Computer security news and media

Computer security experts at the National Institute of Standards and Technology have developed a new standard for information scrambling products used by civilian federal agencies. The standard, NIST Federal Information Processing Standard 140-2, Security Requirements for Cryptographic Modules, becomes effective November 25, 2001.

Computer security products used by agencies for sensitive, unclassified information must be certified under the new FIPS standard. It replaces a standard, 140-1, that had been in place since 1994.

Accredited private sector laboratories have tested and validated more than 150 cryptographic modules as conforming to the existing standard. Indeed, the list is a "who's who" of cryptographic and information technology vendors and developers from the United States, Canada, and abroad. The list contains a complete range of security levels and a broad spectrum of product types including secure radios, Internet browsers, VPN devices, PC postage equipment, cryptographic accelerators, and others.

Vendors who plan to sell security equipment to the federal government submit their products and systems to the Cryptographic Module Validation Program. The CMVP is a joint program between NIST and its Canadian counterpart, the Communications Security Establishment. Before the launch of the testing program in 1995, there was no generally accepted way to test cryptographic modules. The cryptographic modules may be any combination of hardware, software and firmware.

While the government agencies oversee the program, all of the nuts-and-bolts testing is done by private, accredited laboratories in the United States and Canada. The program tests ensure that a product meets federal standards. Federal agencies are currently required to use FIPS 140-1 when purchasing cryptographic products intended to protect information. Additionally, the standards are used in the private sector as well, particularly in the financial services industry.

Detailed information about the new standard is available at http://www.nist.gov/fips 140-2.

Media Contact: Philip Bulman, (301) 975-5661; philip. bulman@nist.gov.