3

We are being forced by the Information Assurance group to turn on the system security policy in Windows Server 2008 R2 that enables the use of FIPS compliant algorithms for encryption, hashing, and signing. The enablement of this policy causes Fogbugz/Kiln to fail to operate and is preventing us from using this product even though we had been using it for years with no issues until now. They are using the STIG as the bat to beat us with.

It would be great if Fogbugz/Kiln worked correctly with this security setting.

flag
It will be almost impossible to get DOD business without this feature. – Bob Cross May 23 2012 at 15:50
The parallel feature request for Fogbugz is here: fogbugz.stackexchange.com/questions/10439/… – Bob Cross May 23 2012 at 16:17

1 Answer

1

Hi JayR! We've heard this complaint from several of our security-hardened customers, and I have good news: The codebase for Kiln 2.9 has been updated to use FIPS-compliant hashing algorithms throughout.

That being said, Kiln 2.9 still requires FogBugz in order to function, and currently FogBugz uses algorithms that are not FIPS-compliant. The FogBugz team has a case open to look into the work required to change this, but it is not yet scheduled for implementation. Please see this post for further details.

link|flag
This sounds very promising - does this mean that Kiln will run on a Windows 2008 server with the FIPS compliant algorithms group policy enabled? – Bob Cross May 23 2012 at 16:10
FYI: I have posted the recommended feature request there: fogbugz.stackexchange.com/questions/10439/… – Bob Cross May 23 2012 at 16:16

Your Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.