Search
CSRC:

NIST, Computer Security Division, Computer Security Resource
Center

about

mission

contact

staff

site
map

csrc home

groups

Cryptographic
Technology

Systems & Emerging
Technologies Security Research

Security Management &
Assurance

publications

Draft
Publications

FIPS
Publications

Special
Publications

NIST Interagency
Reports

ITL Security
Bulletins

Archived FIPS
Publications

Archived Special
Publications

List by Topic
Clusters

List by Family

by Legal
Requirement

drivers

news & events

News

News
Archive

Events

archive

CMVP

What is the
purpose of the CMVP?

What is the
applicability of CMVP to the US government?

Use of Unvalidated
Cryptographic Modules by Federal Agencies and Departments.

What is the status
of modules validated to FIPS 140-1?

How does Common
Criteria (CC) relate to FIPS 140-2?

Announcements

Notices

Standards

Module Validation Lists

Modules In
Process

Contacts

CMVP Management Manual
and FAQs

Quick Links

Testing
Laboratories

CAVP

NPIVP

CMVP Announcements

[12-21-2012] Implementation Guidance for FIPS PUB
140-2 and the Cryptographic Module Validation Program [ PDF ] has been updated.

[01-02-2013] FIPS 140-2 Annex D: Approved Key
Establishment Techniques [ PDF ] has been updated.

more
announcements

CMVP Notices

[04-23-2012] Implementation Guidance for FIPS PUB
140-2 and the Cryptographic Module Validation Program [ PDF ] has been updated with IG G.14 and IG G.15
addressing Validation of Transitioning Cryptographic Algorithms and Key
Lengths and Validating the Transition from FIPS 186-2 to FIPS 186-3
respectively.

more
notices

CSRC Home >

Groups >

STM >

CMVP

Cryptographic Module Validation Program (CMVP)

What is the purpose of the CMVP?

On July 17, 1995, the National Institute of Standards and Technology (NIST)
established the Cryptographic Module Validation Program (CMVP) that validates
cryptographic modules to Federal Information Processing Standards
(FIPS)140-1 Security Requirements for Cryptographic Modules, and
other FIPS cryptography based standards. The CMVP is a joint effort between NIST
and the Communications Security Establishment Canada (CSEC). FIPS 140-2,
Security Requirements for Cryptographic Modules, was released on May 25, 2001
and supersedes FIPS 140-1.

Modules validated as conforming to FIPS 140-1 and FIPS 140-2 are accepted by
the Federal Agencies of both countries for the protection of sensitive
information.

Vendors of cryptographic modules use independent, accredited Cryptographic
and Security Testing (CST) laboratories to test their modules. The CST
laboratories use the Derived Test Requirements (DTR), Implementation Guidance
(IG) and applicable CMVP programmatic guidance to test cryptographic modules
against the applicable standards.. NIST's Computer Security Division (CSD) and
CSEC jointly serve as the Validation Authorities for the program, validating the
test results and issuing certificates.
Back to Top

What is the applicability of CMVP to the US
government?

FIPS 140-1 became a mandatory standard for the protection of sensitive data
when the Secretary of Commerce signed the standard on January 11, 1994. FIPS
140-2 supersedes FIPS 140-1 and the standard was signed on May 25, 2001. The
applicability statement from FIPS 140-2 (page iv):

7. Applicability. This standard is applicable to all Federal agencies
that use cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as defined
in Section 5131 of the Information Technology Management Reform Act of 1996,
Public Law 104-106. This standard shall be used in designing and implementing
cryptographic modules that Federal departments and agencies operate or are
operated for them under contract. Cryptographic modules that have been approved
for classified use may be used in lieu of modules that have been validated
against this standard. The adoption and use of this standard is available to
private and commercial organizations.
Back to Top

Use of Unvalidated Cryptographic Modules by Federal
Agencies and Departments

FIPS 140-2 precludes the use of unvalidated cryptography for the
cryptographic protection of sensitive or valuable data within Federal
systems. Unvalidated cryptography is viewed by NIST as providing no
protection to the information or data - in effect the data would be
considered unprotected plaintext. If the agency specifies that the
information or data be cryptographically protected, then FIPS 140-2 is
applicable. In essence, if cryptography is required, then it must be
validated.

With the passage of the Federal Information Security Management Act (FISMA)
of 2002, there is no longer a statutory provision to allow for agencies to waive
mandatory Federal Information Processing Standards (FIPS). The waiver provision
had been included in the Computer Security Act of 1987; however, FISMA
supersedes that Act. Therefore, the references to the "waiver process" contained
in many of the FIPS listed below are no longer operative.

As background, below is a list of facts found in FIPS 140-2 and other
supporting NIST documents:

Cryptography: The discipline which embodies principles, means and methods
for the transformation of data to hide its information content, prevent its
undetected modification, prevent its unauthorized use or a combination
thereof. [ANSI X9.31]
Cryptography deals with the transformation of
ordinary text (plaintext) into coded form (ciphertext) by encryption and
transformation of ciphertext into plaintext by decryption. [NIST SP
800-2]

The selective application of technological and related procedural
safeguards is an important responsibility of every Federal organization in
providing adequate security in its computer and telecommunication systems.
This standard [FIPS 140-2] provides a standard that will be used by Federal
organizations when these organizations specify that cryptographic-based
security systems are to be used to provide protection for sensitive or
valuable data. [FIPS 140-2]

The FIPS 140-2 standard is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information in
computer and telecommunication systems (including voice systems) as defined in
Section 5131 of the Information Technology Management Reform Act of 1996,
Public Law 104-106. [FIPS 140-2]

FIPS 140-2 shall be used in designing and implementing cryptographic
modules that Federal departments and agencies operate or are operated for them
under contract. [FIPS 140-2]

With the passage of the Federal Information Security Management Act of 2002, there
is no longer a statutory provision to allow for agencies to waive mandatory
Federal Information Processing Standards (FIPS). The waiver provision had been
included in the Computer Security Act of 1987; however, FISMA supersedes that
Act. Therefore, the references to the "waiver process" contained in many of
the FIPS are no longer operative. For further information, please go to the
CMVP FAQs Section
3.2.

Back to Top

What is the status of modules validated to FIPS
140-1?

FIPS 140-1 became a mandatory standard for the protection of sensitive data
when the Secretary of Commerce signed the standard on January 11, 1994. FIPS
140-2 supersedes FIPS 140-1 and the standard was signed on May 25, 2001. The
Implementation Schedule statement from FIPS 140-2 (page v):

14. Implementation Schedule. This standard (FIPS 140-2) becomes
effective six months after approval by the Secretary of Commerce. A transition
period from November 25, 2001 until six months after the effective date is
provided to enable all agencies to develop plans for the acquisition of products
that are compliant with FIPS 140-2. Agencies may retain and use FIPS 140-1
validated products that have been purchased before the end of the transition
period. After the transition period, modules will no longer be tested against
the FIPS 140-1 requirements. After the transition period, all previous
validations against FIPS 140-1 will still be recognized.

The CMVP posted a clarification to the implementation schedule on February
04, 2002 which was posted in the CMVP FAQ Section 1 Overview:

FIPS 140-2, Security Requirements for Cryptographic Modules, was released on
May 25, 2001 and supersedes FIPS 140-1. However, agencies may continue to
purchase, retain and use FIPS 140-1 validated modules after May 25, 2002.
Modules validated as conforming to FIPS 140-1 and FIPS 140-2 are accepted by the
Federal Agencies of both countries for the protection of sensitive information.
However, a federal agency may choose to only procure a FIPS 140-2 validated
module.

Back to Top

How does Common Criteria (CC) relate to FIPS
140-2?

If the operational environment is a modifiable operational environment, the
operating system requirements of the Common Criteria are applicable at Security
Levels 2 and above.

FIPS 140-1 required evaluated operating systems that referenced the Trusted
Computer System Evaluation Criteria (TCSEC) classes C2, B1 and B2. However,
TCSEC is no longer in use and has been replaced by the Common Criteria.
Consequently, FIPS 140-2 now references the Common Criteria for Information
Technology Security Evaluation (CC), ISO/IEC 15408:1999.

The Common Criteria (CC) and FIPS 140-2 are different in the abstractness and
focus of tests. FIPS 140-2 testing is against a defined cryptographic module and
provides a suite of conformance tests to four security levels. FIPS 140-2
describes the requirements for cryptographic modules and includes such areas as
physical security, key management, self tests, roles and services, etc. The
standard was initially developed in 1994 - prior to the development of the CC.
CC is an evaluation against a created protection profile (PP) or security target
(ST). Typically, a PP covers a broad range of products.

A CC evaluation does not supersede or replace a validation to either FIPS
140-1 or FIPS 140-2. The four security levels in FIPS 140-1 and FIPS 140-2 do
not map directly to specific CC EALs or to CC functional requirements. A CC
certificate cannot be a substitute for a FIPS 140-1 or FIPS 140-2
certificate.

Back to Top

CSRC Webmaster, Disclaimer Notice & Privacy
Policy
NIST is an Agency
of the U.S.
Department of Commerce

Last updated: January 2, 2013
Page created: January 28, 1996