how-to block ads
|
|
Share Topic
 |
 |
|
|
|
TabletPremium
join:2003-01-15
Czech
| reply to jansson_mark
Re: OK, now I know whats the problem... said by jansson_mark:
When you enable FIPS, you cant use SSL2/SSL3, since they use not-FIPS algorithms like MD5 and RC2. When you enable FIPS, only TLS is available with 3DES and SHA-1. If you have FIPS enabled and are going to www-site that uses SSL2/SSL3 and does not support TLS with 3DES and SHA-1, you will end up in blank page or "page not found". 
In IE options, you can still enable SSL2/SSL3 but IE doesnt use them. If M$ was logical, they would have "greyed out" those options from IE if IE cant use them, but since they arent, users can still "enable" them from IE options but nomatter are they enabled or disabled from there, they ARE disabled if FIPS is enabled.
MS support just told me this...
SO...I would suggest that you would contact that bank of yours so that they would upgrade to TLS for better security for their customers.  I will notify www.nordea.fi about their site...
--
My computer security & privacy related homepage
»www.markusjansson.net
[text was edited by author 2003-03-02 21:28:43]
Thank you very much, now I am much more clear about the matter and I will definitely contact the bank. Before that could you Markus or anyone else pls explain to me what in fact does FIPS compliance guarantee. Until now I thought that SSL is very secure, now I see that it might not me. I thought 128 bit encryption was used in SSL. I have read you site Markus but I didn't get all the stuff about encryption, so sorry if I am completely wrong.
Thanks again | |
| said by Tablet:
Before that could you Markus or anyone else pls explain to me what in fact does FIPS compliance guarantee.
»www.itl.nist.gov/fipspubs/geninfo.htm
"Under the Information Technology Management Reform Act (Public Law 104-106), the Secretary of Commerce approves standards and guidelines that are developed by the National Institute of Standards and Technology (NIST) for Federal computer systems. These standards and guidelines are issued by NIST as Federal Information Processing Standards (FIPS) for use government-wide. NIST develops FIPS when there are compelling Federal government requirements such as for security and interoperability and there are no acceptable industry standards or solutions."
»www.itl.nist.gov/fipspubs/geninfo.htm#nist
"The major focus of NIST activities in information technology is developing tests, measurements, proofs of concept, reference data and other technical tools to support the development of pivotal, forward-looking technology.
Under Section 513 of the Information Technology Management Reform Act of 1996 and the Computer Security Act of 1987, Public Law 104-106, NIST develops standards, guidelines, and associated methods and techniques for Federal computer systems.
- including those needed to assure the cost-effective security and privacy of sensitive information in Federal computer systems,
- when there are compelling Federal requirements and there are no existing voluntary industry standards."
quote:
Until now I thought that SSL is very secure, now I see that it might not me.
It is. But NIST approved algorithms are even more secure.
quote:
I thought 128 bit encryption was used in SSL.
Actually, SSL uses 40, 56, 128 and 168bit symmetric keys (with RC4, DES and 3DES algorithms). It also uses 512-3076bit asymmetric keys (RSA).
quote:
I have read you site Markus but I didn't get all the stuff about encryption, so sorry if I am completely wrong.
Well, these things are complicated. Some tips here »www.markusjansson.net/esecuring.html#secure
--
My computer security & privacy related homepage »www.markusjansson.net | | |
|
TabletPremium
join:2003-01-15
Czech | Now I read that Windows XP with SP1 uses AES 256 bit symmetric key encryption for EFS. The document says, that if I enable "Use FIPS compliant Algorithms" in Group Policy, the EFS will start using 3DES.
But based on what I have read AES is better and newer symmetric encryption algorithm and also it is already FIPS compliant.
This seems to me that by enabling "Use FIPS Algorithms" I actually downgrade my security settings 
You can get the document here:
»www.microsoft.com/windowsxp/pro/···stem.doc | |
| said by Tablet:
Now I read that Windows XP with SP1 uses AES 256 bit symmetric key encryption for EFS. The document says, that if I enable "Use FIPS compliant Algorithms" in Group Policy, the EFS will start using 3DES.
But based on what I have read AES is better and newer symmetric encryption algorithm and also it is already FIPS compliant.This seems to me that by enabling "Use FIPS Algorithms" I actually downgrade my security settings
So it seems. I dont quite get this. This is all new to me, I tought that WindowsXP always uses either DES or 3DES, but apparently this SP1 changed that thing.
I have asked MS that whats the catch here...how can one
1) Use DES for EFS?
2) Use 3DES for EFS (OK, it seems that you can do this when you enable FIPS)?
3) Use AES for EFS (OK, it seems that you can do this when you disable FIPS)?
I refer to this that I found on that document:
"Note If a user needs to access an encrypted file from both Windows 2000 and Windows XP, the AES 256 nor the 3DES algorithm should not be enabled." ...so WHAT is enabled then and HOW it is enabled?!?!?!?
--
My computer security & privacy related homepage
»www.markusjansson.net
[text was edited by author 2003-03-05 11:06:01] | |
TabletPremium
join:2003-01-15
Czech | said by jansson_mark:
I refer to this that I found on that document:
"Note If a user needs to access an encrypted file from both Windows 2000 and Windows XP, the AES 256 nor the 3DES algorithm should not be enabled." ...so WHAT is enabled then and HOW it is enabled?!?!?!?
This I find weird too, but the only explanation that comes to me is that the above quote from the document only applies to Win 2000 and WinXP without SP1. So to summarise, I think it is as follows:
Win 2000 and XP without Servicepack use DES as default crypto. In XP 3DES may be enabled by enabling "FIPS".
Win XP with SP1 use AES-256 as default and may use 3DES by enabling "FIPS".
It would be nice, if someone from M$ would make it more clear. It doesn't make sense still why with "FIPS" the crypto should be weaker since AES is already FIPS compliant too. May be next the servicepack will patch it. | |
|
