Re: NSS_NoDB_Init(".") and FIPS mode
Wan-Teh Chang <[email protected]>
| Newsgroups | gmane.comp.mozilla.crypto |
|---|---|
| Message-ID | <CALTJjxEWXSNKijU5_aj2_BZRJD3SGu6N=mnFDge6XTqzgRZg0Q@mail.gmail.com> |
Hi Andrew, On Fri, Mar 18, 2016 at 9:14 AM, Andrew Cagney <[email protected]> wrote: > Is it possible to put NSS (softtoken) in FIPS mode (PK11_IsFIPS()) without > a "modutil -fips true" database? The standard definition of the NSS FIPS mode requires an NSS database. The reason is that NSS went for FIPS 140-2 validation at Level 2. Level 2 requires user authentication. NSS does its own user authentication (rather than relying on the user authentication of the operating system, which I think may be allowed by FIPS) and the user password needs to be stored. (It's actually done by encrypting the NSS database with the user password.) > By FIPS mode I guess I really mean confirm that NSS has performed some sort > of FIPS self-check. I seem to remember NSS always performs most of the FIPS self tests. I haven't worked on that part of NSS for several years, so it may have changed. Wan-Teh Chang -- dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto