Should Cloud Service Providers be Concerned with FIPS 140-3?

Christine Biggs, Principal, FedRAMP & Assurance Services, Coalfire

If you’ve dealt with FedRAMP, you may already know that FIPS 140-2 is the standard for cryptographic modules published by the National Institute of Standards and Technology (NIST). All cloud service providers (CSPs) who wish to be FedRAMP compliant must use only crypto modules that have been validated by NIST in their Cryptographic Module Validation Program (CMVP) to ensure they comply with FIPS 140-2.

An update to the standard – FIPS 140-3 – was published in 2019, and Coalfire’s FedRAMP Assurance Services (FAS) team has received questions about it from CSPs, mostly around what kind of impact it will have on them as they go through the FedRAMP process.

The FIPS 140 standard contains the security requirements for cryptographic modules. It’s fairly lengthy and has several appendices (annexes). If you read the new 140-3 standard, you would see that it is basically empty except to state that it has been replaced with the international standard ISO/IEC 19790. And then if you actually reviewed the ISO standard, you would see that it is nearly identical to FIPS 140-2 except that, in addition to all the old crypto algorithms that were allowed before (like AES, Triple-DES, RSA, and HMAC), you can now use newer algorithms like:

  • MISTY1, CAST-128, HIGHT, Camellia, etc., for symmetric encryption
  • DEM1, DEM2, DEM3, ECIES-KEM, RSA-KEM for data and key encapsulation methods
  • MDx-MAC in addition to HMAC for message authentication codes

Do CSPs need to understand these new algorithms or read the ISO standards? Not really, because the FIPS 140 standard is for vendors who make the crypto modules. It contains the requirements that their crypto modules must comply with and which they will be tested against in the CMVP labs. CSPs only need to make sure they use one of the crypto modules that have been tested / validated against this standard. As long as you use a crypto module that is listed on the CMVP website, you will meet the FedRAMP requirements for FIPS.

Are there any FIPS 140-3 modules available? No, not yet. Below is the timetable that CMVP has published for availability of crypto modules that comply with FIPS 140-3. As you can see, they will not even begin accepting modules for validation until September 2020. The sunset date for the last of the modules that comply with FIPS 140-2 is not until 2026.

Date Activity
March 22, 2019 FIPS 140-3 approved
Sept 22, 2019 FIPS 140-3 effective date. Drafts of SP 800-140x published
March 22, 2020 Publication of final SP 800-140x documents. Implementation Guidance updates
Sept 22, 2020 CMVP accepts FIPS 140-3 submissions
Sept 22, 2021 CMVP stops accepting FIPS 140-2 submissions for new validation certificates
Sept 22, 2026 Remaining FIPS 140-2 certificates moved to Historical List

The bottom line is that CSPs have a little time before they must upgrade their FIPS modules in their FedRAMP systems; however, we suggest that CSPs start planning now to upgrade their products containing FIPS modules so they will pass their annual FedRAMP assessments without any problems.

Christine Biggs


Christine Biggs — Principal, FedRAMP & Assurance Services, Coalfire

Recent Posts

Post Topics



Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff CISO cloud CMMC CoalfireOne Compliance Covid-19 credit cards C-Store Culture Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DevSecOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi women XSS