Re: NSS_NoDB_Init(".") and FIPS mode
Wan-Teh Chang <[email protected]>
| Newsgroups | gmane.comp.mozilla.crypto |
|---|---|
| Message-ID | <CALTJjxEg80m=uc0Uk4xSguhGW8_=EBf4GT-P_JG+NGtog3epRQ@mail.gmail.com> |
On Fri, Mar 18, 2016 at 10:49 AM, Robert Relyea <[email protected]> wrote: > > Yes, SECMOD_DeleteInternalModule() is a toggle which switches NSS between > FIPS and non-FIPS. If you don't have a database open, or the database is > open readOnly, the change only affects the running program. Hi Bob, Your answer surprised me. The latest NSS FIPS 140-2 Security Policy at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2564.pdf says user passwords are stored in salted form in the key database (Table 8 on page 26). So I don't understand how NSS can operate in FIPS mode without an NSS database. I guess without an NSS database the NSS crypto module will only provide services that don't require user authentication, such as hashing and random number generation? Thanks, Wan-Teh Chang -- dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto