FIPS Certification in RDP, KRDC, or GRDC

[mikedlong]

Do any of the following have the ability to connect to a Win2k3 Server using FIPS??? We must set our servers to FIPS and so far I'm not having any joy in getting the proceeding to connect to the Remote Desktop. And this is a Mandate and no VNC will not work. It must either be Windows XPe Workstations, not wanted, or LINUX RDC,KRDC,GRDC and it has to be FIPS compliant.

We are using T5735s and t5745s to conect to our Terminal Servers...

THanks for your time,

Mike Long

[Matti_Kurkela]

(Disclaimer: I don't know much about USA's encryption standards. Most of my information in this reply is based on Googling and reading applicable-looking hits.)

As far as I know, FIPS is not a protocol but an US computer security standard.

http://en.wikipedia.org/wiki/FIPS_140
http://en.wikipedia.org/wiki/FIPS_140-2

If you have activated the FIPS mode on Win2k3 Server, it affects the Terminal Server service. Please see this MSKB document:

http://support.microsoft.com/kb/811833

(Basically, the Remote Desktop client is required to support the RDP protocol version 5.2, TLS 1.0 encryption protocol, and to be able to use certain specified encryption algorithms and key lengths.)

In Remote Desktop mode, as far as I've understood, "rdc", "krdc" and "grdc" are all graphical front-ends to the "rdesktop" command-line tool, which uses the OpenSSL library for encryption. The important part of FIPS is that the encryption module must be certified.

This list includes all FIPS-certified encryption modules:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

It seems to include OpenSSL, so if you can compile one of the FIPS-certified OpenSSL versions for T5735s/T5745s without making any source code changes at all to the OpenSSL FIPS module, and replace the standard OpenSSL libraries in the thin client image with the FIPS-certified one, I think that would be OK.

You might have to recompile the rdesktop binary too, because at least on my Debian Linux workstation, the "rdesktop" client is linked to a particular version of OpenSSL (= libcrypto) specifically:

$ which rdesktop
/usr/bin/rdesktop
$ ldd /usr/bin/rdesktop
[...]
libcrypto.so.0.9.8 => /usr/lib/libcrypto.so.0.9.8
[...]

See the OpenSSĹ FIPS documentation:
http://openssl.org/docs/fips/fipsnotes.html
http://openssl.org/docs/fips/UserGuide.pdf

MK

[mikedlong]

Correct, it's not an encryption method but more of a forcing of policy. So the question should be is there a RDP LINUX Client that is equal to or greater then MS RDP 5.2...

[mikedlong]

Or I should say the enforcing of an encryption standard that was certified by NIST...