FIPS 140-3 Vendor affirmation

Vendor affirmation is available only for specific cases described in CMVP Implementation Guidance. For SP 800-208 HSS, IG C.O permits it only when the implementation performs the required cryptographic algorithm self-tests, the underlying LMS operations and parameter sets have the required CAVP certificates, and the CSTL verifies each supported HSS operation through source-code review. The same IG preserves the separate state-management requirements in Section 8 of SP 800-208.

Do not describe vendor affirmation as a general validation status. The FIPS 140-3 standard says cryptographic modules are validated through CMVP, with testing by accredited CST laboratories, while CAVP addresses approved security function and sensitive security parameter generation and establishment method testing.

For SP 800-208 HSS, IG C.O lists concrete conditions rather than a self-attestation shortcut. If HSS key generation or signature generation is implemented, the underlying LMS key generation and LMS signature generation operations need CAVP certificates. If HSS signature verification is implemented, the underlying LMS signature verification operation needs a CAVP certificate.

The same IG requires every LMS parameter set used inside the HSS tree to have the applicable CAVP certificates. It also requires CSTL source-code review of each supported HSS operation against RFC 8554 Sections 6.1, 6.2, and 6.3, with the results documented in TE02.20.04 of the Test Report. This review supports the HSS vendor-affirmation path; it does not turn HSS into a separate CAVP-certified implementation.

Keep a compact evidence packet for each vendor-affirmed claim. It should identify the IG section, the module and version, the exact algorithm or key-generation method, the Security Policy table or disclosure, the CAVP certificates that remain required, and the CSTL or test-report evidence that the IG says must exist.

For SP 800-133 Rev. 2 key generation, IG D.H requires vendor affirmation for methods covered by Sections 4 and 6.3 when a symmetric key or seed for asymmetric key generation starts with a random bit string. The four Section 4 examples are informative; the approved-DRBG output and applicable independence requirements are normative. The Security Policy must describe each method, while the validation certificate has a CKG entry only when the module generates keys for symmetric-key algorithms.