If you have a FIPS 140-2 cryptographic module that implements the Dual EC DRBG from SP800-90A, then you may be fielding questions from your customers after they read articles like this one from the IEEE Spectrum: Can You Trust NIST?
Please contact me if InfoGard performed your FIPS 140-2 validation. I would be happy to help determine if your Dual EC DRBG function can be disabled in a new version of your crypto module without going through a lengthy revalidation effort.
Mark Minnoch
mminnoch@infogard.com
805-783-0810
FIPS means "key escrow". I just modified the RNG in source, to return genuine random numbers, and FIPS tests now fail. Tracing back the cause - your "random" numbers must be the output from the NSA escrow keys, or FIPS will not validate.
ReplyDeleteFIPS exists principally to ensure no US Government employees can create ciphertext that the NSA cannot easily read, and of course, to help let them in to anyone else in the world silly enough to use FIPS too.