8 ms·
anything that is FIPS compliant will use one of the mandated DRBGs, there are two others besides CTR_DRBG. BoringSSL implements CTR_DRBG with AES for example:
by f2f 7y ago
anything that is FIPS compliant will use one of the mandated DRBGs, there are two others besides CTR_DRBG.
BoringSSL implements CTR_DRBG with AES for example: https://boringssl.googlesource.com/boringssl/+/fed35d32245ee4563691d21f55c12b4f8dac840a/crypto/fipsmodule/FIPS.md https://boringssl.googlesource.com/boringssl/+/fed35d32245ee...
- baby 7y agoWhat I don’t understand about this is, if you’re FIPS compliant you can’t just use the PRNG of /dev/urandom? You must use a FIPS as well?
- f2f 7y agoyes. fips compliance says "use what we tell you to use. want government contracts? be fips compliant." it's a source of a lot of online discussion as the compliant algorithms aren't the best available. here's to bureaucracy!