Search code examples
c#cryptographyfips

Is System.Security.Cryptography.RNGCryptoServiceProvider FIPS 140-2 complaint?

we are using this System.Security.Cryptography.RNGCryptoServiceProvider .net lib. we need to make sure that if its is compliant with FIPS 140-2

here is the link from MS

https://learn.microsoft.com/en-us/windows/security/threat-protection/fips-140-validation#_microsoft_fips_140

Solution

  • It depends on the operating system. This .NET object is really just a wrapper around cryptographic services provided by the OS, and the algorithm could potentially change at any time.

    Refer to the CryptGenRandom documentation:

    In Windows Vista with Service Pack 1 (SP1) and later, an implementation of the AES counter-mode based PRNG specified in NIST Special Publication 800-90 is used. In Windows Vista, Windows Storage Server 2003, and Windows XP, the PRNG specified in Federal Information Processing Standard (FIPS) 186-2 is used.