FIPS 140-3 vs Common Criteria: security levels, EALs and what each certification proves

FIPS 140-3 and Common Criteria often appear side by side in procurement requirements, but they answer different questions. FIPS 140-3 asks whether a cryptographic module implements approved cryptography correctly and protects its keys. Common Criteria asks whether a product meets the security claims made for it, and how deeply those claims were evaluated. Knowing the difference helps you ask vendors for the right proof.

FIPS 140-3 at a glance

• Scope: one cryptographic module, which can be a hardware device, a software library, firmware, or a hybrid. The certificate names the exact versions tested.
• Programme: the Cryptographic Module Validation Program (CMVP), run by NIST and the Canadian Centre for Cyber Security, with testing done by accredited laboratories.
• Prerequisite: every approved algorithm in the module must first be validated by the Cryptographic Algorithm Validation Program (CAVP).
• Levels: four security levels, from Level 1 (approved algorithms, production-grade components) to Level 4 (full tamper detection and response, protection against environmental attacks, multi-factor authentication).
• Lifecycle: certificates are active, historical or revoked. FIPS 140-3 replaced FIPS 140-2, whose certificates move to the historical list at their sunset date.

Common Criteria at a glance

• Scope: a whole product, such as a smart card, firewall, operating system, HSM or database, evaluated against a security target that states its security claims.
• Standard: ISO/IEC 15408, with certificates issued by national schemes such as BSI in Germany, ANSSI in France, NLNCSA in the Netherlands or NIAP in the US.
• Levels: Evaluation Assurance Levels EAL1 to EAL7 measure how deeply the claims were checked. A "+" adds extra assurance components, for example EAL4+ with ALC_FLR or EAL6+ with AVA_VAN.5.
• Protection profiles: many products are evaluated against a protection profile for their product type, which fixes the security requirements every product in that category must meet.
• Lifecycle: certificates are active or archived. Mutual recognition between countries applies up to a set level, which differs between agreements.

Side by side

• What is evaluated: FIPS 140-3 covers the cryptographic boundary of a module. Common Criteria covers the security functions of the whole product.
• What the level means: a FIPS 140-3 level sets stronger physical and authentication requirements. An EAL sets a deeper evaluation of the same claims, not stronger claims.
• Who runs it: FIPS 140-3 has one programme, the CMVP. Common Criteria has many national schemes linked by recognition agreements.
• Where to check: FIPS 140-3 certificates are on the NIST CMVP site. Common Criteria certificates are on the Common Criteria Portal and the national scheme sites.

Which one to ask for

• Ask for FIPS 140-3 when the requirement is about cryptography: encryption, key storage, signatures, random number generation. Name the security level you need.
• Ask for Common Criteria when the requirement is about the product as a whole, ideally with a named protection profile and a minimum EAL.
• Many HSMs and smart cards hold both. The Security Certifications brain shows both certificates for the same vendor side by side.

Questions to try

• "Does this HSM hold both a FIPS 140-3 validation and a Common Criteria certificate?"
• "Explain the difference between this product's EAL4+ and EAL5+ certificates."
• "Which Level 3 FIPS 140-3 modules are active for this vendor?"

Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.