Cryptographic Module Testing Laboratory

A Cryptographic Module Testing Laboratory (CMTL) is an information technology (IT) computer security testing laboratory that is accredited to conduct cryptographic module evaluations for conformance to the FIPS 140-2 U.S. Government standard.

The National Institute of Standards and Technology (NIST) National Voluntary Laboratory Accreditation Program (NVLAP) accredits CMTLs to meet Cryptographic Module Validation Program (CMVP) standards and procedures.

This has been replaced by FIPS 140-2 and the Cryptographic Module Validation Program (CMVP).

CMTL requirements

These laboratories must meet the following requirements:

  • NIST Handbook 150, NVLAP Procedures and General Requirements
  • NIST Handbook 150-17 Information Technology Security Testing - Cryptographic Module Testing
    • NVLAP Specific Operations Checklist for Cryptographic Module Testing

FIPS 140-2 in relation to the Common Criteria

A CMTL can also be a Common Criteria (CC) Testing Laboratory (CCTL). The CC and FIPS 140-2 are different in the abstractness and focus of tests. FIPS 140-2 testing is against a defined cryptographic module and provides a suite of conformance tests to four FIPS 140 security levels. FIPS 140-2 describes the requirements for cryptographic modules and includes such areas as physical security, key management, self tests, roles and services, etc. The standard was initially developed in 1994 - prior to the development of the CC. The CC is an evaluation against a Protection Profile (PP), usually created by the user, or security target (ST). Typically, a PP covers a broad range of products.

  • A CC evaluation does not supersede or replace a validation to either FIPS 140-1 or FIPS 140-2. The four security levels in FIPS 140-1 and FIPS 140-2 do not map directly to specific CC EALs or to CC functional requirements. A CC certificate cannot be a substitute for a FIPS 140-1 or FIPS 140-2 certificate.

If the operational environment is a modifiable operational environment, the operating system requirements of the Common Criteria are applicable at FIPS Security Levels 2 and above.

  • FIPS 140-1 required evaluated operating systems that referenced the Trusted Computer System Evaluation Criteria (TCSEC) classes C2, B1 and B2. However, TCSEC is no longer in use and has been replaced by the Common Criteria. Consequently, FIPS 140-2 now references the Common Criteria.
gollark: You are like the Unicode codepoint U+019B ƛ Latin Small Letter Lambda with Stroke, introduced in Unicode 1.1.
gollark: You are like an algebraic magma with the binary operation multiplication.
gollark: You are like the hexadecimal value ce7d4761fa385c421e9b155e0ceea047498f2a33acefdafa6bb93f845de606061868f3a7ad48002042c7c79fc6aa5dc2bcc0528976eacb95b58e4932027b76b2.
gollark: You are like an endofunctor OUTSIDE the category of monoids.
gollark: You are like a homomorphism between two vector spaces.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.