FIPS 140-3 Vendor affirmation

Vendor affirmation is available only for specific cases described in CMVP Implementation Guidance. The clearest HSS example is IG C.O for SP 800-208: HSS can be vendor-affirmed when the implementation performs the required cryptographic algorithm self-tests, the underlying LMS operations have the required CAVP certificates, and the CSTL verifies each supported HSS operation through source-code review.

Do not describe vendor affirmation as a general validation status. The FIPS 140-3 standard says cryptographic modules are validated through CMVP, with testing by accredited CST laboratories, while CAVP addresses approved security function and sensitive security parameter generation and establishment method testing.

For SP 800-208 HSS, IG C.O lists concrete conditions rather than a self-attestation shortcut. If HSS key generation or signature generation is implemented, the underlying LMS key generation and LMS signature generation operations need CAVP certificates. If HSS signature verification is implemented, the underlying LMS signature verification operation needs a CAVP certificate.

The same IG requires every LMS parameter set used inside the HSS tree to have the applicable CAVP certificates. It also requires CSTL source-code review of each supported HSS operation against RFC 8554 key generation, signature generation, and signature verification sections, with the results documented in TE02.20.04 of the Test Report.

Keep a compact evidence packet for each vendor-affirmed claim. It should identify the IG section, the module and version, the exact algorithm or key-generation method, the Security Policy table or disclosure, the CAVP certificates that remain required, and the CSTL or test-report evidence that the IG says must exist.

For SP 800-133 key generation, IG D.H says vendor affirmation is required for methods covered by Sections 4 and 6.3 when a symmetric key or seed for asymmetric key generation starts with a random bit string. It also says the Security Policy must provide details for each method, and that the validation certificate has a CKG entry only when the module generates keys for symmetric-key algorithms.