[12-09-2015] -- Two-key TDEA transition, December 31, 2015
The Cryptographic Technology Group at NIST has confirmed the transition schedule for the Two-key TDEA provided in SP 800-131A. The CMVP will enforce the transition proactively. Accordingly, when the transition takes place the CMVP will proceed as follows:
Â
- Modules on the CMVP queue
- REVIEW PENDING or IN REVIEW: The laboratories/vendors will be asked to provide an updated submission that is fully compliant with the transition. Only compliant submission will be validated.
- COORDINATION: These module submissions will be handled like those in the REVIEW PENDING or IN REVIEW case.
- FINALIZATION: These module submissions will be handled like already validated modules.
Â
- 1/2/4 SUBs for validated modules on the CMVP Active Validation Lists: When an updated Security Policy is submitted it will be required to comply with the transition.
[Updated 7-1-2016][Updated 11-24-2015][Updated 11-10-2015][03-16-2015] -- X9.31 RNG transition, December 31, 2015
The Cryptographic Technology Group at NIST has confirmed the transition schedule for RNGs (e.g., the X9.31 RNG) provided in SP 800-131A. Accordingly, when the transition takes place the CMVP will proceed as follows:
The CMVP will move all Category 3 and 4 modules to a Legacy Validation List, effective January 31, 2016. The Legacy Validation List is not to be used for procurement by federal agencies. However, impacted vendors who can substantiate a hardship case as the result of this deadline are encouraged to contact the CMVP as early as possible. The CMVP will work with them to minimize the negative impact.
The CMVP will provide vendors with a voluntary process for updating Category 3 and 4 modules on the Legacy Validation List and reinstating them back on the Active Validation Lists:
Â
- Validated modules on the CMVP Active Validation Lists: The CMVP will classify the validations into four categories:
- Category 1: Modules with DRBG's only.
- Category 2: Modules without any DRBG's or RNG's.
- Category 3: Modules with DRBG's and RNG's.
- Category 4: Modules with RNG's only.
The CMVP will move all Category 3 and 4 modules to a Legacy Validation List, effective January 31, 2016. The Legacy Validation List is not to be used for procurement by federal agencies. However, impacted vendors who can substantiate a hardship case as the result of this deadline are encouraged to contact the CMVP as early as possible. The CMVP will work with them to minimize the negative impact.
The CMVP will provide vendors with a voluntary process for updating Category 3 and 4 modules on the Legacy Validation List and reinstating them back on the Active Validation Lists:
- 1SUB process: may be used to update the Security Policy and Certificate for modules without any module changes. After June 30, 2016, the CMVP will not accept 1SUBs to address the RNG transition.
- 1SUB-like process++: may be used to update modules with minimal changes. After June 30, 2016, the CMVP will not accept 1SUB-like submissions.
Â
- 3SUB and 5SUB process: may be used for more substantial module changes.
Â
- Modules on the CMVP queue
- REVIEW PENDING or IN REVIEW: The laboratories/vendors will be asked to provide an updated submission that is fully compliant with the transition. Only compliant submission will be validated.
- COORDINATION: These module submissions will be handled like those in the REVIEW PENDING or IN REVIEW case.
- FINALIZATION: These module submissions will be handled like already validated modules.
- 1/2/4 SUBs for validated modules on the CMVP Active Validation Lists: When an updated Security Policy is submitted it will be required to comply with the transition.
++[Note:To take advantage of the 1SUB-like process vendors shall work with an accredited CST laboratory. The laboratory shall follow the procedure below:
- The laboratory shall perform a Scenario 3 revalidation testing - see IG G.8.
- The laboratory shall submit a 3SUB documentation, including a rationale for why this submission should be treated as a 1SUB-like. The rationale should be directly related to the RNG transition, i.e. modules in Categories 3 and 4 above. The RNG transition-related changes include changing all instances where an old RNG is used with a call to the new DRBG and the corresponding updates to the power-on self-tests and applicable health and conditional tests. The submisstion should not include any other security updates and the rationale shall state this explicitly. If it does, then cost recovery shall apply.
- The CMVP will review the rationale and if accepted, NIST will waive the 3SUB cost recovery fee.
- The report review will follow the 3SUB review process, except that the module does not have to adhere to the latest guidance and a new validation certificate will not be created. The CMVP will make a reasonable effort to expedite the processing of these submissions but the actual speedup will depend on the quality of the submissions. ]
[08-12-2015] -- NIST requests comments on using the ISO/IEC 19790:2012 standard as the U.S. Federal Standard for cryptographic modules
NIST is seeking public comments on using International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) standards for cryptographic algorithm and cryptographic module testing, conformance, and validation activities, currently specified by Federal Information Processing Standard (FIPS) 140-2. The National Technology Transfer and Advancement Act (NTTAA), Public Law 104-113, directs federal agencies to adopt voluntary consensus standards wherever possible. The responses to this request for information will be used to plan possible changes to the FIPS or in a decision to use all or part of ISO/IEC 19790:2012 for testing, conformance and validation of cryptographic algorithms and modules. The Request for Information (RFI) posted in today’s Federal Register provides additional background, including seven questions that NIST is especially interested in having addressed, as well as NIST’s intentions.
Send public comments to: UseOfISO@nist.gov (also see the address for sending written comments)
Comment period closes: September 28, 2015.
**[Note: in the official RFI in the Federal Register Notice,
the link to the ISO site is incorrect; it should link to
http://www.iso.org/iso/catalogue_detail.htm?csnumber=52906 instead.]
[03-13-2015] -- The Third International Cryptographic Module Conference
The third annual International Cryptographic Module Conference will take place in November of this year. ICMC is a growing forum for global expertise in commercial cryptography. Industry leaders will convene November 4-6, 2015 in Hilton Washington, D.C., Rockville, MD to address the unique challenges faced by those who produce, use, and test cryptographic modules that conform with standards such as FIPS 140-2 and ISO/IEC 19790. Visit ICMC 2015 for complete information.