I would like to understand the difference between these two options how to generate AES key.

  1. AES key is generated directly in FIPS 140-2 Level 3 device with validated AES algorithm
  2. AES key is generated using BouncyCastle library and SecureRandom source is provided from FIPS 140-2 Level 3 device with validated RNG.

Are these two options equivalent in terms of security?


From a technical standpoint, not really. If you want to adhere to FIPS 140-2 Level 3 requirements, absolutely not.

FIPS 140-2 Level 3 has very specific requirements, including resistance to information leakage when an attacker has some restricted level of physical access to the device. This means that a certified implementation must ensure that the implementation of key generation and the cipher itself is resistant to side-channel attacks such as power analysis and electromagnetic emissions. Level 3 devices undergo rigorous EMC testing above and beyond that of normal electronic products. By taking key material from a FIPS 140-2 Level 3 device and transforming it needlessly on a non-compliant device (e.g. a general purpose computer) you nullify the EMC protection that the device offers, and potentially offer up other side-channels in the process.

  • When I would like to adhere that the AES generation must take place in FIPS 140-2 Level 3 device, what would be the difference on generating AES in such device, or providing me with random data through its certified RNG? AES key (in case of AES-128) is a random key and my RNG is on FIPS 140-2 Level 3 device so all the key data are random generated on device which should ensure protection from side channels, etc. – user1563721 Feb 9 '18 at 16:18
  • @user1563721 The problem is that the secondary key derivation that you perform outside of the certified device may leak the random data that was provided, via side-channel vulnerabilities. You can generate random data in the world's most secure HSM using all manner of technical wizardry and defense mechanisms, but if you spit that data out to a system that immediately leaks the data then there wasn't much point of having the validated RNG. You need to keep the crytographic operations on the non-compliant system to a bare minimum. – Polynomial Feb 9 '18 at 16:28

Your Answer

