Hi, I am using Secur32.dll in my application for EncryptMessage and DecryptMessage APIs. I have confirmed that my application work as expted when FIPS mode is enabled on windows. Wanted to know that can i claim FIPS compliance for my application as the application is using windows native Secur32.dll for crypto

On Sat, 26 Mar 2011 04:32:56 +0000, Rakesh Agrawal wrote: I am using Secur32.dll in my application for EncryptMessage and DecryptMessage APIs. I have confirmed that my application work as expted when FIPS mode is enabled on windows. Wanted to know that can i claim FIPS compliance for my application as the application is using windows native Secur32.dll for crypto You can find guidance on developing for FIPS compliance here: http://technet.microsoft.com/en-us/library/cc750357.aspx#c1 No one here is going to be able to validate whether or not your application is FIPS compliant. If your application is going to be commercially or publicly available then I strongly suggest you consult a lawyer who is familiar with the FIPS standards prior to asserting that your application is FIPS compliant. Paul Adare MVP - Identity Lifecycle Manager http://www.identit.ca My girlfriend always laughs during sex - no matter what she's reading. - Steve Jobs (Founder: Apple Computers)

Thanks Paul, I have gone thorough and found that if i wanted to claim FIPS for my applicaiton i need to ship the FIPS validate version of libraires along with my applicaiton. But for me the problem is that only W2K8 binaries are FIPS validated and my application will support both W2K8 and W2K8 R2. So according to the artical ... i will be deploying W2K8 FIPS validate version of Rsaenh.dll. But will 6.0.6001.22202 is supported/worning on W2K8 R2? Regards Rakesh

Also wanted to know if "Negotiate" package from secur32.dll is also FIPS compilence or its only the "Schannel" which is FIPS certified. ?