Set FIPS Mode

Note

This topic only applies to YubiHSM 2 FIPS devices.

Identify FIPS Version

YubiHSM 2 FIPS Series with firmware version 2.4.1 is NIST FIPS 140-3 Security Level 3 validated. New deployments are required to comply with FIPS 140-3 version. See NIST Certificate 5302.

YubiHSM 2 FIPS Series with firmware version 2.2 is NIST FIPS 140-2 Overall Level 3 validated. Existing deployments can continue to use FIPS 140-2. See NIST Certificate 3916.

To identify your YubiHSM FIPS device version, FIPS 140-2 or 140-3:

  1. Start yubihsm-shell and login to your YubiHSM.
  2. Identify if the YubiHSM is FIPS certified.

The OID value can be retrieved from the preloaded certificate using OpenSSL as follows (output truncated for brevity):

$ openssl asn1parse -in preloaded.pem
 ...
  481:d=5  hl=2 l=  10 prim: OBJECT            :1.3.6.1.4.1.41482.4.10
  493:d=5  hl=2 l=   3 prim: OCTET STRING      [HEX DUMP]:020109
 ...

In this case, the OID value (OCTET STRING) is at position 493. To decode the ASN1 Integer at position 493:

$ openssl asn1parse -in preloaded.pem -strparse 493 -item ASN1_INTEGER
ASN1_INTEGER: 9

The return value indicates:

9 - YubiHSM is FIPS 140-3 certified.

6 - YubiHSM is FIPS 140-2 certified.

See also:

Retrieve FIPS Mode Status

After a factory reset, the YubiHSM 2 is not in FIPS-approved mode. To check if your YubiHSM 2 FIPS is in FIPS-approved mode, use the get option command:

To check the mode of operation, use the Get Option command.

$ yubihsm-shell -a get-option --opt-name fips-mode

The return value indicates:

00 - FIPS approved mode is OFF.

01 - FIPS approved mode is ON.

03 - FIPS pending mode. Waiting to complete change mode. This option applies to YubiHSM 2.4 or later.

Preparing to Change YubiHSM FIPS Mode

You cannot set the device in FIPS approved mode if the HSM has been altered from factory settings.

  1. If the YubiHSM is not in factory settings, perform a factory reset first. See Reset YubiHSM to Factory Settings.
  2. Verify that FIPS-approved mode is pending, as indicated by fips-mode 03.
$ yubihsm-shell -a get-option --opt-name fips-mode

If the return value is 03 the device is in pending mode.

Putting YubiHSM 2 into FIPS Mode

To put the YubiHSM 2 into the FIPS Approved mode, set the fips-mode option to the value 01:

  1. Use the Set Option command as follows:

    $ yubihsm-shell -a put-option --opt-name fips-mode --opt-value 01

  2. Import new Authentication Keys to replace the default values or change the default authentication key:

    $ yubihsm> change authkey 0 1
  Enter password: ********
  Changed Authentication key 0x0001

    The new authentication key (or rather the password it is derived from) must be at least 8 characters long if you want to be able to use it with the YubiHSM 2 PKCS#11 module.

  3. Verify FIPS mode.

    $ yubihsm> get option 0 fips-mode
  Option value is: 01

    FIPS approved mode means the following algorithms are no longer available: rsa-pkcs1-decrypt, rsa-pkcs1-sha1, rsa-pss-sha1, ecdsa-sha1, eck256.

Taking YubiHSM 2 out of FIPS Mode

To disable FIPS approved mode on the YubiHSM 2:

  1. Delete all objects on the YubiHSM 2 or do a factory reset.

  2. Use the Set Option command as follows:

    $ yubihsm-shell -a put-option --opt-name fips-mode --opt-value 00