On 03/18/2016 01:55 PM, Wan-Teh Chang wrote:
The new softokn allows you to run in level 1. If you don't have a database, or the database is set without a password, then NSS is running in FIPS-140 Level 1 mode and does not require a password.On Fri, Mar 18, 2016 at 10:49 AM, Robert Relyea <rrel...@redhat.com> wrote:Yes, SECMOD_DeleteInternalModule() is a toggle which switches NSS between FIPS and non-FIPS. If you don't have a database open, or the database is open readOnly, the change only affects the running program.Hi Bob,Your answer surprised me. The latest NSS FIPS 140-2 Security Policy at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2564.pdf says user passwords are stored in salted form in the key database (Table 8 on page 26). So I don't understand how NSS can operate in FIPS mode without an NSS database. I guess without an NSS database the NSS crypto module will only provide services that don't require user authentication, such as hashing and random number generation?
This allows NSS to run in fips mode based on a system FIPS flag (which linux has) without massive breakage. If you need level 2 however, you must have a database and you must set the password. NSS will allow you to switch from level 1 to level 2, but not vice versa.
bob
Thanks, Wan-Teh Chang
smime.p7s
Description: S/MIME Cryptographic Signature
-- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
