Subject: Re: [saag] Algorithms/modes requested by users/customers

From: [email-masked] (Peter Gutmann)
Date: Thu, 06 Mar 2008 18:37:57 +1300

"Santosh Chokhani" <[email-masked]> writes:

>I do not think this is a forum for negotiations.

Absolutely, that's why I pointed out that I wasn't taking it as a price quote,
more to make a point.

>But, we will be happy to do FIPS testing for your product for Level 1 for
>quoted price.
>
>As to algorithms, all FIPS approved algorithms need to be tested.

And there's the rub, it's not just handing over $30K and getting back a
coloured certificate, you need to get the algorithms certified, prepare a ton
of paperwork, spend a considerable amount of time on this, and that's where
the $100K all-up figure comes from.  If I could simply hand over $30K and the
source code *with no further effort or expense on my behalf* I'd jump at the
chance.

Just to show that I'm not trying to pick on Cygnacom here I'll make this an
open offer to anyone:

  If I can hand you $30K and a copy of my source code and you can get me a
  FIPS 140 cert for it without me incurring any additional effort or expense,
  please get in touch.

>Have you yourself participated in a FIPS evaluation or have you looked at the
>NIST FIPS 140-2 DTR and FIPS 140-2 IG (i.e. Implementation Guidance)
>available on the Web?

Probably about half a dozen directly (+/- one or two, I haven't kept an exact
tally), and been involved indirectly in about a dozen more via discussions
with (and listening to complaining about :-) others going through the process.
(Again, YMMV, I haven't kept an exact tally on the latter, and in some cases
it was nothing more than "what did you guys do to get past ...?", and
sympathising with them over problems).

Peter.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 6 Mar 2008 07:26:24 -0500

Most of the standards are based on the assumption that you have some
software development processes in place and thus will have documentation
on the architecture and design of the product and not just the source
code.

One would think that you would also done some testing based on the
knowledge of the design, interfaces and source code.

-----Original Message-----
From: pgut001 [mailto:[email-masked]] 
Sent: Thursday, March 06, 2008 12:38 AM
To: [email-masked]; [email-masked]; Santosh Chokhani
Cc: [email-masked]
Subject: RE: [saag] Algorithms/modes requested by users/customers

>I do not think this is a forum for negotiations.

Absolutely, that's why I pointed out that I wasn't taking it as a price
quote,
more to make a point.

And there's the rub, it's not just handing over $30K and getting back a
coloured certificate, you need to get the algorithms certified, prepare
a ton
of paperwork, spend a considerable amount of time on this, and that's
where
the $100K all-up figure comes from.  If I could simply hand over $30K
and the
source code *with no further effort or expense on my behalf* I'd jump at
the
chance.

Just to show that I'm not trying to pick on Cygnacom here I'll make this
an
open offer to anyone:

  If I can hand you $30K and a copy of my source code and you can get me
a
  FIPS 140 cert for it without me incurring any additional effort or
expense,
  please get in touch.

>NIST FIPS 140-2 DTR and FIPS 140-2 IG (i.e. Implementation Guidance)

Probably about half a dozen directly (+/- one or two, I haven't kept an
exact
tally), and been involved indirectly in about a dozen more via
discussions
with (and listening to complaining about :-) others going through the
process.
(Again, YMMV, I haven't kept an exact tally on the latter, and in some
cases
it was nothing more than "what did you guys do to get past ...?", and
sympathising with them over problems).

Peter.