FIPS 140-3 is not a security guarantee, and auditors know it

5 hours ago

FIPS 140-3 validation covers only the cryptographic module boundary, not the surrounding product, configuration, or key management, leading to a gap between certification and actual security.
Certified modules have shipped exploitable flaws for years (e.g., ROCA, EUCLEAK, Dual_EC_DRBG, YubiKey FIPS bug), proving validation does not guarantee security.
The certification process freezes firmware, making it costly to update; vendors often choose to ship known-vulnerable code rather than lose certification for a year.
Go's native FIPS module (v1.0.0) lags behind current releases, illustrating how certification can force use of outdated cryptography.
FIPS mode imposes performance costs (e.g., 6-9x slower ECDSA keygen) and forbids algorithms like ChaCha20-Poly1305 or secp256k1, making it incompatible with many real-world use cases like cryptocurrency.
Over 90% of HSM customers run FIPS mode disabled because approved algorithms cannot support Bitcoin/ Ethereum (e.g., secp256k1, Keccak-256, BIP32 HMAC key < 112 bits).
Auditors focus on configuration drift, key provenance, human procedures, backup security, and policy logs—areas outside the certificate's scope.
Practical advice: treat the certificate as a baseline, document actual configurations (including non-FIPS mode), and prioritize process evidence over the certificate alone.

Confidential computing relies on remote attestation to prove a server runs in a genuine Trusted Execution Environment (TEE) before sharing sensitive data.
New research reveals flaws in attested TLS protocols used in confidential computing, allowing relay attacks where a client’s connection can be redirected to a compromised server without detection.
The study formalizes three levels of cryptographic binding for attestation, with level three (tying evidence to application traffic keys) potentially unattainable in current intra-handshake architectures.

The EU's open-source age-verification project mandates hardware-bound attestation, raising concerns about compatibility with Linux, custom Android ROMs, and independently compiled apps.
A project maintainer confirmed that hardware-bound attestation is an architectural requirement, not an optional implementation detail, inviting alternative proposals.
The system aims to prove age without revealing identity, relying on protected hardware like Android TEE or Apple Secure Enclave to prevent credential misuse.

Web-based 'end-to-end' encryption is fundamentally flawed because the server operator, who you're supposedly securing against, distributes the client-side code and could push malicious updates.
Such cryptosystems are incoherent as they fail to separate the entity being secured against from the one providing the implementation, making them essentially backdoored.
Companies adopt snake oil cryptography primarily as a legal maneuver to avoid warrant and subpoena obligations, not to provide real security.

The W3C is developing end-to-end encryption (E2EE) for ActivityPub, separate from a key transparency proposal for the Fediverse.
Three main goals are outlined: enabling E2EE messaging (Fundamental), ensuring correct encryption (Security), and verifiably authenticating user keys without central authority (Authenticity).
Key transparency provides a decentralized root of trust by logging which ActivityPub actor controls which signing keys, addressing authenticity.

Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.

Confidential computing relies on remote attestation to prove a server runs in a genuine Trusted Execution Environment (TEE) before sharing sensitive data.
New research reveals flaws in attested TLS protocols used in confidential computing, allowing relay attacks where a client’s connection can be redirected to a compromised server without detection.
The study formalizes three levels of cryptographic binding for attestation, with level three (tying evidence to application traffic keys) potentially unattainable in current intra-handshake architectures.

The EU's open-source age-verification project mandates hardware-bound attestation, raising concerns about compatibility with Linux, custom Android ROMs, and independently compiled apps.
A project maintainer confirmed that hardware-bound attestation is an architectural requirement, not an optional implementation detail, inviting alternative proposals.
The system aims to prove age without revealing identity, relying on protected hardware like Android TEE or Apple Secure Enclave to prevent credential misuse.

Web-based 'end-to-end' encryption is fundamentally flawed because the server operator, who you're supposedly securing against, distributes the client-side code and could push malicious updates.
Such cryptosystems are incoherent as they fail to separate the entity being secured against from the one providing the implementation, making them essentially backdoored.
Companies adopt snake oil cryptography primarily as a legal maneuver to avoid warrant and subpoena obligations, not to provide real security.

The W3C is developing end-to-end encryption (E2EE) for ActivityPub, separate from a key transparency proposal for the Fediverse.
Three main goals are outlined: enabling E2EE messaging (Fundamental), ensuring correct encryption (Security), and verifiably authenticating user keys without central authority (Authenticity).
Key transparency provides a decentralized root of trust by logging which ActivityPub actor controls which signing keys, addressing authenticity.

Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.

Hasty Briefsbeta