CMVP Validation Sunsetting Policy

Based on a CMVP notice from November 2015, we know that starting in 2017 the CMVP will move all 140-1 certificates and any 140-2 certificates older than 5 years to the Historical List. The goal is to keep current, valid crypto modules in circulation amongst federal agencies.  Remember that the Historical List is a “do not buy” list for US federal government procurement purposes. The previous policy was such that the 5 year clock would start running from the last date that a certificate was modified.  Between now and February 1, 2017, minor updates, such as updating vendor contact information or the module name, will reset the 5 year clock. However, after February 1, 2017, the policy is such that any validation submission that is a maintenance effort (i.e., submissions that are 1, 2, and 4 SUB submissions in CMVP speak) would NOT reset the 5 year running clock. With this change, vendors have the rest of 2016 to complete a minor update effort that would extend the life of their certificates. After that, in order to stay off of the Historical List, it must be proven that the module meets all current guidance.

Another topic to be aware of is that rebranding of an OEM module (1SUB scenario A submissions) will be under much more scrutiny by labs and CMVP reviewers when this policy goes into effect. It will have to be demonstrated that the rebranded module meets all current guidance. Alternatively, the CMVP may choose to only accept 1SUB scenario A submissions within a certain amount of time from the original OEM validation date. CMVP will provide further clarification as it relates to how they will accept rebranded modules.

We can expect an update to the validation sunsetting policy on the CMVP website soon.

Urgent: CMVP Guidance Effective Immediately

This morning, the CMVP released a notice to all labs acknowledging that not all SP 800-90A DRBG implementations submitted for validation have been entirely compliant with the SP 800-90A standard.

Specifically, Section 11.3 of the standard requires that certain health checks be performed.  It was not always clear that these health checks were required for CMVP validation.  In fact, based on some interpretations, wording within SP800-90A itself would leave some to believe that they were, indeed, not required.

The CMVP's stance, based on guidance from the Cryptographic Technology Group, is now that these health checks are absolutely required in order to claim that a DRBG implementation is compliant to 800-90.  This guidance is effective IMMEDIATELY, and even impacts modules that are currently in the queue and in the Coordination phase.

For reports currently in the queue where the module does not implement a compliant DRBG, the lab is to notify the CMVP to put the submission on HOLD until the DRBG implementation comes into compliance and is tested by the lab.
(UPDATE as of 6/1/15 - For reports in the queue where the module does NOT implement the health checks, the lab is still to notify the CMVP to place the report on HOLD, but there are two options for moving forward. One, is to bring the module into compliance and resubmit the report with all appropriate test evidence.  Or two, is to rework the validation documentation and report to show the DRBG implementation as Non-Compliant.  This would include identifying all services within the SP and report that utilize the non-compliant DRBG.  The lab can resubmit the reworked SP and report to the CMVP and the validation will proceed accordingly).

If your particular module is impacted by this, make the appropriate changes now and work with your lab to have them tested (i.e. operational tested and/or code reviewed).

Record number of FIPS 140-2 certificates issued in 2014

In 2014, The CMVP validated the most FIPS 140-2 cryptographic modules in a given year in the history of the program. 233 new FIPS certificates were issued last year, which surpassed the previous high of 229 in 2010.

Here are the totals by Laboratory for 2014:



Congratulations to the FIPS Team at InfoGard Laboratories.  That's 6 years in a row of producing the most FIPS 140-2 certificates (2009-2014).

Certificates and Queue Time Updates

At the end of the second quarter, we wrote about the CMVP being on a record pace for issuing FIPS 140-2 certificates in 2014.  Well, three quarters of the year have gone by now, and the CMVP remains on track.  One hundred ninety-one (191) FIPS 140-2 certificates have been issued during these 9 months of 2014. At the current pace, the projection for 2014 is 254 certificates (down from a projection of 262 in July).  We're still looking at the CMVP blowing by last year's mark of 208 certificates and the all-time record of 229 in 2010.

Here is the breakdown of certificates by the FIPS Laboratories for the first three quarters of 2014.

 

 

A quick update about the CMVP report queue:

  

InfoGard's current estimate for the CMVP queue time is 3-4 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").

Obviously I can't predict the future, but there is no indication that this current queue time will not be maintained.  It's a good sign for the remainder of the year and heading into 2015.  The CMVP was able to reduce the queue from 8-9 months last year to 3-4 months this year amid all of the algorithm transitions that took place, not an easy task. Next year should be a breeze comparatively.

 

Save $2000 on Your FIPS Project!

Congrats to all the new 2014 high school graduates. This is an exciting time in your life and I would like to share a bit of advice with you.

If your parents are involved in a FIPS 140-2 project at work, then be sure to tell them how they can save their company $2000 or more.

This tip is almost guaranteed to work its way back into an awesome graduation present for you!

The NIST Cost Recovery fees for FIPS 140-2 reports are increasing on August 1, 2014.

Security Level	Cost Recovery Fee (through July 31, 2014)	Cost Recovery Fee (starting Aug 1, 2014)	Increase
1	$2750	$4250	$1500
2	$3750	$5750	$2000
3	$5250	$8000	$2750
4	$7250	$11000	$3750

Also, beginning August 1, 2014, revalidation reports (3SUBs) will require a $2000 Cost Recovery fee (currently there is no Cost Recovery fee for 3SUBs).

Here is your take-away: complete your FIPS 140-2 testing in time to get your report submitted to the CMVP no later than July 31, 2014.

Mark Minnoch is an Account Manager at InfoGard Laboratories. Mark helps technology vendors save money and make money!

CMVP Queue Time is 4 to 5 Months

InfoGard's current estimate for the CMVP queue time is 4-5 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").  

InfoGard submitted 22 FIPS 140-2 reports in December 2013.  Half of those reports have made it through the CMVP queue as of today.

The CMVP "Shark Week" in March 2014 took a bite out of the queue, but reviews have stretched out a month since that push.   

Please contribute your comments to this post or contact me directly.

Contact info:

Mark Minnoch

InfoGard Laboratories

805-783-0810

mminnoch@infogard.com

If you are interested in FIPS 140-2 updates, then please connect with me on LinkedIn:  

• www.linkedin.com/pub/mark-minnoch/0/5a1/80b/

  
  

FIPS and sharks

The CMVP recently emerged from "Shark Week" with all limbs attached. In fact, the results of "Shark Week" are even better than fresh fish tacos with guacamole at the beach!

The CMVP probably has a different interpretation of "Shark Week" than I do, but I don't want to interrupt any of the Reviewers to ask them for a definition (they've been busy).

At the beginning of 2014, the CMVP was faced with an enormous backlog of FIPS 140-2 reports to review -- more than 150 reports were waiting for Reviewers to complete their initial pass. When I saw this report backlog, I feared that we might start seeing CMVP review times of 1 year or more. "Shark Week" was CMVP's strategy to attack the report queue.

No mercy.
No phone calls.
No meetings.

They became sharks. Reports were their prey.

How did they do?

Much better than the seals swimming in open waters. The March 10, 2014 Modules in Process report shows only 70 reports are in the "Review Pending" or "In Review" columns --  that's more than a 50% reduction in review backlog.

There's still work to do -- the report also shows 112 reports in the "Coordination" column. The "Coordination" phase indicates that the CMVP has completed their initial review and clarifying questions have been sent to the testing laboratory. This is the highest I've seen the Coordination value. The Vendor, Laboratory, and CMVP Reviewers all share responsibility in moving the report out of the "Coordination" phase so the certificate process can begin.

Will we see 3-4 month review times again this year? It could happen (and I would have never believed it in January).

Next week is InfoGard's "Shark Week."  We have some report comments to attack!

Mark Minnoch is an Account Manager at InfoGard Laboratories.  He was chased to shore once while surfing after seeing a shark fin that actually belonged to a dolphin.

Second highest number of FIPS 140-2 certificates issued in 2013

The CMVP recovered nicely at the end of 2013 -- working down 8+ month queue times to 5.5 months -- to have the second highest year of validating FIPS 140-2 cryptographic modules. With 208 new FIPS certificates issued in 2013, only 2010 tops that number with 229.

Here are the totals by Laboratory for 2013.

Congratulations (again!) to the FIPS Team at InfoGard Laboratories.  That's 5 years in a row of producing the most FIPS 140-2 certificates (2009-2013).

CMVP queue time is currently 5.5 months for FIPS 140-2 reports

InfoGard's current estimate for the CMVP queue time is 5.5 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").  

As of November 15, 2013, the CMVP has provided comments on all InfoGard reports submitted through May 2013 (the oldest InfoGard report that has not received CMVP comments was submitted June 10, 2013).

The CMVP focus on the report queue since returning from the US government shutdown in October has been phenomenal.  Right after the NIST side of the CMVP returned to work last month, I expected the queue to hold steady at 8 months.

Please contribute your comments to this post or contact me directly.

Contact info:

Mark Minnoch

InfoGard Laboratories

805-783-0810

mminnoch@infogard.com

If you are interested in FIPS 140-2 updates, then please connect with me on LinkedIn:  

• www.linkedin.com/pub/mark-minnoch/0/5a1/80b/

  
  

No perfect storm for the FIPS 140-2 report queue?

After reviewing the CMVP's Modules in Process list pre- and post-government shutdown, the expected "welcome back to work" flood of reports did not materialize.  In the simplest of explanations, the CMVP queue only increased by 3 reports during the furlough.

Let me explain my thinking.  The following picture shows the Modules in Process totals updated 10/17/2013 (after NIST returned to work):

The "Review Pending" column shows 73 FIPS 140-2 reports have been submitted to the CMVP but Reviewers have not yet been assigned.  As you might have guessed, this is a large number of reports waiting to be reviewed, but this number was 69 before the shutdown.  The CMVP is responsible for moving reports to the next phase of "In Review."

The "In Review" column indicates that 12 reports have been assigned to Reviewers.  This is actually a decrease from 19 shown on the 9/30/2013 report.  7 or more reports moved into the coordination phase once NIST returned.  The CMVP is responsible for moving reports to the"Coordination" phase.

The 86 reports in the "Coordination" phase means that the CMVP has completed their initial review and clarifying questions have been sent to the testing laboratory.  This is a very high number of reports for the CMVP to manage and it has a direct impact on the queue time.  This compares to 80 at the end of September and we would expect to see this number increase with the decrease in the "In Review" phase.  The Vendor, Laboratory, and CMVP Reviewers all share responsibility in moving the report to the "Finalization" phase.

The "Finalization" phase still has 11 reports pre- and post-shutdown.

In comparing the pre- and post-shutdown grand totals for all reports, there is only a +3 gain.

"What does it all mean?"  (side note: a former co-worker used this question instead of a "hello" greeting every time someone passed him in the hall)

Here are my thoughts (and please share yours in the comment section):

1. We may have dodged a bullet.  Perhaps I will be asking for forgiveness for my earlier prediction that review times would certainly increase. (Let's hope that I do get to apologize!)
2. CSEC, the Canadian side of the CMVP, may have rocked though some reports while NIST was shutdown.

I will continue to monitor the report queue, but for now I estimate the CMVP queue review time is 8 months.

Alternate website for FIPS 140-2 certificate information

Don't let the NIST shutdown keep you from accessing details of the FIPS 140-2 validated cryptographic modules.  The folks at Cryptsoft maintain a copy of the information that is publicly available from NIST (well, available during non-furlough days):  http://www.cryptsoft.com/fips140/

The information is current (last update was September 30, 2013).

NIST CMVP employees are furloughed

Any work requiring NIST CMVP involvement will be delayed until the US government executes a resolution to the budget.  This shut down will impact all FIPS 140-2 validations and revalidations in review by the CMVP, maintenance letters, and algorithm testing.

InfoGard and other FIPS laboratories will remain open.  Lab testing services that do not require NIST CMVP involvement will continue.

The CSEC side of the CMVP will continue their operations although no validations will be completed without a NIST signatory. 

This shut down will increase the already long CMVP review times for FIPS 140-2 reports.  The CMVP is currently reviewing reports that were submitted in January.

FIPS 140-2 Implementation Guidance updated

The CMVP published an update to the FIPS 140-2 Implementation Guidance (IG) on July 25, 2013.

Note:  You must read 9.10 if you have a software-only module. 

New Implementation Guidance:

• 3.5 Documentation Requirements for Cryptographic Module Services
• 9.9 Pair-Wise Consistency Self-Test When Generating a Key Pair
• 9.10 Power-Up Tests for Software Module Libraries
• D.11 References to the Support of Industry Protocols

Updated Implementation Guidance:

• D.8 Key Agreement Methods
  • Resolution section has been updated.
• D.9 Key Transport Methods
  • Resolution section has been updated.

7.5 months for the CMVP queue

InfoGard's current estimate for the CMVP queue time is 7.5 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").  

Notes:  

• 7.5 months is the expected maximum length of time -- InfoGard has received CMVP comments well under that time for some of our reports.
• This estimate is based on InfoGard's report submissions and the trends observed in the Modules in Process list.

I was encouraged during my review of the most recent FIPS 140-2 Modules in Process list.  The number of modules in the "Review Pending" and "In Review" columns total 96.  This number represents the CMVP report queue and the trend is pushing downwards (this total has been over 110 recently).

I thought that CMVP review times were going to steadily increase throughout 2013.  Our information shows that the review times are holding steady.

The 71 reports in "Coordination" is higher than desired.  Vendors, Labs, and the CMVP all share responsibility in moving reports from "Coordination" to "Finalization."  Reducing the number of reports in "Coordination" allows the CMVP to focus more on the reports in the review process.  When less time is spent on "Coordination" efforts, the queue time for report reviews improves.

If you are a Vendor with a report that is currently in "Coordination," take the following proactive steps to assist in the validation effort:

1. Stay in communication with your FIPS Laboratory or Consultant.  If you have actions to complete, let your FIPS contact know your target completion date for your action items.
2. If you are updating your FIPS 140-2 Security Policy (likely), then be sure to follow your configuration management system to properly version control the updated document (e.g., change the version number and date).
3. Ask your Laboratory (or Consultant) to provide the date they expect to submit responses back to the CMVP. Request confirmation when responses are returned.
4. At InfoGard, we contact the CMVP if we have not received an update after 2 weeks.  If you have not received an update after 2 weeks, contact your Laboratory (or Consultant).  (Please do not contact the CMVP directly.  The CMVP politely requests that you communicate through your Laboratory.)
5. When the CMVP responds to the Laboratory, your report either moves into "Finalization" or there are additional comments.  For additional comments, repeat steps 1-4.

Please contribute your comments to this post or contact me directly.  

Contact info:

Mark Minnoch

InfoGard Laboratories

FIPS Program Manager

805-783-0810

mminnoch@infogard.com

FIPS 140-2 report queue update

As of March 20, 2013, the CMVP has issued 52 certificates for the year (19 of those were validated by InfoGard Laboratories).  

As of March 25, 2013, InfoGard has received comments for 7 of 8 reports submitted in July 2012.  All reports submitted prior to July have been reviewed by the CMVP.  No August reports have been returned for comments yet.  

I am increasing my estimate for the current CMVP review time to 8 months.  My February post estimated a queue time that was holding at 6-7 months.  As I mentioned in my earlier post, this increase is not a surprise as the number of reports that the CMVP is processing has dramatically increased compared to last year.  

FIPS 140-2 report queue update

Now that January is behind us, it is time for an update on the FIPS 140-2 report queue.  In January 2013, 15 FIPS 140-2 certificates were issued -- 7 of those were validated by InfoGard Laboratories.  Go Team!

As of February 1, 2013, InfoGard has received comments from the CMVP for 4 reports that were submitted in July 2012 and we are waiting for comments on 4 other July reports.  All reports submitted prior to July have been reviewed by the CMVP.

My estimate for the current CMVP review time remains at 6 to 7 months.  I am actually very encouraged that my estimate has not increased since I went on record with my last estimate in November 2012.

I am carefully monitoring the Modules in Process list as this is an excellent indicator of FIPS 140-2 report activity.  The number of reports in the "Review Pending" and "In Review" columns has increased by 26 (a 23% uptick) since November 2012.

Longer review times may be ahead of us in 2013, so stay tuned for future updates.  High quality report submissions are exactly what the CMVP needs to maintain and improve their review times.

FIPS 140-2 Implementation Guidance updated (again)

The CMVP has been busy updating the FIPS 140-2 Implementation Guidance.  If you delayed reviewing the April update, then delay no further.  The May update deserves your attention.

See the May 2, 2012 document and changes here:  http://csrc.nist.gov/groups/STM/cmvp/announcements.html

Note:  You may need to clear your browser's cache to open the latest IG document.

FIPS 140-2 Consolidated Validation Certificates

Q:  How long does it take for a recently validated cryptographic module to appear on a FIPS 140-2 Consolidated Validation Certificate?

A:  At the end of each month, the CMVP generates a list of cryptographic modules that were issued new FIPS 140-2 certificates.  The Consolidated Validation Certificate is signed by a NIST representative in the United States and then routed to Canada for signature by a CSEC representative.  The signature and posting process takes about two weeks. 

For example, modules that received a certificate number in the month of January will appear on the FIPS 140-2 Consolidated Validation Certificate that gets posted mid-February.

FIPS certificate totals for 2011 down 19%

The number of FIPS 140-2 certificates issued in 2011 was down 19% compared to 2010.  A total of 185 certificates were issued in 2011 (229 were issued in 2010).  Here are the totals by Lab for 2011: