Daily Rules, Proposed Rules, and Notices of the Federal Government
The current FIPS 140-2 standard can be found at:
In 2005, NIST announced that it planned to develop FIPS 140-3 and solicited public comments on new and revised requirements for cryptographic systems. On January 12, 2005, a notice was published in the
Using the comments received in response to the July 13, 2007, notice and the feedback on requirements for software cryptographic modules obtained during the March 18, 2008, “FIPS 140-3 Software Security Workshop,” NIST developed the “Revised Draft FIPS 140-3” (hereafter referred to as “2009 Draft”), that was announced in the
The comments received in response to the December 11, 2009, request for comments suggested either modifying requirements or applying the requirements at a different security level. Some comments asked for clarification of the text of the standard, and some recommended editorial and formatting changes. None of the comments received opposed the approval of a revised standard.
During the process of addressing the public comments received in response to the Request for Comments published in the
4.2.2Trusted Channel—the comments suggested that NIST should not mandate the implementation of a trusted channel at Security Level 3 and
4.3.1Trusted Role—the comments raised a variety of different concerns, reflecting different interpretations of the purpose of the Trusted Role. To address these concerns NIST is proposing the deletion of the Trusted Role and replacement with a Self-initiated Cryptographic Capability, configured and activated by the Crypto Officer that would be preserved over rebooting or power cycling of the module. The capability would provide the module with the ability to perform cryptographic operations including Approved and Allowed security functions without external operator request. NIST would appreciate comments on the proposed approach.
4.7Physical Security—Non-Invasive Attacks—the comments received suggest substantial changes that would either weaken or strengthen the impact of these requirements. Comments received included stronger security requirements for Security Level 3 and 4, making the section mandatory for all cryptographic modules, including the Security Level for this section as part of the overall Security Level, while other comments suggested not addressing non-invasive attacks within the standard. NIST would appreciate general and specific comments on the requirements to address non-invasive attacks.
4.8.4Sensitive Security Parameter (SSP) Entry and Output—the comments received raised a variety of different concerns, reflecting different interpretations of the requirements on SSPs that are entered into or output from a module. SSP entry and output requirements depend on whether the SSP is entered or output manually or electronically, and whether the SSP is distributed manually or electronically. New technologies have called into question this taxonomy of SSP entry and output methods. NIST would appreciate comments on the most appropriate way to categorize these methods, and the appropriate requirements for each method.
Annex B, Section: Operator Authentication Mechanisms—the comments received indicated that the specification for the strength of the operator's authentication method was incomplete, particularly with respect to biometrics. For biometric authentication, NIST proposes the use of a Liveness Detection method associated with the Session False Match Rate for one attempt and the Generalized False Accept Rate for multiple attempts in one minute. NIST would appreciate comments on the proposed approach.
Comments on sections not specifically listed in this notice will not be considered.
Prior to the submission of the FIPS 140-3 to the Secretary of Commerce for review and approval, it is essential that consideration is given to the needs and views of the public, users, the information technology industry, and Federal, State and local government organizations. The purpose of this notice is to solicit such views on specific sections of the “2009 Draft.”