Skip to content

Modify language for FIPS requirements #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bluegate010 wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

Modify language for FIPS requirements #103

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion specifications/attestation-of-system-components/spec.ocp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -331,7 +331,7 @@ The protocol diagram above shows a variation of the interaction between a newly

- *Cryptographic algorithms and deterministic random bit generators **MUST** be validated under the [NIST Cryptographic Algorithm Validation Program (CAVP)](https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program)*

- *Cryptographic modules, if used, **SHOULD** be validated at overall level 2 or higher under [FIPS 140-2 SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf) or [Security Requirements for Cryptographic Modules, FIPS 140-3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf)*
- *Cryptographic modules, if used, **SHOULD** be validated at overall level 1 or higher under [FIPS 140-3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf) and **SHOULD** achieve level 2 or higher in the areas of "Software/Firmware Security" and "Physical Security" (see ISO 19790:2012 Table 1)*

- *Entropy, random bits, symmetric keys, and private asymmetric keys **MUST** be generated within the attester device itself, in a hardware security module, or locally, in a device with the following properties:*

Expand Down