Do passwords (or PINs) used for authentication of operators of a cryptographic module have to be protected (encrypted) when entered into the FIPS140-2 defined cryptographic boundary? Are the requirements for entry of PINs and passwords equivalent for all FIPS140-2 security levels?
Yes, authentication data can be entered in plain text. That is, in fact, usually the case: a very common type of authentication is that a human types the password on a keyboard or similar device. In most settings, there would be no way to protect the password: you would need another cryptographic module for that, which in turn you'd want to certify under FIPS 140…
You must take care that the authentication data cannot be leaked at the point of entry. This is embodied in rules about feedback provided to the operator entering the data (§4.3.3):
Feedback of authentication data to an operator shall be obscured during authentication (e.g., no visible display of characters when entering a password). Feedback provided to an operator during an attempted authentication shall not weaken the strength of the authentication mechanism.
The security level does not affect the rules regarding entry of authentication data, nor even the rules about authentication strength (at most 10-6 probability of one random attempt succeeding, at most 10-5 probability of succeeding with random attempts in under 1 minute). The security level only affects what kinds of authorization model the authentication data must be provided for (none at level 1, role-based at level 2, identity-based above that).
There are no additional requirements when initializing the authentication data (as in setting a password).
Once entered into the module, the requirements on authentication data vary depending on the security level (§4.6.1):
- Level 1 doesn't put any requirements on authentication data even if it is present.
- Level 2 requires that all attempts to access or modify authentication data be logged.
- Level 3 requires that authentication data be communicated through a trusted mechanism.
No cryptography is required at any point: the authentication data can be protected by physical means alone. The requirements on stored authentication data are (from §4.3.3):
Authentication data within a cryptographic module shall be protected against unauthorized disclosure, modification, and substitution.