12

As I understand it, NIST approves crypto algorithms but doesn't cover specific implementations. I think I've read about IEEE approving hardware implementations of, e.g. AES, but I can't think of any organization that performs an analogous function for software implementations of crypto algorithms.

Corollary/follow up question: There are many open-source, freely-available crypto libraries; are any of these standardized/approved by any kind of regulatory body?

TJ Ellis
  • 223
  • 1
  • 5

1 Answers1

12

Since 1995, NIST has indeed also certified implementations, via the Cryptographic Module Validation Program (CMVP) that validates cryptographic modules for adherence to FIPS 140 standards.

OpenSSL is open source and the OpenSSL FIPS Object Module has been validated via this program: OpenSSL: Important Notes about OpenSSL and FIPS 140-2.

The OpenSSL FIPS Object Module validation is unique among all FIPS 140-2 validations in that the product is "delivered" in source code form, meaning that if you can use it exactly as is and can build it (according to the very specific documented instructions) for your platform, then you can use it as validated cryptography on a "vendor affirmed" basis.

Note that, as they say, "it's complicated". So do check out those links carefully and be prepared for frustrating interactions between the technical and bureaucratic challenges.

nealmcb
  • 20,783
  • 6
  • 72
  • 117
  • +1. I'm pretty sure MS Windows' CryptoAPI was also certified thusly, and I think also the System.Security.Cryptography namespace classes in the .NET Framework. But I am not positive... – AviD Apr 20 '11 at 10:52