Cryptographic Module Validation Program CMVP

FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies. Agencies must use cryptographic-based security systems to provide adequate information security for all operations and assets as defined in 15 U.S.C. § 278g-3. Additionally, cryptographic modules must meet the requirements outlined in the FIPS 140 standards in order to comply with the FISMA mandate. 

Non-validated cryptography is viewed as providing no protection to the information or data—in effect the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 or FIPS 140-3 is applicable. In essence, if cryptography is required, then it must be validated. 

Please visit FIPS 140-2 Management Manual and FIPS 140-3 Management Manual. 

First, become familiar with the FIPS requirements and the CMVP - a brief description of each is provided in the “What is the history of the FIPS 140 standards and the most current version?” and “What is the purpose of the CMVP?” FAQs above.   

The CMVP website provides an overview of the CMVP and how the CMVP addresses the needs of U.S. and Canadian governments. 

Please visit Information on CST Lab Accreditation and Fees. Please be advised that the CSTLs charge a fee for the conformance testing.  Fees may vary by laboratory.  Please consult them directly to obtain fee information.   

Yes. A cryptographic module that has already been issued a FIPS 140-2 or FIPS 140-3 validation certificate may be incorporated or embedded into another product. The new product may reference the FIPS 140-2 or FIPS 140-3 validated cryptographic module so long as the new product does not alter the original validated cryptographic module. A product which uses an embedded validated cryptographic module cannot claim itself to be validated; only that it utilizes an embedded validated cryptographic module.  In such case, vendors may use the phrase "FIPS 140-[2 or 3] Inside" (see Use of FIPS 140-3 or FIPS 140-2 Logo and Phrases webpage).

There is no assurance that a product is correctly utilizing an embedded validated cryptographic module – this is outside the scope of the FIPS 140-2 or FIPS 140-3 validation.  

Note, this FAQ is related to but different from guidance specified in: IG 1.A Binding and Embedding Cryptographic Modules.

A vendor may claim its product to be FIPS 140-3 "compliant" and use the phrase "FIPS 140-[2 or 3] Inside" (see Use of FIPS 140-3 or FIPS 140-2 Logo and Phrases webpage). FIPS 140-3 "compliant" means a vendor believes its product implementation meets the FIPS 140-3 requirements, but the product has not gone through the CMVP validation process.  Having a validated product means that it has gone through independent testing conducted by an accredited CSTL and its testing is verified by the CMVP.  A validated product will have a CMVP issued certificate number. 

The CMVP will review the information provided for technical merit and specificity. If the information provides specific technical characteristics that appear to question conformance issues of a validated module, the CMVP will sanitize the information and forward it to the Cryptographic Security Testing Laboratory (CSTL) responsible for the module’s compliance testing. The CSTL will review the information for accuracy and merit. If the provided information appears to surface a non-compliance issue, the CSTL and CMVP will review and confirm the non-compliance. Based on the nature of the non-compliance, the CMVP will take necessary actions that may ultimately lead to the removal of the validation certificate from the active list. The CMVP, working with NVLAP, the CSTL accrediting body, will also investigate the CSTLs testing methodologies and follow up with necessary corrective action.

See related information in the FIPS 140-3 Management Manual "Historical or Revoked Validations".

General correspondence to the NIST CMVP is sent to: cmvp@nist.gov.

Module and compliance specific questions should be discussed between the vendor and labs (CSTLs). If further clarification is needed, please follow Section "2.5 Request for Guidance from CMVP" of the FIPS 140-3 CMVP FIPS 140-3 Management Manual that describes how to submit a Request for Guidance (RFG). In order to support a faster response to your inquiry, please submit non-proprietary RFGs in lieu of proprietary RFGs whenever feasible.  

To verify a cryptographic module, please visit Validated Modules.

When selecting a module from a vendor, verify that the application or product that is being offered is either a validated cryptographic module itself (e.g. VPN, SmartCard, etc) or the application or product uses an embedded validated cryptographic module (toolkit, etc). Ask the vendor to supply a signed letter stating their application, product or module is a validated module or incorporates a validated module, the module provides all the cryptographic services in the solution and reference the modules validation certificate number. The information on the CMVP validation entry can be checked against the information provided by the vendor and verified that they agree. If they do not agree, the vendor is not offering a validated solution. Each entry will state what version/part number/release is validated, and the operational environment (if applicable) the module has been validated. For a validated module that is a software or firmware module, guidance on how the module can be ported to similar operational environments while maintaining the validation can be found in the FIPS 140-2 Implementation Guidance or in the FIPS 140-3 Management Manual. 

The Basic search returns all the currently active validations starting with the most recent validation.    

The advanced search feature allows a user to search on specific fields related to the validation (e.g. module name, vendor name, certificate number, security level, FIPS standard).  

There are two methods to find the list of active modules.  The first method is select the Basic search which returns all active modules with the most recent validation appearing first.   

The second method is to select the Advanced search and select Validation Status: Active and select either Standard: FIPS 140-2 or FIPS 140-3 as applicable.  

Select Basic or Advanced search option and enter the Certificate number in the searchable field.  

Please note that the Validation Status defaults to the active list in this search.  The historical and revoked lists can also be selected.  

If a validation certificate is marked as  historical, this does not mean that the overall FIPS-140 certificate for this module has been revoked, rather it indicates that the certificate and the documentation posted with it is either more than 5 years old, or that it was moved to the historical list because of programmatic transitions. In these cases, the certificates have not been updated to reflect latest guidance and/or transitions and may not accurately reflect how the module can be used in FIPS/approved mode.  

For more detail, please visit Information About Historical Modules and related information in the FIPS 140-3 Management Manual.

If a validation certificate is marked as revoked, the module validation is no longer valid and may not be referenced to demonstrate compliance to the 140 standards.  

For more information on Revoked validations, please review related information in the FIPS 140-3 Management Manual.

Revoked modules can be located using the Advanced search function at Validated Modules. In the dropdown field for “Validation Status”, select Revoked and click on “Search” 

This list of the submitted modules is in the Modules In Process List. At the bottom of the list, there are two categories, "Displayed" and "Not Displayed", along with the totals for each.  Vendors have the option to exclude their modules from this list, and those excluded modules are categorized under "Not Displayed".  

Currently, for FIPS 140-3 submissions, only the FS (full submission) and UPDT (update) scenarios are tracked on the MIP list.  See Section 7.1 of the CMVP Management Manual for a description of all the submission scenarios.

The various stages of the validation process are described at CMVP Validation Process.