As part of our continued push to modernize the product security certification industry, Lightship Security is pleased to announce that it is receiving advisory services and conditional research and development funding from the National Research Council of Canada Industrial Research Assistance Program (NRC IRAP) supporting a project to develop and launch our innovative client facing cryptographic algorithm testing portal.
Read More
The claimed entropy source for a FIPS 140 validated module now requires compliance to NIST SP800-90B. This means that any cryptographic module going through FIPS 140-2 or FIPS 140-3 validation needs to adhere to NIST implementation guidance 7.18 – Entropy Estimation and Compliance with SP 800-90B. This post will introduce relevant requirements and cover basic concepts of entropy source validation for a FIPS 140 module.
Read More
Most CC evaluations performed in North America include cryptographic security claims called out in the target Protection Profile (PP) that is being used. Those requirements are met by obtaining validation certificates from the Cryptographic Algorithm Program (CAVP). The CAVP is a subset of the broader Cryptographic Module Validation Program (CMVP) that validates entire crypto modules against the FIPS 140-2/3 standard (ISO19790).
This post will explore the intersection between CC and FIPS 140 (in North America) and how the CAVP plays a key role in the eventual CC certification of a given product.
Read More
Lightship Security is 5 years old this month. Time flies building a business through a pandemic.
Last year, we said that we would not go into 2020 resting on our previous success. Here is what we have achieved:
In this latest installment of our FIPS blog, we will cover key transition dates, available training and the list of documentation inputs needed for a FIPS 140-3 validation.
Read More
A common concern our clients have before undertaking a new FIPS 140-2 validation is understanding the various phases and the overall time it takes to get from start to finish.
One of the ways we manage our clients’ expectations is by letting them know the lab testing portion of the FIPS validation usually accounts for only a fraction of the overall schedule. The much longer portion of the process (3x to 5x) is simply waiting for the validation report to be reviewed by the Cryptographic Module Validation Program (CMVP).
Read More
Update 2020-Aug-20: There appears to be a discussion within the OpenSSL project on the semantics of checking the OpenSSL flag we describe below. We are working to clarify this.
NIAP (the US Common Criteria Scheme) recently published a series of technical decisions (TDs) about the use of ECDSA X.509 certificates crossing numerous Protection Profiles. The concern with this new mandatory test is that cryptographic libraries, such as OpenSSL, do not (or may not) reject the requested certificates out of the box, which is now required. This means vendors will have to implement another customized check for X.509 certificates in order to be conformant to a number of Protection Profiles.
Read More
At Lightship, we use a lot of open-source tools to perform our testing. Because of the nature of the tests we perform, we often find that these tools can be a bit too rigid. One specific example is that of the ocsp sub-tool provided in the apps directory of OpenSSL. In this blog post, we will describe the changes we made to the OCSP responder subtool and point to our implementation on github for your use and consideration.
It’s surprising to think that new-style Common Criteria Protection Profiles have been around in some way shape, or form, since late 2010, when the first Network Devices Protection Profile (NDPP) v1.0 was released by the Information Assurance Directorate (IAD) for use in the National Information Assurance Partnership (NIAP). The NDPP v1.0 was unique and represented a dramatic shift in policy and function for Common Criteria evaluations.
In this post, we will examine the positive effects that new-style protection profiles have had in product security over the last (almost) 10 years.
Read More
As the legacy CAVP algorithm testing program is put to pasture and the newer automated testing program – ACVP takes its place, there are several questions, concerns and design considerations to think about. Foremost among them is how testing will work going forward and what it means for vendors and their existing implemented algorithm test harnesses.
One of the questions that often comes up here at Lightship is how does an existing test harness need to change to support the JSON formatted ACVP test vector sets and also to produce the needed response files. Because many vendors have an existing test harness based on the legacy program, they now have to redesign their harness for this new program which becomes mandatory on July 1, 2020.
Read More
