EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 4·5 min read
FIPS 140-3 is not a security guarantee, and auditors know it
TL;DR
FIPS 140-3 certification does not guarantee overall security, as many users disable its validated mode after purchase. Understanding this distinction is crucial for effective security practices.
✦ Why It Matters
Evaluate your use of FIPS-certified products and ensure they are configured correctly for your security needs.
Key Takeaways
- Understand the limitations of FIPS 140-3 certification.
- Regularly verify the configuration of cryptographic modules.
- Be aware of the risks associated with disabling FIPS mode.
- Ensure key management practices are robust and compliant.
Full Summary
FIPS 140-3 is a certification for cryptographic modules, ensuring they implement approved algorithms correctly under specific configurations. However, many customers disable the validated mode, undermining the certification's intent.
The article discusses how FIPS validation only covers the module's cryptographic functions, not the surrounding security measures or key management practices. Notably, certified modules have shipped with exploitable flaws, demonstrating that validation does not equate to security.
For instance, flaws like ROCA and EUCLEAK persisted in certified products for years. The disconnect between certification and actual security practices leads to significant risks, especially in industries like cryptocurrency, where FIPS-approved algorithms are often incompatible with necessary operations.