Re: NSS_NoDB_Init(".") and FIPS mode

On 18 March 2016 at 16:55, Wan-Teh Chang <[email protected]> wrote:

> On Fri, Mar 18, 2016 at 10:49 AM, Robert Relyea <[email protected]>
> wrote:
> >
> > Yes, SECMOD_DeleteInternalModule() is a toggle which switches NSS between
> > FIPS and non-FIPS. If you don't have a database open, or the database is
> > open readOnly, the change only affects the running program.
>
> Hi Bob,
>
> Your answer surprised me. The latest NSS FIPS 140-2 Security Policy at
> http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2564.pdf
> says user passwords are stored in salted form in the key database
> (Table 8 on page 26). So I don't understand how NSS can operate in
> FIPS mode without an NSS database. I guess without an NSS database the
> NSS crypto module will only provide services that don't require user
> authentication, such as hashing and random number generation?
>
>
Some more background,

Per my earlier e-mail, I'm trying to run HMAC (specifically, using
alghmac.h) using a "published" value as the key.  I've also got several
versions of this code:

- this one which puts NSS into what I'll call "memory only" FIPS mode; the
result is relatively close to OpenSSL
https://bitbucket.org/cagney/fipscheck/branch/nss

- an alternative that takes an NSS-DB and uses that to put NSS into FIPS
mode
https://bitbucket.org/cagney/fipscheck/branch/nss-db

The interesting thing about the latter is that, even though I initially
included code to provide the password to unlock the DB, that code never
executed.  To me this made sense since I'm not manipulating secure keys; I
just need secured algorithms.

Andrew


Thanks,
> Wan-Teh Chang
> --
> dev-tech-crypto mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-tech-crypto
>
-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto