Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As I understand it, NIST approves crypto algorithms but doesn't cover specific implementations. I think I've read about IEEE approving hardware implementations of, e.g. AES, but I can't think of any organization that performs an analogous function for software implementations of crypto algorithms.

Corollary/follow up question: There are many open-source, freely-available crypto libraries; are any of these standardized/approved by any kind of regulatory body?

share|improve this question
up vote 11 down vote accepted

Since 1995, NIST has indeed also certified implementations, via the Cryptographic Module Validation Program (CMVP) that validates cryptographic modules for adherence to FIPS 140 standards.

OpenSSL is open source and the OpenSSL FIPS Object Module has been validated via this program: OpenSSL: Important Notes about OpenSSL and FIPS 140-2.

The OpenSSL FIPS Object Module validation is unique among all FIPS 140-2 validations in that the product is "delivered" in source code form, meaning that if you can use it exactly as is and can build it (according to the very specific documented instructions) for your platform, then you can use it as validated cryptography on a "vendor affirmed" basis.

Note that, as they say, "it's complicated". So do check out those links carefully and be prepared for frustrating interactions between the technical and bureaucratic challenges.

share|improve this answer
+1. I'm pretty sure MS Windows' CryptoAPI was also certified thusly, and I think also the System.Security.Cryptography namespace classes in the .NET Framework. But I am not positive... – AviD Apr 20 '11 at 10:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.