Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old.

Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware security Module) is FIPS 140-2 Level 1 Compliant - does that mean it's automatically FIPS 140-1 Level 4 compliant? In other words does the lowest of level of FIPS 140-2 automatically cover the highest level of FIPS 140-1.

Can FIPS 140-1 and 140-2 together be considered a 8 step process from 140-1 Lev 1 to 140-2 Lev 4 - i.e. if you have covered step X, does that automatically mean covering all steps between 1 to X?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

The -1 or -2 part is a version number. A module that is FIPS-140-2-compliant is not more secure than a module that is FIPS-140-1-compliant, it is only more up-to-date in the certification process. The requirements for FIPS 140-1 level N and FIPS 140-2 level N are broadly similar. In other words, you get the same amount of security from FIPS 140-2 level 1 as from FIPS 140-1 level 1, and so on. There are 4 steps, not 8 — it's just that the requirements for climbing those steps were tweaked.

You can no longer have a product validated under FIPS 140-1, because it is no longer a current standard. I believe US agencies are still authorized to purchase products based on a FIPS 140-1 certificate, with the same level requirements as for FIPS 140-2 certifications.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.