FIPS validation certificates How to read CAVP and CMVP evidence

The CMVP implementation guidance draws a clear line between certificate types. CAVP tests and validates cryptographic algorithm implementations; the algorithm validation certificate states the implementation name, implementation version, and tested operational environment.

CMVP tests and validates cryptographic modules. A module validation certificate states the validated cryptographic module name, version, and tested operational environment. That module-level evidence is separate from the algorithm certificate, even when the module uses CAVP-tested algorithms.

A validation certificate is a benchmark for the configuration and operational environment used during validation testing. For an algorithm implementation embedded in a module undergoing FIPS 140-3 testing, the guidance requires the algorithm implementation to remain unmodified and the CAVP-tested operational environment to be identical to, or fully included in, the module testing environment.

For software modules, the operating system, platform, processor, and any hypervisor details are part of the check. A certificate tested on one operating system or processor bit size should not be treated as evidence for another environment unless the official record and module evidence support that environment.

Use wording that names the exact evidence and stops at what it proves. The statement should identify the certificate type, certificate number or listing, vendor, module or implementation name, version, operational environment, validation status, and the date the public listing was checked.

For procurement and customer responses, replace broad phrases such as FIPS compliant encryption with narrower wording. For example, state that a named algorithm implementation has a CAVP validation certificate, or that a named cryptographic module is listed by CMVP for a stated version and environment. Then add any approved-mode instructions, caveats, and deployment conditions that limit the claim.

Status changes the decision a certificate can support. An Active module may be used for new and existing federal systems when the exact module version, environment, approved services, and caveats match. A Historical certificate has not been revoked, but NIST says federal agencies should not include the module in new systems; legacy use or procurement requires the responsible agency's documented decision.

A Revoked certificate is no longer valid and may not be cited to demonstrate compliance with the FIPS 140 standards. Historical status can result from age, a sunset date, or a program transition, so read the status reason and current certificate page instead of relying on an old certificate image or supplier copy.