FIPS status with CC crypto

[h3smith]

iOS Cryptography is FIPS Validated itself, shouldn't the "FIPS Status check" for CC always return true? If the device is not in FIPS mode, it won't boot at all.

Link

static int sqlcipher_cc_fips_status(void *ctx) {
  return 0;
}

[developernotes]

Hi @h3smith

Apple submits various portions of individual iOS releases for the CMVP. For example, currently, iOS 10 is currently in process, however their previous versions of iOS hold a different status. More information can be found here.

[PrasadPotale]

ok, can we say SQLCipher is FIPS validated as its using OS Cryptography and iOS Cryptography is FIPS Validated?

[sjlombardo]

@PrasadPotale No, you can claim that.

First of all, SQLCipher itself is not FIPS 140-2 validated and does not directly implement cryptographic primitives.

Second, as @developernotes mentioned earlier, depending on the version of iOS in use the underlying cryptographic module may not be FIPS 140-2 validated. For example, as far as I'm aware, there is no validation yet for iOS 11, yet that operating system has already shipped to users. Thus, if your application runs under certain OS versions it would use a FIPS 140-2 validated module, but on others it would not. Or, it could start running on one version of iOS and the user could upgrade the OS and change the status.

As a result, I don't think it is possible to assert in the context of an application that the app, SQLCipher, or even the cryptographic module is FIPS 140-2 validated. Perhaps you could make a limited statement surrounding certain versions, e.g. "This application uses SQLCipher with the CommonCrypto cryptographic provider on iOS which may be FIPS 140-2 validated when running under certain iOS versions.", but frankly I would not even recommend doing that, because I don't think there is a way to "self-test" at run-time to check "FIPS mode", which seems to be a documented requirement for claiming the use of a FIPS 140-2 validated module.

That said, if your organization has an interest in FIPS 140-2 with SQLCipher, please feel free to reach out to support@zetetic.net to discuss further. We offer special packages under our Enterprise program that are built using a dedicated FIPS 140-2 validated cryptographic module. This package does not use the built in iOS CommonCrypto to avoid the aforementioned problems. Instead, a FIPS 140-2 validated cryptographic module is linked directly into the SQLCipher library. This ensures the same library is used on all deployments, and also facilitates the self test requirements.

Disclaimer: This my personal opinion only based on my understanding of FIPS 140-2 validation. However, I am not a subject matter expert in FIPS 140-2 validation, nor am I an attorney. As a result none of the information in this post should be construed as specific advice to the poster or any other party for decision making, contracting, validation, or any other purpose.

[PrasadPotale]

@sjlombardo thanks Stephen for the detailed reply, now its much clear, definitely we will think about Enterprise program and contact the support team, thanks again for the great library, keep up the good work.

[h3smith]

To add on, with CC if the underlying OS has FIPS validated crypto you can’t specifically claim your product is FIPS validated. Depending on the customer and what you are doing platform provided FIPS may satisfy your needs. Not many federal agencies require dual layers of crypto for 95% of use cases.

With SqlCiphers enterprise offering - you’d still need to go through validation on your own to claim your product is FIPS Validated. But you can also “bring your own module” as well if you already have gone through the process.

[PrasadPotale]

Thanks @h3smith, for providing more insights into it.