search

microsoft / SymCrypt

Cryptographic library
MIT License
660 stars 68 forks source link

FIPS 140-2 certification #14

Closed BenKnigge closed 3 years ago

BenKnigge commented 3 years ago

I see that "Support FIPS 140-2 certification of products using SymCrypt" is listed as a goal, however I did not find an actual cirtificate when searching for one on NIST https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search?SearchMode=Basic&Vendor=microsoft&CertificateStatus=Active&ValidationYear=0

Does the library actually have certification? If so could you provide the certificate number?

NielsFerguson commented 3 years ago

A library can't be FIPS-140 certified, only an executable can. SymCrypt is used in CNG.SYS and BCryptPrimitives.DLL, the two primary crypto libraries used in Windows which are FIPS-140 certified. For example https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3527 which links to algorithm certificates such as https://csrc.nist.gov/projects/Cryptographic-Algorithm-Validation-Program/details?source=AES&number=5300 which lists the implementation name that contains SymCrypt.