4

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus seems to be that our application should be FIPS 140-2 compliant if we use a FIPS certified library.

We are using the AES algorithm from a FIPS certified library — iOS commoncrypto — for the encryption of database and disk files. We generate a key dynamically based on a random salt for each encryption of a file (CBC mode, same key for different block of same file). However, we don't use any initialization vector.

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

Community
  • 1
windfly2006
  • 245
  • 2
  • 8

2 Answers2

4

No you don't need to use an IV. However, this limits you to ECB mode only — the only one which doesn't use an IV — and your CAVP (Cryptographic Algorithm Validation Program) AES certificate will indicate so.

Mike Edward Moras
  • 18,161
  • 12
  • 87
  • 240
Mr. Stone
  • 468
  • 3
  • 7
1

Foreword

atsec IT security blog recently commented about FIPS and NIST rules with: "As technology moves on, and the pace of change increases, with no real update to the specification for a decade, FIPS 140-2 is creaking badly. To deal with this, the CMVP must issue Implementation Guidance (I.G.), which is now so complex that it is virtually impossible to understand all the nuances. We saw several presentations on the topic of several notorious implementation guidances, and even some more formal logical analysis of the I.G. themselves."

So, do not expect anybody else than CMVP to be able to guide you in this. They are supposedly the ones to decide what are the approved and allowed ways. (But you need to wait until the government shutdown ends.)

Answer

If I interpret 'without IV' very strictly, I would recommend to use ECB mode (like Mr. Stone) or maybe AES KW. AES-GCM likely does not do because of A.5.

The OP mentioned CBC mode. There is no CBC without IV, so I interpret his question to mean CBC mode, with zero IV or some other static IV.

If each file uses different key, it should be fairly ok to use static IV. However, NIST SP 800-38A (document describing basic cipher modes of operation) has two allowed ways of creating CBC mode IV, random and usage of approved cipher. Therefore, if the target is to be FIPS 140-2 compliant (which includes compliance with NIST SP 800-38A), it is likely more secure to use one of these mechanisms.

If you already generate keys randomly, I would think you could also generate random IV? Then you would be most likely compliant with the recommendation.

Alternatives

It was discussed above that it may not be recommendable to use all zeroes for CBC, but using start IV/nonce/counter of all zeroes could be OK for these modes: CTR, GCM, CCM -- assuming the key/IV pair is not reused. Maybe one of these would meet your needs?

user4982
  • 5,379
  • 21
  • 33