May 29, 2015

Urgent: CMVP Guidance Effective Immediately

This morning, the CMVP released a notice to all labs acknowledging that not all SP 800-90A DRBG implementations submitted for validation have been entirely compliant with the SP 800-90A standard.

Specifically, Section 11.3 of the standard requires that certain health checks be performed.  It was not always clear that these health checks were required for CMVP validation.  In fact, based on some interpretations, wording within SP800-90A itself would leave some to believe that they were, indeed, not required.

The CMVP's stance, based on guidance from the Cryptographic Technology Group, is now that these health checks are absolutely required in order to claim that a DRBG implementation is compliant to 800-90.  This guidance is effective IMMEDIATELY, and even impacts modules that are currently in the queue and in the Coordination phase.

For reports currently in the queue where the module does not implement a compliant DRBG, the lab is to notify the CMVP to put the submission on HOLD until the DRBG implementation comes into compliance and is tested by the lab.
(UPDATE as of 6/1/15 - For reports in the queue where the module does NOT implement the health checks, the lab is still to notify the CMVP to place the report on HOLD, but there are two options for moving forward. One, is to bring the module into compliance and resubmit the report with all appropriate test evidence.  Or two, is to rework the validation documentation and report to show the DRBG implementation as Non-Compliant.  This would include identifying all services within the SP and report that utilize the non-compliant DRBG.  The lab can resubmit the reworked SP and report to the CMVP and the validation will proceed accordingly).

If your particular module is impacted by this, make the appropriate changes now and work with your lab to have them tested (i.e. operational tested and/or code reviewed).

April 16, 2015

January 6, 2015

Record number of FIPS 140-2 certificates issued in 2014

In 2014, The CMVP validated the most FIPS 140-2 cryptographic modules in a given year in the history of the program. 233 new FIPS certificates were issued last year, which surpassed the previous high of 229 in 2010.

Here are the totals by Laboratory for 2014:

Congratulations to the FIPS Team at InfoGard Laboratories.  That's 6 years in a row of producing the most FIPS 140-2 certificates (2009-2014).

December 5, 2014

The RNG Transition is Coming!

The RNG transition in 2016 is fast approaching.  Is your cryptographic module prepared?

Per the SP800-131A transition guidance, the following is stated in regards to the RNG transition:

"The use of the RNGs specified in FIPS 186-2, [X9.31] and [X9.62] is deprecated from 2011 through December 31, 2015, and disallowed after 2015".

Put simply, if a module utilizes one of the Random Number Generators (RNGs) in question for the purposes of key generation, the module will no longer have a compliant key generation method starting in January 2016. All cryptographic keys generated using the disallowed RNG will no longer be considered Approved.

This will not only affect future validations but be retroactive for all currently validated cryptographic modules.  Although CMVP would not confirm their specific course of action on January 1, 2016, we do know that a large percentage of FIPS 140-2 validated modules will be without a compliant mechanism to generate approved cryptographic keys, placing agencies using these cryptographic modules in a precarious position as they are required to use FIPS validated cryptographic modules.  Without updates to this functionality, federal agencies would be in direct violation of FISMA 2002.

So what are your options? If you are currently in the process, or plan to undergo FIPS 140-2 validation testing on a new module in the near future, you will need to ensure that your RNG is one defined in Special Publication 800-90A.  If you already have a FIPS 140-2 validated product and that device implements one or more of the soon to be disallowed RNGs, you will need to undergo revalidation testing with an approved RNG in order to maintain your validation.

October 2, 2014

Certificates and Queue Time Updates

At the end of the second quarter, we wrote about the CMVP being on a record pace for issuing FIPS 140-2 certificates in 2014.  Well, three quarters of the year have gone by now, and the CMVP remains on track.  One hundred ninety-one (191) FIPS 140-2 certificates have been issued during these 9 months of 2014. At the current pace, the projection for 2014 is 254 certificates (down from a projection of 262 in July).  We're still looking at the CMVP blowing by last year's mark of 208 certificates and the all-time record of 229 in 2010.

Here is the breakdown of certificates by the FIPS Laboratories for the first three quarters of 2014.



A quick update about the CMVP report queue:
InfoGard's current estimate for the CMVP queue time is 3-4 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").

Obviously I can't predict the future, but there is no indication that this current queue time will not be maintained.  It's a good sign for the remainder of the year and heading into 2015.  The CMVP was able to reduce the queue from 8-9 months last year to 3-4 months this year amid all of the algorithm transitions that took place, not an easy task. Next year should be a breeze comparatively.

September 3, 2014

What a Great 400 Weeks!

[Mark Minnoch posting one last time for The FIPS Lab blog]

I am so fortunate to have been part of the best Cryptographic Security Testing Laboratory these past 400 weeks (my InfoGard start date was January 2, 2007). I wanted to stay at least 500 weeks, but I ended up accepting an opportunity to join wolfSSL to help change the security world in a different way.

Yes, I will dearly miss my awesome co-workers and customers. The security world is a small place so I expect to keep in touch with many of you. Please send me a connection request on LinkedIn:

Marc Ireland, InfoGard's FIPS Program Manager, will be your new "FIPS Lab" blogger. Here I am passing InfoGard's "Top Tiger" Award to Marc for taking over the blog. Please let him know what topics you would like to see covered in The FIPS Lab blog!

Marc Ireland (Left) accepting the "Top Tiger" Award from Mark Minnoch

Mark Minnoch is now the new Account Manager at wolfSSL.

Marc Ireland is the FIPS Program Manager at InfoGard Laboratories and new author of The FIPS Lab blog.

July 1, 2014

FIPS 140-4 Draft Available

The CMVP posted a proposed draft of FIPS 140-4 today. This draft includes a warning statement that vendors are strongly advised not to design to requirements of draft FIPS 140-4 if they conflict with the requirements of FIPS 140-2.


Let's recap where we stand with FIPS 140-4:

  1. No schedule. The Division Chief position at NIST has still not been "officially" filled. Expect no progress or schedule before the new Division Chief is announced.
  2. No surprise. The FIPS 140-4 draft is an 11 page document that points to ISO/IEC 19790:2012. 
  3. No overlap. If you are the proactive type, do not jump to the draft standard too early. Meeting a FIPS 140-4 requirement will not allow you a free pass on an annoying FIPS 140-2 requirement if they conflict.   
The Vendor and Lab communities need to become more active in driving FIPS 140-4. 

QUESTION: "How can I positively influence the adoption of FIPS 140-4?" 

ANSWER: Contact Charles Romine, the Director of the Information Technology Laboratory at NIST. In the FOREWORD section of the FIPS 140-4 draft, the Director welcomes all comments. (A physical address is provided in the draft but a quick search on shows the following e-mail for Dr. Romine:

Make "FIPS 140-4 Feedback" the subject of your e-mail.

Here are some things to think about when crafting your feedback to the Director:

  1. With the current 13 year-old FIPS 140-2 standard, will you be satisfied testing your future products to those aging requirements?
  2. Can you make the world a better place for government agencies by designing your products to more relevant requirements?
  3. Share your development lead times with the Director. Express how important it is for you to understand (and plan for) requirement changes.
My feedback e-mail has already been sent.

Mark Minnoch is an Account Manager at InfoGard Laboratories.  He covers FIPS 140-4 updates like TMZ covers a paparazzi-dodging star.