1

I've searched high and low for information on whether eCryptFS encryption is FIPS 140-2 compliant. I've found information on other filesystem or block encryption and their FIPS compliance I presume that since eCryptFS uses Open SSL for keys it might be possible to make that part of it FIPS compliant through implementing the right calls to the OpenSSL FIPS Object Module.

But, I am not clear on how the ciphers are implemented in eCryptFS, and whether more needs to be known on FIPS compliance there.

2

While eCryptFS is actively maintained by Canonical/Ubuntu engineers and the design is cryptographically sound, eCryptFS has never been formally evaluated for FIPS 140-2 certification or compliance, and it's unlikely that it ever will be.

Full disclosure: I am one of the authors and maintainers of eCryptFS.

0

FIPS 140 applies to a specific product. Validating a cryptographic library does not make a product using it validated, nor does validating a product make its components validated.

FIPS 140 level 1 compliance is not really a security certification, it's mostly a functional certification. To meet FIPS 140 level 1, you need (when the product is running in FIPS mode) mainly:

  • To use only approved cryptographic algorithms.
  • To demonstrate that the algorithms work on test vectors.
  • To run some tests when the system starts.
  • To erase keys after use.
  • To go through the formal certification process.

FIPS 140 level 2 and above have actual security requirements.

The fact that OpenSSL has a FIPS 140 level 1 certification only helps to certify a product using OpenSSL in that someone must have implemented the tests and key erasure. For FIPS 140 level 1, the work is pretty much only red tape.

In any case, ecryptfs does not use OpenSSL, so work done on OpenSSL is irrelevant. Ecryptfs is implemented in the Linux kernel. There have been kernel configurations certified to FIPS 140 level 1, I don't remember whether that includes the use of Ecryptfs (dmcrypt, definitely).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.