CMVP issues over 200 certificates in 2015

In 2015 the CMVP issued 206 FIPS 140-2 certificates, including a Security Level 4 certificate. This was the first Level 4 certificate since 2011.

 
Here are the totals by laboratory for 2015:

 

Congratulations to the FIPS Team at InfoGard for producing the most FIPS 140-2 certificates for the 7^th straight year.

On December 4, 2015, InfoGard was acquired by UL, a global leader in safety science.

Record number of FIPS 140-2 certificates issued in 2014

In 2014, The CMVP validated the most FIPS 140-2 cryptographic modules in a given year in the history of the program. 233 new FIPS certificates were issued last year, which surpassed the previous high of 229 in 2010.

Here are the totals by Laboratory for 2014:



Congratulations to the FIPS Team at InfoGard Laboratories.  That's 6 years in a row of producing the most FIPS 140-2 certificates (2009-2014).

Certificates and Queue Time Updates

At the end of the second quarter, we wrote about the CMVP being on a record pace for issuing FIPS 140-2 certificates in 2014.  Well, three quarters of the year have gone by now, and the CMVP remains on track.  One hundred ninety-one (191) FIPS 140-2 certificates have been issued during these 9 months of 2014. At the current pace, the projection for 2014 is 254 certificates (down from a projection of 262 in July).  We're still looking at the CMVP blowing by last year's mark of 208 certificates and the all-time record of 229 in 2010.

Here is the breakdown of certificates by the FIPS Laboratories for the first three quarters of 2014.

 

 

A quick update about the CMVP report queue:

  

InfoGard's current estimate for the CMVP queue time is 3-4 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").

Obviously I can't predict the future, but there is no indication that this current queue time will not be maintained.  It's a good sign for the remainder of the year and heading into 2015.  The CMVP was able to reduce the queue from 8-9 months last year to 3-4 months this year amid all of the algorithm transitions that took place, not an easy task. Next year should be a breeze comparatively.

 

CMVP Could Set Record in 2014 for FIPS 140-2 Certificates

The CMVP is on a record pace for issuing FIPS 140-2 certificates in 2014.  One hundred thirty-one (131) FIPS 140-2 certificates have been issued during the first 6 months of 2014. At the current pace, the projection for 2014 is 262 certificates -- that would smash the 208 certificates issued in 2013 and crush CMVP's all-time record of 229 in 2010.

Here is the breakdown of certificates by the FIPS Laboratories for the first half of 2014. 

A few folks were on travel (or camera shy), but most of the InfoGard FIPS Team are pictured here.

Mark Minnoch is an Account Manager at InfoGard Laboratories. The InfoGard FIPS Team produces more FIPS certificates for our customers than any other lab.

Save $2000 on Your FIPS Project!

Congrats to all the new 2014 high school graduates. This is an exciting time in your life and I would like to share a bit of advice with you.

If your parents are involved in a FIPS 140-2 project at work, then be sure to tell them how they can save their company $2000 or more.

This tip is almost guaranteed to work its way back into an awesome graduation present for you!

The NIST Cost Recovery fees for FIPS 140-2 reports are increasing on August 1, 2014.

Security Level	Cost Recovery Fee (through July 31, 2014)	Cost Recovery Fee (starting Aug 1, 2014)	Increase
1	$2750	$4250	$1500
2	$3750	$5750	$2000
3	$5250	$8000	$2750
4	$7250	$11000	$3750

Also, beginning August 1, 2014, revalidation reports (3SUBs) will require a $2000 Cost Recovery fee (currently there is no Cost Recovery fee for 3SUBs).

Here is your take-away: complete your FIPS 140-2 testing in time to get your report submitted to the CMVP no later than July 31, 2014.

Mark Minnoch is an Account Manager at InfoGard Laboratories. Mark helps technology vendors save money and make money!

OpenSSL Heartbleed Bug and FIPS

(Image from heartbleed.com)

The Q&A section at Heartbleed.com states that "OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality."

Although the OpenSSL FIPS module does not mitigate the heartbeat vulnerability, it is also important to note that the vulnerability exists outside of the OpenSSL FIPS cryptographic module boundary.

The vulnerability affects TLS implementations in certain OpenSSL libraries.

"The OpenSSL FIPS module is completely unaffected by the heartbeat vulnerability (CVE-2014-0160)," confirms Steve Marquess, Founding Partner at OpenSSL Software Foundation, Inc. 

The OpenSSL FIPS Object Module achieved FIPS 140-2 Certificate #1747 in 2012 (the certificate is maintained frequently by OpenSSL Software Foundation, Inc.)

Mark Minnoch is an Account Manager at InfoGard Laboratories.  The InfoGard FIPS Team performed the OpenSSL FIPS Object Module FIPS 140-2 validation for OpenSSL Software Foundation.

FIPS and sharks

The CMVP recently emerged from "Shark Week" with all limbs attached. In fact, the results of "Shark Week" are even better than fresh fish tacos with guacamole at the beach!

The CMVP probably has a different interpretation of "Shark Week" than I do, but I don't want to interrupt any of the Reviewers to ask them for a definition (they've been busy).

At the beginning of 2014, the CMVP was faced with an enormous backlog of FIPS 140-2 reports to review -- more than 150 reports were waiting for Reviewers to complete their initial pass. When I saw this report backlog, I feared that we might start seeing CMVP review times of 1 year or more. "Shark Week" was CMVP's strategy to attack the report queue.

No mercy.
No phone calls.
No meetings.

They became sharks. Reports were their prey.

How did they do?

Much better than the seals swimming in open waters. The March 10, 2014 Modules in Process report shows only 70 reports are in the "Review Pending" or "In Review" columns --  that's more than a 50% reduction in review backlog.

There's still work to do -- the report also shows 112 reports in the "Coordination" column. The "Coordination" phase indicates that the CMVP has completed their initial review and clarifying questions have been sent to the testing laboratory. This is the highest I've seen the Coordination value. The Vendor, Laboratory, and CMVP Reviewers all share responsibility in moving the report out of the "Coordination" phase so the certificate process can begin.

Will we see 3-4 month review times again this year? It could happen (and I would have never believed it in January).

Next week is InfoGard's "Shark Week."  We have some report comments to attack!

Mark Minnoch is an Account Manager at InfoGard Laboratories.  He was chased to shore once while surfing after seeing a shark fin that actually belonged to a dolphin.

Second highest number of FIPS 140-2 certificates issued in 2013

The CMVP recovered nicely at the end of 2013 -- working down 8+ month queue times to 5.5 months -- to have the second highest year of validating FIPS 140-2 cryptographic modules. With 208 new FIPS certificates issued in 2013, only 2010 tops that number with 229.

Here are the totals by Laboratory for 2013.

Congratulations (again!) to the FIPS Team at InfoGard Laboratories.  That's 5 years in a row of producing the most FIPS 140-2 certificates (2009-2013).

Shut the backdoor

If you have a FIPS 140-2 cryptographic module that implements the Dual EC DRBG from SP800-90A, then you may be fielding questions from your customers after they read articles like this one from the IEEE Spectrum:  Can You Trust NIST?

Please contact me if InfoGard performed your FIPS 140-2 validation.  I would be happy to help determine if your Dual EC DRBG function can be disabled in a new version of your crypto module without going through a lengthy revalidation effort.

Mark Minnoch
mminnoch@infogard.com 
805-783-0810

FIPS 140-2 certs down 16% in 2013

For the first 3 calendar quarters of 2013, the CMVP has issued 126 new FIPS 140-2 certificates.  At this pace, the expected number of certificates in 2013 will be 16% less than 2012.

The NIST shutdown in October will almost certainly push the number of FIPS certificates to a low level not seen since 2007.

Here are the 2013 FIPS 140-2 certificate totals by Laboratory through September 30:

Alternate website for FIPS 140-2 certificate information

Don't let the NIST shutdown keep you from accessing details of the FIPS 140-2 validated cryptographic modules.  The folks at Cryptsoft maintain a copy of the information that is publicly available from NIST (well, available during non-furlough days):  http://www.cryptsoft.com/fips140/

The information is current (last update was September 30, 2013).

99 FIPS 140-2 certificates during first 6 months of 2013

The CMVP is maintaining their pace for issuing FIPS 140-2 certificates.  Ninety-nine (99) FIPS 140-2 certificates have been issued during the first 6 months of 2013 (for comparison, 200 certificates were issued in all of 2012).

Here is the breakdown of certificates by the FIPS Laboratories for the first half of 2013:

7.5 months for the CMVP queue

InfoGard's current estimate for the CMVP queue time is 7.5 months (this is the time between report submission -- "Review Pending" -- to the time the Lab receives comments from the CMVP -- "Coordination").  

Notes:  

• 7.5 months is the expected maximum length of time -- InfoGard has received CMVP comments well under that time for some of our reports.
• This estimate is based on InfoGard's report submissions and the trends observed in the Modules in Process list.

I was encouraged during my review of the most recent FIPS 140-2 Modules in Process list.  The number of modules in the "Review Pending" and "In Review" columns total 96.  This number represents the CMVP report queue and the trend is pushing downwards (this total has been over 110 recently).

I thought that CMVP review times were going to steadily increase throughout 2013.  Our information shows that the review times are holding steady.

The 71 reports in "Coordination" is higher than desired.  Vendors, Labs, and the CMVP all share responsibility in moving reports from "Coordination" to "Finalization."  Reducing the number of reports in "Coordination" allows the CMVP to focus more on the reports in the review process.  When less time is spent on "Coordination" efforts, the queue time for report reviews improves.

If you are a Vendor with a report that is currently in "Coordination," take the following proactive steps to assist in the validation effort:

1. Stay in communication with your FIPS Laboratory or Consultant.  If you have actions to complete, let your FIPS contact know your target completion date for your action items.
2. If you are updating your FIPS 140-2 Security Policy (likely), then be sure to follow your configuration management system to properly version control the updated document (e.g., change the version number and date).
3. Ask your Laboratory (or Consultant) to provide the date they expect to submit responses back to the CMVP. Request confirmation when responses are returned.
4. At InfoGard, we contact the CMVP if we have not received an update after 2 weeks.  If you have not received an update after 2 weeks, contact your Laboratory (or Consultant).  (Please do not contact the CMVP directly.  The CMVP politely requests that you communicate through your Laboratory.)
5. When the CMVP responds to the Laboratory, your report either moves into "Finalization" or there are additional comments.  For additional comments, repeat steps 1-4.

Please contribute your comments to this post or contact me directly.  

Contact info:

Mark Minnoch

InfoGard Laboratories

FIPS Program Manager

805-783-0810

mminnoch@infogard.com