FIPS 140-3

FIPS 140-3 directly aligns with the international standard ISO/IEC 19790:2012, creating a unified testing framework. This replaces the divergent FIPS 140-2 standard, allowing vendors to achieve compliance with both U.S. and international requirements through a single, coherent evaluation process.

• Base Standard: Derives all core security requirements from ISO/IEC 19790.
• Global Recognition: Facilitates mutual recognition of certifications across borders.
• Consistency: Eliminates conflicting requirements between domestic and international markets.

A critical addition to the base ISO standard is the FIPS 140-3 Annex, which imposes mandatory software and firmware security requirements. This annex addresses modern attack vectors that were not covered by the older FIPS 140-2.

• Runtime Integrity: Requires self-tests to verify the integrity of executable code.
• Side-Channel Mitigation: Mandates protections against timing and power analysis attacks.
• Non-Modifiable Logic: Enforces that security functions cannot be altered post-validation.

FIPS 140-3 defines a tiered hierarchy of five security levels (Level 1 through Level 4, plus a new Level 5) for each of 11 functional requirement areas. This allows a module to be certified at different levels for different functions.

• Level 1: Basic encryption algorithm and production-grade component requirements.
• Level 2: Adds tamper-evidence coatings and role-based authentication.
• Level 3: Requires tamper-resistance and zeroization of critical security parameters on breach.
• Level 4: Demands environmental failure protection against voltage and temperature fluctuations.
• Level 5: A new level for non-physical modules, requiring runtime software protection.

FIPS 140-3 introduces explicit requirements for defending against non-invasive side-channel attacks. Unlike its predecessor, the standard mandates testing and documentation of countermeasures against attacks that observe a module's physical emissions without penetrating its enclosure.

• Timing Analysis: Must demonstrate resistance to key extraction via execution time measurement.
• Power Analysis: Requires mitigation of Simple Power Analysis (SPA) and Differential Power Analysis (DPA).
• Electromagnetic Emanations: Mandates testing for information leakage via radio frequency emissions.

The standard enforces a strict cryptographic algorithm lifecycle, formally deprecating legacy algorithms and mandating transitions to quantum-resistant primitives. This is enforced through the SP 800-140 series of implementation guidance documents.

• Deprecated Algorithms: Formally prohibits the use of SHA-1 and non-compliant random number generators.
• Transition Symmetry: Requires modules to support both current and next-generation algorithms during transition periods.
• Quantum Readiness: Establishes a framework for the eventual mandatory adoption of post-quantum cryptographic algorithms.

FIPS 140-3 mandates a comprehensive suite of pre-operational self-tests that must be executed automatically before any cryptographic service is made available. This ensures the module has not been corrupted and is functioning correctly.

• Known Answer Tests (KAT): Verifies the integrity of each approved algorithm by comparing output to a known correct value.
• Pairwise Consistency Tests: Validates the mathematical relationship between public and private keys for asymmetric algorithms.
• Firmware Integrity Test: Computes a cryptographic hash over the module's firmware and compares it to a stored, validated digest.

The international standard upon which FIPS 140-3 is directly based. It defines the security requirements for cryptographic modules across four increasing qualitative levels. FIPS 140-3 adopts this standard verbatim while adding U.S.-specific SP 800-140 series annexes for implementation guidance. This harmonization allows vendors to pursue joint CMVP and international CC validation, reducing redundant testing for global deployments.

Specifies the test methods used by accredited laboratories to validate cryptographic modules against ISO/IEC 19790. FIPS 140-3 mandates the use of this standard's procedures, replacing the legacy Derived Test Requirements (DTR) used under FIPS 140-2. This shift introduces a more rigorous, evidence-based testing methodology where vendors must supply comprehensive test evidence including design documentation, source code, and operational proofs.

The predecessor standard, FIPS 140-2, was published in 2001 and remained active for over two decades. NIST established a sunset timeline: FIPS 140-2 submissions were no longer accepted after September 22, 2021, and all existing FIPS 140-2 certificates will move to the Historical List by September 21, 2026. Organizations with deployed FIPS 140-2 modules must plan migration to FIPS 140-3 validated replacements before this deadline to maintain compliance posture.