Comments sought on NIST updated draft of standards for cryptographic modules
Connecting state and local government leaders
The proposed revision of FIPS 140 limits the security level of software crypto tools and includes requirements for mitigation against power analysis attacks.
An updated draft of security standards for cryptographic modules has been released by the National Institute of Standards and Technology for public comment.
Federal Information Processing Standard 140-3, “Security Requirements for Cryptographic Modules,” would replace the existing version, FIPS 140-2, upon approval. This is the second draft of FIPS 140-3. The original draft was released in July 2007, and comments on that draft and from a subsequent workshop have been incorporated into the current version.
The current draft replaces a proposed five-level security model with the four-level model already used in FIPS 140-2 and reintroduces the idea of firmware cryptographic modules.
“Differences with the current FIPS 140-2 standard include limiting the overall security level for software cryptographic modules to Security Level 2, requirements for mitigation of noninvasive attacks at higher security levels, elimination of the requirement for formal modeling at Security Level 4, modified conditions for pre-operational/power-on self-tests, and strengthened integrity testing,” NIST said in announcing the release.
Comments on the second draft of FIPS 140-3 should be sent to FIPS140-3@nist.gov by March 11, 2010.
FIPS 140 grew out of Federal Standard 1027, "General Security Requirements for Equipment," which used the now-outdated Data Encryption Standard algorithm as the standard for encryption. FIPS 140-1 was issued in 1994, with a requirement that it be reviewed every five years. The review and revision process can take several years. FIPS 140-2 was approved in 2001.
Advances in technology soon outpaced the newer version, which requires the Advanced Encryption Standard, and a review of FIPS 140-2 began with a request for comments in January 2005. The original timeline for the new version, which has slipped, called for FIPS 140-3 to be approved by May 2006 and for FIPS 140-2 to be retired in May 2007, although products validated under the previous standard still could be used.
FIPS 140-2 identifies four security levels to provide for a variety of data sensitivity as well as application environments.
Comments on the 2007 draft were received from 45 entities, including two U.S. federal agencies and two from foreign governments.
“None of the comments opposed the approval of a revised standard,” NIST said. “Some comments asked for clarification of the text of the standard or recommended editorial and formatting changes. Other comments suggested modifying requirements or applying the requirements at a different security level.”
One of the differences in the current draft of the proposed FIPS 140-3 is the requirement that some modules include defenses against simple and differential power analysis attacks. Power analysis is a technique for discovering the cryptographic keys by monitoring variations in a device’s electrical power consumption and using statistical methods to separate the key from background noise. This was a relatively new technique for cracking codes in single-chip processors when FIPS 140-2 was approved in 2001. Simple and differential power analysis get a mention in this version under “other attacks,” but protection against them is not required.
Today it has become a common form of attack against cryptographic devices.
The 2007 draft of FIPS 140-3 required that protection against power analysis attacks at Security Level 4, and many commentators believed that the protection should begin at Level 2. NIST settled in the current draft on Level 3 for providing this protection because of the preparation needed for such attacks.
“They require, in addition to access to the module's power line, minimum equipment to collect the data; therefore, the attacker has to be prepared with appropriate equipment,” NIST wrote. “NIST determined that protection against noninvasive attacks is required starting with the Security Level 3 to provide consistent protection for the module's Critical Security Parameters.”
The 2007 draft of FIPS 140-3 included requirements to prevent the use of weak passwords for authentication, but dissenters raised objections during review that this would be too complex and require restrictive standards on the modules, and this requirement was dropped.
All comments received on the 2007 draft, together with NIST's responses, are available here. The current FIPS 140-2 standard is available here.