Notices

[05-21-2007] DES Transition Plan and SP 800-57 Transition Plan has ended on May 19, 2007.

The Cryptographic Module Validation Program (CMVP) DES Transition Plan addresses the use of single key DES by Federal agencies, which are incorporated in cryptographic modules, validated to FIPS 140-1 or FIPS 140-2. Single key DES has been an Approved security function since the inception of the CMVP and the signing of FIPS 140-1 on January 11, 1994. The DES transition plan was developed to allow Federal agencies and vendors to smoothly transition to the stronger Approved security functions, specifically AES and Triple-DES.

The Cryptographic Module Validation Program (CMVP) NIST Special Publication (SP) 800-57 Transition Plan addresses the use of a minimum of 80 bits of security strength used by Federal agencies, as incorporated in cryptographic modules validated to FIPS 140-1 or FIPS 140-2. The SP 800-57 transition plan was developed to allow Federal agencies and vendors to smoothly transition to the use of a minimum of 80 bits of security strength.

CMVP Actions:

• References to DES as an Approved Security Function has been removed from FIPS 140-2 Annex A.
• All cryptographic module validation entries for DES as an Approved Security Function have been changed and DES has been moved as a non-Approved Security Function.
• All cryptographic module validation entries for security methods less than 80-bits of security strength have been modified to indicate these methods are not Approved for use in a FIPS Approved mode of operations.
• Referenced Security Policies or Certificate images have not been modified or updated. Vendors are encourage to provide updated Security Policies. Per FIPS 140-2 FAQ, certificate images are only provided representing initial validation and are not updated when validation changes occur.
• As a result of the above changes, if a cryptographic module validation is no longer valid, this module entry will be marked as "Revoked" with a link to the transition plan document.

CAVP Actions:

• The DES Algorithm Validation List has been archived and is still accessible for historical purposes only.
• The Triple-DES Algorithm Validation List has been modified to only recognize those implementations that support keying option 1 (K1, K2, and K3 are independent) and keying option 2 (K1=K2, and K3 is independent). If an implementation previously tested supported only keying option 3 (which is equivalent to DES), it has been marked as no longer NIST-Approved.
• The DSA Algorithm Validation List has been modified to only recognize those implementations that support 80-bits or more of security strength. This includes implementations that use a modulus size of 1024 bits. If an implementation previously tested did not support mod size of 1024 bits, it has been marked as no longer NIST-Approved.

Please contact the NIST Security Technology Group for additional information regarding the transition. William Burr 301-975-2914.

[03-06-2006] SP 800-57 Transition Plan

The Cryptographic Module Validation Program (CMVP) NIST Special Publication (SP) 800-57 Transition Plan addresses the use of a minimum of 80 bits of security strength used by Federal agencies, as incorporated in cryptographic modules validated to FIPS 140-1 or FIPS 140-2. The SP 800-57 transition plan was developed to allow Federal agencies and vendors to smoothly transition to the use of a minimum of 80 bits of security strength.

[05-19-2005] DES Transition Plan

The Cryptographic Module Validation Program (CMVP) DES Transition Plan addresses the use of single key DES by Federal agencies, which are incorporated in cryptographic modules, validated to FIPS 140-1 or FIPS 140-2. Single key DES has been an Approved security function since the inception of the CMVP and the signing of FIPS 140-1 on January 11, 1994. The DES transition plan was developed to allow Federal agencies and vendors to smoothly transition to the stronger Approved security functions, specifically AES and Triple-DES.

[02-09-2005] DES Testing and Algorithm Validation

The CMT laboratories shall no longer accept DES algorithm implementations for validation by the CAVP. As of today, February 9, 2005, the CAVP will no longer issue algorithm certificates for DES algorithm implementations not under contract for testing by the CMT laboratories at the time of receipt of this notice.