21 Code For Federal Regulation Parts 1305, 1311 Page 9
ADVERTISEMENT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67purchaser to the supplier. Once orders have been archived, each order does not have to have the
specific digital certificate attached, as long as the certificate is associated with the order. Thus,
an archive may have one copy of a specific certificate that is associated with a number of orders
that have been archived, provided that retrieval of an order includes a copy of the certificate.
FIPS 140-1. Commenters noted that the proposed rule referenced FIPS 140-2, but did
not mention FIPS 140-1, causing concern that systems validated and approved under 140-1
might not be allowed under the new standard. They were further concerned because the rule did
not specify the security level required. Commenters stated that requiring a standard beyond
security level 1 would cause difficulties for participants.
FIPS 140-2 grandfathers FIPS 140-1; any system validated and approved under FIPS
140-1 is considered to be approved and validated under FIPS 140-2. Therefore, the regulatory
provision that implementations be certified under FIPS 140-2 incorporates, by reference, any
implementations previously certified under FIPS 140-1. With respect to the security level
required, DEA agrees with comments that Security Level 1 is appropriate and has included it in
the final rule.
Commenters objected to the requirement that the private keys be stored on a FIPS-
approved module. As DEA explained in the NPRM, government agencies must adopt FIPS
requirements for any federal system, such as CSOS. DEA, therefore, must require that storage of
keys be on FIPS-approved systems. While DEA encourages the use of smartcards, biometrics,
or other secure hardware devices for private key storage within the CSOS architecture, use of
such devices is voluntary. The regulations only require that the private key be stored on a FIPS-
approved cryptographic module.
9
ADVERTISEMENT
0 votes
Related Articles
Related forms
Core Ct Coding For Leave Of Absence Under The Federal Family And Medical Leave Act (fmla) - State Of Connecticut Human Resources
Business
Standard Form 8 - Unemployment Compensation For Federal Employees (ucfe) Program Notice To Federal Employee About Unemployment Insurance
Legal
Form St-r-21 - Application For Sale/use Tax Exemption Certificate For An Incorporated Hospital
Legal
Form As 2645.1 - Application For Tax Exemption Under Section 1101.01 Of The Internal Revenue Code For A New Puerto Rico
Financial
Related Categories
Parent category: Legal