式机上的资源。尤其是样本提供有关如何使用TLS使每个通信通道安全的一般指导,以使整个系统符合FIPS 140-2。
1.3配置Windows使用FIPS批准的加密算法,有两种方法可以为CryptogrPahic Primitives库启用FIPS批准的模式。首先是使用FIPS本地/组安全策略设置或移动设备管理(MDM)为加密原始图库启用FIPS批准的模式。Windows操作系统提供了一个组(或本地)安全策略设置,“系统密码学:使用符合FIPS的算法进行加密,哈希和签名”。启用加密原语库启用FIPS批准模式的第二种方法是将以下注册表密钥设置为1:HKLM \ System \ CurrentControlset \ Control \ control \ lsa \ fipsalgorithmpolicy \ ste。当此注册表密钥存在并设置为1时,CryptoGaphic Primitives库中的自从库将按照FIPS 140-2实施指导第9.11节运行,并且该模块将处于FIPS批准的模式。除了这些方法外,还请咨询MDM文档以获取有关如何启用FIPS-批准模式的信息。策略CSP-密码学包括设置允许Fipsalgorithmpolicy。更改为批准的模式安全策略设置,直到重新启动计算机后才生效。
技术和相关程序保障的选择性应用是每个联邦组织在其计算机和电信系统中提供足够安全性的重要责任。本出版物提供了一种标准,当这些组织指定基于加密的安全系统应用于为敏感或有价值的数据提供保护时,联邦组织将使用该标准。必须在安全系统中保护加密模块,以维持由模块保护的信息的机密性和完整性。此标准指定密码模块将满足的安全要求。该标准提供了四个不断提高的定性安全性,旨在涵盖广泛的潜在应用和环境。安全要求涵盖了与加密模块的安全设计和实施相关的区域。这些区域包括加密模块规范;加密模块端口和接口;角色,服务和身份验证;有限状态模型;身体安全;操作环境;加密密钥管理;电磁干扰/电磁兼容性(EMI/ EMC);自我测试;设计保证;并缓解其他攻击。
随着网络安全威胁的检测和预防越来越复杂,政府和联邦机构需要解决方案,不仅提供了强大的安全性,而且还达到了严格的监管和合规标准。Forcepoint下一代防火墙(NGFW)旨在满足这些关键需求,包括遵守联邦信息处理标准(FIPS)140-3。
部署Yubikey FIPS(联邦信息处理标准)系列为组织提供了使用Yubikey上的任何多个协议中的任何一个进行强验证的选择。由于并非所有问题都可以通过单个身份验证协议来解决,因此Yubikey FIPS系列包括PIV,宣誓,Yubiotp和FIDO U2F协议,以解决各种情况。FIPS指南和要求旨在确保在有安全的环境中,只有FIPS批准模式下的设备才能进行身份验证。为了满足FIPS的要求,公司IT员工需要与合规部门紧密合作,以开发和实施强大的流程。必须将FIPS命令的加密官员角色纳入在线服务用户注册步骤中,以满足组织安全和业务流程的需求。