FACT-N-FICTION

[Brad S]

Ice,

Do we know who actually produces the stealth for CK? We know for a fact that they don't produce it themselves, all they do is add their DRM stuff to it. The reason I ask is because of the paragraph below which in part states that if the USB stick is already FIPS certified when they get it (fips inside) they don't necessarily need to recertify it. Maybe this is what was meant by the third party talk, third party being the one who actually makes the stick. Not trying to make excuses here, just trying to look at all avenues.

http://www.corsec.com/fips_faq.php

You can check out the existing list of validated vendors to see who currently holds a FIPS product certificate. You can also view NIST's pre-validation list to see who is currently in the process of being evaluated for FIPS 140-2 compliance. Please note that vendors who incorporate FIPS validated components in their products will not be represented on these lists. Only those companies that go through the testing process and are issued certificates in their name are listed. The same goes for the list of evaluated products that NIST also maintains on their website. Vendors using a compliant cryptographic module in their products can request a "FIPS inside" logo to show that a FIPS validated component has been used in their product. Please note that merely using a FIPS validated module in a product will not always meet the government requirement for purchasing only FIPS approved products. The same holds true for products that use FIPS approved algorithms, which is considered to be a precursor to full 140-2 compliance.