FIPS 140-2 report queue update

As of March 20, 2013, the CMVP has issued 52 certificates for the year (19 of those were validated by InfoGard Laboratories).  

As of March 25, 2013, InfoGard has received comments for 7 of 8 reports submitted in July 2012.  All reports submitted prior to July have been reviewed by the CMVP.  No August reports have been returned for comments yet.  

I am increasing my estimate for the current CMVP review time to 8 months.  My February post estimated a queue time that was holding at 6-7 months.  As I mentioned in my earlier post, this increase is not a surprise as the number of reports that the CMVP is processing has dramatically increased compared to last year.  

The FIPS 140-2 Cryptographic Modules Listings on the NIST website identify CST Labs by NVLAP numbers.

The following table is sorted by NVLAP number to make it easy to identify the Lab that performed a validation.  The list of NVLAP Testing Laboratories is maintained on the NIST website:  http://csrc.nist.gov/groups/STM/testing_labs/index.html

100414-0	Underwriters Laboratories, Inc.	USA - IL
100432-0	InfoGard Laboratories, Inc.	USA - CA
200002-0	CEAL: a CygnaCom Solutions Laboratory	USA - VA
200416-0	COACT Inc. CAFE Laboratory	USA - MD
200017-0	(No longer accredited) DOMUS	n/a
200423-0	Booz Allen Hamilton (BAH)	USA - MD
200996-0	Computer Sciences Corporation	USA - MD
200427-0	SAIC Accredited Testing & Evaluation (AT&E) Labs (MD)	USA - MD
200492-0	SAIC Accredited Testing & Evaluation (AT&E) Labs (VA)	USA - VA
200556-0	EWA - Canada IT Security Evaluation & Test Facility	Canada
200636-0	TÜV Informationstechnik GmbH	Germany
200648-0	(No longer accredited) Aspect Labs	n/a
200658-0	atsec Information Security Corporation	USA - TX
200697-0	ICSA Labs, An Independent Division of Verizon Business	USA - PA
200802-0	ÆGISOLVE, INC.	USA - CA
200822-0	Information Technology Security Center	Japan
200824-0	TTC IT Security Evaluation Laboratory	Taiwan
200835-0	ECSEC Laboratory Inc.	Japan
200856-0	Epoche & Espri	Spain
200900-0	Detica Lab	Australia
200901-0	UL Transaction Security	Australia
200928-0	CGI IT Security Evaluation & Test Facility	Canada
200968-0	ADVANCED DATA SECURITY	USA - CA
200983-0	Penumbra Security	USA - CA

FIPS 140-2 report queue update

Now that January is behind us, it is time for an update on the FIPS 140-2 report queue.  In January 2013, 15 FIPS 140-2 certificates were issued -- 7 of those were validated by InfoGard Laboratories.  Go Team!

As of February 1, 2013, InfoGard has received comments from the CMVP for 4 reports that were submitted in July 2012 and we are waiting for comments on 4 other July reports.  All reports submitted prior to July have been reviewed by the CMVP.

My estimate for the current CMVP review time remains at 6 to 7 months.  I am actually very encouraged that my estimate has not increased since I went on record with my last estimate in November 2012.

I am carefully monitoring the Modules in Process list as this is an excellent indicator of FIPS 140-2 report activity.  The number of reports in the "Review Pending" and "In Review" columns has increased by 26 (a 23% uptick) since November 2012.

Longer review times may be ahead of us in 2013, so stay tuned for future updates.  High quality report submissions are exactly what the CMVP needs to maintain and improve their review times.

InfoGard at RSA Conference in San Francisco

Please visit InfoGard at Booth #0554 during the RSA Conference in San Francisco February 25-28.

FIPS 140-2 certificate totals up 8% in 2012

We ended 2012 with 20 FIPS Testing Laboratories.  Thirteen of those Laboratories completed validations for their customers last year resulting in a total of 200 FIPS 140-2 certificates issued.  That is an increase of 8% over 2011 (there were 185 certs issued in 2011).

The FIPS Team at InfoGard Laboratories thanks our customers for making us the #1 FIPS Lab for the 4th year in a row!

Here is the breakdown by Laboratory:

SP 800-38F added to Annex D

NIST Special Publication 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping, has been added to Annex D:  Approved Key Establishment Techniques for FIPS PUB 140-2 on January 2, 2013.

FIPS 140-2 Implementation Guidance updated

The FIPS 140-2 Implementation Guidance document was updated on December 21, 2012.  (You may need to refresh your browser to pick up the recent update.)

Updated Implementation Guidance:

• G.5 Maintaining validation compliance of software or firmware cryptographic modules
  • Included reference to the impact to the generated key strength assurance when porting, and vendor Security Policy updates.
• G.13 Instructions for Validation Information Formatting
  • For all embodiments, the OE shall be specified on the validation entry.
• G.14 Validation of Transitioning Cryptographic Algorithms and Key Lengths
  • Addressed two-key Triple-DES requirements.
• D.8 Key Agreement Methods
  • IG updated to address SP 800-135rev1.