FIPS PUB 140-2

The FIPS 140-2 is a security standard that specifies the security requirements for a cryptographic module used within a security system. It is a standard provided by NIST to evaluate and accredit the operation of cryptographic modules through the Cryptographic Module Verification Program (CMVP). The CMVP is run by NIST-approved test laboratories to test and validate cryptographic modules. The modules are tested against the derived test requirements of the FIPS 140-2 standard.

For each security function that is validated and approved for use in FIPS 140-2 accredited mode, an individual certificate under the Cryptographic Algorithm Validation Program (CAVP) is recorded in the FIPS 140-2 approval certificate for the module. The approval certificate lists all security functions that the module provides—both approved and non-approved, and details the functions that can be used in the FIPS 140-2 approved mode of operation.

Each approved module publishes an associated security policy document that details how the module must be operated in order to be compliant with the FIPS 140-2 standard.

Note: Only cryptographic modules can be certified as FIPS 140-2 accredited and approved; applications cannot be, though they can use FIPS 140-2 approved modules in their approved modes of operation.