Cryptographic Module Validation Program

Overview

Welcome to the CMVP

The Cryptographic Module Validation Program (CMVP) is a joint effort between the National Institute of Standards and Technology under the Department of Commerce and the Canadian Centre for Cyber Security, a branch of the Communications Security Establishment. The goal of the CMVP is to promote the use of validated cryptographic modules and provide Federal agencies with a security metric to use in procuring equipment containing validated cryptographic modules.

Each Cryptographic and Security Testing Laboratories (CSTL) is an independent laboratory accredited by NVLAP. CSTLs verify each module meets a set of testable cryptographic and security requirements, with each CSTL submission reviewed and validated by CMVP.

CMVP accepted cryptographic module submissions to Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules until March 31, 2022. On April 1, 2022 the CMVP no longer accepted FIPS 140-2 submissions for new validation certificates except as indicated in the table below.

As of September 22, 2020, CMVP began validating cryptographic modules to Federal Information Processing Standard (FIPS) 140-3, Security Requirements for Cryptographic Modules.

^{Back to Top}

Applicability of Validated Modules

Modules validated as conforming to FIPS 140-2 will continue to be accepted by the Federal agencies of both countries for the protection of sensitive information (United States) or Designated Information (Canada) through September 21, 2026. After that time CMVP will place the FIPS 140-2 validated modules on the Historical list, allowing agencies to continue using these modules for existing systems only. Agencies should continue to make use of FIPS 140-2 modules until replacement FIPS 140-3 modules become available.

FIPS 140-3 submissions for validations are being accepted. Upon validation, modules will be placed on the Active list for 5 years and may be purchased for new and existing systems.

Status of CMVP validation effort

CMVP is experiencing a significant backlog in the validation process. Use of validated modules currently on the Active list is encouraged.

Updated - 06-15-2022
Date	Activity
September 22, 2020	CMVP accepts FIPS 140-3 submissions.
June 14, 2021	Last date CSTLs accepted contracts for FIPS 140-2 Scenario 5 and Scenario 3.
September 22, 2021	CMVP no longer accepts FIPS 140-2 submissions for new validation certificates unless the vendor is under contract with a CSTL prior to June 15, 2021, the CSTL has submitted an extension request, and the CSTL has received acceptance by the CMVP. However, CMVP continues to accept FIPS 140-2 reports that do not change the validation sunset date, i.e. Scenarios 1, 1A, 1B, 3A, 3B, and 4 as defined in FIPS 140-2 Implementation Guidance G.8.
October 1, 2021	Scenarios 2 and 1B submissions are no longer accepted.
April 1, 2022	CMVP only accepts FIPS 140-2 reports that do not change the validation sunset date, i.e. Scenarios 1, 1A, 3A, 3B, and 4 as defined in FIPS 140-2 Implementation Guidance G.8.
September 21, 2026	FIPS 140-2 active modules can be used until this date for new systems. After this date, FIPS 140-2 validation certificates will be moved to the Historical List.

^{Back to Top}

Use of Non-validated Cryptographic Modules by Federal Agencies and Departments

Non-validated cryptography is viewed by NIST as providing no protection to the information or data—in effect the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 or FIPS 140-3 is applicable. In essence, if cryptography is required, then it must be validated. Should the cryptographic module be revoked, use of that module is no longer permitted.

^{Back to Top}