Cryptography and FIPS 140
Vardhold contains no cryptographic implementation of its own. Every hash, key, encryption and signature check is performed by Windows.
Vardhold is not a validated cryptographic module and does not claim to be one. It relies on the Windows modules below, which Microsoft validates under FIPS 140 for supported Windows builds.
Modules used#
- Windows CNG for hashing, keyed hashing and random numbers. Vardhold runs on .NET 10, which hands all cryptography to CNG on Windows.
- DPAPI for keys and credentials at rest.
- SChannel for TLS, and WinVerifyTrust for signature checks.
Only FIPS-approved algorithms are used: SHA-256, HMAC-SHA256, the Windows DRBG, and AES within DPAPI. Vardhold does not use MD5, SHA-1, DES or RC4.
Uses of cryptography#
| Purpose | Algorithm | Performed by |
|---|---|---|
| Audit chain | HMAC-SHA256, 256-bit per-machine key | CNG |
| Seals on approvals, alerts, checkpoints, policy versions and the chain head | HMAC-SHA256 | CNG |
| Audit key generation | 256 bits from the Windows DRBG | CNG |
| Audit key at rest | DPAPI, machine scope | DPAPI |
| Splunk token at rest | DPAPI, service account scope | DPAPI |
| API tokens | 256 bits from the Windows DRBG, compared in constant time | CNG |
| Agent executable signatures | Authenticode | WinVerifyTrust |
| Export to Splunk, syslog over TLS | TLS per Windows policy, certificate validation on by default | SChannel |
| Vardhold's own code signing | Authenticode, SHA-256 digest, RFC 3161 timestamp | signtool |
Data in transit#
| Channel | Protection |
|---|---|
| Hook, proxy, tray and dashboard to the service | Loopback only, token-authenticated, never leaves the machine |
| Tray to the elevated confirmation window | Local named pipe restricted to the signed-in user |
| Splunk HEC | HTTPS |
| Syslog | TLS (RFC 5425) with the tls protocol; TCP and UDP are unencrypted, for local or trusted collectors only |
Operating in FIPS mode#
- Enable the Windows policy System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing (Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options) and restart.
- Keep TLS certificate validation on for every export.
- Encrypt the system drive with BitLocker. The audit database relies on folder permissions and disk encryption for confidentiality; the audit chain provides integrity.
Operation with the Windows FIPS policy enabled is expected to work, because Vardhold uses only approved algorithms through Windows modules, but it has not yet been tested end to end. Include it in your acceptance testing.