Slides · 9 slides
FIPS 140-3 and the CMVP: what 'FIPS validated' actually means
The same page told visually, ready to present. Speaker notes carry the full explanation.
Certification
FIPS 140-3 and the CMVP
What 'FIPS validated' actually means
A standard for the module that runs the algorithms, not the algorithms themselves
No self-certification
How a module gets a certificate
Required by US and Canadian federal buyers, and inherited by FedRAMP and CMMC
Built on ISO/IEC 19790
A short standard with layers underneath
The first time the US and international module standards share the same text
The transition
From FIPS 140-2 to 140-3
New federal procurement now expects an active FIPS 140-3 certificate
Four levels
What each level adds
Libraries live at Level 1; network HSMs usually target Level 3
Scored per area
The weakest area sets the level
Eleven areas, each graded; the certificate shows the lowest
Three tracks
What the lab actually checks
Conformance testing against a fixed list, not a free-form hunt for flaws
Read the claim
Only one of these is a validation
A certificate is active for five years, then moves to the Historical list
The bind
Validated or patched?
Vendors keep the validated part small and slow-moving so it rarely changes
Keys: ← → move, F full screen, G all slides, N notes