What’s New in FIPS 140-3?

    • There are a few significant changes coming with FIPS 140-3. Over the years with many specification updates, a few things got a little inconsistent, so these inconsistencies have been brought back in line. wolfSSL is prepared to deliver the first and best implementation of FIPS 140-3, so get ready:

    • The power-on self-test is changing. It now takes two sets of tests: the Pre-operational Self-Test (POST) and the Conditional Algorithm Self-Test (CAST).
    • The old Known Answer Tests used as a part of the old test are not required to run at startup. They are now conditional tests that must be run right before use of an algorithm. If you don’t use an algorithm, you don’t need to test it. The tests will run automatically on calling any API for an algorithm.
    • The pre-operational self-test is now purely an integrity test of the executable in memory. The algorithms used for this test must be tested first. In our case, HMAC-SHA-256’s CAST is run automatically, then the POST. The POST will be run automatically as wolfCrypt’s default entry point in the code.
    • All the tests may be and should be run periodically during run time. We will provide an API to run tests as desired. In an embedded application, you can run your CAST early before any algorithms are used as some CASTs do take time.

    wolfSSL has a long history in FIPS 140-2, starting with wolfCrypt FIPS 140-2 Level 1 Certificate #2425 and surviving Certificate #3389. wolfSSL is helping customers move from Certificate #2425 as NIST is sending it into sunset next year. For those who will be impacted, contact us to get your new cert!

    wolfSSL is currently the leader in embedded FIPS certificates. Stay tuned as we support you with the best in FIPS 140-3. Be sure to join us for an upcoming webinar on this topic, details forthcoming! 

    Additional Resources 

    If you have any questions or run into any issues, contact us at facts@wolfssl.com, or call us at +1 425 245 8247.

    Check out the wolfSSL embedded SSL/TLS library, star us on Github, and learn more about the latest TLS 1.3 is available in wolfSSL.