Re: NSS_NoDB_Init(".") and FIPS mode

On 03/18/2016 01:55 PM, Wan-Teh Chang wrote:
> On Fri, Mar 18, 2016 at 10:49 AM, Robert Relyea <[email protected]> wrote:
>> Yes, SECMOD_DeleteInternalModule() is a toggle which switches NSS between
>> FIPS and non-FIPS. If you don't have a database open, or the database is
>> open readOnly, the change only affects the running program.
> Hi Bob,
>
> Your answer surprised me. The latest NSS FIPS 140-2 Security Policy at
> http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2564.pdf
> says user passwords are stored in salted form in the key database
> (Table 8 on page 26). So I don't understand how NSS can operate in
> FIPS mode without an NSS database. I guess without an NSS database the
> NSS crypto module will only provide services that don't require user
> authentication, such as hashing and random number generation?
The new softokn allows you to run in level 1. If you don't have a 
database, or the database is set without a password, then NSS is running 
in FIPS-140 Level 1 mode and does not require a password.

This allows NSS to run in fips mode based on a system FIPS flag (which 
linux has) without massive breakage. If you need level 2 however, you 
must have a database and you must set the password. NSS will allow you 
to switch from level 1 to level 2, but not vice versa.

bob
>
> Thanks,
> Wan-Teh Chang

-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto