NIST, Computer Security Division, Computer Security Resource Center
FIPS 140-3 PUB Development
Security Requirements for Cryptographic Modules
| FIPS 140-3 Development Status | |
|---|---|
|
TBD
|
FIPS 140-3 becomes effective after signature by DoC. FIPS 140-3 Derived Test Requirements is published. The CMVP can start receiving test reports for modules tested for conformance to FIPS 140-3. The CMVP will continue to accept test reports for modules tested for conformance to FIPS 140-2. |
|
TBD
|
FIPS 140-3 presented to the Secretary of the Department of Commerce for signature. |
|
11 Mar 2010
|
Public comment period for second draft of FIPS 140-3 will end. All comments to the Revised Draft FIPS 140-3 must be received on or before March 11, 2010; please use the template provided. |
|
11 Dec 2009
|
The Revised Draft of FIPS 140-3 is published at "CSRC" for public comments. This draft addresses the comments received on the first public draft posted in July 2007 and from the FIPS 140-3 Software Security Workshop held by NIST on March 18, 2008. A complete set of all comments received in response to the July 2007 FIPS 140-3 draft and NIST's responses to these comments may be accessed here. All comments to the Revised Draft FIPS 140-3 must be received on or before March 11, 2010; please use the template provided. |
18 Mar 2008 |
FIPS 140-3 Software Security Workshop |
12 Oct 2007 |
The public comment period for the first draft of FIPS 140-3 has closed. |
11 Oct 2007 |
Public comment period for first draft of FIPS 140-3 will end. |
13 Jul 2007 |
Announcing Public Draft of Federal Information Processing Standard (FIPS) 140-3 [PDF Draft: 07-13-2007], a revision of FIPS 140-2, Security Requirements for Cryptographic Modules. [Docket No. 070321067–7068–01] |
31 Mar 2007 |
First public draft of FIPS 140-3 has been completed. This draft is undergoing the standard NIST and DoC administrative review and release process. Once this process is complete, a Federal Register Notice will be published and the draft will be made available for a public review and comment. This page will be updated as soon as a date is known when this process is completed and it will be available. |
26 Sep 2005 |
Physical Security Testing Workshop held September 26-29, 2005. |
28 Feb 2005 |
Comments on new and revised requirements for FIPS 140-3 ended. |
12 Jan 2005 |
Announcing Development of Federal Information Processing Standard (FIPS) 140-3, a revision of FIPS 140-2, Security Requirements for Cryptographic Modules - [Docket No. 041217352-4352-01] |
Announcements
- Announcing FIPS 140-3 Revised DRAFT Security Requirements for Cryptographic Modules
A Federal Register Notice [Docket No. 070321067-91333-02] was published regarding a public comment period on the the Revised Draft of FIPS 140-3. The Revised Draft FIPS 140-3 is the second public draft of NIST’s proposed revision of FIPS 140-2. The Revised Draft was developed using the comments received on the first public draft, which was posted for public review and comment on July 13, 2007, and the FIPS 140-3 Software Security Workshop held on March 18, 2008. While the 2007 Draft proposed 5 levels of security, the Revised Draft FIPS 140-3 reverts to 4 levels of security as currently specified in FIPS 140-2. In contrast to the 2007 Draft, the Revised Draft also reintroduces the notion of firmware cryptographic module and defines the security requirements for it, limits the overall security level for software cryptographic modules to Security Level 2, and removes the formal model requirement at Security Level 4. Differences with the current FIPS 140-2 standard include limiting the overall security level for software cryptographic modules to Security Level 2, requirements for mitigation of non-invasive attacks at higher security levels, elimination of the requirement for formal modeling at Security Level 4, modified conditions for pre-operational/power-on self-tests, and strengthened integrity testing. All comments to the Revised Draft FIPS 140-3 must be received on or before March 11, 2010; please use the template provided. Written comments may be sent to: Chief, Computer Security Division, Information Technology Laboratory, Attention: Dr. Michaela Iorga, 100 Bureau Drive, Mail Stop 8930, National Institute of Standards and Technology, Gaithersburg, MD 20899-8930. Electronic comments may also be sent to: FIPS140-3@nist.gov, with "Comments on the Revised Draft FIPS 140-3" in the subject line.
- Announcing First Public Draft of Federal Information Processing Standard (FIPS) 140-3, a revision of FIPS 140-2, Security Requirements for Cryptographic Modules
A Federal Register Notice [Docket No. 070321067–7068–01] was published regarding a public comment period on the first public draft of FIPS 140-3. The comment period ends on October 11, 2007. Written comments may be sent to: Chief, Computer Security Division, Information Technology Laboratory, Attention: Dr. Allen Roginsky, 100 Bureau Drive—Stop 8930, National Institute of Standards and Technology, Gaithersburg, MD 20899–8930.
- Presentations and papers presented at the Physical Security Testing Workshop presented by the CMVP and IPA/Instac
- Announcing Development of Federal Information Processing Standard (FIPS) 140-3, a Revision of FIPS 140-2, Security Requirements for Cryptographic Modules
A Federal Register Notice [Docket No. 041217352-4352-01] was published regarding a public comment period on FIPS PUB 140-2 to provide input on the development of FIPS 140-3. The comment period ended February 28, 2005. NIST and CSEC are currently developing a draft document which will be submitted for public comment later this year. A detailed development schedule will be available shortly. As part of the development activity, NIST may hold public workshops addressing various sections of the proposed standard or as a whole. These will be posted as details become available.