Security Policy: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
mNo edit summary
 
(5 intermediate revisions by the same user not shown)
Line 2: Line 2:


[http://www.mozilla.org/projects/security/pki/nss/fips/secpolicy.pdf Security Policy]
[http://www.mozilla.org/projects/security/pki/nss/fips/secpolicy.pdf Security Policy]
==Authentication Policy==
===Strength of Authentication Mechanism===
In FIPS mode, the NSS cryptographic module imposes the following requirements on the password.
* The password must be at least '''seven''' characters long.
* The password must consist of characters from '''three or more character classes'''. We define five character classes: digits (0-9), ASCII lowercase letters, ASCII uppercase letters, ASCII non-alphanumeric characters (such as space and punctuation marks), and non-ASCII characters.  If an ASCII uppercase letter is the first character of the password, the uppercase letter is not counted toward its character class.  Similarly, if a digit is the last character of the password, the digit is not counted toward its character class.
To estimate the probability that a random guess of the password will succeed, we assume that
* the characters of the password are '''independent''' with each other, and
* the probability of guessing an individual character of the password is < '''1/10'''.
Since the password is >= 7 characters long, the probability that a random guess of the password will succeed is < (1/10)^7 = 1/10,000,000.
After each failed authentication attempt in FIPS mode, the NSS cryptographic module inserts a one-second delay before returning to the caller, allowing at most 60 authentication attempts during a one-minute period. Therefore, the probability of a successful random guess of the password during a one-minute period is < 60 * 1/10,000,000 = 0.6 * (1/100,000).
== Mitigation of Other Attacks ==
The NSS cryptographic module is designed to mitigate the following
attacks.
{| border="1" cellpadding="2"
|+
|-
!
Other Attacks
!
Mitigation Mechanism
!
Specific Limitations
|-
| Timing attacks on RSA
|| '''RSA blinding'''
Timing attack on RSA was first demonstrated by Paul Kocher in 1996[1], who contributed the mitigation code to our module. Most recently Boneh and Brumley[2] showed that RSA blinding is an effective defense against timing attacks on RSA.
|| None.
|-
| Cache-timing attacks on the modular exponentiation operation used in RSA and DSA
|| '''Cache invariant modular exponentiation'''
This is a variant of a modular exponentiation implementation that Colin Percival[3] showed to defend against cache-timing attacks.
|| This mechanism requires intimate knowledge of the cache line sizes of the processor. The mechanism may be ineffective when the module is running on a processor whose cache line sizes are unknown.
|-
| Arithmetical errors in RSA signatures
|| '''Double-checking RSA signatures'''
Arithmetical errors in RSA signatures might leak the private key. Ferguson and Schneier[4] recommend that every RSA signature generation should verify the signature just generated.
|| None.
|-
|}
== Results of FIPS 140-2 Level 2 Validation of NSS Cryptographic Module 3.11.5 ==
<table width="100%" border="1" cellspacing="2" cellpadding="2">
          <tr>
            <td valign="Top" align="Center"><font size="+1"><b>FIPS 140-2<br>Section<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Description<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Validation<br>      Level <br>Obtained<br>
            </b></font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">1.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Module Specification<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">2.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Module Ports and Interfaces<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">3.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Roles, Services, and Authentication<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">4.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Finite State Model<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">5.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Physical Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">6.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Operational Enviroment<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">7.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Key Management<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">8.0<br>
            </font></td>
            <td valign="Top"><font size="+1">EMI/EMC<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">9.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Self-Tests<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2</font><br>
            </td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">10.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Design Assurance<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
            <tr>
            <td valign="Top" align="Left"><font size="+1">11.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Mitigation of Other Attacks<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">C<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Module Security Policy<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
</table>
== Platform List ==
* Level 1
** Red Hat Enterprise Linux 4 x86
** Windows XP Service Pack 2
** 64-bit Solaris 10 AMD64
** HP-UX B.11.11 PA-RISC
** Mac OS X 10.4
* Level 2
** Red Hat Enterprise Linux 4 x86_86
** 64-bit Trusted Solaris 8 SPARC
== References ==
[1] P. Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems," CRYPTO '96, Lecture Notes In Computer Science, Vol. 1109, pp. 104-113, Springer-Verlag, 1996. (http://www.cryptography.com/timingattack/)
[2] D. Boneh and D. Brumley, "Remote Timing Attacks are Practical," http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html.
[3] C. Percival, "Cache Missing for Fun and Profit," http://www.daemonology.net/papers/htt.pdf.
[4] N. Ferguson and B. Schneier, Practical Cryptography, Sec. 16.1.4 "Checking RSA Signatures", p. 286, Wiley Publishing, Inc., 2003.
[[Category:NSS]]

Latest revision as of 20:55, 23 March 2007

This is a draft document.

Security Policy

Retrieved from "https://wiki.mozilla.org/index.php?title=Security_Policy&oldid=52838"