Author: Prabhat Kumar Tomar

FIPS (Federal Information Processing Standard) 140-2 is a set of standards established by the National Institute of Standards and Technology (NIST) for security requirements in cryptographic modules used in government systems. Cryptographic modules are computer hardware or software that protect data through encryption or other cryptographic methods. The purpose of the FIPS 140-2 standard is to provide a level of assurance that these cryptographic modules are secure and will protect sensitive information from unauthorized access or tampering.

FIPS 140-2 security levels

The standard defines four security levels, each representing an increased security level. The levels range from minimal protection to the highest level of security available. They are intended to provide organizations with a way to choose a cryptographic module that meets their specific security requirements. The four security levels are as follows

1. Level 1

   This level provides basic protection and is used for applications where cost is a primary consideration. The security requirements at this level are minimal and are designed to prevent the most basic attacks.

2. Level 2

   This level provides increased security compared to Level 1 and is used for applications where security is more important than cost. This level includes additional security requirements such as key generation, storage, and operational security.

3. Level 3

   This level offers the highest level of security available under the FIPS 140-2 standard and is used for applications that require the highest level of security. At this level, cryptographic modules must provide multiple layers of security and must be tested against a comprehensive set of attacks.

4. Level 4

   This level provides the ultimate level of security and is used for applications that require the protection of classified information. Cryptographic modules at this level must meet stringent security requirements and be tested against various sophisticated attacks.

Security Levels Comparison based on

Physical Security

1. Level 1

   Basic physical security mechanisms, such as tamper-evident packaging, are in place.

2. Level 2

   Intermediate physical security mechanisms, such as tamper-evident packaging and secure power and reset controls, are in place.

3. Level 3

   High physical security mechanisms, such as tamper-evident packaging, secure power and reset controls, and physical protection against tampering and unauthorized access, are in place.

4. Level 4

   The highest level of physical security, with physical protection against tampering and unauthorized access and a secure environment for the module.

Cryptographic Key Management

1. Level 1

   Limited key management, with the keys generated and used within the module.

2. Level 2

   Improved key management, with the keys generated, stored, and used within the module, and the ability to securely update keys.

3. Level 3

   Robust key management, with secure key generation, storage, and use, and the ability to securely update keys.

4. Level 4

   The highest level of key management, with secure key generation, storage, use, and the ability to securely update keys, and a secure environment for the module.

Approved Algorithms

1. Level 1, 2, and 3

   AES, DES/3DES, RC2, RC4, SHA-1/224/256/384/512, DSA, ECDSA algorithms are approved for use at each level.

2. Level 4

   AES, DES/3DES, RC2, RC4, SHA-1/224/256/384/512, DSA, ECDSA algorithms are approved for use at this level.

It’s important to note that the specific security requirements for each level and the algorithms approved for use at each level may be subject to change as technology and security needs evolve.

FIPS 140-2 Security Levels Key Features

Cryptographic algorithms

Cryptographic algorithms play a crucial role in protecting sensitive information and are an important consideration when choosing a cryptographic module. FIPS 140-2 requires that all cryptographic algorithms used in cryptographic modules be approved by NIST and strong enough to provide the required level of security. In addition, the standard requires that cryptographic algorithms be implemented correctly in the cryptographic module to ensure the desired level of security is achieved.

Key management

Key management is a vital component of any cryptographic system, and FIPS 140-2 requires that all cryptographic modules implement secure key management processes. The standard specifies key generation, storage, and transmission requirements to ensure that cryptographic keys are protected from unauthorized access or tampering. This includes requirements for secure key storage, secure key transmission, and the use of secure key escrow processes.

Physical security

Physical security is a vital aspect of protecting cryptographic modules, and the FIPS 140-2 standard specifies requirements for the physical security of cryptographic modules. This includes requirements for the environment in which the cryptographic module must operate, such as temperature, humidity, and electromagnetic interference, and for physical protection from tampering or theft.

Operational security

Operational security refers to the security of the cryptographic module during normal operation, and the FIPS 140-2 standard specifies requirements for operational security. This includes requirements for user authentication, access control, audit logging, and protecting the cryptographic module against unauthorized access, tampering, or modification.

Testing and certification

To ensure compliance with the FIPS 140-2 standard, cryptographic modules must undergo extensive testing by an accredited third-party laboratory. The laboratory must be accredited by NIST and must follow the procedures specified in the standard. Once the cryptographic module has been tested and certified as compliant with the standard, it can be used in government systems that use cryptographic modules that meet the FIPS 140-2 security requirements.

Conclusion

In conclusion, using FIPS 140-2 cryptographic modules assures organizations that their cryptographic systems meet rigorous security requirements and are suitable for protecting sensitive information. By requiring strict security requirements for key management, physical security, operational security, and testing and certification, the FIPS 140-2 standard guarantees that their cryptographic systems are secure, and that sensitive information is protected against unauthorized access or tampering.

The standard provides a clear framework for evaluating cryptographic modules and helps organizations to choose a cryptographic module that meets their specific security needs.

It is important for organizations to be aware of the security requirements specified by the FIPS 140-2 standard and to choose cryptographic modules that meet the standard’s requirements. This will ensure that their cryptographic systems are secure and provide the required level of protection for sensitive information. 

Quantum computers analyze enormous data sets and execute complex computations significantly faster than traditional computers. Google constructed a quantum computer in 2019 that could calculate in 3 minutes and 20 seconds. Still, regular supercomputers would have taken 10,000 years to solve the identical calculation, proving quantum edge or quantum supremacy.

While quantum computing is still in its early stages, upheavals in various areas, including cybersecurity, may occur much sooner than you think. The impact of quantum computing on cybersecurity is tremendous and game-changing.

Quantum computing shows significant promise in various fields, including weather forecasting, artificial intelligence, medical research, etc. However, it poses a substantial threat to cybersecurity, necessitating a shift in how we secure our data.

While quantum computers cannot currently break most of our present types of encryptions, we must immediately keep ahead of the risk and develop quantum-proof solutions. It will be too late if we wait till those powerful quantum computers begin breaking our encryption.

An additional reason to act now

Regardless of when commercially available quantum computers will emerge, the potential of malicious actors harvesting data is another reason to quantum-proof data now. They are already grabbing data and storing it until they can obtain a quantum computer to decipher it.

The data will have already been compromised at that point. The only way to maintain information security, particularly information that must be kept indefinitely, is to protect it today via quantum-safe key transmission.

Quantum Threat to Cybersecurity

Quantum computers will be capable of solving issues that traditional computers are incapable of solving. This involves deciphering the algorithms underlying the encryption keys that safeguard our data and the Internet’s infrastructure.

The encryption used nowadays is largely built on mathematical calculations that would take far too long to decipher on today’s machines. Scientists have been working on constructing quantum computers that can factor progressively bigger numbers since then. Consider two large integers and multiply them together to simplify this. It’s simple to calculate the product, but it’s considerably more difficult to start with a huge number and divide it into its two prime numbers. However, a quantum computer can readily factor those numbers and break the code.

Peter Shor created a quantum method (aptly titled Shor’s algorithm) that can factor in big numbers far faster than a traditional computer.

Today’s RSA encryption is extensively used for transferring critical data over the Internet and is based on 2048-bit numbers. Experts believe that breaking that encryption would require a quantum computer with up to 70 million qubits. The largest quantum computer available today is IBM’s 53-qubit quantum computer, so it may be long before that encryption to be broken.

As the speed of quantum research continues to accelerate, such a computer cannot be developed within the next 3-5 years.

For example, Google and Sweden’s KTH Royal Institute of Technology discovered “a more efficient technique for quantum computers to do the code-breaking calculations, decreasing required resources by orders of magnitude” earlier this year. Their research, featured in the MIT Technology Review, proved that a 20 million-qubit computer could break a 2048-bit number in about 8 hours. However, given the rapid speed of quantum research, such a computer cannot be developed within 3-5 years. That means that continued advances like this will keep pushing the timescale forward.

It’s worth mentioning that perishable sensitive data isn’t the major concern when it comes to the quantum encryption issue. The more serious concern is the susceptibility of information that must remain secret indefinitely, such as banking data, privacy data, national security-level data, etc. Those are the secrets that need to be protected by quantum-proof encryption right now.

Adapting Cybersecurity to Respond to the Threat

Researchers have been working hard to produce “quantum-safe” encryption in recent years. There are many unanswered problems in quantum computing, and scientists are working hard to find answers.

However, one thing is certain about the influence of quantum computing on cybersecurity: it will represent a danger to cybersecurity and current types of encryptions. To mitigate that threat, we must change how we secure our data and begin doing it now.

We must handle the quantum threat the same way we approach other security vulnerabilities: by adopting a defense-in-depth strategy that includes many layers of quantum-safe protection. Security-conscious enterprises recognize the need for crypto agility.

They are looking for crypto-diverse solutions, such as those provided by Encryption Consulting LLC, quantum-safe their encryption now and quantum-ready for tomorrow’s challenges.

In February, TikTok agreed to pay $92 million to resolve a class-action privacy lawsuit.

The plaintiffs claim TikTok obtained biometric data illegally, mined user information from unpublished draughts, and improperly shared data with third firms such as Google and Facebook.

What Happened Next?

TikTok has agreed to resolve a class-action lawsuit over the collection and use of personal data from TikTok users. This agreement was reached because of 21 lawsuits, a few of which were filed on behalf of minors, and it affects about 89 million TikTok users.

TikTok rejected all the charges made in the complaints but agreed to a $92 million settlement for affected users. “While we disagree with the statements, rather than engaging in prolonged litigation, we’d like to focus our efforts on creating a safe and pleasant experience for the TikTok community,” TikTok said in February after reaching a deal.

So, what aspects of personal information and data privacy did TikTok violate? We can’t be sure because the lawsuit was settled out of court. However, based on the charges and TikTok’s settlement, we can detect possible and likely privacy violations.

The Personal Data Problem

The plaintiffs claim TikTok obtained biometric data illegally, mined user information from unpublished draughts, and inappropriately shared data with third-party firms such as Google and Facebook.

TikTok is accused of using face recognition to obtain a competitive edge over other social media apps. According to the lawsuit, facial recognition was utilized to assess personal information like as age, gender, and race in order to recommend content.

The Illinois Biometric Information Privacy Act granted Illinois residents the opportunity to sue TikTok for utilizing their biometric information without their permission.

The suit claimed that the app mined information from drafted and unposted films and that the user’s personal data was being improperly provided to third parties.

TikTok apparently made improvements as part of the deal to avoid the lawsuit going to trial. They will erase some data; however, whether this data is unpublished draughts or biometrics is unknown.

TikTok has also stated that it will no longer gather biometric data, track user location, harvest information from user-created content, or store US citizens’ data outside the US. All of this, however, may be rectified if its privacy policies are openly published.

The Settlement

Although a $92 million settlement may appear considerable, if applied to all impacted consumers, those in the nationwide subclass would receive a compensation of $0.96 due to attorney fees.

On the other hand, Illinois residents will earn more (up to $5.75 if every eligible person files a claim). Even if only 20% of users claim a portion of the settlement, customers nationwide may only earn $4.79.

An app notice notified Eligible users of the TikTok Data Privacy Notice of Settlement. These specifics can still be seen on the TikTok data privacy settlement website.

Even though TikTok has not agreed to any privacy violations, this settlement has resulted in TikTok entering into new agreements to protect users’ personal data and biometric data.

Many individuals are concerned about TikTok’s suspected use of personal data because they were previously ignorant of the app’s privacy concerns. While the social media behemoth was able to resolve these allegations out of court, the case demonstrates customers’ growing awareness of privacy concerns.

Read time: 9 minutes

Asymmetric encryption, commonly known as public-key cryptography, is based on calculations that are extremely hard to crack even with the most powerful computers available today. However, using encryption with private and public keys still has one issue. The public keys are presumed to be open, which means that anybody may access them. Nothing can prevent a malicious party from claiming ownership of a public key that is not theirs. Public Key Infrastructure can be used to solve this integrity issue.

Information can be exchanged on an insecure network, such as the internet, securely and privately using PKI. To achieve this, PKI uses two key technologies: digital signatures and digital certificates which are the key components in the certificate authority trust model.

What is a Digital Signature?

The term digital signature is comprised of two words: digital and signature, so let’s try to elaborate on each of these terms one by one.

• What is meant by digital?

  Digital elaborates the electronic technology that generates, stores, and processes data in terms of positive and negative states. Positive is represented by the number 1 and 0 represents the non-positive. Thus the data is expressed as a string of 0’s and 1’s which is transmitted or stored with digital technology.

• What is a Signature?

  To show whether a document is approved by us or created by us, we generally sign a document. This signature proves to the recipient that this document is coming or generated from a legitimate source. This signature present on the document signifies the authenticity of the document.

For example, When X sends a message to Y, Y wants to check the legitimacy of the message and confirm whether it is coming from X, not from some third party or malicious Z. So, Y can ask X to electronically sign the message. The identity of X is proved by this electronic signature which is called a digital signature.

Features of a Digital Signature

1. Message Integrity

   In signing and verifying algorithms, the message’s integrity is preserved by using a hash function.

2. Message Authentication

   The verification of the message is done by using the sender’s public key. When X sends a message to Y. The public key of X is used by Y for verification and the public key of X can’t create the same signature as Z’s private key.

3. Message Nonrepudiation

   Non-repudiation is the guarantee that the originator of a message cannot deny any previously sent messages, commitments, or actions.

What is a Digital Certificate?

A digital certificate is a collection of electronic credentials that are used to confirm the identity of the certificate holder using encryption keys (public and private keys). These keys sign and encrypt information digitally. A digital certificate guarantees that the certificate includes a public key that belonged to the SSL requestor to whom it was issued.

A digital certificate is issued by a certificate authority. A digital certificate holds two keys: a public key and a private key. While the receiver has the recipient’s private key, the certificate contains the public key. A message that has been encrypted with a public key can only be decrypted with the mathematically linked private key. When a certificate is issued by a certificate authority, it contains the encryption algorithm, digital signature, serial number, expiry dates, and name of a certificate owner. The process of certificate issuance starts with the submission of a CSR (certificate signing request) and submission of the required information.

The verification of the domain ownership along with business registration documents is done after the information is submitted. After the verification, a digital certificate is issued by the certificate authority and needs to be installed on the server.

Who Can Issue a Digital Certificate?

The responsibility for issuing digital certificates falls on the certificate authority. They will attach their signatures to the certificates as evidence of the legitimacy and reliability of the entity that made the request. The management of domain control verification is largely under the responsibility of the certificate authority. In essence, certificate authorities are vital to the functioning of the public key infrastructure and the security of the internet.

Benefits of Digital Certificates?

Digital certificates play an important role in the cybersecurity landscape. Some of the key advantages of having a digital certificate are made up of the following:

1. Data Security, Confidentiality, and Integrity Through Encryption

   The protection of sensitive data is one of the most significant functions that digital certificates provide. Information cannot be viewed by anybody who is not allowed to read it thanks to digital certificates. Therefore, having a digital certificate will be advantageous for people and organizations transporting vast amounts of data. Consider the use of an SSL certificate, which assures that hackers cannot intercept user data by helping to encrypt data sent between website servers and browsers.

   Additionally, digital certificates assist in resolving issues with message confidentiality and privacy. They enable private communication between parties using a public network. Digital certificates also contribute to the maintenance of data integrity by preventing intentional or unintentional tampering with the data while it is in transit.

2. Authenticity or Identification Benefits

   Digital certificates have been at the forefront of the fight against fraudsters and fake websites that appear as authentic ones in an era of extensive data breaches and increasing cyberattacks. They show that websites and servers are exactly who they claim to be and identify every participant in the communication chain. As you are aware, before granting a digital certificate, certificate authorities investigate a company or website. The certificate details will contain all the necessary information about the website. This data is what aids in proving the legitimacy of the website.

3. Scalability

   The same encryption strength is provided to businesses of all shapes and sizes by digital certificates such as SSL certificates. These certificates are also very scalable because they may be issued, canceled, and renewed in a matter of seconds.

4. Reliability and Cost-effectiveness

   The trusted certificate authorities have the responsibility of issuing digital certificates. For the CA to issue a certificate, it must thoroughly investigate each applicant, meaning the organization that uses the certificate cannot be tricked by the hacker. Digital certificates also provide the necessary encryption strengths at a reasonable cost. You shouldn’t be shocked to find that most digital certificates cost around $100 or less each year.

5. Public Trust

   Visitors to your website are worried about their security and wouldn’t take the chance of going to an unsafe website. Because of this, most of them will seek confirmation that your website is trustworthy and safe. You may utilize it in a variety of ways to gain user trust, and getting a digital certificate is the ideal option.

Digital Certificate vs. Digital Signature: What’s the Difference?

The basic difference between a digital certificate and a digital signature is that the certificate attaches the digital signature to an entity, while the digital signature must guarantee the security of the data or information from the moment it is sent. Digital certificates are used to validate the sender’s and the digital signature is used to validate the sent data.

A digital certificate is a collection of the digital or electronic credentials (file or passwords) issued by a trusted certificate authority and linked to digital messages/communications to validate the legitimacy of the sender, server, or device using the public key infrastructure (PKI). In comparison, a digital signature is a hashing approach that verifies the users’ identities and provides authenticity using a numeric string.

Using cryptographic key technology, a digital signature is simply attached to an email or document. The same hash algorithm is used by the signature to decrypt the message when it is received by the recipient.

Conclusion

Both the digital signature and the digital certificate are essential components of security. In our daily lives, we use them both. So next time you visit a website don’t forget to verify whether it has a valid digital certificate or not. We at Encryption Consulting with top-of-the-line consultants provide a vast array of PKI services to easily manage and store your digital certificates.