The NIST Cryptographic Algorithm Validation Program (CAVP) provides validation testing of Approved (i.e., FIPS-approved and NIST-recommended) cryptographic algorithms and their individual components. Cryptographic algorithm validation is a prerequisite of cryptographic module validation.
Vendors may use any of the NVLAP-accredited Cryptographic and Security Testing (CST) Laboratories to test algorithm implementations.
An algorithm implementation successfully tested by a lab and validated by NIST is added to an appropriate validation list, which identifies the vendor, implementation, operational environment, validation date and algorithm details.
Tests
Currently, CAVP tests the following cryptographic algorithms*. Follow the links to algorithm specifications, validation testing requirements, validation lists and test vectors.
|
Block Ciphers
|
AES, Triple DES, Skipjack (decryption only)
Tests for ECB, CBC, CFB and OFB modes.
|
|
Block Cipher Modes
|
CCM, CMAC, GCM / GMAC / XPN, Key Wrap, XTS
|
|
Digital Signatures
|
FIPS 186-4: DSA, ECDSA, RSA
FIPS 186-2: DSA, ECDSA, RSA
|
|
Key Derivation Functions
|
KBKDF
|
|
Key Management
|
KAS
|
|
Message Authentication
|
HMAC (FIPS 198-1)
|
|
Random Number Generation
|
DRBG
|
|
Secure Hashing
|
SHA-2, SHA-1
SHA-3
|
|
Component Testing
|
ECC-CDH (SP 800-56A),
ECDSA Signature (FIPS 186-4),
KDF (SP 800-135),
RSA PKCS1-v1.5 RSASP1 (FIPS 186-4),
RSA PKCS1-vPSS RSASP1 (FIPS 186-4),
RSADP Decryption (SP 800-56B; PKCS#1 v2.1)
|
Other algorithm testing has been retired: DES, MAC, Skipjack (encryption only), and ANSI X9.17,RNG.
* Note: this table lists Approved algorithms that have tests available in both CAVS and ACVTS. Please refer to the CST Lab transition page for a list of testing available in ACVTS that is not in CAVS as well as other testing requirements during the transition period.
Relationship of Algorithm Validation to FIPS 140-2 Module Validation
A cryptographic module validated to FIPS 140-2 shall implement at least one Approved security function used in an Approved mode of operation. For an algorithm implementation to be listed on a cryptographic module validation certificate as an Approved security function, the algorithm implementation must meet all the requirements of FIPS 140-2 and must successfully complete the cryptographic algorithm validation process. However, a product or implementation does not meet the FIPS 140-2 module validation requirements by simply implementing an Approved security function and acquiring validations for each of the implemented algorithms. For more information, see the Cryptographic Module Validation Program.
Further Information
|
CAVP Management Manual
|
The CAVP Management Manual provides effective guidance for the CAVP Validation Authorities, CST laboratories, and vendors who participate in the program. It outlines the management activities and specific responsibilities of the various participating groups; however, it does not include any cryptographic standards. The manual may also interest consumers who acquire validated cryptographic modules and validated cryptographic algorithm implementations.
Last update: 06-24-2009
|
|
CAVP FAQ
|
The CAVP FAQ addresses many questions raised by the testing laboratories; it includes a section of general questions and sections for most of the tested algorithms. The FAQ addresses:
- interpretations of algorithm specifications;
- programmatic questions about the CAVP;
- the Cryptographic Algorithm Validation System (CAVS) tool; and
- information required during validation.
The FAQ is primarily intended for use by the testing labs. Vendors may also find the information useful when submitting their algorithms for testing.
Last update: 01-01-2016
|
|
How to access ACVTS
|
How to access to the ACVTS demonstration (Demo) and production (Prod) systems.
|
|
CST Lab Transition Page
|
Information to assist CST labs in the transition from CAVS to ACVP testing in FY 2020.
|
The CAVP was established in July 1995 by NIST and the Government of Canada's CCCS. CSD's Security Testing, Validation, and Measurement Group (STVMG) manages the validation testing of cryptographic modules and their underlying cryptographic algorithms through the CAVP and CMVP.
) or https:// don't prove our archive is authentic, only that you securely accessed it. Note that we are working to fix that :)
