CMVP Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

Schaffer, Kim

SP 800-140B (Draft)

Obsoleted on March 20, 2020 by SP 800-140B.

CMVP Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

Date Published: October 2019
Comments Due: December 9, 2019 (public comment period is CLOSED)
Email Questions to: sp800-140-comments@nist.gov

Author(s)

Kim Schaffer (NIST)

Announcement

NIST has released the following Draft NIST Special Publications (the SP 800-140x “subseries”) for public comment. They directly support Federal Information Processing Standards Publication (FIPS) 140-3, Security Requirement for Cryptographic Modules, and its associated validation testing program, the Cryptographic Module Validation Program (CMVP).

Draft SP 800-140, FIPS 140-3 Derived Test Requirements (DTR)
Draft SP 800-140A, CMVP Documentation Requirements
Draft SP 800-140B, CMVP Security Policy Requirements
Draft SP 800-140C, CMVP Approved Security Functions
Draft SP 800-140D, CMVP Approved Sensitive Parameter Generation and Establishment Methods
Draft SP 800-140E, CMVP Approved Authentication Mechanisms
Draft SP 800-140F, CMVP Approved Non-Invasive Attack Mitigation Test Metrics

Public comments are due December 9, 2019. Also see an overview of the transition to FIPS 140-3.

Abstract

NIST Special Publication (SP) 800-140B is to be used in conjunction with ISO/IEC 19790 Annex B and ISO/IEC 24759 6.14. The special publication modifies only those requirements identified in this document. SP 800-140B also specifies the content of the tabular and graphical information required in ISO/IEC 19790 Annex B. As a validation authority, the Cryptographic Module Validation Program (CMVP) may modify, add, or delete Vendor Evidence (VE) and/or Test Evidence (TE) specified under paragraph 6.14 of the ISO/IEC 24759 and specify the order of the security policy as specified in ISO/IEC 19790:2012 B.1.

Keywords

Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 2759; testing requirement; vendor evidence; vendor documentation; security policy

Control Families

None selected

Documentation

Publication:
Draft SP 800-140B

Supplemental Material:
None available

Other Parts of this Publication:
SP 800-140 (Draft)
SP 800-140A (Draft)
SP 800-140C (Draft)
SP 800-140D (Draft)
SP 800-140E (Draft)
SP 800-140F (Draft)

Document History:
10/09/19: SP 800-140B (Draft)
03/20/20: SP 800-140B (Final)

Topics

Security and Privacy
cryptography; testing & validation