Jump to content
Welcome to our new Citrix community!

Going from MPX FIPS to VPX FIPS - what fips key ?


Recommended Posts

Hi,

Got a project that is going from a mpx fips netscaler to a vpx fips (vmware) all is installed and when i do :

sh system fipsStatus

I get the desired out come :

"System is operating in FIPS mode"

however i am not able to create any fips key on the VPX does the vpx work without how does it check it's compliance or is just setting the cipher suite to FIPS enough ?

 

reading some more I come across integration with thales or safenet does this means the vpx is still reliant on separate hardware modules ? so does this mean we can't virtualise the process ?

 

Cheers

 

Edited by mkraan596
Link to comment
Share on other sites

  • 2 weeks later...

Hi,

 

An FIPS-enabled NetScaler MPX appliance uses a Cavium FIPS card. Therefore, the critical security parameters (CSP), such as the private keys of the server are securely stored or generated in the cryptographic module, Hardware Security Module (HSM).

 

For further details regarding FIPS in MPX box please refer to this article - https://support.citrix.com/article/CTX129543

Link to comment
Share on other sites

Hi Gowthami,

 

Thanks for your reply, I was looking into how the VPX FIPS would store their private keys without the FIPS card but after speaking to Citrix it appears it doesn't it only applies the FIPS cyphers without securing the key, if you want to do this you have to have a 3rd party (HSM module) to offload the keys to secure them, but it is not a functionality within the VPX therefor it look like it is only compliant to version 140-1. 

It is very hard to find information about the VPX FIPS as it doesn't seem to be a widely used solution, it would be good to see a virtual solution for the 3rd party HSM module as the current setup means you have to have another hardware appliance.

 

Cheers

  • Like 1
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...