2 Analysis of FIPS 140-2 Test The FIPS 140-2 Test issued by the National Institute of Standard and Technol-ogy consists of four tests: Monobit test, Pork test, Run test and Long Run test. Each test needs a single stream of 20,000 one and zero bits from keystream gen-eration. Any failure in the test means the sequence of stream must be rejected. In FIPS 140 -1 there are 4 statistical random number generator tests (The Monobit Test, The Poker Test, The Runs Test and The Long Runs Test. Then FIPS 140-2 came along and supposedly tightened the criteria for these tests. I'll provide a short summary of the changes here.

The 140 series of Federal Information Processing Standards (FIPS) are U.S.governmentcomputer securitystandards that specify requirements for cryptography modules. As of December 2016, the current version of the standard is FIPS 140-2, issued on 25 May 2001.^[1] Its successor FIPS 140-3 was approved on March 22, 2019 and will become effective on September 22, 2019.^[2] FIPS 140-3 testing will begin September 22, 2020. After FIPS 140-3 testing begins, FIPS 140-2 testing will continue for at least a year, making the two standards to coexist for some time.

Purpose of FIPS 140[edit]

The National Institute of Standards and Technology (NIST) issues the 140 Publication Series to coordinate the requirements and standards for cryptographic modules which include both hardware and software components for use by departments and agencies of the United States federal government. FIPS 140 does not purport to provide sufficient conditions to guarantee that a module conforming to its requirements is secure, still less that a system built using such modules is secure. The requirements cover not only the cryptographic modules themselves but also their documentation and (at the highest security level) some aspects of the comments contained in the source code.

User agencies desiring to implement cryptographic modules should confirm that the module they are using is covered by an existing validation certificate. FIPS 140-1 and FIPS 140-2 validation certificates specify the exact module name, hardware, software, firmware, and/or applet version numbers. For Levels 2 and higher, the operating platform upon which the validation is applicable is also listed. Vendors do not always maintain their baseline validations.

The Cryptographic Module Validation Program (CMVP) is operated jointly by the United States Government's National Institute of Standards and Technology (NIST) Computer Security Division and the Communications Security Establishment (CSE) of the Government of Canada. The use of validated cryptographic modules is required by the United States Government for all unclassified uses of cryptography. The Government of Canada also recommends the use of FIPS 140 validated cryptographic modules in unclassified applications of its departments.

Security levels[edit]

FIPS 140-2 defines four levels of security, simply named 'Level 1' to 'Level 4'. It does not specify in detail what level of security is required by any particular application.

Poker Hands From Best To Worst Poker Hands From Best To Worst 1. Royal Flush10 J Q K AThe best possible hand in Texas hold'em is the combination of ten, jack, queen, king, ace, all of the same suit2. Texas holdem scala a terra.

Fips 140 2 Levels

FIPS 140-2 Level 1 the lowest, imposes very limited requirements; loosely, all components must be 'production-grade' and various egregious kinds of insecurity must be absent.
FIPS 140-2 Level 2 adds requirements for physical tamper-evidence and role-based authentication.
FIPS 140-2 Level 3 adds requirements for physical tamper-resistance (making it difficult for attackers to gain access to sensitive information contained in the module) and identity-based authentication, and for a physical or logical separation between the interfaces by which 'critical security parameters' enter and leave the module, and its other interfaces.
FIPS 140-2 Level 4 makes the physical security requirements more stringent, and requires robustness against environmental attacks.

In addition to the specified levels, Section 4.1.1 of the specification describes additional attacks that may require mitigation, such as differential power analysis. If a product contains countermeasures against these attacks, they must be documented and tested, but protections are not required to achieve a given level. Thus, a criticism of FIPS 140-2 is that the standard gives a false sense of security at Levels 2 and above because the standard implies that modules will be tamper-evident and/or tamper-resistant, yet modules are permitted to have side channel vulnerabilities that allow simple extraction of keys.

Scope of requirements[edit]

FIPS 140 imposes requirements in eleven different areas:

Grim fandango remastered casino bug. Grim Fandango Remastered. All Discussions Screenshots Artwork Broadcasts Videos News Guides Reviews. GAMEBREAKING BUG Stuck in Hector's Casino WARNING: SOME SPOILERS AHEAD I'm at the part in Year 4 where you are supposed to grab the sheet to throw over Charlie inside the casino except when I got in that animation loop, I clearly saw the.

Cryptographic module specification (what must be documented)
Cryptographic module ports and interfaces (what information flows in and out, and how it must be segregated)
Roles, services and authentication (who can do what with the module, and how this is checked)
Finite state model (documentation of the high-level states the module can be in, and how transitions occur)
Physical security (tamper evidence and resistance, and robustness against extreme environmental conditions)
Operational environment (what sort of operating system the module uses and is used by)
Cryptographic key management (generation, entry, output, storage and destruction of keys)
EMI/EMC
Self-tests (what must be tested and when, and what must be done if a test fails)
Design assurance (what documentation must be provided to demonstrate that the module has been well designed and implemented)
Mitigation of other attacks (if a module is designed to mitigate against, say, TEMPEST attacks then its documentation must say how)

Brief history[edit]

FIPS 140-1, issued on 11 January 1994, was developed by a government and industry working group, composed of vendors and users of cryptographic equipment. The group identified the four 'security levels' and eleven 'requirement areas' listed above, and specified requirements for each area at each level.

Online casino license search. In the world of online casinos, licenses serve as a clear indicator showing just how serious and reliable a particular online casino is.

FIPS 140-2, issued on 25 May 2001, takes account of changes in available technology and official standards since 1994, and of comments received from the vendor, tester, and user communities. It was the main input document to the international standard ISO/IEC19790:2006 Security requirements for cryptographic modules issued on 1 March 2006. NIST issued Special Publication 800-29 outlining the significant changes from FIPS 140-1 to FIPS 140-2^[3].

FIPS 140-3 is a new version of the standard which is currently under development. In the first draft version^[4] of the FIPS 140-3 standard, NIST introduced a new software security section, one additional level of assurance (Level 5) and new Simple Power Analysis (SPA) and Differential Power Analysis (DPA) requirements. The draft issued on 11 Sep 2009, however, reverted to four security levels and limits the security levels of software to levels 1 and 2.

Criticism[edit]

Due to the way in which the validation process is set up, a software vendor is required to re-validate their FIPS-140-validated module for every change, no matter how small, to the software; this re-validation is required even for obvious bug or security fixes. Since validation is an expensive process, this gives software vendors an incentive to postp

Fips 140 2 Poker Test