NIST, Computer Security Division, Computer Security Resource Center
Standards
FIPS PUB 140-3 Development
Security Requirements for Cryptographic Modules
| FIPS 140-3 Development Status | |
|---|---|
|
+6 months
|
The CMVP will no longer accept test reports for modules tested for conformance to FIPS 140-2. |
|
+6 months
|
FIPS 140-3 becomes effective after signature by DoC. FIPS 140-3 Derived Test Requirements is published. The CMVP can start receiving test reports for modules tested for conformance to FIPS 140-3. The CMVP will continue to accept test reports for modules tested for conformance to FIPS 140-2. |
|
2Q09
|
FIPS 140-3 presented to the Secretary of the Department of Commerce for signature (subject to change). |
|
4Q08
|
The second draft of FIPS 140-3 will be published for public comment (subject to change). |
| 18 Mar 2008 |
FIPS 140-3 Software Security Workshop (more information) |
| 12 Oct 2007 | The public comment period for the first draft of FIPS 140-3 has closed. |
| 11 Oct 2007 | Public comment period for first draft of FIPS 140-3 will end. |
| 13 Jul 2007 |
Announcing Public Draft of Federal Information Processing Standard (FIPS) 140-3 [PDF Draft: 07-13-2007], a revision of FIPS 140-2, Security Requirements for Cryptographic Modules. [Docket No. 070321067–7068–01] |
| 31 Mar 2007 | First public draft of FIPS 140-3 has been completed. This draft is undergoing the standard NIST and DoC administrative review and release process. Once this process is complete, a Federal Register Notice will be published and the draft will be made available for a public review and comment. This page will be updated as soon as a date is known when this process is completed and it will be available. |
| 26 Sep 2005 | Physical Security Testing Workshop held September 26-29, 2005. (Click Here) |
| 28 Feb 2005 | Comments on new and revised requirements for FIPS 140-3 ended. |
| 12 Jan 2005 | Announcing Development of Federal Information Processing Standard (FIPS) 140-3, a revision of FIPS 140-2, Security Requirements for Cryptographic Modules - [Docket No. 041217352-4352-01] |
Announcements
- Announcing First Public Draft of Federal Information Processing
Standard (FIPS) 140-3, a revision of FIPS 140-2, Security Requirements
for Cryptographic Modules
A Federal Register Notice [Docket No. 070321067–7068–01] was published regarding a public comment period on the first public draft of FIPS 140-3. The comment period ends on October 11, 2007. Written comments may be sent to: Chief, Computer Security Division, Information Technology Laboratory, Attention: Dr. Allen Roginsky, 100 Bureau Drive—Stop 8930, National Institute of Standards and Technology, Gaithersburg, MD 20899–8930. Electronic comments may also be sent to: FIPS140-3@nist.gov with "Comments on Draft 140-3" in the subject line.
- Presentations and papers presented at the Physical Security Testing
Workshop presented by the CMVP and IPA/Instac (Click
Here)
- Announcing Development of Federal Information Processing Standard
(FIPS) 140-3, a Revision of FIPS 140-2, Security Requirements
for Cryptographic Modules
A Federal Register Notice [Docket No. 041217352-4352-01] was published regarding a public comment period on FIPS PUB 140-2 to provide input on the development of FIPS 140-3. The comment period ended February 28, 2005. NIST and CSEC are currently developing a draft document which will be submitted for public comment later this year. A detailed development schedule will be available shortly. As part of the development activity, NIST may hold public workshops addressing various sections of the proposed standard or as a whole. These will be posted as details become available.
Back to Top
FIPS PUB 140-2
Security Requirements for Cryptographic Modules
NVLAP accredited Cryptographic Modules Testing (CMT) laboratories perform validation testing of cryptographic modules. Cryptographic modules are tested against requirements found in FIPS PUB 140-2, Security Requirements for Cryptographic Modules [ PDF ]. Security requirements cover 11 areas related to the design and implementation of a cryptographic module Within most areas, a cryptographic module receives a security level rating (1-4, from lowest to highest), depending on what requirements are met. For other areas that do not provide for different levels of security, a cryptographic module receives a rating that reflects fulfillment of all of the requirements for that area.
An overall rating is issued for the cryptographic module, which indicates (1) the minimum of the independent ratings received in the areas with levels, and (2) fulfillment of all the requirements in the other areas. On a vendor's validation certificate, individual ratings are listed, as well as the overall rating. It is important for vendors and users of cryptographic modules to realize that the overall rating of a cryptographic module is not necessarily the most important rating. The rating of an individual area may be more important than the overall rating, depending on the environment in which the cryptographic module will be implemented (this includes understanding what risks the cryptographic module is intended to address).
FIPS PUB 140-2 Annexes:
Annex A: Approved Security Functions [ PDF
Draft 12-18-2007]
Annex B: Approved Protection Profiles [ PDF
Draft 06-14-2007]
Annex C: Approved Random Number Generators [ PDF
Draft 10-18-2007]
Annex D: Approved Key Establishment Techniques [ PDF
Draft 01-16-2008]
Testing Requirements:
Cryptographic module validation testing is performed using the Derived Test Requirements [DTR] for FIPS PUB 140-2, Security Requirements for Cryptographic Modules [ PDF Draft 03/24/2004]. The DTR lists all of the vendor and tester requirements for validating a cryptographic module, and it is the basis of testing done by the CMT accredited laboratories.
Implementation Guidance:
NIST and CSEC have developed an Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program [ PDF 05-22-2008] document for cryptographic module vendors and testing laboratories. This is intended to provide clarifications of the testing process, FIPS 140-2, and the FIPS 140-2 Derived Test Requirements.
Validation List:
NIST maintains the FIPS 140-1 and FIPS 140-2 Cryptographic Modules Validation List of all validated FIPS 140-1 and FIPS 140-2 cryptographic modules. An alphabetical list of FIPS 140-1 and FIPS 140-2 vendors (vendors with validated cryptographic modules) is also available.
Other Information:
- FIPS PUB 140-2 was signed on May 25, 2001. NIST and CSEC have completed
the FIPS 140-2 Derived Test Requirements document. CMT laboratories
may begin testing cryptographic modules against the FIPS 140-2 DTR
and submit validation reports to NIST/CSEC. The FIPS 140-2 DTR will
remain draft for a period of time to allow the CMT labs to use the
document and provide comments to NIST/CSEC. The FIPS 140-2 DTR will
be updated as appropriate.
NIST and CSEC will accept validation reports from CMT laboratories against EITHER FIPS 140-1 or FIPS 140-2 and the applicable DTR from November 15, 2001 to May 25, 2002. After May 25, 2002, NIST and CSEC will only accept validation reports for cryptographic modules against FIPS 140-2 and the FIPS 140-2 DTR. After May 25, 2002, all previous validations against FIPS 140-1 WILL STILL BE RECOGNIZED. - FIPS PUB 140-2 Page v, Implementation Schedule: "Agencies may retain and use FIPS 140-1 validated products that have been purchased before the end of the transition period." Clarification: Agencies may continue to purchase, retain and use FIPS 140-1 validated products after May 25, 2002.
- Special Publication 800-29: A Comparison of the Security Requirements in Cryptographic Modules in FIPS 140-1 and FIPS 140-2
- Diagram that maps the general flow of the CMVP FIPS 140-2 testing process.
Back to Top
FIPS PUB 140-1
Security Requirements for Cryptographic Modules
NVLAP accredited Cryptographic Modules Testing (CMT) laboratories perform validation testing of cryptographic modules. Cryptographic modules are tested against requirements found in FIPS PUB 140-1, Security Requirements for Cryptographic Modules, [ PDF ]. Security requirements cover 11 areas related to the design and implementation of a cryptographic module Within most areas, a cryptographic module receives a security level rating (1-4, from lowest to highest), depending on what requirements are met. For other areas that do not provide for different levels of security, a cryptographic module receives a rating that reflects fulfillment of all of the requirements for that area.
An overall rating is issued for the cryptographic module, which indicates (1) the minimum of the independent ratings received in the areas with levels, and (2) fulfillment of all the requirements in the other areas. On a vendor's validation certificate, individual ratings are listed, as well as the overall rating. It is important for vendors and users of cryptographic modules to realize that the overall rating of a cryptographic module is not necessarily the most important rating. The rating of an individual area may be more important than the overall rating, depending on the environment in which the cryptographic module will be implemented (this includes understanding what risks the cryptographic module is intended to address).
Testing Requirements:
Cryptographic module validation testing is performed using the Derived Test Requirements for FIPS PUB 140-1 [ PDF ] and Derived Test Requirements for FIPS PUB 140-1 APPENDIX A, A Cryptographic Module Security Policy [ PDF ]. It lists all of the vendor and tester requirements for validating a cryptographic module, and it is the basis of testing done by the CMT accredited laboratories.
Implementation Guidance:
NIST and CSEC have developed an Implementation Guidance for FIPS PUB 140-1 and the Cryptographic Module Validation Program [ PDF 01-10-2002] document for cryptographic module vendors and testing laboratories. This is intended to provide clarifications of the testing process, FIPS 140-1, and the FIPS 140-1 Derived Test Requirements.
Validation List:
NIST maintains the FIPS 140-1 and FIPS 140-2 Cryptographic Modules Validation List of all validated FIPS 140-1 and FIPS 140-2 implementations. An alphabetical list of FIPS 140-1 and FIPS 140-2 vendors (vendors with validated cryptographic modules) is also available.
Other Information:
- Diagram that maps the general flow of the CMVP FIPS 140-1 testing process