FIPS 140-2: Validation versus Compliance (2024)

FAQs

FIPS 140-2: Validation versus Compliance? ›

Key Differences Between FIPS Compliance and FIPS Validation

FIPS Validation means a product has undergone and passed detailed conformance testing at an accredited national laboratory. FIPS Compliance means that different components of a product have received FIPS validation, but the product in its entirety has not passed testing or has not been tested at all.

FIPS 140-2 Standard explained

FIPS 140-2 is the current industry standard. FIPS 140-2 provides regulations for physical tamper-resistance, role-based authentication, and physical and logical separation of interfaces through which “critical security parameters” pass.

FIPS compliance means a product meets all the necessary security requirements established by the U.S. government for protecting sensitive information. To be FIPS-compliant, a product must adhere to rigid standards, pass rigorous testing, and be certified by NIST.

Level 1: Requires production-grade equipment and externally tested algorithms. Level 2: Adds requirements for physical tamper-evidence and role-based authentication. Software implementations must run on an Operating System approved to Common Criteria at EAL2.

Validation is the process of checking whether the specification captures the customer's requirements, while verification is the process of checking that the software meets specifications. Verification includes all the activities associated with the producing high quality software.

The U.S. federal government's transition to the FIPS 140-3 cryptography standard has begun, with NIST announcing that all FIPS 140-2 certificates will be retired in September 2026.

BitLocker is FIPS-validated, but it requires a setting before encryption that ensures that the encryption meets the standards set forth by FIPS 140-2.

AES encryption is compliant with FIPS 140-2. It's a symmetric encryption algorithm that uses cryptographic key lengths of 128, 192, and 256 bits to encrypt and decrypt a module's sensitive information. AES algorithms are notoriously difficult to crack, with longer key lengths offering additional protection.

Should I enable FIPS compliance? ›

Windows has a hidden setting that will enable only government-certified "FIPS-compliant" encryption. It may sound like a way to boost your PC's security, but it isn't. You shouldn't enable this setting unless you work in government or need to test how software will behave on government PCs.

FIPS 140-2 required modules to support a crypto officer role and a user role, with an optional maintenance role. In FIPS 140-3, the crypto officer role is the only required role. For levels 1-3, FIPS 140-2 and 140-3 are fairly similar. However, FIPS 140-3 requires multi-factor authentication at Level 4.

Key Differences Between FIPS Compliance and FIPS Validation

FIPS compliance relies on self-declaration by the organization responsible for the product, whereas FIPS validation involves a third-party evaluation by a NIST-accredited laboratory.

To comply with FIPS 140-2, your system must be configured to run in a FIPS approved mode of operation, which includes ensuring that a cryptographic module uses only FIPS-approved algorithms. For more information on configuring systems to be compliant, see the Windows and Windows Server FIPS 140-2 content.

During the certification process, all file transfer software and server applications are rigorously tested to ensure they meet the FIPS standard. A NIST approved lab will test the system to ensure its certification.

FIPS 140-2 Certification focuses on cryptographic modules used in securing sensitive information, while Common Criteria provides an internationally recognized framework for evaluating and certifying the security of IT products.

The average time for a FIPS 140-3 validation is 1.59 years (579 days or 1 year, 7 months and 4 days). This marks the time the CMVP receives the FIPS 140-3 validation report to the issuance of a FIPS 140-3 certificate. The average time for the initial CMVP review is 1 year (366 days).

Level 3: Adds requirements for physical tamper-resistance and identity-based authentication. There must also be physical or logical separation between the interfaces by which “critical security parameters” enter and leave the module. Private keys can only enter or leave in encrypted form.