FIPS 140-3

The foundational level requiring only approved algorithms and correct implementation. No physical security mechanisms are mandated beyond basic production-grade components.

• Approved algorithms only: AES, SHA, ECDSA, and other NIST-validated functions
• Software-only execution permitted on general-purpose hardware
• No physical tamper resistance required
• Example: A software library running encryption on a standard server
• Typical use case: Encrypting data at rest on a commodity operating system

Adds requirements for tamper-evident coatings or seals and enforces role-based authentication for operators. The module must provide visible evidence of any physical access attempt.

• Tamper-evident seals or pick-resistant coatings required on removable covers
• Role-based authentication: Operators must authenticate to assume a role (e.g., Crypto Officer vs. User)
• Software modules must run on an OS with Common Criteria EAL2 or equivalent
• Example: A PCIe HSM card with a breakable seal over the enclosure screws
• Typical use case: Enterprise key management appliances in a controlled data center

Requires hardened physical security that zeroizes critical security parameters upon detected intrusion. Identity-based authentication replaces simple role-based access.

• Tamper-resistant enclosure: Must resist probing and automatically zeroize all plaintext CSPs when tampering is detected
• Identity-based authentication mandatory—each operator has a unique identity
• Critical Security Parameters (CSPs) must be encrypted when exported and physically separated from logical access paths
• Example: A FIPS 140-3 Level 3 HSM that erases its master key if the chassis is opened
• Typical use case: Payment HSM in a PCI DSS environment or certificate authority root key protection

The highest assurance level, designed for operation in physically unprotected environments. The module must detect and respond to environmental anomalies that could compromise security.

• Environmental Failure Protection (EFP): Detects voltage and temperature fluctuations outside normal operating ranges and zeroizes CSPs immediately
• Complete envelope of protection: The entire cryptographic boundary must resist sophisticated physical attacks including fault injection
• Designed for field-deployed, unattended equipment where physical security cannot be guaranteed
• Example: A military-grade encryption module that self-destructs its key material if cooled below a threshold for a cold-boot attack
• Typical use case: Satellite communication cryptosystems, battlefield tactical radios, or ATM cash-dispensing modules in unguarded locations

FIPS 140-3 aligns with the international ISO/IEC 19790:2012 standard, introducing significant structural changes from its predecessor FIPS 140-2.

• ISO alignment: FIPS 140-3 is a profile of ISO/IEC 19790, enabling mutual recognition with international Common Criteria schemes
• Mandatory SP 800-56B compliance for RSA key transport, eliminating legacy padding schemes
• Non-invasive security testing is now explicitly required at all levels, not just Level 3 and 4
• Software/firmware security requirements are now defined in a separate standard (ISO/IEC 24759) and referenced normatively
• Self-tests expanded to include pairwise consistency tests for both signature generation and verification keys
• Transition deadline: All FIPS 140-2 certificates sunset on September 21, 2026, making migration mandatory for federal systems

The Cryptographic Module Validation Program (CMVP)—jointly run by NIST and the Canadian Centre for Cyber Security—validates modules against FIPS 140-3.

• Accredited laboratories: Testing is performed by 23 NVLAP-accredited CST laboratories (as of 2024)
• Algorithm validation prerequisite: All cryptographic algorithms must first receive CAVP certificates before module testing begins
• Documentation package: Vendors submit a security policy, finite state model, and source code for review
• Typical timeline: 9–18 months from submission to certificate issuance, depending on complexity and lab backlog
• Certificate lookup: All validated modules are listed on the NIST CMVP website with their exact operational configurations and security policy documents
• Revalidation triggers: Any hardware revision, firmware update affecting security, or algorithm change requires revalidation

An international standard (ISO/IEC 15408) for computer security certification that provides a framework for specifying security requirements and independently evaluating products. While FIPS 140-3 focuses specifically on cryptographic modules, Common Criteria addresses broader system security:

• Protection Profiles: Standardized security requirement sets
• Evaluation Assurance Levels (EAL1-EAL7): Increasing rigor of testing
• Mutual Recognition: Certificates recognized across 31 nations

Organizations often require both FIPS 140-3 and Common Criteria certification for defense and critical infrastructure deployments.

The security and privacy controls framework that mandates the use of FIPS 140-validated cryptography within U.S. federal information systems. Key control families include:

• SC-13: Cryptographic Protection — explicitly requires FIPS-validated modules
• SC-12: Cryptographic Key Establishment and Management
• SA-10: Developer Configuration Management

Sovereign AI infrastructure inherits these controls when deployed for government workloads, making FIPS 140-3 validation a prerequisite for federal contract compliance.

A prerequisite program that validates the correctness of individual cryptographic algorithms before a module can undergo FIPS 140-3 testing. The CAVP process:

• Tests algorithm implementations against NIST test vectors
• Issues separate certificates for each approved algorithm
• Covers AES, RSA, ECDSA, SHA-3, and DRBG implementations

A FIPS 140-3 certificate requires that all embedded cryptographic algorithms have valid CAVP certificates, establishing a two-tier validation hierarchy.

The international standard upon which FIPS 140-3 is directly based, harmonizing U.S. requirements with global cryptographic module evaluation criteria. The relationship includes:

• FIPS 140-3 adopts ISO/IEC 19790 as its normative core
• Adds NIST-specific annexes for U.S. government requirements
• Enables mutual recognition with other national schemes

This alignment allows module vendors to pursue both FIPS and international certifications with reduced duplicate testing effort.

A mandatory component of FIPS 140-3 testing that verifies the quality and unpredictability of random bit generation. Entropy sources must demonstrate:

• Min-entropy estimation: Statistical proof of randomness density
• Health tests: Continuous monitoring for entropy failure
• Independent testing: Per NIST SP 800-90B requirements

Weak entropy undermines all cryptographic operations. FIPS 140-3 requires validated entropy sources at all security levels, with Level 4 demanding the most stringent physical entropy verification.