[Dnssec-deployment] Non-(US or any)government following of FIPS ... was Re: SCA6000 users...

[Edward Lewis]

At 19:32 +0200 3/28/11, Paul Hoffman wrote:

>Right. Which TLDs are USgovt entities?

That isn't the right question.

In industry, a lot of times a government recommendation is used as a 
basis for requirements.  It's a lot more efficient to write 
"Cryptographic elements must be FIPS 140-2 compliant" than to pay an 
engineering a few weeks or months salary to come up with something 
roughly equivalent.

Another reason for industry to do this is that if there's a 
government mandate for government use, there will be a couple of 
suppliers.  (This is one way a government can make a market.)  If I 
want a solution to meet my custom requirements, it will take a lot 
more time in "discovery" to find sources than if I just pull down the 
list from the FIPS 140-2 accreditation page.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Me to infant son: "Waah! Waah! Is that all you can say?  Waah?"
Son: "Waah!"