SECURING FIBRE CHANNEL FABRICS - Brocade

Federal Information Processing Standards (FIPS)cryptographic material. For the most part, laws around exporting cryptographicmaterial outside of these countries have been relaxed, butthere still are some restrictions. It is best to verify with the BIS beforeexporting any cryptographic material.Other countries also have restrictions on exporting or importing cryptographicmaterials. For example, France, at the time of writing, has animport restriction on 128-bit keys, which are subject to specialpermission.Federal Information Processing Standards (FIPS)IT security product consumers may not necessarily have the expertise,knowledge, or resources necessary to fully evaluate products, that is,whether the security of a product is appropriate and meets theirrequirements. Assertions from the vendors and developers of theseproducts may not provide the highest level of confidence to the consumer.To increase this level of confidence, a consumer can hire anindependent organization to evaluate products for them or simply usea pre-established standard that vendors must comply with.When US Federal and private sector organizations make purchasingdecisions for security products that perform a cryptographic function,they must evaluate the proposed products from each vendor. This issometimes accomplished by creating an evaluation matrix comparingthe different product features. A compliant/non-compliant system maybe used, while others may prefer a weighted point system to give moreimportance on some functionality over others. Since this matrix canbecome quite large and complex when multiple vendors respond to atender, a standard was created to establish base security criteria levelsfor all vendors.The National Institute of Science and Technology (NIST), reporting intothe US Department of Commerce, created publication 140-2 on May25, 2001 (also known as the Security Requirements for CryptographicModules) to simplify the acquisition process. FIPS 140-2 was developedprimarily for US Federal organizations and provides standardevaluation criteria for cryptographic modules used in certain securityproducts. It is sometimes used by private sector organizations in NorthAmerica but seldom in other parts of the world. The FIPS 140-2 standardapplies specifically to the cryptographic modules used in securityproducts. A cryptographic module consists of the hardware, software,and/or firmware used to implement security functions (includingencryption algorithms and key generation) and is contained within acryptographic boundary that establishes its physical boundaries (seeFigure 44 on page 177).Securing Fibre Channel Fabrics 163