Looking at what it's not got, rather than what it has, means you could miss
the diamond in the rough
Let's pretend that it's time to elect a world leader. Here are some revealing
facts about the three candidates: Candidate A associates with crooked politicians,
and consults with astrologists; he's had two mistresses; chain smokes and drinks
8 to 10 martinis a day. Candidate B was kicked out of office, twice; sleeps
until noon; used opium in college and drinks a quart of whiskey every evening.
Finally, Candidate C is a decorated war hero; a vegetarian who doesn't smoke
and only drinks an occasional beer and he has never had ANY extramarital affairs.
Who gets your vote? Would it surprise you to discover that Candidate A is Franklin
D. Roosevelt; Candidate B is Winston Churchill and Candidate C is Adolph Hitler?
All very interesting but what has this got to do with FIPS, encryption or security
generally? It proves the point you shouldn't judge a book by its cover.
There are numerous organizations who, when looking for a new solution, will
draw up a list of attributes products must have to proceed to the evaluation
phase. FIPS accreditation, CAPS and CESG all appear regularly on this list of
must haves, especially for government bodies. They're obviously very important
but do you know what these acronyms really mean?
Federal Information Processing Standards (FIPS), according to Whatis.com, are
a set of standards that describe document processing, encryption algorithms
and other information technology standards for use within non-military government
agencies and by government contractors and vendors who work with the agencies.
The National Institute of Standards and Technology (NIST) issued the FIPS 140
Publication Series to coordinate the requirements and standards for cryptographic
modules which include both hardware and software components for use by departments
and agencies of the United States federal government. FIPS 140-2 defines four
levels of security, simply named "Level 1" to "Level 4."
It does not specify in detail what level of security is required by any particular
application. A word of warning, FIPS 140 does not purport to provide sufficient
conditions to guarantee that a module conforming to its requirements is secure,
still less that a system built using such modules is secure.
CESG is the Information Assurance (IA) arm of GCHQ and is the Government's
National Technical Authority for IA responsible for enabling secure and trusted
knowledge sharing, which helps its customers achieve their aims. CESG aims to
protect and promote the vital interests of the UK by providing advice and assistance
on the security of communications and electronic data. CAPS helps private sector
companies to develop cryptographic products for use by HMG and other appropriate
organizations. CAPS links the cryptographic knowledge of CESG (the national
technical authority for information assurance) with the private sector's expertise
and resources.
-1-