Cryptographic Module Validation Program

Cryptographic Module Validation Program
Name	Cryptographic Module Validation Program
Abbreviation	CMVP
Formed	1995
Jurisdiction	United States
Parent agency	National Institute of Standards and Technology
Key people	National Security Agency
Website	https://csrc.nist.gov/projects/cryptographic-module-validation-program

Cryptographic Module Validation Program. It is a joint effort between the National Institute of Standards and Technology and the National Security Agency to validate cryptographic modules against established standards. The program provides federal agencies and regulated industries with assurance that commercial products meet stringent security requirements. Validation under this framework is often a mandatory prerequisite for use in protecting sensitive government and financial information.

Overview

Established in the mid-1990s, the program operates under the authority of the Federal Information Security Management Act and related directives. Its primary governing document is FIPS 140, a standard that specifies security requirements for cryptographic modules. The Computer Security Division within NIST manages the program's day-to-day operations and public-facing components. Independent, accredited laboratories conduct the testing, which is then reviewed by the validation bodies.

Validation process

The process begins when a vendor submits a cryptographic module to an accredited testing laboratory. These laboratories, which operate under the National Voluntary Laboratory Accreditation Program, perform rigorous conformance testing against the requirements of FIPS 140. The laboratory submits a detailed report to the CMVP Validation Authority, a joint body of experts from NIST and the NSA. Following a successful review, the module is listed on the official Validated Modules List, which is maintained publicly by NIST.

Security levels

The FIPS 140 standard defines four distinct security levels, offering increasing assurance. Level 1 provides basic security requirements, while Level 2 adds requirements for physical tamper-evidence and role-based authentication. Level 3 requires enhanced physical tamper-resistance and identity-based authentication, and is often sought for systems handling significant value. Level 4 provides the highest assurance, requiring rigorous environmental failure testing and comprehensive mitigation of attacks, making it suitable for physically unprotected environments.

Approved algorithms

Modules must implement cryptographic algorithms that are specified in other NIST standards. This includes symmetric block ciphers like the Advanced Encryption Standard and Triple DES, as well as asymmetric algorithms such as the Rivest–Shamir–Adleman cryptosystem and Elliptic-curve cryptography. Approved hash functions include those in the Secure Hash Algorithm family, and random number generators must meet standards outlined in NIST Special Publication 800-90. The use of deprecated algorithms, or those not yet approved, will result in a validation failure.

International recognition and agreements

The program's validation certificates are widely recognized internationally through mutual recognition agreements. Key arrangements include the Common Criteria Recognition Arrangement and specific agreements with Canada's CSE under the FIPS 140 Annex. This reciprocity allows validated products to be procured by governments like Australia's ASD and the UK National Cyber Security Centre without redundant testing. Such agreements facilitate global trade in security products and align with efforts by ISO/IEC JTC 1/SC 27 on international standards.

Impact and adoption

Validation is a de facto requirement for cryptographic products sold to the U.S. federal government, including agencies like the Department of Defense and the Internal Revenue Service. Its influence extends deeply into the private sector, particularly in regulated industries such as financial services, where standards from the Payment Card Industry Security Standards Council often reference it. Major technology firms, including IBM, Microsoft, and Cisco Systems, maintain extensive portfolios of validated modules. The program's rigor has significantly shaped the development, testing, and commercial success of information security products worldwide.

Category:Computer security Category:National Institute of Standards and Technology Category:Cryptography