FIPS 140-2-Compliant Technologies

SA achieves FIPS 140-2 compliance by using cryptographic modules that have already gone through the NIST certification process. SA uses the following FIPS 140-2-compliant technologies.

NSS cryptographic module

SA employs the FIPS 140-2 certified Network Security Services (NSS) cryptographic module, an open-source, general purpose cryptographic library under the Mozilla Public License.

The NSS cryptographic module contains an API based on the industry standard Public-Key Cryptography Standards (PKCS) #11 cryptographic token interface version 2.20 published by RSA, the security division of EMC Corporation.

TLS/SSL transport protocol

SA also makes use of Transport Layer Security (TLS), the next generation of Secure Sockets Layer (SSL).

The SA platform is composed of multiple distributed components that communicate sensitive information over insecure networks. SSL is a proven industry standard that provides:

• Encryption to ensure that data (events/user interaction) cannot be sniffed
• Data integrity (MAC) to prevent intentional or accidental data modification on the wire
• Authentication to prevent credentials from leaking across the wire

Because the function of TLS and SSL is the same, the protocols are referred to jointly as TLS/ SSL, although they use different algorithms to establish secure key exchange.

The SSL 2.0 and 3.0 protocols are not FIPS 140-2 compliant. TLS is the only SSL variant that incorporates FIPS 140-2-approved algorithms based upon Internet Engineering Task Force (IETF) standards.

SHA-1/SHA-2 family

The Secure Hash Algorithm is a set of cryptographic hash functions published by the National Institute of Standards and Technology (NIST) as a U.S. Federal Information Processing Standard (FIPS). SA uses SHA-256, but SHA-1 and other hash functions from SHA-2 family are supported.