Hi, Dan (Wing),I'm not trying to channel Dan (York), but I did undertand his concern as being that other countries that don't use FIPS-140 might reasonably ask "hey, what about OUR mechanism?"
Not that FIPS-140 is evil or weak, just that calling it out may lead to requests that we call out other standards, too.
Thanks, Spencer
There's also the wee little detail that FIPS is only a US government standard (although various other countries do follow it).Yes, FIPS-140 is a US Government standard, but I don't understand the concern. For example, FIPS-140, today, allows a module that implements IPsec to pass FIPS certification; thisdoes not mean IPsec is somehow evil or has weak security.