Cryptography and Encryption  for Cybersecurity Companies

• Cryptography is everywhere. It is a key security control that enables privacy, security, and trust in our digital world

• NIST's FIPS 140 standard dates back to 2001 and specifies extensive laboratory testing and certification for cryptography implementations sold to the US government

• Numerous additional government security standards and frameworks, including FISMA, NIST SP 800-53, Common Criteria, DoDIN APL, FedRAMP, StateRAMP, CMMC 2.0, and CNSA 2.0, have all adopted FIPS 140 as the gold standard for cryptography compliance

• Given you are in the cybersecurity business, you surely use cryptography and encryption. That means you will need FIPS 140-3 validation to sell to the federal government and other regulated industries. 

Traditional FIPS 140-3 validation has three main phases: Documentation, Testing, and Validation. It requires extensive collaboration with a FIPS consultant, your NIST-authorized certification lab, and NIST itself.

This process can take two+ years, not counting the time required to develop the cryptography software. More recently, as the industry has been transitioning from FIPS 140-2 to FIPS 140-3, this process has been taking much longer.

Even worse, FIPS Validation is not a one-time project, expense, and headache.  FIPS validated software often needs to be revalidated due to CVEs and changing requirements.  Otherwise, your FIPS certificate will go 'historical', and you will no longer be able to use it to support new federal acquisitions.

• Asymmetric (public/private key) cryptography  has been used in almost every aspect of computer security for 30 years

• Classical PKI algorithms rely on mathematical problems existing computers cannot easily solve, but emerging quantum computers will solve easily

• Gartner predicts quantum computing will make existing systems unsafe to use cryptographically by 2029

• Cryptographic products and services will need to be updated or replaced to use post-quantum cryptographic (PQC) algorithms to protect against this threat

• In August 2024, NIST announced the availability of three Post-Quantum Cryptography (PQC) algorithm standards, as well as changes to the CMVP program to allow them to be incorporated into FIPS 140-3

   

• Less Expertise and Effort Required. Sure you could hire and train your own team to work with a FIPS lab to achieve and maintain FIPS certification, but couldn’t your engineers deliver more value to your customers on other projects?
  
  
• Faster Time to Market.  If you are new to federal markets, do you want to start generating revenue in two months or two years?
  
  
• Predictable Fixed Costs Over Time.  How much will it cost you to develop your encryption software, get it certified by NIST, and then get it recertified multiple times over its lifetime to avoid going Historical?