FIPS 140-3

← Back to glossary

What FIPS 140-3 certifies

FIPS 140-3 specifies security requirements for cryptographic modules — the boundary within which approved algorithms run and keys are managed. The standard defines four security levels (1-4) with progressively stricter requirements on physical security, role-based authentication, key management, and self-testing.

The certification process

Modules are evaluated by NIST-accredited Cryptographic and Security Testing Laboratories (CSTLs). The lab produces a Functional Test Report and a Security Policy document; NIST reviews and issues a certificate. The process typically takes 9-18 months and is expensive.

Why FIPS-only cryptography matters

The certification process is dramatically faster when the module under test uses only NIST-published algorithms. Proprietary algorithms typically require additional cryptographic-analysis work before they can be considered for FIPS approval. SkyeConnex's choice to use only NIST-published primitives — AES, AES Key Wrap, SHA-256, HMAC-SHA-256, ML-KEM-1024, ML-DSA-87, HKDF, scrypt, TLS 1.3 — compresses the path from years to months.

FIPS 140-3 vs FIPS 140-2

140-3 superseded 140-2 in September 2019. The newer standard aligns with ISO/IEC 19790 and 24759, introducing stricter requirements particularly around non-invasive attacks (side-channel) and lifecycle management. Many modules certified under 140-2 are being re-certified under 140-3 as their original certificates expire.

SkyeConnex's posture

FIPS 140-3 module certification is in progress. Every primitive in active use is NIST-published. The cryptographic boundary candidates are identified. The test suite already produces KAT-style round-trip evidence — meaning much of the implementation evidence the CSTL will need is already in production.

Where customers need FIPS 140-3

US federal agencies are required to use FIPS-validated cryptography for protecting Sensitive But Unclassified information. Canadian government, defence, and increasingly financial services and healthcare apply similar requirements. ITAR, CMMC, FedRAMP, and many other compliance frameworks reference FIPS 140 directly.

Related terms

• AES-256-GCM
• ML-KEM-1024
• FedRAMP

See also

• SkyeConnex Architecture
• Cryptographic Posture
• Whitepaper v1.2