LAE

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: Wizardous

Hi,

In encrypt node help, we can see triple DES algorithm and SHA-1 password hashing technique used for encryption. We need this kind of encryption and it is really useful, but customer asks me if it is security certified module or not. I know, these methods mentioned on node help, are certified by Nist. But how about the node/module? Do or will Lavastorm have a certification for Encrypt node/module like we see on this list ( http://csrc.nist.gov/groups/STM/cmvp...1/1401vend.htm )? If it is not necessery as the methods are certified please let me know.

And sorry about my questions if they are nonsense as I don't know much about this security issue.

Kind regards,

�zg�n

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: mmarinelli

The Encrypt/Decrypt node set uses a F/OSS component called jasypt (www.jasypt.org), which provides a simplified API for using Java Cryptography Extension (JCE). JCE is a framework for delivering cryptography modules which is used by many software providers to deliver NIST compliant functionality. For our node set, we only implemented support for the default JCE provider used by jasypt - the JCE implementation provided by the core Oracle Java VM, which itself is not NIST certified. This default was chosen because it did not require the distribution or installation of additional software which may carry a premium and which can be complicated by cryptography export regulations. So the nodes as they are packaged are not NIST compliant.

It is possible to utilize an alternate JCE provider with jasypt, however this was not a design goal of the initial node release, so this functionality is not exposed via node parameters and has not been tested. A future version of the node will include such functionality.

Note: This was originally posted by an inactive account. Content was preserved by moving under an admin account.

Originally posted by: Wizardous

Thanks for quick response.

Regards,

�zg�n