The NIST Computer Security Division and the Communications Security Establishment Canada (CSEC) administer the CMVP. A FIPS 140-3 certified product usually consists of hardware and software/firmware included in an enclosure. Typically, an OEM integrates hardware and software/firmware cryptographic modules into the top-level cryptographic module, which then comprises the end product in an enclosure. Cryptographic modules use FIPS 140-3 approved algorithms, such as the advanced encryption standards (AES) or the Rivest Shamir Adleman (RSA) algorithm. The approved algorithm is certified in the CAVP.
In March 2019, the United States Department of Commerce approved the FIPS140-3 Security Requirements for Cryptographic Modules [REF 1] to succeed FIPS140-2 [REF 2]. FIPS140-3 represents the formal adoption of the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 19790:2012/Cor 1:2015 standard to replace FIPS 140-2. The ISO 24759:2017 standard serves as the derived testing requirements and the NIST Special Publication (SP) 800-140A-F series serves as the requirements for the CMVP. Clarifications and guidelines to the ISO are provided in the Implementation Guidance for FIPS 140-3 and the Cryptographic Module Validation Program [REF 3].
Vendors and OEMs obtain CAVP and CMVP certification using independent Cryptographic and Security Testing (CST) labs. The labs are accredited by the National Voluntary Laboratory Accreditation Program (NVLAP). The CMVP FIPS certification process typically takes 9–12 months. The certification process is expedited if the final cryptographic product consists of certified cryptographic algorithms and cryptographic modules. When a FIPS 140-3 certified algorithm is used in a cryptographic module, the OEM must make the case to the CST that the certified algorithm/module used is not modified.
The Zynq UltraScale+ MPSoC Security section describes security in Zynq UltraScale+ MPSoCs. FIPS 140-3 provides security requirements in areas such as cryptographic boundary, cryptographic ports, software/firmware security, physical security, key management roles, self-test, and services. In many cases, the FIPS 140-3 security requirement is in the domain of the OEM's top-level cryptographic module. The Zynq UltraScale+ MPSoC security functionality can be used to meet most of the module cryptographic requirements. However, additional protections (e.g., anti-tamper coatings) might be required outside of the Zynq device for module/system level certification.
The CMVP Overview section describes the four levels of security defined in FIPS 140-3. It also provides details on the Zynq UltraScale+ MPSoC’s functionality as it applies to the FIPS 140-3 security requirements. The CAVP Overview provides background information on the CAVP and shows certified cryptographic algorithms used in AMD FPGAs and in the Zynq UltraScale+ MPSoC.