A SNIA event
April 30, 2025

Build FIPS into Your Storage Products

Selling to the US Government can require getting FIPS (Federal Information Processing Standards) certification.Many storage products are based on Linux and Open Source code, which by themselves do not promise compliance with any standards. Sometimes the storage protocols themselves are incompatible with the required FIPS-140 standards. Sometimes the Open Source code is old enough that they still hand-craft their own crypto code dating from a time when the US Government tried to restrict some crypto algorithms). This talk will cover an engineers perspective on what getting FIPS-140 certification for a product requires in terms of code changes, testing, and compliance.

Welcome to the FIPS trenches, here is your shovel. Start digging!

Jeremy Allison
CIQ / Samba Team.
Abstract

Selling to the US Government can require getting FIPS (Federal Information Processing Standards) certification.Many storage products are based on Linux and Open Source code, which by themselves do not promise compliance with any standards. Sometimes the storage protocols themselves are incompatible with the required FIPS-140 standards. Sometimes the Open Source code is old enough that they still hand-craft their own crypto code dating from a time when the US Government tried to restrict some crypto algorithms). This talk will cover an engineers perspective on what getting FIPS-140 certification for a product requires in terms of code changes, testing, and compliance.

Welcome to the FIPS trenches, here is your shovel. Start digging!

Download the Presentation
Related Sessions
Data Security
Storage Security Update for Developers

2023 has been an interesting and challenging year for storage security.

Eric Hibbard
Samsung Semiconductor, Inc.
Favorites
Data Security
An Introduction to the IEEE Security in Storage Working Group

The IEEE Security In Storage Work Group (SISWG) produces standards that many storage developers, storage vendors, and storage system operators care about, including: a) A family of standards on san

Paul Suhler
KIOXIA
Favorites
Data Security
Storage Sanitization - Why, When, and How

Operators of data storage systems are legally obligated to protect customer data, and can be subject to significant penalties.

Paul Suhler
KIOXIA
Favorites
Data Security
SPDM 1.3 and Beyond

DMTF has released SPDM version 1.3, with a number of enhancements to the protocol.

Chandra Nelogal
Dell Technologies
Favorites
Data Security
How to use an Encryption Key per IO

The Key Per IO (KPIO) project was a joint initiative between NVM Express® and the Trusted Computing Group (TCG) Storage Work Group to define a new KPIO Security Subsystem Class (SSC) under TCG Opal

Eric Hibbard
Samsung Semiconductor, Inc.
Favorites
Data Security
Data Immutability – Retention Locking/WORM

Data immutability and retention locking have gained enormous traction over the last many years owing to a severe surge in number of cyber and ransomware attacks.

Sailu Yallapragada
Dell Technologies
Favorites
Data Security
TCG Storage Work Group Update

The Storage Work Group under the Trusted Computing Group is active in security technologies related to data storage and focuses on data at rest encryption mechanisms.

Chandra Nelogal
Dell Technologies
Favorites