What is the CMVP? How FIPS 140-3 validation works, from CAVP to certificate
The Cryptographic Module Validation Program (CMVP) is how NIST and the Canadian Centre for Cyber Security validate cryptographic modules against FIPS 140-3. Learn the steps, the four security levels, certificate status and how to check a module from your AI assistant.
Add the Security Certifications brain to your AI assistant
The Cryptographic Module Validation Program (CMVP) is a joint programme of the US National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security. It validates cryptographic modules against FIPS 140-3, the US and Canadian government standard for modules that protect sensitive information. US federal agencies, and many regulated industries that follow them, can only rely on cryptography inside a validated module.
How a module gets validated
- Algorithm testing: each approved algorithm the module uses (AES, SHA-2, ECDSA, ML-KEM and so on) is first tested by the Cryptographic Algorithm Validation Program (CAVP), which issues algorithm certificates.
- Laboratory testing: an accredited Cryptographic and Security Testing laboratory tests the module against FIPS 140-3 and its derived test requirements, and reviews the module's security policy.
- CMVP review: the lab submits its report. The module appears on the Modules in Process list while NIST and the Canadian Centre for Cyber Security review it, ask questions and resolve comments.
- Certificate: once accepted, the module gets a numbered certificate listing the vendor, module name and versions, security level, tested configurations, validated algorithms and the public security policy.
The four FIPS 140-3 security levels
- Level 1: approved algorithms and security functions, production-grade components. Typical for software libraries.
- Level 2: adds tamper evidence, such as seals or coatings, and role-based authentication of operators.
- Level 3: adds tamper resistance with detection and response to physical intrusion, identity-based authentication, and stronger separation of the interfaces that carry critical security parameters. Typical for HSMs.
- Level 4: adds a complete protective envelope with immediate zeroisation on penetration, protection against environmental attacks such as voltage and temperature, and multi-factor authentication.
The overall level is the lowest level the module reaches across all areas of the standard, so a module described as "Level 3" may still list some areas at a different level. The security policy gives the detail.
Status: active, historical, revoked
- Active: the certificate can be used for new procurements.
- Historical: the certificate passed its sunset date (normally five years after validation) or was moved for another reason. Agencies may keep using existing deployments under their own risk assessment, but should not buy new ones on that basis.
- Revoked: the validation was withdrawn and should not be relied on.
- FIPS 140-2: the previous version of the standard. Its certificates move to the historical list at their sunset date, so a "FIPS 140-2 validated" claim should be checked for status.
Questions to try
- "Is FIPS certificate 4282 active, and what is its sunset date?"
- "Which lab tested this module, and which algorithms are on its certificate?"
- "List active Level 3 FIPS 140-3 modules from this HSM vendor."
- "Which of this vendor's modules were moved to the historical list this year?"
Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.
Add the Security Certifications brain to your AI assistant
Check FIPS 140-3 and Common Criteria certificates, post-quantum algorithms, and the CVEs that may affect certified products from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed weekly from sec-certs.org, with nothing to set up.
Questions people ask.
Who runs the CMVP?
NIST in the US and the Canadian Centre for Cyber Security in Canada run it jointly. Testing is done by independent laboratories accredited under NIST's NVLAP programme.
What is the difference between the CMVP and the CAVP?
The CAVP validates individual algorithm implementations, such as one AES or ML-DSA implementation. The CMVP validates the whole cryptographic module, and requires that every approved algorithm inside it already holds a CAVP certificate.
How long does a FIPS 140-3 certificate stay active?
A certificate normally has a sunset date five years after validation, after which it moves to the historical list. It can also be moved earlier, for example when a standard or algorithm transition ends.
Where does the KBrain data come from?
From sec-certs.org, which collects the CMVP certificates and security policies published by NIST. KBrain refreshes it weekly and links each certificate to the official NIST page.