FIPS 140-2: Stay compliant and secure with Canonical

FIPS 140-2 is a set of publicly announced cryptographic standards developed by the National Institute of Standards and Technology. It is an essential part of FEDRamp requirements for many governmental agencies in the US and Canada, as well as their business partners from all around the world. Furthermore, as a well established and verified security standard, an increasing number of large companies and financial institutions are asking for FIPS compliance. 

Yet, FIPS certification process introduces challenges that could impact your security. Ubuntu lets you choose the way to implement FIPS-certified cryptographic modules with two distinct FIPS alternatives to choose from to overcome those challenges.

FIPS 140-2 certification vs CVE patching

FIPS 140-2 is a great way to assure that the best practices in cryptography are met. The rules that each organisation needs to follow to achieve the FIPS 140-2 certification are very strict. Each component needs to be designed, documented, tested and then validated by the NIST Testing Laboratory. Once a component becomes certified, it cannot be further modified without requiring a re-certification. This individual module validation can take weeks, and so the overall process can easily stretch to over 6 months. 

The apparent drawback of that situation appears when a new security patch becomes available. 

Imagine that a new critical CVE (Common Vulnerability and Exposure) was discovered in the OpenSSH module, but thankfully there is a USN (Ubuntu Security Notice) available to fix it. With a security fix applied  – the module will change and hence will no longer be certified; without it – the module’s security can be compromised by an exploitable vulnerability. 

FIPS Certified or FIPS Compliant

You might be wondering which Ubuntu FIPS version should be used in your organisation. That depends. If you work for a federal government department that collects, stores, transfers and shares sensitive but unclassified information, it’s likely that you’re required to use FIPS Certified modules without any modifications. In other cases – we recommend using FIPS Certified modules that include all security patches. We call it Ubuntu FIPS Compliant

Maintaining FIPS Certified modules security

To keep your FIPS Certified Ubuntu secure we will re-certify all modules every year.

Today, Ubuntu 18.04 LTS and 16.04 LTS has certifications for 5 distinct modules:  

Ubuntu 18.04 LTS

ComponentDescriptionVersionCMVP Certificate
Linux kernel (generic)The Linux kernel cryptographic library4.15.03647
OpenSSLGeneral purpose cryptographic library that includes TLS implementation1.1.13622
OpenSSH clientSSH server application for operating systems7.9p13633
OpenSSH serverSSH client application for operating systems7.9p13632
StrongSWANIPSec based VPN solution library5.6.23648

Ubuntu 16.04 LTS

ComponentDescriptionVersionCMVP Certificate
Linux kernel (generic)The Linux kernel cryptographic library4.4.0.10022962
OpenSSLGeneral purpose cryptographic library that includes TLS implementation1.0.2g2888
OpenSSH clientSSH client application for operating systems7.2p22907
OpenSSH serverSSH server application for operating systems7.2p22906
StrongSWANIPSec based VPN solution library5.3.52978

Start using FIPS 140-2 and other Ubuntu security products  

Both Ubuntu FIPS-certified and Ubuntu FIPS-compliant modules are offered under a comprehensive Ubuntu Advantage for Infrastructure package, starting at $75 per VM per year. Check out the full list of Ubuntu security certifications and hardening standards.

Ubuntu cloud

Ubuntu offers all the training, software infrastructure, tools, services and support you need for your public and private clouds.

Newsletter signup

Select topics you're
interested in

In submitting this form, I confirm that I have read and agree to Canonical's Privacy Notice and Privacy Policy.

Related posts

FIPS 140-2 certification for Ubuntu 20.04 LTS!

Ubuntu, the world’s most popular operating system across private and public clouds has received the FIPS 140-2, Level 1 certification for its cryptographic...

How to develop Linux applications for FIPS on Ubuntu

This is the second article in our series regarding FIPS 140 and Ubuntu. The first part of this series, this article, covers running FIPS 140 applications on...

Running FIPS 140 workloads on Ubuntu

This is the first article in a two-article series regarding FIPS 140 and Ubuntu. The first part of this series, this article, covers running FIPS 140...