How can Windows OS detect if an algorithm is FIPS compliant?

Question

When Windows setting to force use FIPS Compliant algorithms is turned on and if there is an application that uses non-FIPS compliant algorithm running on that machine, and exception is thrown in that application saying something like it is not part of windows FIPS implementation... I have seen someone bypassing the the FIPS check by commenting out this check in the application code. If one can do this, is this real FIPS compliant?

How does windows detect if an application is using FIPS compliant algorithm or not?

Here is some reading from Microsoft you might be interested in: "[Why We’re Not Recommending “FIPS Mode” Anymore](https://blogs.technet.microsoft.com/secguide/2014/04/07/why-were-not-recommending-fips-mode-anymore/)" — Scott Chamberlain, May 11 '17 at 20:14

Scott Chamberlain · Accepted Answer · 2017-05-11T20:12:07.967

The algorithms are provided by libraries built in to Windows or by products shipped by Microsoft, they contain both complaint and non complaint algorithms.

When your code calls in to those built in libraries those libraries contain the check for the windows setting and will throw a exception if those libraries are set.

Here is a example of the check inside of Sha256Managed

    public SHA256Managed()
    {
#if FEATURE_CRYPTO
        if (CryptoConfig.AllowOnlyFipsAlgorithms)
            throw new InvalidOperationException(Environment.GetResourceString("Cryptography_NonCompliantFIPSAlgorithm"));
        Contract.EndContractBlock();
#endif // FEATURE_CRYPTO

        _stateSHA256 = new UInt32[8];
        _buffer = new byte[64];
        _W = new UInt32[64];

        InitializeState();
    }

If you use a 3rd party implementation or write your own of implementation of an algorithm windows will not detect that you are using a non FIPS complaint algorithms on a system with that setting set.

Thanks Scott. So it is our responsibility to make sure they are compliant and not that Operating System can force it always. Thank you for educating. — sethu, May 15 '17 at 14:38

How can Windows OS detect if an algorithm is FIPS compliant?

1 Answers1