ANNOUNCEMENT:
wolfSSL is very proud to let our FIPS community know that wolfCrypt has received its’ first two consolidated ACVP vector certificates!
Both of these consolidated certificates were for embedded operating environments (OEs’) and wolfSSL will soon be working on adding a Linux 4.4 on ARM OE, CMSIS-RTOS on EFM32 OE, WINCE on ARM OE and more!
BACKGROUND:
As many in the FIPS world are aware NIST retired CAVP (Cryptogrphic Algorithm Validation Protocol) testing on June 30th of 2020, permanently replacing CAVP with ACVP (Automated Cryptographic Validation Protocol), also referred to as ACVTS (Automated Cryptographic Validation Test System).
In order to prepare for this transition NIST offered a “demo server” that Vendors like wolfSSL and FIPS Labs could utilize in standup of the new protocol. Once the transition was completed NIST also setup “production servers” which only FIPS Labs with a trusted certificate issued by NIST can connect to. Production Vectors passing are now the gateway to Algorithm Certification (IE certs like the ones wolfSSL just received!).
Algorithm Certification is a prerequisite to CMVP FIPS 140-2 (and 140-3) validations. This design keeps in place the need for a FIPS lab to achieve algorithm certification but it now allows for Vendors such as wolfSSL to pre-test in advance of requesting production vectors for certification!
USE-CASES:
The ACVP client wolfSSL has developed can do several things:
- Connect to the demo server, request test vectors for 1 (or many) algorithms, process them, and return the responses ultimately receiving either a “pass” or “fail” result.
- Support for testing on full Operating System such as Linux/Windows/Unix
- Support for testing on embedded Operating Environments (Yes even those that are barely above bare-metal)!
- Process JSON files received from a FIPS lab containing production vectors and write out JSON response files for returning to a FIPS lab.
- Support for testing on full Operating System such as Linux/Windows/Unix
- Support for testing on embedded Operating Environments (even those that are barely above bare-metal)!
- The wolfSSL ACVP client also has some local known-answer tests it can run to check algorithms without an RNG component IE most bulk encryption algorithms without an integrity check, and hash algorithms. Bulk encryption algorithms with an integrity check, public key algorithms, and the DRBG can only be sanity-checked against the demo server as the outputs are random and can not be simply diffed with a static known-answer test file.
Users who may want to prepare in advance for the possibility of doing a FIPS validation could use the wolfSSL proprietary ACVP client to test their implementations are ready before pulling the trigger on a FIPS effort with a FIPS lab! If you have any questions or are interested in hearing more about the wolfSSL ACVP client or having wolfSSL validate an Operating Environment so that you can win those deals with customers that need a FIPS validated software module, please contact us at support@wolfssl.com or fips@wolfssl.com anytime!
Sources:
https://csrc.nist.gov/Projects/cryptographic-algorithm-validation-program/cst-lab-transition
For information regarding the use of cipher suites or general inquiries about wolfSSL’s embedded SSL/TLS library contact us at facts@wolfssl.com!