4

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it added to the FIPS certificate?

Improve this question

1 Answer 1

Reset to default
4

This is a bit of a guess, but on page 6 of the Derived Test Requirements for FIPS PUB 140-2, we have (emphasis mine):

Required Vendor Information

VE01.12.01: The vendor shall provide a validation certificate for all Approved cryptographic algorithms.

VE01.12.02: The vendor shall provide a list of all non-Approved security functions.

VE01.12.03: The vendor shall provide a list of all vendor affirmed security methods.

VE01.12.04: The vendor provided nonproprietary security policy shall include reference to all vendor affirmed security methods.

It sounds like, during a certification, they're breaking crypto implementations into 3 categories:

  1. Approved cryptographic algorithms: implementations that have already been certified (that you use internally). These will be excluded from the review.
  2. non-Approved security functions: if you really want to use MD5 or twofish, or some other non-FIPS crypto, you need to declare it. These will be excluded from the review.
  3. vendor affirmed security methods: things that the vendor claims conform to the spec, but have not yet been verified by NIST. Presumably this is what you are submitting for testing.

So as for your question:

Can I say my AES implementation as vendor affirmed and get it added to the FIPS certificate?

Of course! You are perfectly welcome to run your AES implementation through the CAVP and get it FIPS certified (if it passes, of course)

Improve this answer
2
  • I've seen security policies on NIST listings which reads like these. \n Approved Security Functions: AES #Cert 2321, AES #Cert 2322, AES Vendor affirmed etc. \n So the module has three approved AES implementations where two of them went through CAVP process and one is vendor affirmed. So it implies the third one is not ran through CAVP but still got to be in approved list in FIPS mode of the module
    – Shashank V
    Commented Nov 21, 2017 at 16:53
  • Yeah, that would be my guess. I would be happy to up vote an answer from someone who knows for sure.
    – Mike Ounsworth
    Commented Nov 21, 2017 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .