Following the annual lab managers meeting and International Crypto Module Conference (ICMC) last week, the CMVP has released a few important notices that have a large impact on the community at large.
The first describes a new policy in which FIPS validation certificates older than 5 years will be moved to a "Legacy Validation List". The Legacy Validation list is not to be used for procurement by federal agencies. This policy becomes effective January 1st, 2017.
This new policy will certainly have a large impact on our government agencies who will potentially be in violation of FISMA when this policy takes affect. In a way this is a good thing, though. It keeps dated technology not up to current security guidelines from protecting sensitive information within our government.
For product vendors, there is a process to keep older modules off of this legacy list, but it does involve working with the labs to demonstrate that the module is compliant with all current standards and implementation guidance. This work would need to take place prior to January 1, 2017. I suggest that you begin this work now. In some cases, depending on when the module was validated, it may be a large undertaking to demonstrate that all current guidance is being adhered to.
The second notice of interest relates to the RNG transition. We know that RNG's will no longer be considered Approved for key generation at the end of this year. Any module that has an RNG will be moved to the same Legacy Validation List described above. The CMVP has allowed for updating these modules through a 1SUB like process ("bug fix" or "maintenance letter" process). This will allow for an efficient and timely process for keeping these modules off of the legacy list.
Here is the link to the notices (again):
http://csrc.nist.gov/groups/STM/cmvp/notices.html
