Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...DNN and FIPS complianceDNN and FIPS compliance
Previous
 
Next
New Post
4/19/2012 11:05 AM
 
That means if I am testing using my FIPS enabled laptop under Windows 7 IIS my PE DNN app should work without the "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms" error message. I am not sure why then it fails and points to "MD5CryptoServiceProvider".BTW what PE edition setting/s should I use to explicitly disable "file based caching" and how to modify it? web.config/host settings/portal settings? Appreciate your help very much.
 
New Post
4/20/2012 8:30 AM
Accepted Answer 

Strictly with respect to the use of MD5 in the caching provider, it would  be a trivial modification to create a custom provider that utilized SHA over the existing algorithm.  The use of the hash here is only superficially security-related, and was added to (i) ensure valid filenames and (ii) prevent naming collisions (which does remain a security consideration).  

I'll submit a work item for this issue, but just wanted to point out that the continued use of CE remains a possibility.  However, there are a number of uses of MD5 within the core itself that remain problematic (for all editions).

Brandon


Brandon Haynes
BrandonHaynes.org
 
New Post
4/20/2012 11:40 AM
 
Bandon,Thanks a lot for raising the work order. Though we have successfully completed all testing (QA/UAT etc) currently we are "on hold" with respect to production rollout due to FIPS compliance issues. The customer has assumed that our apps are compliant. We are using DNN 5.2.2 (PE). our custom modules are all built using C#/SQL2005. Our modules do not explicitely invoke any hashing algorithms. Once again thanks a lot for your help.
 
New Post
4/20/2012 3:15 PM
 
FYI there is a task on our list for the post 6.2.0 to assess the changes required to meet FIPS compliance (these will include changes in the core, providers and the client dependency framework - which we will submit back to the original CDF project) - based on the estimated effort we will then schedule these fixes for a release and after that will remain FIPS compliant i.e. our internal development standards will be updated to only allow FIPS compliance algorithms.

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US
 
New Post
4/20/2012 7:14 PM
 
We have reviewd the articles 108 and 109 as suggested by Leith Tussing but we still not sure how to implementa a workaround in the mean time. Is there a specific knowledge base article that covers the work around? We are developing under DNN 5.2.2.75 (PE). We poked around the host settings and found the "Performance Settings" allowing selections under "Module Cache Provider and "Page Output Cache Provider".  Not sure if these are settings that we should be looking at. However to our dismay none of them has "WeBasedCachingProvider" as an option. The only options that I see are  "File/Database/Memory".  Not sure if "WebCachingProvider" is only available with later versions of DNN.  We are despartely looking for a work around while awaiting the future FIPS compliant DNN 6.
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...DNN and FIPS complianceDNN and FIPS compliance


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out