topic Re: FIPS-CC Security Functions- can you trust PAN documentation? in General Topics

FIPS-CC Security Functions- can you trust PAN documentation?

dtran — Wed, 27 Jul 2022 15:05:19 GMT

According to PAN documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/certifications/fips-cc-security-functions

MS-CHAPv2 is not compatible with FIPS-CC mode. It is recommended to use RADIUS with TLS.

However, in my test with my PAN-820 in FIPs mode, it works perfectly with RADIUS PEAP with MSCHAP-v2.

Can you even trust PAN documentation?

Re: FIPS-CC Security Functions- can you trust PAN documentation?

reaper — Thu, 04 Aug 2022 10:15:42 GMT

that seems a bit combative 😛

maybe the documentation could do with a little rewording, or the protocol could be removed from configuration options

FIPS-CC classifies MS-CHAPv2 as insecure, but this should not mean the protocol becomes unusable. The recommendation is to use a more secure alternative

Re: FIPS-CC Security Functions- can you trust PAN documentation?

dtran — Thu, 04 Aug 2022 14:45:32 GMT

I have to disagree with you a bit here. If PAN classifies MS-CHAPv2 as insecure, it should have listed PAP as well because PAP is the least secure method, even worse than MS-CHAPv2. PAP not only sends password (encrypted with weak encryption) along with username in clear-text over the wire. MS-CHAPv2 does not do that. And yet, PAP is available in FIPS-CC mode. Go figure.