FIPS 140-2 Annex A, B, C, D updates

The FIPS 140-2 Annexes have been updated recently:

Annex A: Approved Security Functions [ PDF 07-26-2011]

• Added new Section: Transitions
• Added: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

Annex B: Approved Protection Profiles [ PDF 08-12-2011]

• Added U.S. Government Approved Protection Profile - U.S. Government Protection Profile for General-Purpose Operating Systems in a Networked Environment – CC Version 3.1, 30 August 2010

Annex C: Approved Random Number Generators [ PDF 07-26-2011]

• Added new Section: Transitions
• Added: Recommendation for Transitioning the Use of Cryptographic Algorithms
  and Key Lengths

Annex D: Approved Key Establishment Techniques [ PDF 07-26-2011]

• Added new Section: Transitions
  
• Added: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths

FIPS 140-2 Implementation Guidance updated

The FIPS 140-2 Implementation Guidance was updated on July 15, 2011.  The NIST website shows the following changes:

New Implementation Guidance:

• 11.1 Mitigation of Other Attacks
• D.4 Requirements for Vendor Affirmation of NIST SP 800-56B
• D.5 Requirements for Vendor Affirmation of NIST SP 800-108
• D.6 Requirements for Vendor Affirmation of NIST SP 800-132
• D.7 Requirements for Vendor Affirmation of NIST SP 800-135

Updated Implementation Guidance:

• G.3 Partial Validations and Not Applicable Areas of FIPS 140-2
  • Modified in regard to new IG 11.1
• G.6 Modules with both a FIPS mode and a non-FIPS mode
  • Clarification that all implemented algorithms shall be referenced on the validation certificate.
• G.8 Revalidation Requirements
  • Added security policy requirements for revalidation Scenarios 1 and 4
• G.13 Instructions for Validation Information Formatting
  • Added examples for CVL and KTS
• 1.4 Binding of Cryptographic Algorithm Validation Certificates
  • Added examples of an operational environment change
• D.1 CAVP Requirements for Vendor Affirmation of NIST SP 800-56A
  • Modified the testing for primitives
• D.2 Acceptable Key Establishment Protocols
  • Modified the transition text and key agreement guidance

Second draft of SP 800-56C open for comments

Open for public comments:  SP 800-56 C - DRAFT (2nd Draft) Recommendation for Key Derivation through Extraction-then-Expansion

The comment period closes on August 11, 2011.

New FIPS 140-2 testing lab, Booz Allen Hamilton

Booz Allen Hamilton is now the most recent NIST accredited FIPS 140 testing laboratory.  The addition of CGI and BAH to the NIST website this week brings the number of FIPS labs back up to 19.

The Booz Allen Hamilton FIPS Lab is located in Maryland (USA).

Welcome, BAH!

Canadian lab, CGI, back as an accredited FIPS 140 lab

CGI is back on the NIST website of accredited FIPS 140 testing laboratories.  Back in March of 2011, I noted that CGI had dropped off the website.  Jason Lawlor (CGI Lab Manager) informed me that it was a temporary situation.  On May 24, 2011, Jason confirmed that CGI has received their accreditation as a FIPS 140 testing lab.

Welcome back!

FIPS 140-2 certificates trending down in 2011

The number of FIPS 140-2 certificates issued in 2011 is trending at a slower pace than 2010.  My unofficial projection for the end of year total has been lowered to 175 new FIPS 140-2 certs (there were 229 certs last year).

This is actually great news for anyone pursuing a FIPS 140-2 validation in 2011.  CMVP review times have significantly improved this year and there is capacity for validation testing at all of the FIPS labs.

The chart below shows the breakdown of FIPS 140-2 certificates by Laboratory for 2011 (through May 27, 2011 there are 73 new FIPS certs).  The number between the Lab name and the percentage is the number of certificates for 2011.

FIPS 140-2 turns a decade old

FIPS 140-2 was signed by the Secretary of Commerce on May 25, 2001.  Happy 10th anniversary!

One of the most popular questions I get is "When is FIPS 140-3 coming out?"  The NIST schedule for FIPS 140-3 indicates that Secretary of Commerce will receive FIPS 140-3 for signature before the end of June.  I have not seen any indication that this target time frame will be met, but I do not claim to have deep insight into the schedule.

If you have thoughts on the FIPS 140-3 schedule, please share in a comment for the benefit of others in the FIPS community.  Thanks.