I am trying to build a commercial encryption device. Ok, I know how to write code, how to transform encryption algorithms from the book into code and construct electronics. But my question is: what should I take care of in order to implement a commercial encryption device (ECC, RSA, AES)?
foreverska's answer gets an upvote, but I'll give more detail.
For US government: FIPS 140-2 / 140-3
To claim that your product is FIPS 140-3 compliant, you need to get it tested by a certified lab, and it has to be listed here.
Since you mention hardware, I'll note that there are 4 levels with increasing security requirements, where level 1 is about correctness of the algorithms, and levels 2, 3 & 4 are focused on hardware security, like detecting physical tampering of the device and wiping memory, and robustness to physical side-channel attacks like power or EM analysis, abusing the device with very high temperature or voltage, etc. Level 4 is exceedingly hard to obtain and even most of the big-name HSM vendors only certify to level 3.
For international markets: Common Criteria
Common Criteria is a set of crypto standards that are recognized by 31 countries, similar to FIPS.
Depends on your customer.
Most devices aim for FIPS compliance