On 03.05.2012, at 11:01, Alexander Graf wrote: > > On 03.05.2012, at 10:57, Daniel P. Berrange wrote: > >> On Thu, May 03, 2012 at 10:51:15AM +0200, Alexander Graf wrote: >>> >>> On 03.05.2012, at 10:29, Daniel P. Berrange wrote: >>> >>>> On Wed, May 02, 2012 at 03:32:56PM -0400, Paul Moore wrote: >>>>> FIPS 140-2 requires disabling certain ciphers, including DES, which is >>>>> used >>>>> by VNC to obscure passwords when they are sent over the network. The >>>>> solution for FIPS users is to disable the use of VNC password auth when >>>>> the >>>>> host system is operating in FIPS mode. >>> >>> So that means "no password" is more secure according to FIPS than >>> "DES encrypted password"? >> >> No, FIPS is not making statements about the choice of auth methods. >> FIPS is concerned with what encryption algorithms an application uses. >> The requirements about whether authentication is required & what sort, >> is upto other specifications (eg Common Criteria) to decide. > > Hrm, so short-term this fixes things. But long-term, I think the better > solution would be to implement the tight security model and use a real cipher: > > http://www.tigervnc.org/cgi-bin/rfbproto#tight-security-type
In fact, there were even patches to get AES encryption into the tight auth: http://old.nabble.com/adding-AES-encryption-to-TightVNC-td14235009.html Not sure what became of that though :). Alex
