Resolution on the CMVP’s FIPS 140 Queue

On Feb 21, 2024, the CMVP made a big announcement regarding modules which had been submitted for FIPS 140 validation: “Due to the issues caused by the queue length, the CMVP has made a decision to allow for provisional validation of FIPS 140-3 modules that were submitted prior to Jan 1, 2024.”

A Resolution and Path Forward

On May 24, 2024 the CMVP made an announcement on a course of action to address the issues raised on the previous announcement while still addressing the heart of the issues related to the FIPS 140-3 queue.  As part of the notice, there were significant changes:

• No report will be required to undergo interim validation or be updated to SP 800-140Br1 (a.k.a. Br1)
• The caveat language for the interim validation has been updated (request a copy of the caveat explanation)
• A limited set of revalidation scenarios for interim certificates will be accepted, including CVE, NSRL, VUP, and VAOE (see FIPS 140-3 MM 7.1 Submission Scenarios)
• The CMVP cannot commit to accepting Rebrands at this time and can’t guarantee that they will in the future
• Processing interim validation requests will begin on June 3, 2024

Proposed Process

The notice has defined the process the CMVP will follow as they move forward.  Below is text taken directly from the release:

1. We will continue to process reports that are “In Coordination” using current processes. Other than the interim validation path described below, 100% of our review time will be dedicated to completing these validations.
2. Once we begin processing interim validation requests (target date of June 3, 2024), we will work through the reports in queue order, processing interim validations for the reports as requested by the vendor. As a report hits the top of the queue, if interim validation is not selected, we will continue to the next interim report in the queue. As new interim validation requests are submitted after June 3, we will process them in the original submission queue order. We will continue this until we’ve processed all the reports requesting interim validation submitted prior to January 1, 2024.
3. When the interim reports and the reports in coordination have been completed (or at least waiting for the lab responses), we will, in queue order, begin work reviewing the reports that have not been selected for interim validation. At this time we cannot provide any specific timeline information for these reports or detail the exact approach we will take to get through the validation. Once we have completed the interim validations, we will need to see how many vendors select the interim validation option, how many select the Br1 option, and analyze and review our processes to date. We anticipate being able to provide updated timeline information at that time. There are two things we can say now related to the validation timeline for these reports:
   • The review process for reports in the Br1 format will take significantly less time.
   • The validation timeline for all the reports will be sooner than it would in the current situation.
4. After we have completed the initial queue-order processing of interim validations, we will continue to accept requests for interim validation until October 1, 2024. However, once we begin reviewing a report, whether in the current format or in the Br1 format, we will not accept an interim validation request.
5. To get through the queue and work through the processes above, we will need to reduce (but not eliminate) the time we spend on other CMVP activities including responding to status requests, RFGs, special process requests, etc.

What Is Next?

Corsec is working with the CMVP, Accredited Labs, and Product vendors to discuss the best path forward for each validation. If you have any questions or would like more information, please reach out directly.

Past Milestones of the CMVP’s Proposed Plan

Below are statistics on FIPS 140-2 and FIPS 140-3 government wait times based on an AWS Lambda monitoring project:

About FIPS 140-3

FIPS 140-3 is a joint effort by the National Institute of Standards and Technology (NIST) in the United States and the Communications Security Establishment Canada (CSEC), under the Canadian government. The Cryptographic Module Validation Program (CMVP), headed by NIST, provides module and algorithm testing for FIPS 140-3, which applies to Federal agencies using validated cryptographic modules to protect sensitive government data in computer and telecommunication systems. FIPS 140-3 provides stringent third-party assurance of security claims on any product containing cryptography that may be purchased by a government agency.

FIPS 140-3 is mandated by law in the U.S. and very strictly enforced in Canada. FIPS 140-3 has gained worldwide recognition as an important benchmark for third party validations of encryption products of all kinds. A FIPS 140 validation of a product provides end users with a high degree of product security, assurance, and dependability.