On 18 March 2016 at 16:55, Wan-Teh Chang <w...@google.com> wrote: > On Fri, Mar 18, 2016 at 10:49 AM, Robert Relyea <rrel...@redhat.com> > wrote: > > > > Yes, SECMOD_DeleteInternalModule() is a toggle which switches NSS between > > FIPS and non-FIPS. If you don't have a database open, or the database is > > open readOnly, the change only affects the running program. > > Hi Bob, > > Your answer surprised me. The latest NSS FIPS 140-2 Security Policy at > http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2564.pdf > says user passwords are stored in salted form in the key database > (Table 8 on page 26). So I don't understand how NSS can operate in > FIPS mode without an NSS database. I guess without an NSS database the > NSS crypto module will only provide services that don't require user > authentication, such as hashing and random number generation? > > Some more background,
Per my earlier e-mail, I'm trying to run HMAC (specifically, using alghmac.h) using a "published" value as the key. I've also got several versions of this code: - this one which puts NSS into what I'll call "memory only" FIPS mode; the result is relatively close to OpenSSL https://bitbucket.org/cagney/fipscheck/branch/nss - an alternative that takes an NSS-DB and uses that to put NSS into FIPS mode https://bitbucket.org/cagney/fipscheck/branch/nss-db The interesting thing about the latter is that, even though I initially included code to provide the password to unlock the DB, that code never executed. To me this made sense since I'm not manipulating secure keys; I just need secured algorithms. Andrew Thanks, > Wan-Teh Chang > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
