FIPS validation certificates How to read CAVP and CMVP evidence

The CMVP implementation guidance draws a clear line between certificate types. CAVP tests and validates cryptographic algorithm implementations; the algorithm validation certificate states the implementation name, implementation version, and tested operational environment.

CMVP tests and validates cryptographic modules. A module validation certificate states the validated cryptographic module name, version, and tested operational environment. That module-level evidence is separate from the algorithm certificate, even when the module uses CAVP-tested algorithms.

A validation certificate is a benchmark for the configuration and operational environment used during validation testing. For an algorithm implementation embedded in a module undergoing FIPS 140-3 testing, the guidance requires the algorithm implementation to remain unmodified and the CAVP-tested operational environment to be identical to, or fully included in, the module testing environment.

For software modules, the operating system, platform, processor, and any hypervisor details are part of the check. A certificate tested on one operating system or processor bit size should not be treated as evidence for another environment unless the official record and module evidence support that environment.

Use wording that names the exact evidence and stops at what it proves. A safe evidence statement identifies the certificate type, certificate number or listing, vendor, module or implementation name, version, operational environment, validation status, and the date the public listing was checked.

For procurement and customer responses, replace broad phrases such as FIPS compliant encryption with narrower wording. For example, state that a named algorithm implementation has a CAVP validation certificate, or that a named cryptographic module is listed by CMVP for a stated version and environment. Then add any approved-mode instructions, caveats, and deployment conditions that limit the claim.