Uploaded image for project: 'C# Driver'
  1. C# Driver
  2. CSHARP-2163

Make PasswordEvidence implementation FIPS compliant

    • Type: Icon: Improvement Improvement
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • 2.6.0
    • Affects Version/s: 2.5
    • Component/s: Security
    • None

      The implementation of PasswordEvidence uses SHA256Managed and SHA256Managed is not FIPS compliant.

      In fact, PasswordEvidence doesn't need to use SHA256 at all. It is only used as an optimization for the Equals method, to avoid having to decrypt the SecureString to compare two passwords.

      Equals should be implemented in such a way that two PasswordEvidence instances can be compared without using a non-FIPS compliant method.

            Assignee:
            robert@mongodb.com Robert Stam
            Reporter:
            robert@mongodb.com Robert Stam
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: