As a rule, one should never trust closed source cryptography software, but encrypting external drives and Time Machine backups has become quite convenient in Mac OS X Lion. Is that specific code available anyplace? Or has anyone audited it seriously?

2 Answers 2


According to a public talk by Rich Trouton, FileVault 2 is not FIPS 140-2 validated, but "Apple's new Common Crypto implementation is just starting to undergo FIPS evaluation"

The code itself for Common Crypto is available at http://www.opensource.apple.com/ and has been all the way back to 10.4 (where I got tired of checking revisions - it probably goes back even further, but what matters is the code shipped in Lion which is available for all three lion releases 10.7, 10.7.1 and 10.7.2)


It looks like the FIPS validation is proceeding, with iOS 5's CommonCrypto being validated first and then Lion's.


Entries 1672 - 1677 at the NIST link above are for CommonCrypto in iOS 5 for the various iDevices. It also appears that Apple is revalidating the now-deprecated Common Data Security Architecture (CDSA) cryptographic framework for Lion as of 11/17/2011 (entry 1872 in the link above.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .