Cryptographic Module Validation Program CMVP

On July 17, 1995, the National Institute of Standards and Technology (NIST) established the CMVP to validate cryptographic modules to Federal Information Processing Standards (FIPS) 140-1 Security Requirements for Cryptographic Modules, and other FIPS cryptography-based standards. FIPS are standards for federal computer systems that are developed by the National Institute of Standards and Technology (NIST) and approved by the Secretary of Commerce in accordance with the Information Technology Management Reform Act of 1996 and Computer Security Act of 1987.

FIPS 140-1, Security Requirements for Cryptographic Modules, was published on January 11, 1994. FIPS 140-2, Security Requirements for Cryptographic Modules, was released on May 25, 2001, and superseded FIPS 140-1. On March 22, 2019, FIPS 140-3, Security Requirements for Cryptographic Modules, was published and superseded FIPS 140-2.

The CMVP is a joint effort between NIST and the Canadian Center for Cyber Security (CCCS) of the Government of Canada. Modules validated as conforming to either FIPS 140-2 or FIPS 140-3 are accepted by the Federal Agencies of both countries for the protection of controlled unclassified information. Vendors of cryptographic modules use independent, accredited Cryptographic and Security Testing Laboratories (CSTLs) to test their modules.

FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies. Agencies must use cryptographic-based security systems to provide adequate information security for all operations and assets as defined in 15 U.S.C. § 278g-3. Additionally, cryptographic modules must meet the requirements outlined in the FIPS 140 standards in order to comply with the FISMA mandate.

Non-validated cryptography is viewed as providing no protection to the information or data—in effect the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 or FIPS 140-3 is applicable. In essence, if cryptography is required, then it must be validated.

Please visit FIPS 140-2 Management Manual and FIPS 140-3 Management Manual.

First, become familiar with the FIPS requirements and the CMVP - a brief description of each is provided in the "What is the history of the FIPS 140 standards and the most current version?" and "What is the purpose of the CMVP?" FAQs above.

The CMVP website provides an overview of the CMVP and how the CMVP addresses the needs of U.S. and Canadian governments.

Please visit "FIPS Validation and Updates, Patches, and CVEs" in the CMVP Process Flow webpage.

A flowchart listing the steps to obtain a module validation.

The role of the CST Laboratories is to test the cryptographic module against all applicable requirements as specified in FIPS 140-2 or FIPS 140-3 and in the cryptographic algorithm standards and record the results. If a cryptographic module conforms to all the functional and assurance requirements as stated in the Derived Test Requirements, the CST laboratory submits a written report to the Validation Authorities. If a cryptographic module does not meet one (or more) requirements, the CST Laboratory will work with the vendor to resolve all discrepancies prior to resubmitting the validation package to the Validation Authorities.

Please visit Information on CST Lab Accreditation and Fees. Please be advised that the CSTLs charge a fee for the conformance testing. Fees may vary by laboratory. Please consult them directly to obtain fee information.

Please visit Testing Laboratories and NVLAP for the details.

Please visit NIST Cost Recovery Fees.

Yes, cryptographic algorithms approved for use in the modules must first be validated by the Cryptographic Algorithm Validation Program (CAVP), before submitting the module validation to the CMVP.

The role of the vendors is to design and produce cryptographic modules to comply with the functional and assurance requirements specified in the applicable standards. When a cryptographic module is ready for testing, the vendor submits the module and the associated documentation to one of the CSTLs for testing.

Work with an accredited CSTL to obtain conformance testing. To find a list of CSTLs, please visit NVLAP Program for Cryptographic Module Testing.

A user verifies that a cryptographic module they are considering purchasing has been validated and can verify this at Validated Modules. The user should consult the security policy for the cryptographic module to ensure that the module provides the security features that are required by the user.

Yes. A cryptographic module that has already been issued a FIPS 140-2 or FIPS 140-3 validation certificate may be incorporated or embedded into another product. The new product may reference the FIPS 140-2 or FIPS 140-3 validated cryptographic module so long as the new product does not alter the original validated cryptographic module. A product which uses an embedded validated cryptographic module cannot claim itself to be validated; only that it utilizes an embedded validated cryptographic module. In such case, vendors may use the phrase "FIPS 140-[2 or 3] Inside" (see Use of FIPS 140-3 or FIPS 140-2 Logo and Phrases webpage).

There is no assurance that a product is correctly utilizing an embedded validated cryptographic module – this is outside the scope of the FIPS 140-2 or FIPS 140-3 validation.

Note, this FAQ is related to but different from guidance specified in: IG 1.A Binding and Embedding Cryptographic Modules.

A vendor may claim its product to be FIPS 140-3 "compliant" and use the phrase "FIPS 140-[2 or 3] Inside" (see Use of FIPS 140-3 or FIPS 140-2 Logo and Phrases webpage). FIPS 140-3 "compliant" means a vendor believes its product implementation meets the FIPS 140-3 requirements, but the product has not gone through the CMVP validation process. Having a validated product means that it has gone through independent testing conducted by an accredited CSTL and its testing is verified by the CMVP. A validated product will have a CMVP issued certificate number.

The CMVP will review the information provided for technical merit and specificity. If the information provides specific technical characteristics that appear to question conformance issues of a validated module, the CMVP will sanitize the information and forward it to the Cryptographic Security Testing Laboratory (CSTL) responsible for the module’s compliance testing. The CSTL will review the information for accuracy and merit. If the provided information appears to surface a non-compliance issue, the CSTL and CMVP will review and confirm the non-compliance. Based on the nature of the non-compliance, the CMVP will take necessary actions that may ultimately lead to the removal of the validation certificate from the active list. The CMVP, working with NVLAP, the CSTL accrediting body, will also investigate the CSTLs testing methodologies and follow up with necessary corrective action.

See related information in the FIPS 140-3 Management Manual "Historical or Revoked Validations".

Any non-validated applications subsequently loaded and executed within a FIPS 140-2 or FIPS 140-3 validated cryptographic module invalidates the original validation.

Please visit our websites, CMVP FIPS 140-3 Standards, and SP 800-140 Series Supplemental Information.

Please visit FIPS 140-3 IG Announcements.

Please visit FIPS 140-3 Resources.

General correspondence to the NIST CMVP is sent to: [email protected].

Module and compliance specific questions should be discussed between the vendor and labs (CSTLs). If further clarification is needed, please follow Section "2.5 Request for Guidance from CMVP" of the FIPS 140-3 CMVP FIPS 140-3 Management Manual that describes how to submit a Request for Guidance (RFG). In order to support a faster response to your inquiry, please submit non-proprietary RFGs in lieu of proprietary RFGs whenever feasible.

Please visit Programmatic Transitions.

No, neither the CAVP nor the CMVP tests the industry protocol’s compliance to the applicable industry standard, but their underlying approved algorithms are tested to the applicable algorithm standards by the CAVP and incorporated into services that are part of the CMVP validation.

The correct the term is validated. If a vendor is making a claim of compliance, conformance or certification to the FIPS 140 standards, request the associated validation certificate number. For a list of all the CMVP validated modules, please visit Validated Modules.

To verify a cryptographic module, please visit Validated Modules.

When selecting a module from a vendor, verify that the application or product that is being offered is either a validated cryptographic module itself (e.g. VPN, SmartCard, etc) or the application or product uses an embedded validated cryptographic module (toolkit, etc). Ask the vendor to supply a signed letter stating their application, product or module is a validated module or incorporates a validated module, the module provides all the cryptographic services in the solution and reference the modules validation certificate number. The information on the CMVP validation entry can be checked against the information provided by the vendor and verified that they agree. If they do not agree, the vendor is not offering a validated solution. Each entry will state what version/part number/release is validated, and the operational environment (if applicable) the module has been validated. For a validated module that is a software or firmware module, guidance on how the module can be ported to similar operational environments while maintaining the validation can be found in the FIPS 140-2 Implementation Guidance or in the FIPS 140-3 Management Manual.

Please visit Validated Modules.

The Basic search returns all the currently active validations starting with the most recent validation.

The advanced search feature allows a user to search on specific fields related to the validation (e.g. module name, vendor name, certificate number, security level, FIPS standard).

This module meets the requirements of either the FIPS 140-2 or FIPS 140-3 standard as annotated on the CMVP validation entry. This is the default status for all newly validated modules.

FIPS 140-1 validated modules are no longer on the active list. FIPS 140-2 validated modules will remain on the active list through September 21, 2026. On September 22, 2026, only FIPS 140-3 module validations will remain on the active list.

There are two methods to find the list of active modules. The first method is select the Basic search which returns all active modules with the most recent validation appearing first.

The second method is to select the Advanced search and select Validation Status: Active and select either Standard: FIPS 140-2 or FIPS 140-3 as applicable.

Select Basic or Advanced search option and enter the Certificate number in the searchable field.

Please note that the Validation Status defaults to the active list in this search. The historical and revoked lists can also be selected.

If a validation certificate is marked as historical, this does not mean that the overall FIPS-140 certificate for this module has been revoked, rather it indicates that the certificate and the documentation posted with it is either more than 5 years old, or that it was moved to the historical list because of programmatic transitions. In these cases, the certificates have not been updated to reflect latest guidance and/or transitions and may not accurately reflect how the module can be used in FIPS/approved mode.

For more detail, please visit Information About Historical Modules and related information in the FIPS 140-3 Management Manual.

Historical modules can be located at Validated Modules, using the Advanced search function. In the dropdown field for "Validation Status", select Historical, and click on "Search".

If a validation certificate is marked as revoked, the module validation is no longer valid and may not be referenced to demonstrate compliance to the 140 standards.

For more information on Revoked validations, please review related information in the FIPS 140-3 Management Manual.

Revoked modules can be located using the Advanced search function at Validated Modules. In the dropdown field for "Validation Status", select Revoked and click on "Search"

The Sunset date indicates the date that the module will be removed from the active list. Being removed from the active list indicates that the certificate and the documentation posted with it is more than 5 years old, no longer meets the current guidance, or failed to meet the new requirements of a programmatic transition. For more detail, please visit Validated Modules.

It is important to note that validation certificates are issued for cryptographic modules. A module may either be an embedded component of a product or application, or a complete product in and of itself. If the cryptographic module is a component of a larger product or application, one should contact the product or application vendor in order to determine what products utilize an embedded validated cryptographic module. There are inevitably a larger number of security products available which use a validated cryptographic module than the number of modules which are found in this list. In addition, it is possible that other vendors, who are not found in this list, might incorporate a validated cryptographic module from this list into their own products.

This list of the submitted modules is in the Modules In Process List. At the bottom of the list, there are two categories, "Displayed" and "Not Displayed", along with the totals for each. Vendors have the option to exclude their modules from this list, and those excluded modules are categorized under "Not Displayed".

Currently, for FIPS 140-3 submissions, only the FS (full submission) and UPDT (update) scenarios are tracked on the MIP list. See Section 7.1 of the CMVP Management Manual for a description of all the submission scenarios.

The various stages of the validation process are described at CMVP Validation Process.

The IUT list is provided as a marketing service for vendors who have a viable contract with an accredited laboratory for the testing of a cryptographic module, and the module and required documentation is resident at the laboratory. Inclusion on this list is voluntary. The CMVP does not have detailed information about the specific cryptographic module or when the test report will be submitted to the CMVP for validation. When the lab submits the test report to the CMVP, the module will transition from the IUT list to the MIP list. If you would like more information about a specific cryptographic module or its schedule, please contact the vendor.

Please visit Implementation Under Test List.

Please visit Entropy Validations.

Please visit Entropy Source Validation Search.

Guidance on Use of FIPS 140-2 and FIPS 140-3 Logo.

Please complete the FIPS 140-2 or FIPS 140-3 logo form located at the link above and submit the completed form to [email protected]. Please note that the FIPS 140 logos are a trademark of NIST and improper usage will be reported.