If KDF testing is not performed, then the KDF must be listed as \u201cnon-compliant\u201d in your documentation, and the module\u2019s Security Policy must include a caveat that states that the associated protocol(s) cannot be used in an Approved mode of operation.<\/p>\n

This update applies to you if your candidate module is in the test lab now but has not yet been submitted to CMVP. If the module has already been submitted to CMVP, it will be validated under the previous rule.<\/p>\n

If you have not yet submitted your modules, take note! You\u2019ll be required to comply with the new guidance<\/strong>. Not every instance of this new change has been made clear as of this writing. For example, Corsec is in the process of determining the requirements for KDF testing on modules that use Open-SSL-based crypto engines, but we do know that similar efforts will be necessary for other open source-based libraries and other vendor-specific implementations.<\/p>\n