FIPS - Federal Information Processing Standards

FIPS (Federal Information Processing Standards) are standards developed by the U.S. federal government, specifically the National Institute of Standards and Technology (NIST). They are considered U.S. standards that specify requirements for various purposes such as data formats, software interfaces, and cryptographic algorithms, often used by federal agencies and contractors.

FIPS dictate certain requirements for a range of cybersecurity matters, including computer encryption schemes, key generation methods, computer security, and interoperability (amongst other things), and stipulate which are acceptable.

They are generally only developed in areas where there are still no industry standard guidelines for solutions to a specific government requirement.

Why are FIPS necessary?

FIPS address the fact that although there are multiple different ways that you can, for example, encrypt information, not all methods are equally secure or effective. For this reason, the federal government vets and approves certain schemes that meet their requirements, and sets those as a standard for its agencies.

The most up to date FIPS can be found on NIST’s current FIPS webpage

What are the different FIPS series?

The term ‘FIPS’ is actually an umbrella term for a number of different standards relating to specific security concerns. Here are just a few examples:

FIPS-140-2 and 3 relate to cryptography modules
FIPS – 201-2 – Personal Identity Verification (PIV) of Federal Employees and Contractors
FIPS-186-4 – Digital Signature Standard
FIPS-197 – Advanced Encryption Standards
FIPS- 199 Relate to Standards for Security Categorization of Federal Information and Information Systems

What are FIPS 140-2 and FIPS 140-3?

These are both sets of standards that are frequently referred to within a cyber-security context. FIPS-140-2/3 both relate to the standard security requirements for cryptographic modules. FIPS-140-2 will eventually be replaced by FIPS-140-3, and this transition is currently underway.

Level 1 – The lowest security level that imposes minimum requirements and requires all components to be ‘production grade’
Level 2 – Added requirements for physical-tamper evidence as well as role-based authentication
Level 3 – Further obligation to strengthen security against attackers, the use of identity-based authentication, as well as a physical separation between interfaces
Level 4 – The most stringent level that necessitates robust physical security measures against environmental attacks

Why is FIPS Compliance Important?

• Government Use: Mandatory for U.S. government agencies handling sensitive but unclassified information.
• Security Assurance: Demonstrates a high level of security assurance due to the rigorous testing and validation process.
• Trust: Builds trust with customers and partners, especially in industries like finance and healthcare where data security is paramount.

How are FIPS developed?

FIPS are only really developed if no acceptable industry standards already exist and where there is an explicit governmental need for them in a particular space.

First, the proposed FIPS are announced on the Federal Register, NIST’s electronic pages, and the Chief Information Officers Council page. Comments and reviews are welcomed on the proposal for a period of up to 90 days.

Following this, relevant amendments and modifications are applied to the proposed draft. Once this is complete, a justification document is prepared that contextualizes updates, modifications, or the choice to keep certain aspects the same.

Once the Secretary of Commerce has approved the proposed FIPS, an announcement to this effect is published on the NIST’s website.

When are FIPS withdrawn?

If and when industry standards are developed, then FIPS for that specific area become defunct and are withdrawn. This can also happen if a certain commercial product that lays down the standard becomes widely available.

The reason for this is that, in actual fact, governmental departments and agencies are required under the National Technology Transfer and Advancement Act (1995) to utilize technical industry standards developed by voluntary bodies rather than investing in the development of its own standards.

Who should follow FIPS?

FIPS (Federal Information Processing Standards) compliance is primarily crucial for:

• U.S. Federal Government Agencies: These agencies are generally required to use FIPS-validated cryptographic modules to protect sensitive but unclassified (SBU) information.
• U.S. Government Contractors: Any contractors who work with federal agencies and handle sensitive data are also often required to use FIPS-validated cryptographic modules. This is usually stipulated in their contracts.
• Regulated Industries (Certain Situations): Certain regulated industries, like healthcare (HIPAA) or finance, might choose to use FIPS-validated modules to bolster security and compliance, though it isn't always a strict legal requirement. Sometimes, regulations might implicitly steer organizations toward FIPS-validated options to demonstrate a robust security posture.
• Organizations Seeking Enhanced Security: Any organization that wants to ensure a high level of security, even if not legally mandated, can choose to use FIPS-validated cryptographic modules. This can provide assurance that the cryptographic algorithms and implementations have been rigorously tested and meet stringent standards.

Common Product Categories with FIPS-Compliant Options:

• Operating Systems:
  • Windows: Microsoft offers FIPS-compliant configurations of Windows Server and client operating systems. You need to enable FIPS mode.
  • Linux: Red Hat Enterprise Linux (RHEL), SUSE Linux Enterprise Server (SLES), and Ubuntu often have FIPS-compliant versions or configurations available.
• Databases:
  • Microsoft SQL Server: Offers FIPS-compliant modes.
  • Oracle Database: Can be configured for FIPS compliance.
  • PostgreSQL: Some distributions or configurations can be FIPS-compliant.
• Web Servers:
  • Apache HTTP Server: With appropriate modules and configurations, can be made FIPS-compliant.
  • Microsoft IIS: Can be configured for FIPS compliance.
  • nginx: May be configurable for FIPS compliance through modules like OpenSSL (if a FIPS-validated version of OpenSSL is used).
• VPNs (Virtual Private Networks):
  • Many commercial VPN solutions offer FIPS-compliant versions.
• Firewalls:
  • Many hardware and software firewalls are available with FIPS-validated cryptographic modules.
• Routers and Switches:
  • Many networking equipment vendors offer FIPS-compliant versions of their products.
• Cryptographic Libraries:
  • OpenSSL: While OpenSSL itself isn't *always* FIPS validated, there are FIPS-validated versions of OpenSSL available (e.g., OpenSSL FIPS Object Module). This is crucial because many applications rely on OpenSSL for cryptography.
  • Botan: A modern crypto library aiming for security and compliance.
  • BoringSSL: A fork of OpenSSL used by Google, and has FIPS validated versions
• Hardware Security Modules (HSMs):
  • These are dedicated hardware devices for secure key storage and cryptographic operations. Many HSMs are FIPS-validated.
• Encryption Software:
  • Disk encryption software (e.g., VeraCrypt) can be configured to use FIPS-validated cryptographic algorithms.
• Wireless Security:
  • Routers and access points supporting WPA2/WPA3 with AES encryption can be configured for FIPS compliance when used with FIPS-validated cryptographic modules.
• Cloud Services:
  • Major cloud providers (AWS, Azure, Google Cloud) offer services that can be configured to be FIPS-compliant. This often involves selecting specific instance types, regions, and configurations that use FIPS-validated cryptographic modules.

Important Considerations:

• Configuration is Key: Simply buying a product with the *potential* for FIPS compliance isn't enough. You must configure the product correctly to operate in FIPS mode and use FIPS-validated cryptographic modules. This often involves specific settings, libraries, and disabling non-compliant algorithms.
• FIPS 140-2 vs. FIPS 140-3: FIPS 140-3 is the latest standard and gradually replacing FIPS 140-2. When looking for compliant products, check which version of the standard they adhere to.
• Vendor Certification: Look for products with official FIPS validation certificates from NIST. You can search the NIST Cryptographic Module Validation Program (CMVP) website for validated modules.
• Complexity: Achieving and maintaining FIPS compliance can be complex, requiring expertise in cryptography, security, and the specific product being configured.

Why use FIPS mode?

• Compliance: Required for U.S. government agencies and often for organizations that work with the government.
• Security: Provides a higher level of assurance that the cryptographic components used are secure and trustworthy. Validation involves rigorous testing and review of the module's design and implementation.
• Best Practices: Adopting FIPS mode can demonstrate a commitment to security best practices, even if it's not strictly required.

What is FIPS Mode?

FIPS stands for Federal Information Processing Standards. When we talk about "FIPS mode" in the context of computing, we're usually referring to FIPS 140-2 (or its successor, FIPS 140-3), which is a U.S. government standard for validating cryptographic modules.

• Cryptographic Module: A cryptographic module is a set of hardware, software, and/or firmware that implements cryptographic algorithms and security functions. Think of it as the "toolbox" for encrypting, decrypting, hashing, signing, and verifying data.
• FIPS 140-2 and FIPS 140-3 (and upcoming FIPS 140-4): These standards define the security requirements for cryptographic modules used by U.S. federal government agencies and departments, and also by industries that do business with the government (like healthcare, finance, etc.) They are also often adopted by companies that require strong security. The main goal is to ensure that these modules use approved and validated algorithms and are implemented in a secure manner. FIPS 140-2 is the most current standard, FIPS 140-3 is a recent update and FIPS 140-4 is coming sometime in 2024/2025.
• FIPS Mode (Simplified): Enabling FIPS mode in a system or application typically means configuring it to use only FIPS-validated cryptographic modules for all cryptographic operations. It ensures that only specific, approved algorithms and key lengths are used, and that certain security best practices are followed.

How FIPS Mode Works

When FIPS mode is enabled, the underlying system or application takes specific actions to comply with the FIPS 140-2 (or 140-3) standard. Here's a breakdown of the key aspects:
1. Approved Algorithms: FIPS mode restricts the use of cryptographic algorithms to those approved by NIST (National Institute of Standards and Technology). Examples include:

• Encryption: AES (Advanced Encryption Standard), Triple DES (Triple Data Encryption Standard) (though Triple DES is being phased out)
• Hashing: SHA-256, SHA-384, SHA-512 (Secure Hash Algorithm)
• Digital Signatures: RSA, DSA, ECDSA (Elliptic Curve Digital Signature Algorithm)
• Key Exchange: Diffie-Hellman, ECDH (Elliptic Curve Diffie-Hellman)
• *Important: Older, weaker, or considered insecure algorithms like MD5, SHA-1, DES, and RC4 are typically prohibited in FIPS mode.*

2. Minimum Key Lengths: FIPS mode often enforces minimum key lengths for cryptographic keys. For example, it might require RSA keys to be at least 2048 bits long.
3. Module Validation: The system must use cryptographic modules that have been formally validated by NIST's Cryptographic Module Validation Program (CMVP). This means the module has undergone rigorous testing and evaluation to ensure it meets the security requirements of FIPS 140-2 (or 140-3). Validated modules are listed on the NIST website.
4. Key Management: FIPS mode often dictates how cryptographic keys are generated, stored, and used. This includes requirements for:

• Random Number Generation: Using approved random number generators (RNGs) to create cryptographic keys.
• Key Storage: Protecting keys from unauthorized access, often through hardware security modules (HSMs) or secure software key stores.
• Key Destruction: Securely erasing keys when they are no longer needed.

5. Self-Tests: FIPS validated modules must perform self-tests at startup and periodically during operation to ensure that they are functioning correctly. These tests verify the integrity of the module's code and the functionality of its cryptographic algorithms.
6. Error Handling: FIPS mode requires specific error handling procedures. If a cryptographic operation fails or a security violation is detected, the system must take appropriate actions, such as logging the error, halting the operation, or even shutting down the system.
 

How to Use FIPS Mode

The process of enabling and using FIPS mode varies depending on the operating system, application, or device you're working with. Here are some general examples:
1. Operating Systems (e.g., Windows, Linux):

• Windows:
  • Typically, FIPS mode is enabled through the Local Security Policy editor (gpedit.msc). You'd navigate to:
• Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options
  • Find the setting “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing.”
  • Enable this setting.
• Important: Enabling FIPS mode in Windows affects the entire operating system and all applications that use the Windows cryptographic libraries. It's crucial to test thoroughly after enabling FIPS mode to ensure that all applications continue to function correctly.
• Linux (e.g., Red Hat, Ubuntu, SUSE):
  • The process varies depending on the distribution. Some distributions provide a command-line tool or a graphical interface for enabling FIPS mode.
  • Typically involves configuring the system's cryptographic libraries (e.g., OpenSSL) to use only FIPS-validated algorithms and modules.
  • May require installing specific FIPS-validated packages.
  • You might need to regenerate cryptographic keys after enabling FIPS mode.
  • There are often steps for configuring the kernel to be FIPS compliant.
  • Example (Red Hat): fips-mode-setup --enable

2. Applications:

• Some applications have a built-in FIPS mode setting. This might be a checkbox in the application's configuration or a command-line option.
• If an application doesn't have a built-in FIPS mode, you might need to configure it to use FIPS-validated cryptographic libraries or modules provided by the operating system. This might involve modifying the application's configuration files or code.
• Java: Enable FIPS mode for the JVM (Java Virtual Machine).

3. Network Devices (e.g., Routers, Firewalls):

• Network devices that handle sensitive data often have a FIPS mode. This is usually enabled through the device's web-based interface or command-line interface (CLI).
• Enabling FIPS mode on a network device typically involves configuring it to use only FIPS-approved cryptographic algorithms for VPN tunnels, secure web access (HTTPS), and other security functions.

Important Considerations When Using FIPS Mode:

• Compatibility: Enabling FIPS mode can break applications that rely on non-FIPS-approved algorithms. Thorough testing is essential before deploying FIPS mode in a production environment.
• Performance: FIPS-approved algorithms can sometimes be slower than non-approved algorithms. This is because they may be more computationally intensive or may involve additional security checks.
• Complexity: Configuring and maintaining a FIPS-compliant system can be complex, requiring a good understanding of cryptography and security best practices.
• Certification vs. Mode: Enabling FIPS *mode* does not automatically mean that your system is FIPS *certified*. FIPS certification requires a formal validation process by an accredited testing laboratory. FIPS mode simply means that you are configuring the system to use FIPS-validated components.
• Documentation: Always refer to the documentation for your operating system, application, or device for specific instructions on enabling and configuring FIPS mode.
• Update Regularly: Keep your operating system, cryptographic libraries, and applications up to date with the latest security patches.
• Disable Non-Compliant Features: Ensure that any features or protocols that are not FIPS compliant are disabled.

Example Scenario: Configuring OpenSSL for FIPS Mode (Conceptual)

OpenSSL is a widely used open-source cryptographic library. To configure it for FIPS mode, you would typically:
1. Install a FIPS-validated OpenSSL module: Some distributions provide a separate FIPS-validated OpenSSL package.
2. Configure OpenSSL: Modify the OpenSSL configuration file (usually openssl.cnf) to:

• Restrict the allowed algorithms to only FIPS-approved algorithms. This might involve setting the openssl_conf variable and modifying the alg_section to only include approved algorithms.
• Specify the location of the FIPS-validated OpenSSL module.

3. Test: Use OpenSSL commands to verify that only FIPS-approved algorithms are available. For example, try to use a non-FIPS algorithm and see if it fails.