News for hackers. Stuff that matters.

A comment on On the Juniper backdoor. Parent comment

Re:On the Juniper backdoor by tptacek on Tuesday December 22, 2015 @12:39PM (#10779061)
The likelihood of them ever having the cryptographic components of ScreenOS competently audited is very low.

Most firms didn't even start getting basic software security assessments done until ~5 years ago, and almost nobody gets crypto reviews done (crypto reviews are nosebleed expensive, because only a tiny fraction of software security people can do them competently).

[ Parent | on HN ]
Re:On the Juniper backdoor by count on Tuesday December 22, 2015 @01:08PM (#10779260)
This might be a stupid question, but if they're using their own values, wouldn't this have triggered issues during a FIPS assessment?

ScreenOS has been FIPS-140 validated a couple of times in the last 10 years...

[ Parent | on HN ]
Re:On the Juniper backdoor by tptacek on Tuesday December 22, 2015 @01:10PM (#10779272)
No, you're allowed to use your own values.

Also: FIPS validation isn't particularly meaningful. It's not like a serious crypto assessment.

[ Parent | on HN ]