FIPS 140-3 operational environments

FIPS 140-3 names operating environment as one of the security requirement areas for cryptographic modules. The environment is part of the validation evidence, but it is not automatically inside the cryptographic boundary. For a software module, the operating system, processor, platform, and other applications can sit outside the boundary while remaining inside the tested operational environment's physical perimeter.

The CMVP implementation guidance defines operational environment for software, firmware, and hybrid modules as the management of the software, firmware, and hardware needed for the module to operate. At minimum, that includes the module components, the computing platform, and the operating system that controls or allows the software or firmware to execute.

Start with the certificate, security policy, and algorithm validation evidence for the exact module and version. CMVP guidance says cryptographic module validation certificates state the module name, version, and tested operational environment; CAVP algorithm certificates also state the tested operational environment for the algorithm implementation.

For software modules, each listed operational environment must include the operating system, platform, and processor used for testing. If a hypervisor was used, it must be listed too. IG 2.3.A does not allow an algorithm implementation tested on one processor bit size to be claimed for another bit size, or one tested operating system to be claimed for another during module testing. Memory size and processor frequency do not create that same distinction under the cited rule.

The main mistake is stretching a validation claim beyond the environment that was tested. CMVP guidance says a claim cannot be made for a different processor bit size when an implementation was tested on one bit size, and a claim cannot be made for another operating system when the implementation was tested on one operating system for module testing.

For Level 1 software in a general-purpose operational environment, the CMVP guidance also points to operating-system capabilities that protect critical and sensitive security parameters: each module instance must control its own SSPs, the environment must separate application processes, and spawned processes must be owned by the module rather than external processes or operators.