NIST Random Bit Generation Workshop, Dec 5-6, 2012

NIST announced a Random Bit Generation Workshop December 5-6, 2012, in Gaithersburg, Maryland.  The intended audience includes industry and government.  Registration is limited and closes November 26, 2012.

The workshop will discuss SP 800-90A/B/C (with the primary focus expected to be on the entropy sources in SP 800-90B).

SHA-3 winner announced

Congrats to the cryptographers of Keccak for winning NIST's SHA-3 competition.

The short SHA-3 Selection Announcement is worth the read.

I've already been asked the following question:
Q:  When will SHA-3 be an approved security function for FIPS 140-2 cryptographic modules?

The answer is easy, but I do not know the date:
A:  As soon as it is included in Annex A:  Approved Security Functions for FIPS 140-2

Additional info:  Wiki on SHA-3 NIST hash function competition

Unofficial FIPS 140-3 schedule

Thank you, dear readers, for your interest in my "unofficial FIPS 140-3 schedule" updates.  By popular demand, I've been asked to communicate my best guesses again.

Here are the latest dates from NIST's FIPS 140-3 Pub Development page:

• On October 1, 2012, the additional public comments period closes for specific sections of the second draft of FIPS 140-3 (comments on sections not specifically listed will not be considered).
• During 2Q of 2013 (April/May/June), all public comments will be addressed by NIST.
• The remaining schedule milestones do not have target dates so this is where I begin my guessing...

Here are my thoughts on the remainder of FIPS 140-3 schedule:

• The scope of the current public comment period is focused.  My approach is to pick more aggressive dates than I have in the past as I do not anticipate any significant changes to the working draft.
• 3Q of 2013 (July/August/September) - FIPS 140-3 presented to the Commerce Department for signature.
• 1Q of 2014 (January/February/March) - FIPS 140-3 becomes effective.  The Derived Test Requirements have already been published by now.  Modules may be validated by Labs for FIPS 140-3 requirements.
• 3Q of 2014 (July/August/September) - the transition period for completing FIPS 140-2 reports ends. All new validation reports submitted must be validated to FIPS 140-3 requirements.  
• 2015 - Any products in the planning cycle that are to be released in 2015 must be designed to meet FIPS 140-3 requirements.

In other news, ISO/IEC 19790:2012 was published in August 2012.  This is an international standard that evolved from the original FIPS 140-3 draft.  The Derived Test Requirements for 19790, ISO/IEC 24759, may be published in 4Q 2013 (October/November/December).  If the FIPS 140-3 publication followed an alternate path to adopt 19790 (with allowances for US and Canadian specific security functions and other requirements), then the overall schedule may be a Quarter sooner than my estimated schedule above.  There are no official plans for FIPS 140-3 to adopt 19790.

Reference Links:
Official FIPS 140-3 Pub Development
ISO / IEC 19790:2012

 

NIST seeking comments on FIPS 140-3 draft

Here is the link to the latest FIPS 140-3 draft:   http://csrc.nist.gov/news_events/index.html#august30

Comments are requested on or before October 1, 2012.

NIST plans to address all public comments in the 2nd Quarter of 2013.  The updated FIPS 140-3 Development Status information is here:  http://csrc.nist.gov/groups/ST/FIPS140_3/

CMVP review times currently in the 4-6 month range

InfoGard's Quality Manager informed me that CMVP review times have slipped to the 4 to 6 month range for FIPS reports this summer.  We believe the reasons for the summer slow-down are due to CMVP vacations, new Implementation Guidance, and a surge in report submissions by Labs in the spring.

When selecting a FIPS Laboratory for your next FIPS project, make sure to ask about the Lab's report review process prior to submission.  InfoGard has a deliberate review process involving an independent technical review by a FIPS Security Engineer, a Quality review, a Signatory review, and then a final quick Quality check at the end.  This is our secret sauce for delivering high-quality reports to the CMVP.  Clear, consistent, and compliant reports are easily reviewed by the CMVP allowing you to reach your product sales goals sooner.

InfoGard first to reach 500 FIPS certs!

We like reasons to celebrate at InfoGard and we thank our customers for allowing us to achieve this milestone.

Earlier this month, InfoGard became the first FIPS 140-2 testing laboratory to pass the 500 FIPS Certificates mark!  That's 28% of the total during the lifetime of the program.  Thank you, InfoGard Customers, for trusting us with your FIPS 140-2 projects.

FIPS 140-2 Implementation Guidance updated (again)

The CMVP has been busy updating the FIPS 140-2 Implementation Guidance.  If you delayed reviewing the April update, then delay no further.  The May update deserves your attention.

See the May 2, 2012 document and changes here:  http://csrc.nist.gov/groups/STM/cmvp/announcements.html

Note:  You may need to clear your browser's cache to open the latest IG document.