RSA Security 5.2.2 manual Pkcs Compared with Nist, Nist Approval and Windows NT Platforms

Cryptographic Standards and Crypto-C

•Secure Hash Algorithm (SHA1), as specified in FIPS PUB 180-1, Secure Hash Standard (SHS)

•RSA Digital Signatures (rDSA), as specified in FIPS PUB 186-2

•Digital Signature Algorithm (DSA), as specified in FIPS PUB 186, Digital Signature Standard (DSS)

•Data Encryption Standard (DES), as specified in FIPS PUB 46-2

•DES Modes of Operation, as specified in FIPS PUB 81

NIST Approval and Windows NT Platforms

If you require NIST approval for your Windows NT applications, you may benefit from using the “Crypto-C Cryptographic Services Module,” a DLL that is compliant with the FIPS 140-1 standard. NIST may approve the use of this module in your application without requiring further testing of your application, based on the NIST certification issued to the Crypto-C module. For more information, see the \FIPS140 folder on the Crypto-C CD-ROM for Windows NT.

PKCS Compared with NIST

In some cases, such as the RSA algorithm, the PKCS standards differ from the NIST standards. In such cases, the standard you choose depends primarily on the scope of your application and how it will be deployed.

As mentioned previously, the PKCS standards, many of which have been in place for a long time, have widespread acceptance and are used as the base for many other higher-level standards (for example, S/MIME, SET, IPSec, and SSL). Therefore, if you are implementing one of these higher-level standards, or if you want compatibility with other applications that use the PKCS standards, you should use the PKCS-based implementation.

However, the United States government may have specific standards requirements for certain government agencies and for government contractors. These are usually the standards as defined by NIST. If you are creating applications for U.S. government use, you should ensure that you are in compliance with any required protocols.

C h a p t e r 1 I n t r o d u c t i o n 5