WOLFCRYPT FIPS 140-2 and FIPS 140-3

Federal agencies purchasing cryptographic-based security systems must confirm an associated FIPS 140-2 certificate exists.

This procurement “check-box” item is a deal breaker. Vendor claims of “designed for FIPS” or “FIPS ready” are not sufficient to pass this hurdle.

No FIPS certificate = No sale

Many private and commercial organizations perceive an advantage in selecting a product with a FIPS 140-2 certificate over a solution that has not undergone the rigorous approval process.

wolfSSL is currently the leader in embedded FIPS certificates. We currently maintain two FIPS 140-2 certificates for the wolfCrypt Cryptographic Module: #2425 and #3389. Certificate #3389 includes algorithm support required for TLS 1.3 and can be used in conjunction with the wolfSSL embedded SSL/TLS library for full TLS 1.3 client and server support. wolfSSL intends to continue to serve our customers by taking wolfCrypt through the FIPS 140-3 validation process, as mentioned above.

wolfSSL also supports the new ACVP (Automated Cryptographic Validation Protocol), which is the successor to the two decade old CAVP system from NIST.  ACVP is intended to alleviate the manual steps of the older CAVP process, creating a more efficient and effective method for cryptographic algorithm testing and validation.  Learn more about ACVP in our blog posts here and here.

For additional information contact fips@wolfssl.com.  Read our blog post update here, and our update on the most recent certificate here!

wolfCrypt FIPS 140-2 Level 1 Certificate #2425
wolfCrypt v4 FIPS 140-2 Level 1 Certificate #3389

For a full list of currently validated Operating Environments, please see the section below.

wolfCrypt is a cryptographic software API library. Your application may rely on wolfCrypt to provide all of the cryptographic processing. Instead of performing your own FIPS validation, you may claim that you are using an embedded FIPS cryptographic module. This will make your Federal customers happy.

wolfCrypt is compliant with FIPS 140-2 Implementation Guidance 9.10. We implemented a default entry point to run self-tests automatically. The FIPS OpenSSL module does not provide a default entry point.

wolfCrypt FIPS Boundary Design

wolfSSL has defined the wolfCrypt FIPS boundary specifically around a subset of the wolfCrypt algorithms such that it is easy and painless to update to new wolfSSL releases while maintaining an existing wolfCrypt FIPS validation. Most bugs and vulnerabilities happen in the SSL/TLS layer code - outside the cryptographic module code itself. With the FIPS boundary drawn around only the wolfCrypt cryptography algorithms, this allows users to update to newer versions of the wolfSSL SSL/TLS code and keep the same validated wolfCrypt FIPS code underneath. With a current wolfSSL support package in place, our FIPS customers receive new wolfSSL SSL/TLS release bundles packaged with their existing validated version of wolfCrypt, making it easy to stay secure and up to date!

Yes. You have the option of rebranding the wolfCrypt module and NIST will issue a FIPS 140-2 certificate in your company’s name. Your Sales Teams will thank you.

At wolfSSL, our security experts have the FIPS expertise you need. We will form a FIPS strategy that is best for you, optionally including on-site FIPS consulting! Before you search for a FIPS Consultant or begin calling several of the 22 FIPS Laboratories, contact us.  We can save you time, money, and effort.

wolfSSL also provides support for a wolfCrypt FIPS Ready version of the library! wolfCrypt FIPS Ready is our FIPS enabled cryptography layer code included in the wolfSSL source tree that you can enable and build. You do not get a FIPS certificate, you are not FIPS approved, but you will be FIPS Ready. FIPS Ready means that you have included the FIPS code into your build and that you are operating according to the FIPS enforced best practices of default entry point, and power on self test.

wolfCrypt FIPS Ready can be downloaded from the wolfSSL download page located here: https://www.wolfssl.com/download/. More information on getting set up with wolfCrypt FIPS Ready can be found in our FIPS Ready User guide here: https://www.wolfssl.com/docs/fips-ready-user-guide/