Search
CSRC:

NIST, Computer Security Division, Computer Security Resource
Center

about

mission

contact

staff

site
map

csrc home

groups

Cryptographic
Technology

Systems & Emerging
Technologies Security Research

Security Management &
Assurance

publications

Draft
Publications

FIPS
Publications

Special
Publications

NIST Interagency
Reports

ITL Security
Bulletins

Archived FIPS
Publications

Archived Special
Publications

List by Topic
Clusters

List by Family

by Legal
Requirement

drivers

news & events

News

News
Archive

Events

archive

CMVP

Announcements

Notices

Standards

FIPS
140-2

FIPS
140-1

International

Module Validation Lists

Modules In
Process

Contacts

CMVP Management Manual
and FAQs

CSRC Home >

Groups >

STM >

CMVP

Standards

FIPS PUB 140-2 - Effective 15-Nov-2001

Security Requirements for Cryptographic Modules

NVLAP accredited Cryptographic and Security Testing (CST) Laboratories
perform conformance testing of cryptographic modules. Cryptographic modules are
tested against requirements found in FIPS PUB 140-2, Security
Requirements for Cryptographic Modules [ PDF ]. Security requirements cover 11 areas related to the
design and implementation of a cryptographic module. For each area, a
cryptographic module receives a security level rating (1-4, from lowest to
highest) depending on what requirements are met.

An overall rating is issued for the cryptographic module, which indicates (1)
the minimum of the independent ratings received in the areas with levels, and
(2) fulfillment of all the requirements in the other areas. On a vendor's
validation certificate, individual ratings are listed, as well as the overall
rating. It is important for vendors and users of cryptographic modules
to realize that the overall rating of a cryptographic module is not necessarily
the most important rating. The rating of an individual area may be more
important than the overall rating, depending on the environment in which the
cryptographic module will be implemented (this includes understanding what risks
the cryptographic module is intended to address).

FIPS PUB 140-2 Annexes:

Annex A: Approved Security Functions [ PDF 05-30-2012]
Annex B: Approved Protection Profiles [ PDF 08-12-2011]
Annex C: Approved Random Number Generators
[ PDF 02-16-2012]
Annex D: Approved Key Establishment
Techniques [ PDF 01-02-2013]

Testing Requirements:

Cryptographic module validation testing is performed using the Derived
Test Requirements [DTR] for FIPS PUB 140-2, Security Requirements for
Cryptographic Modules [ PDF 01/04/2011]. The DTR lists all of the vendor and tester
requirements for validating a cryptographic module, and it is the basis of
testing done by the CST accredited laboratories.

Implementation Guidance:

NIST and CSEC have developed an Implementation Guidance for FIPS PUB
140-2 and the Cryptographic Module Validation Program [ PDF 12-21-2012] document for cryptographic module users,
vendors and testing laboratories. This is intended to provide clarifications of
CMVP programmatic guidance, FIPS 140-2, FIPS 140-2 Derived Test Requirements,
testing guidance, and guidance related to the implementation of Approved or
non-Approved security functions.

Validation List:

NIST maintains the FIPS 140-1 and FIPS
140-2 Cryptographic Modules Validation List of all validated FIPS 140-1 and
FIPS 140-2 cryptographic modules. An alphabetical list of FIPS 140-1 and FIPS
140-2 vendors (vendors with validated cryptographic modules) is also available
along with the underlying data base which the validation listing are generated
from. The posted validation listing represents the official valdiation
information.

Other Information:

FIPS PUB 140-2 was signed on May 25, 2001 and became effective November
15, 2001 when the Derived Test Requirements for FIPS PUB 140-2, Security
Requirements for Cryptographic Modules was published.

The CMVP accepted test reports from CST laboratories against either FIPS
140-1 or FIPS 140-2 and the applicable DTR from November 15, 2001 to May 25,
2002 when the transition period ended.

After May 25, 2002, the CMVP will only accept test reports against FIPS
140-2.

All previous validations against FIPS 140-1 WILL STILL BE
RECOGNIZED.

FIPS PUB 140-2 Page v, Implementation Schedule:
"Agencies may retain and use FIPS 140-1 validated products that have
been purchased before the end of the transition period."
Clarification: Agencies may continue to purchase, retain
and use FIPS 140-1 validated products after May 25, 2002.

Special Publication 800-29: A Comparison of the Security
Requirements in Cryptographic Modules in FIPS 140-1 and FIPS
140-2

Diagram that maps the general flow of the CMVP FIPS 140-2
testing process.

Back to Top

FIPS PUB 140-1 - Transition Ended 25-May-2002

Security Requirements for Cryptographic Modules

NVLAP accredited Cryptographic Module Testing (CMT) laboratories perform
validation testing of cryptographic modules. Cryptographic modules are tested
against requirements found in FIPS PUB 140-1, Security Requirements
for Cryptographic Modules, [ PDF ]. Security requirements cover 11 areas related to the
design and implementation of a cryptographic module Within most areas, a
cryptographic module receives a security level rating (1-4, from lowest to
highest), depending on what requirements are met. For other areas that do not
provide for different levels of security, a cryptographic module receives a
rating that reflects fulfillment of all of the requirements for that area.

An overall rating is issued for the cryptographic module, which indicates (1)
the minimum of the independent ratings received in the areas with levels, and
(2) fulfillment of all the requirements in the other areas. On a vendor's
validation certificate, individual ratings are listed, as well as the overall
rating. It is important for vendors and users of cryptographic modules
to realize that the overall rating of a cryptographic module is not necessarily
the most important rating. The rating of an individual area may be more
important than the overall rating, depending on the environment in which the
cryptographic module will be implemented (this includes understanding what risks
the cryptographic module is intended to address).

Testing Requirements:

Cryptographic module validation testing is performed using the Derived
Test Requirements for FIPS PUB 140-1 [ PDF ] and Derived Test Requirements for FIPS PUB 140-1
APPENDIX A, A Cryptographic Module Security Policy [ PDF ]. It lists all of the vendor and tester requirements for
validating a cryptographic module, and it is the basis of testing done by the
CMT accredited laboratories.

Implementation Guidance:

NIST and CSEC have developed an Implementation Guidance for FIPS PUB
140-1 and the Cryptographic Module Validation Program [ PDF 01-10-2002] document for cryptographic module users,
vendors and testing laboratories. This is intended to provide clarifications of
CMVP programmatic guidance, FIPS 140-1, FIPS 140-1 Derived Test Requirements,
testing guidance, and guidance related to the implementation of Approved or
non-Approved security functions.

Validation List:

NIST maintains the FIPS 140-1 and FIPS
140-2 Cryptographic Modules Validation List of all validated FIPS 140-1 and
FIPS 140-2 implementations. An alphabetical list of FIPS 140-1 and FIPS 140-2
vendors (vendors with validated cryptographic modules) is also available along
with the underlying data base which the validation listing are generated from.
The posted validation listing represents the official valdiation
information.

Other Information:

Diagram that maps the general flow of the CMVP FIPS 140-1
testing process

Back to Top

International Standards

ISO/IEC 19790 Information technology - Security techniques - Security
requirements for cryptographic modules

ISO/IEC 19790 1st Edition was published 2006-03-01

ISO/IEC 19790 2nd Edition was published 2012-08-15

It was prepared by Joint Technical Committee ISO/IEC JTC 1, Information
technology, Subcommittee SC 27, IT Security techniques. ISO/IEC 19790 1st
Edition was derived from NIST Federal Information Processing Standard (FIPS) PUB
140-2, Security Requirements for Cryptographic Modules.

The CMVP does not validate cryptographic modules tested for conformance to
ISO/IEC 19790.

Copies of ISO/IEC 19790 may be obtained at http://csrc.nist.gov/groups/STM/cmvp/www.iso.org

ISO/IEC 24759 Information technology - Security techniques - Test
requirements for cryptographic modules

ISO/IEC 24759 1st Edition was published 2008-07-01.

It was prepared by Joint Technical Committee ISO/IEC JTC 1, Information
technology, Subcommittee SC 27, IT Security techniques. This International
Standard was derived from NIST Derived Test Requirements for FIPS PUB 140-2,
Security Requirements for Cryptographic Modules.

ISO/IEC 24759 is currently undergoing revision to be aligned with ISO/IEC
19790 2nd Edition. The 1st Committee Draft (CD) was circulated for NB comment
3Q2012.

Copies of ISO/IEC 24759 may be obtained at http://csrc.nist.gov/groups/STM/cmvp/www.iso.org

CSRC Webmaster, Disclaimer Notice & Privacy
Policy
NIST is an Agency
of the U.S.
Department of Commerce

Last updated: January 2, 2013
Page created: January 28, 1996