What Is FIPS 140-3?

FIPS 140-3 is the current U.S. federal security standard for cryptographic modules. It defines requirements for the hardware, software, firmware, or combinations of these components that perform cryptographic functions such as encryption, digital signing, authentication, and key management.

For organizations selecting cryptographic technology, FIPS validation confirms that a defined module has completed laboratory testing and Cryptographic Module Validation Program (CMVP) review against the applicable security requirements. FIPS 140-3 superseded FIPS 140-2.

Understanding that transition, the four FIPS security levels, and the scope of a validation can help security and procurement teams determine which evidence applies to a new deployment or an existing system.

FIPS stands for Federal Information Processing Standards. FIPS 140 establishes security requirements for cryptographic modules used in cryptographic-based security systems that protect sensitive information.

A cryptographic module is not necessarily a standalone hardware device. FIPS 140-3 can apply to hardware, software, firmware, or hybrid modules within a defined cryptographic boundary. The standard addresses 11 security areas, including module interfaces, authentication, software and firmware security, physical security, sensitive security parameter management, self-tests, and lifecycle assurance.

Validation is managed through the Cryptographic Module Validation Program, jointly operated by the National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security. Independent accredited laboratories test cryptographic modules, and CMVP reviews the resulting submissions before issuing validations for modules that meet the applicable requirements.

FIPS 140-3 is the standard, while CMVP is the program through which cryptographic modules are validated against it. Although the process is sometimes called FIPS certification, validation is the formal CMVP term.

For a broader look at how FIPS relates to other security standards, certifications, and validation frameworks, see Security Certifications and Standards.

FIPS 140-3 superseded FIPS 140-2, but the change did not replace the four-level model or fundamentally change the purpose of cryptographic module validation. One of the most significant differences is how the requirements and testing framework are organized.

FIPS 140-2 contained cryptographic module requirements within the standard itself. FIPS 140-3 references ISO/IEC 19790 for cryptographic module security requirements and ISO/IEC 24759 for testing requirements. NIST's SP 800-140 series and CMVP Implementation Guidance provide additional program-specific requirements and interpretations.

The transition from FIPS 140-2 to 140-3 also updated requirements and testing approaches across areas such as authentication, physical and non-invasive security, self-tests, and lifecycle assurance. NIST notes, however, that relatively few of the changes represent major new technical requirements; much of the transition involved changes to the program and validation process.

Buyers should use the validation record and associated security policy to confirm the applicable standard, module version, security level, configuration, and approved operating conditions.

FIPS 140-3 became effective on Sept. 22, 2019, and CMVP began accepting FIPS 140-3 submissions on Sept. 22, 2020. New FIPS 140-2 validation submissions were subsequently phased out as the program transitioned to the newer standard.

On Sept. 21, 2026, all remaining Active FIPS 140-2 certificates moved to CMVP's Historical List, completing the program's transition away from Active FIPS 140-2 validations.

Historical status does not mean every existing FIPS 140-2 deployment must be replaced immediately. NIST allows Historical FIPS 140-2 modules to continue to support existing systems under its transition policy. New systems should be planned around current FIPS 140-3 validations and the requirements that apply to the deployment.

For organizations still using FIPS 140-2 technology, the practical question is whether the module supports an existing system or is being considered for a new deployment or technology refresh. Procurement requirements, customer contracts, agency policies, and other security requirements may also affect when migration is needed.

FIPS 140-3 defines four increasing qualitative security levels, from Level 1 through Level 4. These levels apply across the standard's security requirement areas and suit a range of applications and threat environments.

Level 1
Level 1 establishes the baseline requirements for a FIPS 140-3 cryptographic module. It can be appropriate where validated cryptography is required without the additional protections introduced at higher security levels.

Level 2
Level 2 adds requirements beyond the baseline. For applicable hardware modules, these include stronger physical protections such as evidence of tampering, alongside higher requirements in applicable security areas.

Level 3
Level 3 adds stronger protections in applicable areas, including physical security and protection of sensitive security parameters. It can be relevant where stronger physical security and protection of sensitive security parameters are required, but it is not a universal requirement for every deployment.

Level 4
Level 4 is the highest overall FIPS 140-3 security level. It introduces additional requirements intended for modules operating in especially demanding threat environments, including stronger protections against physical and environmental attacks.

A higher overall security level is not automatically the right choice for every system. The Canadian Centre for Cyber Security advises purchasers that a module's overall level may be less important than the ratings in the individual security areas that matter to a particular architecture or requirement.

The appropriate level should therefore be determined by the agency, customer, regulatory, contractual, or procurement requirements governing the deployment.

FIPS validation applies to a defined cryptographic module and its validation boundary. It does not automatically extend to every product, system, configuration, or operating mode in which that module may be used.

1. Define the cryptographic module and validation boundary: The vendor identifies the hardware, software, firmware, interfaces, and other components included in the module being evaluated.
2. Engage an accredited testing laboratory: An appropriately accredited Cryptographic and Security Testing Laboratory evaluates the module for the CMVP process.
3. Prepare the required documentation: The vendor provides technical evidence, including a non-proprietary security policy describing the module and how it meets the applicable requirements.
4. Complete laboratory testing: The laboratory tests the module against the applicable FIPS 140-3, ISO/IEC, and CMVP requirements.
5. Submit the results to CMVP: The laboratory submits the test report and supporting package for government review.
6. Complete CMVP review: CMVP reviews the submission and, when the applicable requirements have been satisfied, issues the validation and lists the module.
7. Deploy within the validated conditions: Users should confirm that the hardware, firmware, configuration, and approved mode used in production match the conditions covered by the validation.

A product can contain a FIPS-validated cryptographic module without every product configuration or operating mode falling within the validated conditions. Buyers should therefore review both the CMVP validation record and the module's non-proprietary security policy.

Those sources identify details such as the validated module and version, security levels, tested configurations, applicable caveats, and approved modes. The Canadian Centre for Cyber Security specifically recommends checking this information when selecting a CMVP-validated product.

Entrust nShield hardware security modules (HSMs) provide dedicated hardware for cryptographic processing and key protection.

Entrust nShield 5s hardware security modules are fully validated to FIPS 140-3 Level 3, available as a PCIe card for direct server installation, or embedded inside the nShield 5c range of network-attached HSM appliances. Full Level 3 operation depends on using the validated hardware and firmware in the approved FIPS configuration described in Entrust's product and certification documentation.

Entrust nShield 5 validation and certification information

The nShield 5 family also provides a migration path for organizations modernizing earlier nShield environments. Entrust designed nShield 5 around the same Security World architecture used by previous nShield generations, allowing nShield 5 HSMs to work alongside existing nShield environments and supporting transition from earlier nShield Solo XC and nShield Connect XC HSM deployments.

Entrust nShield Solo XC and Connect XC HSMs retain their FIPS 140-2 Level 3 validations, which are now listed in CMVP's Historical List. Entrust nShield 5s and nShield 5c are validated to FIPS 140-3 Level 3 for deployments where a current FIPS 140-3 validation is required.

Organizations planning an HSM refresh should verify the exact validation status, hardware, firmware, configuration, and operating mode required for their deployment using Entrust's current validation documentation.

Explore nShield HSMs