From 7cbc14a0df3f43080cccfe4b8d38cdc52f8e2e11 Mon Sep 17 00:00:00 2001 From: Jeff Andersen Date: Sun, 9 Aug 2026 08:52:33 -0700 Subject: [PATCH] Modify language for FIPS requirements Downgrade to level 1 overall, but ask for level 2 for select areas. --- specifications/attestation-of-system-components/spec.ocp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/specifications/attestation-of-system-components/spec.ocp b/specifications/attestation-of-system-components/spec.ocp index e497290..0952cdf 100644 --- a/specifications/attestation-of-system-components/spec.ocp +++ b/specifications/attestation-of-system-components/spec.ocp @@ -331,7 +331,7 @@ The protocol diagram above shows a variation of the interaction between a newly - *Cryptographic algorithms and deterministic random bit generators **MUST** be validated under the [NIST Cryptographic Algorithm Validation Program (CAVP)](https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program)* -- *Cryptographic modules, if used, **SHOULD** be validated at overall level 2 or higher under [FIPS 140-2 SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf) or [Security Requirements for Cryptographic Modules, FIPS 140-3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf)* +- *Cryptographic modules, if used, **SHOULD** be validated at overall level 1 or higher under [FIPS 140-3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf) and **SHOULD** achieve level 2 or higher in the areas of "Software/Firmware Security" and "Physical Security" (see ISO 19790:2012 Table 1)* - *Entropy, random bits, symmetric keys, and private asymmetric keys **MUST** be generated within the attester device itself, in a hardware security module, or locally, in a device with the following properties:*