FIPS stands for Federal Information Processing Standard. This standard imposes some restrictions on the algorithms used for encryption/decryption and hashing. The operating systems have many different algorithm types, but only part of them are actually FIPS compliant.

Note
Starting from Q3 2011, RadControls for ASP.NET AJAX offically supports the FIPS standard. Please note that PDF export is not FIPS compliant.

There are at least two ways to enforce the FIPS compliancy:

• Via the security policies

  Open Administrative Tools and then go to Local Security Policy applet (or press WinKey+R and enter 'secpol.msc'). Expand Local Policies, Security Options and scroll down to "System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing".

• By editing the corresponding registry key directly

  Open the Registry Editor and then expand HKEY_LOCAL_MACHINE, System, CurrentControlSet, Control, Lsa then select the FIPSAlgorithmPolicy key. There, you will find a DWORD value which should be set to 0 (0x00000000) for disabled and 1 for enabled.

Note that in NET 3.5 environment, the default ViewState validation algorithm (SHA1) is not FIPS compliant. In this case you may need to change the default algorithms to 3DES as shown below:

CopyWEB.CONFIG

<machineKey validationKey="AutoGenerate,IsolateApps" 
     decryptionKey="AutoGenerate,IsolateApps" 
     validation="3DES" 
     decryption="3DES" />

Note
Setting <compilation debug="true" /> in web.config will cause FIPS exception. You can find a possible workaround here: Visual Studio 2008 cannot debug with FIPS enabled

Note
FIPS compliant algorithm means that it is supported by the FIPS 140 standard.

Other Resources