canmove, Confirmed users
937
edits
Security Policy: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
|||
| Line 119: | Line 119: | ||
| 32 || In the FIPS PUB 140-2 mode of operation, the cryptographic module shall perform a continuous random number generator test upon each invocation of the pseudorandom number generator as defined in section 4.9.2 of FIPS PUB 140-2. | | 32 || In the FIPS PUB 140-2 mode of operation, the cryptographic module shall perform a continuous random number generator test upon each invocation of the pseudorandom number generator as defined in section 4.9.2 of FIPS PUB 140-2. | ||
|- | |- | ||
| 33 || Upon exit from the FIPS PUB 140-2 mode of operation, all security relevant data items within the cryptographic module | | 33 || The cryptographic module takes a number of explicit zeroization steps to clear the memory region previously occupied by a plaintext secret key, private key, or password. Any plaintext secret and private keys and passwords are zeroized once the use is complete. Upon exit from the FIPS PUB 140-2 mode of operation, all security relevant data items within the cryptographic module are zeroized by having their memory contents rewritten with zeroes. | ||
|- | |- | ||
| 34 || The TLS pseudorandom function (PRF) is contained within the cryptographic module, and it shall enforce if one hash is weak the PRF function would remain strong. This is accomplished by exclusive-oring the results of the two hashes in computation of security relevant data items -- specifically TLS pre-master secrets. | | 34 || The TLS pseudorandom function (PRF) is contained within the cryptographic module, and it shall enforce if one hash is weak the PRF function would remain strong. This is accomplished by exclusive-oring the results of the two hashes in computation of security relevant data items -- specifically TLS pre-master secrets. | ||
| Line 1,371: | Line 1,371: | ||
== Means of Access == | == Means of Access == | ||
Prior to execution of the Client or Server products, the Security Libraries are stored on disk in compiled binary form. The NSS cryptographic module relies on Discretionary Access Controls (DAC) to protect the binary image from being tampered with. | Prior to execution of the Client or Server products, the Security Libraries are stored on disk in compiled binary form. The NSS cryptographic module relies on Discretionary Access Controls (DAC) to protect the binary image from being tampered with. | ||
== Role-based Authentication == | == Role-based Authentication == | ||