Our laboratory is accredited by the National Institute of Standards and Technology (NIST) National Voluntary Laboratory Accreditation Program (NVLAP Laboratory Code 200968-0). We are accredited to perform FIPS 140-2, FIPS 140-3, Cryptographic Algorithm and Entropy Source Validation testing.
The FIPS 140-3 certification consists of the following steps:
-
A FIPS 140-3 workshop is usually performed by the laboratory either at a vendor’s site or remotely. The workshop covers all applicable FIPS 140-3 requirements as they apply to the vendor’s product.
-
The laboratory analyzes the product information obtained during the workshop and conducts a gap analysis to determine potential areas of non-compliance.
-
The vendor corrects deficiencies identified during the gap analysis phase, if any.
-
The vendor and the laboratory enter into a testing agreement for the testing of the product.
-
The vendor submits the product and the product documentation to the laboratory.
-
The laboratory works with the vendor to conduct the FIPS 140-3 testing of the product. The vendor addresses any deficiencies that are found during the testing.
-
Upon successful completion of the testing the laboratory submits the testing documents to CMVP. The set of testing documents submitted to CMVP includes: draft certificate, summary module description, detailed test report, nonproprietary security policy, and website information.
-
CMVP assigns reviewers to review the testing documents. CMVP reviewers review the testing documents and issue comments to the laboratory.
-
Additional testing may be conducted by the laboratory based on the CMVP comments. Laboratory may also request additional documentation from the vendor. The comments are resolved and the updated testing documents are resubmitted to CMVP.
-
Upon final resolution of validation review comments and submission of the final testing documents to CMVP, the Certificate number is assigned. Certificate printing and signature process is then initiated.
Entropy Source Validation Testing
All FIPS 140-3 module submission after January 1, 2023 for a module that uses SP 800-90B compliant entropy sources must include references to entropy certificate numbers for each entropy source.
All new SP 800-90B entropy validations must be performed using the ESV system, which upon the completion of a certify request and the review process, results in an entropy certificate number being issued for the completed validation.
The Entropy Validation Test System is the process by which we can submit all information around an entropy source to receive a validation. The ESV runs the SP 800-90B Entropy Assessment Tool on outputs provided by the entropy source to provide an entropy estimate. Additional documentation is needed to address the other requirements of SP 800-90B. This documentation is also submitted through ESV. When a validation certificate is requested, this information is sent to a CMVP reviewer to determine if the justification for conformance is sufficient.
Our laboratory is looking forward to performing the Entropy Source Validation Testing for your product.
