How to prove .Net app FIPS compliance referencing NIST CMVP Certificate

Brandon Arthur 0 Reputation points
2024-03-06T17:50:13.5866667+00:00

There appears to be no supported version of Windows Server with active FIPS certificates for the Cryptographic Primitives Library and Kernel Mode Cryptographic Primitives Library.

Needing to prove how .Net app is FIPS compliant by referencing the FIPS certificate numbers available in the NIST CMVP for Windows Server. Since the application runs on Windows Server I assume that .Net Framework and IIS derive cryptographic functions from the underlying Windows CNG API. Does the hierarchy of cryptographic functions flow from .Net to the Cryptographic Primitives Library (bcrypt.dll) then to the Kernel Mode Cryptographic Primitives Library (cng.sys)? And does that mean I will have to reference both bcrypt.dll and cng.sys FIPS certificates? If so, I do not see a current FIPS certificate for a supported version of Server 2019 for Cryptographic Primitives Library.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,054 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,834 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.