We are being forced by the Information Assurance group to turn on the system security policy in Windows Server 2008 R2 that enables the use of FIPS compliant algorithms for encryption, hashing, and signing. The enablement of this policy causes Fogbugz/Kiln to fail to operate and is preventing us from using this product even though we had been using it for years with no issues until now. They are using the STIG as the bat to beat us with.
It would be great if Fogbugz/Kiln worked correctly with this security setting.
Hi JayR! We've heard this complaint from several of our security-hardened customers, and I have good news: The codebase for Kiln 2.9 has been updated to use FIPS-compliant hashing algorithms throughout.
That being said, Kiln 2.9 still requires FogBugz in order to function, and currently FogBugz uses algorithms that are not FIPS-compliant. The FogBugz team has a case open to look into the work required to change this, but it is not yet scheduled for implementation. Please see this post for further details.