Organizations that already have a FIPS 140-2 validation may assume that their work is finished. After all, the product already went through a formal validation process, so why would another validation be necessary?

The answer is that FIPS 140-2 and FIPS 140-3 are different standards. FIPS 140-3 replaced FIPS 140-2 as the current standard for new validations and introduced updated requirements for evaluating cryptographic modules. With that and the looming FIPS 140-2 sunset date approaching, all vendors considering an approach for FIPS 140 will need to validate to the newest version of the publication.

This post is the fourth installment in our Deconstructing FIPS 140-3: 5 Myths and Realities series, where we examine common misconceptions surrounding FIPS validation and explain what organizations should understand before beginning the certification process.

Myth #4:

“Our product has a FIPS 140-2 validation, so we don’t need FIPS 140-3.”

At first glance, this assumption seems reasonable. If a product has already completed FIPS validation, it can be easy to think that the existing validation automatically carries over to the newer standard.

Reality:

A FIPS 140-2 validation does not automatically make a product FIPS 140-3 validated.

FIPS 140-2 was the standard used to validate cryptographic modules for many years. FIPS 140-3 is its successor and was developed to update the requirements and align the U.S. standard more closely with international standards.

While FIPS 140-3 builds on many of the concepts found in FIPS 140-2, it also includes updated requirements and changes to how cryptographic modules are evaluated. FIPS 140-2 and even FIPS 140-3 validations have a sunset date, traditionally 5 years. However, all remaining FIPS 140-2 validations will be automatically sunset on Sept. 21, 2026.

For vendors selling into the U.S. federal government, the CMVP states that all modules with a status designation of Historical “should not be included by Federal Agencies in new procurements.”

If an organization has already invested significant time and resources into obtaining a FIPS 140-2 validation, it is understandable to assume that the existing validation should be sufficient for the newer standard. However, a FIPS 140-2 certificate does not simply become a FIPS 140-3 certificate. The two standards have different requirements, and organizations need to understand what their existing validation means and what requirements apply to their specific product and use case.

Validation & Boundaries

If an organization has already invested significant time and resources into obtaining a FIPS 140-2 validation, it is understandable to assume that the existing validation should be sufficient for the newer standard. However, a FIPS 140-2 certificate does not simply become a FIPS 140-3 certificate. The two standards have different requirements, and organizations need to understand what their existing validation means and what requirements apply to their specific product and use case.

Another important consideration is that FIPS validation applies to a specific cryptographic module and its defined configuration. It is not a blanket certification that automatically covers every version or configuration of a product.

This means that when a product is updated or a new version is released, organizations need to understand whether those changes affect the scope of the existing validation. The fact that an earlier version was validated does not necessarily mean that a newer version has the same validation status.

Moving From One Standard to the Next

For organizations with an existing FIPS 140-2 validation, the transition to FIPS 140-3 does not necessarily mean starting from scratch. The existing validation can provide a useful foundation for understanding what may need to change.

Planning early can help organizations identify differences between their current FIPS 140-2 validation and the requirements of FIPS 140-3. This can help teams anticipate potential design, documentation, and testing impacts before beginning a new validation effort.

The Takeaway

Having a FIPS 140-2 validation is valuable, but it should not be confused with having a FIPS 140-3 validation. As organizations plan new products, product updates, or future validation efforts, understanding the differences between the two standards is an important first step.

FIPS validation is not simply a label that applies to every version of a product. The applicable standard, validated module, configuration, and current requirements all matter.

Understanding where your product stands today can help ensure that your next step is the right one.

Product vendors often rely on OpenSSL to meet FIPS 140 requirements.

However, with the new CMVP requirements and regulations, vendors using certain versions of the OpenSSL cryptographic library to meet FIPS 140-2/FIPS 140-3 requirements are in jeopardy of being out of FIPS compliance.

This update makes it crucial for vendors to understand the implications of FIPS 140-2/FIPS 140-3 certification and how to navigate the FIPS validation process.

FIPS 140-3 Compliance vs. FIPS 140-3 Validation: Key Differences

There is a substantial difference between stating your product meets FIPS compliance and being ‘FIPS 140-2 validated.’

FIPS Compliance

FIPS compliance refers to a product that has incorporated within its design another company’s cryptographic module that went through the complete FIPS validation process. While this may seem sufficient, it does not hold as much weight as achieving full FIPS 140-2/FIPS 140-3 validation.

FIPS 140-3 Validation

FIPS 140-2/FIPS 140-3 validation means a vendor has gone through the entire FIPS 140-2/FIPS 140-3 process and has received a certificate issued by the government for their specific product. This certificate signifies that the product meets legal requirements passed by Congress, as well as procurement requirements for the U.S. government and various industries, including healthcare, financial services, and critical infrastructure.

When considering the security of a product, every measure must be taken to ensure all entry and access points are secure and meet full government requirements. Choosing the FIPS compliance route covers only a portion of what truly needs to be protected. Achieving FIPS 140-3 validation means both you and the government are attesting to the security of the entire cryptographic module.

Why FIPS 140-3 Certification Matters

With the introduction of FIPS 140-2/FIPS 140-3, product vendors who previously relied on FIPS 140-2/FIPS 140-3 or FIPS compliance may find themselves out of step with the latest standards. The new set of requirements impacts not only those who have relied on a FIPS inside strategy but also affects other certifications such as Common Criteria and listing on the DoDIN APL.

The Risks of Non-Compliance

Modules that were once thought to have met FIPS compliance will soon be unprocurable and removed from the FIPS 140-2/FIPS 140-3 validated list. This will significantly impact product vendors who are unaware of these changes.

The FIPS 140-3 Process: Steps to Achieve Certification

Achieving FIPS 140-3 certification involves a comprehensive process, including:

1. Initial Assessment: Understanding the specific requirements for FIPS 140-3 and how they apply to your product.
2. Cryptographic Module Validation: Ensuring that your cryptographic module meets all FIPS 140-3 standards.
3. Documentation and Submission: Preparing and submitting the required documentation to the CMVP.
4. Government Evaluation: Your product undergoes a thorough evaluation by government bodies to ensure compliance.
5. Certification Issuance: Once your product passes all evaluations, a FIPS 140-3 certificate is issued, confirming its compliance.

The Role of FIPS 140-3 Validation Experts

Given the complexity of the FIPS 140-2/FIPS 140-3 process, working with FIPS validation experts is crucial. These experts can guide you through each step of the process, helping you avoid costly mistakes and ensuring your product meets all necessary standards.

Take Action Now

For help determining if and how your product will be affected by this change, contact us to ensure you avoid timely and costly delays, or worse, de-listing from the CMVP website. Our team of FIPS 140-2/FIPS 140-3 validation experts is ready to assist you.