Policy-Discussion

["Kyle Hamilton" <aerowolf AT gmail.com>]

At this point, everything relies upon OpenSSL, which has not yet
released a FIPS-140-2 compliant module.  I believe the keys are stored
encrypted on the drive, which has a physical access control as well as
logical access control.

At this point, FIPS-140-2 certification has not been achieved by
CAcert (to the best of my knowledge; if I am wrong, please correct
me).  At such time as it is, if it is based on OpenSSL's FIPS code
base, it will be (at best) level 1; if it relies on OpenSSL's ENGINE
capability, it depends on the certification of the hardware used, and
how it is used.  (In any case, the certification for the cryptographic
module does not carry itself out to the entire implementation which
uses the cryptographic module; the implementation must be certified
independently of the module, though the use of a secure module makes
things a lot quicker.)

-Kyle H

On 2/20/06, 
Lambert.Hofstra AT ins.com
 
<Lambert.Hofstra AT ins.com>
 wrote:
> > This makes me wonder if it would be possible to have a key generator
> > somewhere that would split it into a 2/4 share scheme before ever
> > letting it leave the box -- preferably one that would do all the
> > encryption necessary to send via S/MIME to each of the employees, as
> > well as talking to the SMTP server to do so.
> >
> > Just musing...
> >
> > -Kyle H
>
> FIPS 140-2 requires for level 3 and 4 that keys can only be exported in
> such a way ("Secret and private keys established using manual methods
> shall be entered or output encrypted or with split knowledge
> procedures.", see
> http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf ;)
>
> Most devices support both n out of m, or n-components mechanisms.
>
> This makes me wonder: what is the security level of the cryptographic
> hardware in use at CAcert?
>
> Lambert Hofstra
>
>
> > _______________________________________________
> > Have you subscribed to our RSS News Feed yet?
> >
> > CAcert-Policy mailing list
> > CAcert-Policy AT lists.cacert.org
> > http://lists.cacert.org/cgi-bin/mailman/listinfo/cacert-policy
> _______________________________________________
> Have you subscribed to our RSS News Feed yet?
>
> CAcert-Policy mailing list
> CAcert-Policy AT lists.cacert.org
> http://lists.cacert.org/cgi-bin/mailman/listinfo/cacert-policy
>