[qbnkelt]

I agree. I can't see any reason why RIM would want to start a new launch of mobile devices and split them between 2 different OSs hurting the unified ecosystem that they are trying to create. Never mind the fact that it would take years to create a new OS out of QNX. Even Microsoft takes 3 to 5 years to create a new one and that's with their unlimitted resources. QNX is not just a mobile OS. It's more than that and you can't create a new version of it every year like you can with the other ones. The phrase mobile computing isn't just being thrown around lightly.

Yesterday it was announced that BB10 was granted FIPS certification.
Previously the PB Tablet was granted FIPS certification.
Before that BB OS 7 was granted FIPS certification.
Before that BB OS 6 was granted FIPS certification.

Each in its own merit.

There was no blanket QNX approval to everything that was QNX based.

Each had to prove compliance and obtain a certificate. The certificate is proof that yeh, verily, thou, RIM, hast complied and art, by the granting of this certificate, proven thusly to have done so.

I am truly astounded at why it is so difficult to accept that FIPS is required and granted in its own merit.


Sent from my iPhone 4S using Tapatalk

[mikeo007]

I agree. I can't see any reason why RIM would want to start a new launch of mobile devices and split them between 2 different OSs hurting the unified ecosystem that they are trying to create. Never mind the fact that it would take years to create a new OS out of QNX. Even Microsoft takes 3 to 5 years to create a new one and that's with their unlimitted resources. QNX is not just a mobile OS. It's more than that and you can't create a new version of it every year like you can with the other ones. The phrase mobile computing isn't just being thrown around lightly.

Hate to break it to you, but there hasn't been a major OS built from scratch in a LONG time. IOS wasn't built from scratch, BB10 wasn't built from scratch, WP7/8 weren't built from scratch, android wasn't built from scratch. Just because 2 versions of an OS share code, doesn't mean that they're the same OS. Even if they share the same kernel, there are just so many other layers that can have differences.

[NFLPLAYBOOK]

Yes they did set a new level in security efficiency between the PlayBook and BB10 using QNX. Pre approval before carrier testing. Something never accomplished with BB Legacy. I wonder how they achieved that.

[mikeo007]

Yes they did set a new level in security efficiency between the PlayBook and BB10 using QNX. Pre approval before carrier testing. Something never accomplished with BB Legacy. I wonder how they achieved that.

I would imagine that they gave government officials full access before carriers got their hands on it. Judging by the roadmap, BB10 has been mostly finished for a while now, so theoretically officials could have had their hands on it for weeks or months now.

[qbnkelt]

There is a multi step process that entails delivery of code, test parameters, contract for testing, and the testing itself.



Sent from my iPhone 4S using Tapatalk

[kraski]

I agree. I can't see any reason why RIM would want to start a new launch of mobile devices and split them between 2 different OSs hurting the unified ecosystem that they are trying to create. Never mind the fact that it would take years to create a new OS out of QNX. Even Microsoft takes 3 to 5 years to create a new one and that's with their unlimitted resources. QNX is not just a mobile OS. It's more than that and you can't create a new version of it every year like you can with the other ones. The phrase mobile computing isn't just being thrown around lightly.

Think about what MS did, though. Once they got past the garage/basement stage of operating, the OSes were basically programmed by committee. So, a lot of the time taken to build a new OS version was testing and reprogramming to get the different pieces to play nice with each other. Both RIM and QNX (the company) are still small enough that a lot of that can be worked out internally, as the OS is being developed. And everything I've read points to QNX (the OS) being fairly flexible. More so than many others. So, even if there was major modification to the base OS, the fact that the base was already well developed would cut RIM's programming time considerably.

Doing plain vanilla QNX to launch the Playbook was probably partly an OS test and partly a feeler to see how it would go with the public.

[BlackBerry Guy]

No one here was doubting BB10 was going to be eventually certified. And it did, yesterday. This little discussion started because some were of the belief BB10 was already certified simply because the PlayBook OS was, and they're both QNX based. I think the announcement does prove Qbnkelt's point that each version of the OS must be evaluated on their own, regardless of past versions or company history.

Anyway, with the recent news about the carrier testing and now this, things are looking good for 2013. Now give me my BB10 damnit!

[qbnkelt]

No one here was doubting BB10 was going to be eventually certified. And it did, yesterday. This little discussion started because some were of the belief BB10 was already certified simply because the PlayBook OS was, and they're both QNX based. I think the announcement does prove Qbnkelt's point that each version of the OS must be evaluated on their own, regardless of past versions or company history.

Anyway, with the recent news about the carrier testing and now this, things are looking good for 2013. Now give me my BB10 damnit!

THANK YOU!!!!!

I felt like I was talking into a wind tunnel!!!!!


Sent from my iPhone 4S using Tapatalk

[NFLPLAYBOOK]

FIPS 140-2 Validation Certificate no. 1578 - applicable to BlackBerry Tablet OS version 1.0 and 2.0, and BlackBerry OS version 10

Then why is this one certificate linked to every version of QNX. One certificate. Not 2.

BlackBerry - Security Approvals & Certifications - US

[NFLPLAYBOOK]

And before you go on it's the only thing QNX related that is FIPS certified. Just because they update the server software and bundled it with the BB10 moniker doesn't make it QNX related. Go through the whole list. Every version of BB Legacy has it's own certification number. And there are no other referrences to QNX.

[NFLPLAYBOOK]

Now it makes sense why RIM didn't have to wait until after carrier testing. Because the phones had nothing to do with it getting FIPS approval because they were already covered under a prior certificate.

[qbnkelt]

FIPS 140-2 Validation Certificate no. 1578 - applicable to BlackBerry Tablet OS version 1.0 and 2.0, and BlackBerry OS version 10

Then why is this one certificate linked to every version of QNX. One certificate. Not 2.

BlackBerry - Security Approvals & Certifications - US

Please point out where it refers to BB 10. You keep linking back to the Playbook Tablet.

1578 Research in Motion Ltd.



BlackBerry OS Cryptographic Library
(Software Version: 5.6, 5.6.1 or 5.6.2)

(When operated in FIPS mode)


Validated to FIPS 140-2

Security Policy

Consolidated Validation Certificate

Vendor Product Link
Software 07/21/2011;
06/05/2012;
08/16/2012 Overall Level: 1

-Operational Environment: Tested as meeting Level 1 with BlackBerry� Tablet OS Version 6.6 (single-user mode)

-FIPS-approved algorithms: Triple-DES (Cert. #1053); AES (Cert. #1608); SHS (Cert. #1421); HMAC (Cert. #944); RNG (Cert. #862); DRBG (Cert. #81); DSA (Cert. #499); ECDSA (Cert. #199); RSA (Cert. #790); KAS (Cert. #13; key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength; non-compliant less than 80-bits of encryption strength)

-Other algorithms: DES; DESX; AES CCM* (non-compliant); ARC2; ARC4; MD2; MD4; MD5; HMAC-MD5; ECNR; ECQV; ECIES; RSA (key wrapping; key establishment methodology provides between 80 and 256 bits of encryption strength; non-compliant less than 80-bits of encryption strength); RSA (key wrapping; key establishment methodology provides between 80 and 256 bits of encryption strength; non-compliant less than 80-bits of encryption strength)

Multi-chip standalone

"The BlackBerry Tablet Cryptographic Kernel is a software module that provides the cryptographic functionality required, for basic operation of the BlackBerry� PlayBook™"

[qbnkelt]

I posted only the information and kept sensitive information out. Everything else is listed exactly as it appears.

Note the dates on validation certificate number 1578.

[Tre Lawrence]

I have a question, as I am trying to understand how the FIPS thing works.

What does a FIPS-certified BB do that a FIPS-certified Samsung cannot? Am I correct in assuming that one could still be more secure than the other, but that both have met the minimum standards to be used in secure establishments?

Thanks.

[qbnkelt]

I have a question, as I am trying to understand how the FIPS thing works.

What does a FIPS-certified BB do that a FIPS-certified Samsung cannot? Am I correct in assuming that one could still be more secure than the other, but that both have met the minimum standards to be used in secure establishments?

Thanks.

It varies greatly.

Access dependent, hardware dependent.

It is a standard to be met within certain parameters of intended use.

Within FIPS there are four basic levels, each applicable to the functionality. Agencies use the devices that meet the levels for the intended use.


Sent from my iPhone 4S using Tapatalk

[kraski]

Please point out where it refers to BB 10. You keep linking back to the Playbook Tablet.

1578 Research in Motion Ltd.



BlackBerry OS Cryptographic Library
(Software Version: 5.6, 5.6.1 or 5.6.2)

(When operated in FIPS mode)


Validated to FIPS 140-2

I cut a lot out for brevity. But it does say "applicable to BlackBerry Tablet OS version 1.0 and 2.0, and BlackBerry OS version 10". So, yes, it does include BB10. But it appears that BB10 is only approved, so far, for tablet use. So, it may still need testing on phone hardware. And, the grouping would make me conclude that while BB10 is related to tablet OS 1.0 and 2.x, it looks like the FIPS people even consider it a separate entity.

[Tre Lawrence]

It varies greatly.

Access dependent, hardware dependent.

It is a standard to be met within certain parameters of intended use.

Within FIPS there are four basic levels, each applicable to the functionality. Agencies use the devices that meet the levels for the intended use.


Sent from my iPhone 4S using Tapatalk

Thanks. I'm assuming RIM alone stands at the TOP of the FIPS ladder? Or did the Samsung devices attain that highest level? Sorry if the post makes no sense...

[qbnkelt]

I cut a lot out for brevity. But it does say "applicable to BlackBerry Tablet OS version 1.0 and 2.0, and BlackBerry OS version 10". So, yes, it does include BB10. But it appears that BB10 is only approved, so far, for tablet use. So, it may still need testing on phone hardware. And, the grouping would make me conclude that while BB10 is related to tablet OS 1.0 and 2.x, it looks like the FIPS people even consider it a separate entity.

Where do you see that, Kraski?

I only see 1578 for tablet use.



Sent from my iPhone 4S using Tapatalk

[Tre Lawrence]

On the list, it says:

BlackBerry Cryptographic Java Module
(Software Versions: 2.8 and 2.8.7)

(When operated in FIPS mode)

Validated to FIPS 140-2

Security Policy

Consolidated Validation Certificate

Vendor Product Link

What does that mean? Are everyday, BIS BBs FIPS certified?

[qbnkelt]

Thanks. I'm assuming RIM alone stands at the TOP of the FIPS ladder? Or did the Samsung devices attain that highest level? Sorry if the post makes no sense...

I don't know anything about the Samsung devices, sorry.

But no, there are mobile solutions that have higher clearance than RIM. RIM's advantage is that it straddles consumer and sensitive but unclassified clearances.

The devices that have higher clearance, like the General Dynamics devices, you wouldn't want to go near. Ugly, clunky things. AND you need approval to even get them.

[qbnkelt]

On the list, it says:

BlackBerry Cryptographic Java Module
(Software Versions: 2.8 and 2.8.7)

(When operated in FIPS mode)

Validated to FIPS 140-2

Security Policy

Consolidated Validation Certificate

Vendor Product Link

What does that mean? Are everyday, BIS BBs FIPS certified?

I deleted sensitive information. Everyday, BIS BBs have in fact received the same certification. There is one piece missing, which is BES certification itself. In combination, it's what's approved to go behind firewalls.

[kraski]

Where do you see that, Kraski?

I only see 1578 for tablet use.



Sent from my iPhone 4S using Tapatalk

It's toward the bottom of the 1578 link. And I get to correct myself on something else. According to this link at Blackberry, BlackBerry 10 Receives FIPS 140-2 Security Certification Ahead of Launch �Inside BlackBerry for Business Blog, the BB10 OS is certified for tablets and phones. That's my bitly shortened link to the latest post in the Blackberry for Business section of the Blackberry site. You can find Blackberry's own link to it on Facebook.

[qbnkelt]

It's toward the bottom of the 1578 link. And I get to correct myself on something else. According to this link at Blackberry, BlackBerry 10 Receives FIPS 140-2 Security Certification Ahead of Launch �Inside BlackBerry for Business Blog, the BB10 OS is certified for tablets and phones. That's my bitly shortened link to the latest post in the Blackberry for Business section of the Blackberry site. You can find Blackberry's own link to it on Facebook.

Oh they will be using BB10 for the Playbook 3.

I still can't see what you see.

I'm in the certs page. And I can't upload a pdf.

[Kwela123]

On my stock ticker today:

** RESEARCH IN MOTION LTD, $8.48, up 3 pct (1002 ET)

The struggling phone maker said it has won a much-coveted U.S. government security clearance for its yet-to-be launched platform for BlackBerry 10 devices that are expected to hit store shelves in the first quarter of 2013.

I may be foolish, but I bought some RIM stock today. Unfortunately it dropped soon after

But asset value of company excluding soft assets is about 2X current market cap (value of outstanding shares on stock markets). If someone bought RIM they would have to offer close to asset value. And if not sold, the upcoming product line is a make or break. I am betting it being a boost for company and if not that someone will buy RIM for more than current stock price! Wish me luck

[qbnkelt]

On my stock ticker today:


I may be foolish, but I bought some RIM stock today. Unfortunately it dropped soon after

But asset value of company excluding soft assets is about 2X current market cap (value of outstanding shares on stock markets). If someone bought RIM they would have to offer close to asset value. And if not sold, the upcoming product line is a make or break. I am betting it being a boost for company and if not that someone will buy RIM for more than current stock price! Wish we luck

Don't feel foolish.

I bought at $28.00

Meh.....

Expendable cash.