Yesterday was quite the day. September 22, 2020.
It was the Autumnal Equinox - happy fall! It was also Ray Potter's speaking session at the virtual International Cryptographic Module Conference (ICMC 2020), and I'll post more on that soon. Most importantly, it was the day that NIST's Cryptographic Module Validation Program (CMVP) began FIPS 140-3 validation testing!
Like Y2K before it, FIPS 140-3 Day went off without the world melting down.
CMVP has had quite the backlog of validations recently. By most reports it has been around 9 months or so for a new FIPS certificate, due to dividing resources between preparations for 140-3 and the existing workload for 140-2. The deprecation of 186-2 on September 1, 2020 required significant attention as well. NIST confirmed today that FIPS 140-3 submissions will feed into the same queue, so there will be no shortcuts and the 9 month wait will still apply. Hopefully that will ease up, as some of the burden gets passed from CMVP to the labs and vendors who take on the unenviable role of guinea pigs for the first validations. Sure, it would be fun to be the first FIPS 140-3 validated module, but such a headache! As Ray blogged last year, there is plenty of time.
SafeLogic will be addressing it as we always do - methodically, strategically, and pragmatically - so that our customers and partners can reap the benefits of our expertise.
We will have more details to share on our roadmap soon, but in the meantime, do take a minute and refer to the transition calendar below and note how early we remain in the process. Our customers will continue to enjoy the effortless maintenance and support of their FIPS 140-2 validations for years to come, and we will continue to offer RapidCert validations for our existing modules right up until the last day of testing on September 22, 2021, unless conditions change.
[Update - conditions DID change! RapidCerts from SafeLogic will be continued to be allowed and processed past the testing deadline for FIPS 140-2!]