Hi, our objective is to make our application FIPS compliant. One of the procedure accepts username and password as parameters and does a CREATE LOGIN call. But with FIPS, if we pass the password to the procedure in clear text format, it will be a violation.
Can you suggest any other method of passing the password to the procedure and still be FIPS compliant? Or any other way to achive the same result?
Also want to know that when SQL Server Management Studio opens a connection using sql user and password, how is the password sent to the SQL Server? Is it in clear text? In other words, is SQL Server Management Studio FIPS compliant?
It seems like it should be possible to import a certificate or asymmetric key into both SQL Server and your .NET application and use the cert/asym key to encrypt the password before sending to the server and decrypt once it gets there. Notice I said it "should" be possible, I haven't tried it yet. It is an interesting question.
You can't do it with symmetric encryption (AES, Triple DES, etc.) because SQL Server can't import and export symmetric keys. You only need the public key of an asymmetric key pair to actually encrypt the data. It would be an interesting proof of concept if you could make it work - you'll be limited in what you can encrypt asymmetrically in each string though. The limit is 117 bytes of 8-bit plain text or 58 bytes of Unicode plaintext. Probably more than adequate for most passwords, however.
> Hi, our objective is to make our application FIPS compliant. One of the > procedure accepts username and password as parameters and does a CREATE > LOGIN > call. But with FIPS, if we pass the password to the procedure in clear > text > format, it will be a violation.
> Can you suggest any other method of passing the password to the procedure > and still be FIPS compliant? Or any other way to achive the same result?
> Also want to know that when SQL Server Management Studio opens a > connection > using sql user and password, how is the password sent to the SQL Server? > Is > it in clear text? In other words, is SQL Server Management Studio FIPS > compliant?
> Hi, our objective is to make our application FIPS compliant. One of the > procedure accepts username and password as parameters and does a CREATE > LOGIN > call. But with FIPS, if we pass the password to the procedure in clear > text > format, it will be a violation.
> Can you suggest any other method of passing the password to the procedure > and still be FIPS compliant? Or any other way to achive the same result?
> Also want to know that when SQL Server Management Studio opens a > connection > using sql user and password, how is the password sent to the SQL Server? > Is > it in clear text? In other words, is SQL Server Management Studio FIPS > compliant?
