Cryptographic Algorithm Validation Program CAVP

 [09-30-15]--New release of the CAVS algorithm validation testing tool to the CST Laboratories (CAVS17.9). The following modifications have been made:

1. In RSADP, initialized testallconditions to TRUE.
2. Removed Dual ECDRBG.
3. Re-added testing for SHA1 for all digital signatures using SHA-1 for use with protocols.
4. Added affirmation check box required by IUT to assure that SHA1 with digital signature is being used for protocol use only. Also specified that these are protocols as specified by NIST protocol-specific guidance.
5. For HMAC-SHA256, when a MAC size of 24 Bytes was selected in the HMAC tab the TestedInfo.txt file shows a MAC size of 26 Bytes instead. This typo has been fixed.
6. For RSA2 FIPS 186-2 - Legacy PKCS PSS Signature Verification: the -Salt Value= line header was not being printed. The value was printed though on the same line as the salt length. (If the salt value was NULL, a zero was being adhered on the end of the salt length making it look like the salt length was multiplied by 10. (16 became 160) ) This has been corrected so it will look like this: Salt Length = 16. On next line it will say Salt Value = 0.
7. RSA2 FIPS 186-2 Key Gen testing - Was linked to - New Format code: so wouldn’t create files if New Format was not checked. New Format does not apply to FIPS 186-2 testing. This has been corrected to not need New Format checked. Only FIPS 186-2 Key Gen needs to be selected which brings up a window where information must be entered
8. Removed box around RSA mod 4096 as only allowed for revalidations because update to FPS 186-4 in future is going to put an explicit statement in these standards about allowing longer keys

The transition period ends December 30, 2015.

As has been the policy in the past:

1. EFFECTIVE IMMEDIATELYon any new validation requests for implementations of TDES, AES, SHA, RNG, HMAC, CCM, CMAC, DRBG 800-90A, Key Agreement Scheme (KAS) FFC, KAS ECC, GCM 800-38D, FIPS186-4 DSA, FIPS186-4 ECDSA, FIPS186-4 RSA, XTS, the ECC DLC Primitive Component, SP800-108 KDF, the KDFs in SP800-135, RSA Signature Generation Component testing for PKCS1.5 and/or PKCS PSS, the ECDSA2 Signature Generation Component, the RSADP component and/or SP 800-38F Key Wrapping, the CST lab must use the CAVS17.8 to validate the IUT.
2. For any algorithm validation request where a lab has used CAVS 17.8 to create files and has already sent the sample and request files to the vendor, NIST will accept validations using this tool up through December 30, 2015.
3. If there are any validation requests where a lab has used a version of CAVS that has not expired to create files and has not yet sent the appropriate files to the vendor, please regenerate everything using CAVS 17.9.

The CAVP will also review special conditions on a case-by-case basis.

[09-16-15] -- Updated ASKDFVS document.

[06-16-15] -- Removed statement "This requirement must be enforced at the module or product level." from TDES testing announcement posted 06-04-15. The statement should read "As always, even though guidance included in a NIST publication is not testable at the algorithm level, this does not mean it can be ignored."

[06-16-15]--New release of the CAVS algorithm validation testing tool to the CST Laboratories (CAVS17.8). CAVS 17.7 WILL NOT BE USED BECAUSE OF A MINOR BUG FIX. The following modification has been made:

1. Fixed error associated with RSA2 Key Gen Format labels.

The transition period ends September 16, 2015.

As has been the policy in the past:

1. EFFECTIVE IMMEDIATELY on any new validation requests for implementations of TDES, AES, SHA, RNG, HMAC, CCM, CMAC, DRBG 800-90A, Key Agreement Scheme (KAS) FFC, KAS ECC, GCM 800-38D, FIPS186-4 DSA, FIPS186-4 ECDSA, FIPS186-4 RSA, XTS, the ECC DLC Primitive Component, SP800-108 KDF, the KDFs in SP800-135, RSA Signature Generation Component testing for PKCS1.5 and/or PKCS PSS, the ECDSA2 Signature Generation Component, the RSADP component and/or SP 800-38F Key Wrapping, the CST lab must use the CAVS17.8 to validate the IUT.
2. For any algorithm validation request where a lab has used CAVS 17.6 to create files and has already sent the sample and request files to the vendor, NIST will accept validations using this tool up through September 16, 2015.
3. For any algorithm validation request where a lab has used CAVS 17.7 to create files, please regenerate everything using CAVS 17.8.
4. If there are any validation requests where a lab has used a version of CAVS that has not expired to create files and has not yet sent the appropriate files to the vendor, please regenerate everything using CAVS 17.8.

The CAVP will also review special conditions on a case-by-case basis.

[06-16-15]--New release of the CAVS algorithm validation testing tool to the CST Laboratories (CAVS17.7). The following modifications have been made:

1. RSA2 - Reports of non prime numbers were found in the CAVS test value files when all the numbers should have been prime. The reason was discovered and was corrected. It was caused by more than one error code being assigned to distinguish between different types of errors but only one error code (FAILURE) being processed.
2. RSA2 - Function C.9 has RSA_BAD800_90 error code if genRand800-90 fails. Changing this to FAILURE so only has one error code returned from Function C.9.
3. RSA2 - Added error message to be printed in fax file if PGENCOUNTERMAXFAIL occurs .
4. RSA2 - when any error happens restart the keygen process from the beginning. This is done by adding: while stat != SUCCESS continue- to SigVer931_gen and SigVerPKCS_PSS_gen.
5. RSA2 186-2 Key Gen - Summary file was not recognizing if only mod 2048 selected. This has been corrected.
6. RSA2 186-2 KeyGen - Fixed error in printing out Summary file. Caused when: fixed e was selected.
7. ECDSA2 - If select SigGen and SigGenComponent check boxes, but then uncheck SigGen, when save it would recheck the SigGen button. This has been corrected.
8. ECDSA2 - The prerequisite numbers were being displayed as huge numbers. This has been corrected to display 0 until a value is entered.
9. RSA KeyGen - RSA2 186-4 KeyGen- Added the ability to test with either KeyGen format (the old format or the new format (See Announcement 7/10/14)) using the same CAVS tool.

The transition period ends September 16, 2015.

As has been the policy in the past:

1. EFFECTIVE IMMEDIATELY on any new validation requests for implementations of TDES, AES, SHA, RNG, HMAC, CCM, CMAC, DRBG 800-90A, Key Agreement Scheme (KAS) FFC, KAS ECC, GCM 800-38D, FIPS186-4 DSA, FIPS186-4 ECDSA, FIPS186-4 RSA, XTS, the ECC DLC Primitive Component, SP800-108 KDF, the KDFs in SP800-135, RSA Signature Generation Component testing for PKCS1.5 and/or PKCS PSS, the ECDSA2 Signature Generation Component, the RSADP component and/or SP 800-38F Key Wrapping, the CST lab must use the CAVS17.7 to validate the IUT.
2. For any algorithm validation request where a lab has used CAVS 17.6 to create files and has already sent the sample and request files to the vendor, NIST will accept validations using this tool up through September 16, 2015.
3. If there are any validation requests where a lab has used a version of CAVS that has not expired to create files and has not yet sent the appropriate files to the vendor, please regenerate everything using CAVS 17.7.

The CAVP will also review special conditions on a case-by-case basis.

[06-04-15]--On February 5, 2015, guidance was posted indicating that there was going to be a change in the TDES algorithm validation testing to support the statement in NIST SP 800-67 Revision 1, dated January 2012 - A key bundle shall not consist of three identical keys. Phase 1 of this guidance was completed and is included in CAVS 17.5 which was released March 4, 2015. This included:

1. Removing the radio button to select Keying Option 3;
2. Modifying the Monte Carlo and MMT validation tests to remove the use of Keying Option 3 (where K1=K2=K3).

It has been determined that Phase 2 of this guidance posted on February 5, 2015 will not be done. The use of a key bundle consisting of three identical keys in the Known Answer tests is used to test the underlying DES engine(s) in a TDES implementation. The values used for the key and the text for the second and third rounds of the TDES function must be controlled to assure that the targeted components of the TDES algorithm are being tested. The Known Answer test values for TDES, which are based on the Known Answer test values designed initially for DES, assure this. Therefore an implementation must have the ability to use a key bundle consisting of three identical keys for validation testing purposes.

The requirement: A key bundle shall not consist of three identical keys is not testable at the algorithm level. As always, even though guidance included in a NIST publication is not testable at the algorithm level, this does not mean it can be ignored.

[05-14-15]--Updated FIPS 186-4 RSA Test Vectors to include truncated SHA examples.

[05-14-15]--Updated FIPS 186-4 ECDSA Test Vectors to include truncated SHA examples.

[05-14-15]--Updated CAVP Frequently Asked Questions (FAQ) document.

[03-16-15]--New release of the CAVS algorithm validation testing tool to the CST Laboratories (CAVS17.6). The following modifications have been made:

1. SP800-135 - The screens for IKEv1 and IKEv2 were too short to hold all the information and therefore the information was being truncated. The screen length has been increased to show all the information.

The transition period ends June 16, 2015.

As has been the policy in the past:

1. EFFECTIVE IMMEDIATELYon any new validation requests for implementations of TDES, AES, SHA, RNG, HMAC, CCM, CMAC, DRBG 800-90A, Key Agreement Scheme (KAS) FFC, KAS ECC, GCM 800-38D, FIPS186-4 DSA, FIPS186-4 ECDSA, FIPS186-4 RSA, XTS, the ECC DLC Primitive Component, SP800-108 KDF, the KDFs in SP800-135, RSA Signature Generation Component testing for PKCS1.5 and/or PKCS PSS, the ECDSA2 Signature Generation Component, the RSADP component and/or SP 800-38F Key Wrapping, the CST lab must use the CAVS17.6 to validate the IUT.
2. For any algorithm validation request where a lab has used CAVS 17.5 to create files and has already sent the sample and request files to the vendor, NIST will accept validations using this tool up through June 16, 2015.
3. If there are any validation requests where a lab has used a version of CAVS that has not expired to create files and has not yet sent the appropriate files to the vendor, please regenerate everything using CAVS 17.6.

The CAVP will also review special conditions on a case-by-case basis.

[03-04-15] -- Modify TDES test vectors to remove Monte1 and MMT1 validation tests.

[03-04-15] -- Updated the SRTP section of The SP800-135 Validation System document.

[03-04-15]--New release of the CAVS algorithm validation testing tool to the CST Laboratories (CAVS17.5). The following modifications have been made:

1. New Information Added to Vendor/Implementation screen: This additional cryptographic algorithm testing information addresses how and by whom the algorithm testing was performed.
2. RSA2 - In the inf file the section for Legacy RSA information, the label had a space in the middle of it. The space has been removed. ( Legacy_PKCS#1_15SigVer had a space after it and before = or _mod or _SHA - ex. Legacy_PKCS#1_15SigVer _mod1024)
3. In GCM section of inf file moved Selected=True/False to first line of section. Now consistent with other sections.
4. In GCM section changed [AES GCM] to [GCM]. Code will accept both labels as input but will replace with only GCM for future. That way code will read older files created with other tool.
5. 800-135 SRTP - added ability to select subset of possible KDR values
6. 800-135 SRTP – wasn’t checking that 2^24 is supported when select all values. Corrected this
7. 800-135 SRTP - When verifying, assumed the given values from the request file were entered correctly so didn’t check their accuracy. I’ve changed this so it will detect differences between the given values and the values that should have been repeated exactly in the response file.
8. 800-135 SRTP - Modified Log file to be more descriptive.
9. ECDSA2 and ECDSA2SigGenComponent - In the inf file have these fields separated in the inf file since they get different validations (either ECDSA or Component). But when imported into the CAVS tool, they populate the same screen.
10. ECDSA2 SigGen verification of SHA512/224 and SHA512/256 - Was not verifying correctly thought it was SHA224 and SHA256. This has been corrected.
11. TDES - Removed Keying Option 3 (K1=K2=K3) from the screens
12. TDES - Removed the Keying Option 3 Monte Carlo and MMT tests from the suite of tests for TDES.
13. RSA - Added Legacy tests to the TestInfo.txt file. They were not being printed on the cover letter.
14. RSA2 - Key Gen Screen. Make it clear that the Fixed/Random key selection on the first screen is for all methods except Appx B.3.3
15. RSA2 - Key Gen Screen. When 186-2 Key Generation was selected, was forcing either random or fixed public key in the 186-4 part of the screen to be selected. This is not required in 186-2 Key Generation - just erroneously required one option to be selected but never used. This has been corrected.

The transition period ends June 4, 2015.

As has been the policy in the past:

1. EFFECTIVE IMMEDIATELYon any new validation requests for implementations of TDES, AES, SHA, RNG, HMAC, CCM, CMAC, DRBG 800-90A, Key Agreement Scheme (KAS) FFC, KAS ECC, GCM 800-38D, FIPS186-4 DSA, FIPS186-4 ECDSA, FIPS186-4 RSA, XTS, the ECC DLC Primitive Component, SP800-108 KDF, the KDFs in SP800-135, RSA Signature Generation Component testing for PKCS1.5 and/or PKCS PSS, the ECDSA2 Signature Generation Component, the RSADP component and/or SP 800-38F Key Wrapping, the CST lab must use the CAVS17.5 to validate the IUT.
2. For any algorithm validation request where a lab has used CAVS 17.4 to create files and has already sent the sample and request files to the vendor, NIST will accept validations using this tool up through June 4, 2015.
3. If there are any validation requests where a lab has used a version of CAVS that has not expired to create files and has not yet sent the appropriate files to the vendor, please regenerate everything using CAVS 17.5.
4. For new algorithm validations tested with CAVS17.5, please begin supplying the additional information concerning how and by whom the algorithm testing was performed. A new form is generated by the CAVS17.5 tool called the (foldername)TestingMethodInfo.txt. This page of information will be signed by the appropriate individuals depending on whom and where the testing was performed, will be scanned in as a pdf (like you currently do the official submission cover letter) and will be included in the cryptographic algorithm validation submission.

The CAVP will also review special conditions on a case-by-case basis.

[03-03-15]--Feedback from laboratories on the addition of this information can be found at Response from Labs for Collecting Testing Information.

[02-05-15] -- Change in TDES testing as of March 4, 2015 --NIST SP 800-67 Revision 1, dated January 2012 states in Section 3.1:

1. A TDEA key ....A key bundle shall not consist of three identical keys.

1. Currently the TDES algorithm validation testing, as discussed in SP800-20, uses Keying Option 3 (where K1=K2=K3) when testing Keying Option 1 and Keying Option 2. This has been removed from the Monte Carlo and the MMT tests. The request files Monte1.req and MMT1.req (where K1=K2=K3) will no longer be generated by CAVS and therefore won't be used in the testing of TDES implementations. Monte2.req, Monte3.req, MMT2.req and MMT3.req will still be generated and used for testing.
2. Because the Keying Option 3 is used in the testing of CAVS, currently implementations need to have the ability to accept a key bundle consisting of three identical keys in addition to supporting Keying Option 1 and/or Keying Option 2.
3. Over the next 3 months (by June 2015), the CAVS testing will not allow TDES implementions to accept a key bundle consisting of three identical keys. Implementations supporting key bundles consisting of three identical keys will not pass the TDES cryptographic algorithm validation testing.(See 6/4/15 Announcement)
4. The CAVP will be updating the TDES testing in the CAVS tool in stages to phase out the use of Keying Option 3.
5. Phase 1 (In CAVS 17.5) (NOTE THESE DO NOT REQUIRE ANY CHANGE IN IMPLEMENTATION DESIGN):
6. Remove the radio button to select Keying Option 3
7. Modify the Monte Carlo and MMT validation tests to remove the use of Keying Option 3 (where K1=K2=K3) in the testing
8. Phase 2 (Within three months (June 2015)):
9. Add validation testing that will assure that the TDES implementation does not allow three identical keys to be used as input.
10. Modify the known answer tests to remove the use of three identical keys in the tests.(See 6/4/15 Announcement)

[01-23-15] -- Announced that the CAVP will be adding additional requirements to the vendor/implementation information page to record how and by whom the algorithm testing was performed for this IUT along with some additional testing details.  This will replace the current requirements of this information in the CMVP Cryptik tool.