For those product vendors that have been able to get listed and certified on the DoD Unified Capabilities Approved Products List (UC APL), there is a prerequisite certification required called FIPS 140-2. FIPS 140-2 is a certification program managed by the National Institute for Standards and Technology (NIST) and more specifically the Cryptographic Module Validation Program (CMVP). This program was setup to validate the robustness and security of all encryption modules. This certification process is required for all products being sold to the United States Government. This certification; however, only assesses the cryptographic module functionality and security in accordance with the FIPS 140-2 technical specification: FIPS 140-2 “Security Requirements for Cryptographic Modules.” The current Validated Crypto Module List is located here.
However, during the last few years, the program has been encouraging product vendors to being transitioning their crypto module from using the legacy Random Number Generator (RNG) to a more secure Deterministic Random Bit Generator (DRBG). Without getting into too much technical detail about the details of what the differences are, the key take-away is that the method for determining crypto-randomness is no longer secure with traditional random number generators. This means that modules should move to more bit-level (DRBG) generators as described in the NIST specification: SP 800-131A “Recommendations for Transitioning the Use of Cryptographic Algorithms and Key Lengths.”
What NIST Is Doing Starting 31 January 2016
NIST will begin validating that certifications listed on the FIPS 140-2 Validated Crypto Module List are compliant to this transition guidance. The guidance states that all modules will be categorized into different levels. These levels are as follows:
- Category 1: Modules with DRBG’s only.
- Category 2: Modules without any DRBG’s or RNG’s.
- Category 3: Modules with DRBG’s and RNG’s.
- Category 4: Modules with RNG’s only.
NIST stated on their notification in November 2015, that the “CMVP will move all Category 3 and 4 modules to a Legacy Validation List, effective January 31, 2016. The Legacy Validation List is not to be used for procurement by federal agencies. However, impacted vendors who can substantiate a hardship case as the result of this deadline are encouraged to contact the CMVP as early as possible. The CMVP will work with them to minimize the negative impact.”
This means that FIPS certifications with RNGs only or RNG and DRBGs (both methods in certification) will be moved to a legacy list.
The DoD UC APL Implication
The implication is significant. If the crypto module is category 3 or 4, and moved to the legacy list, then the Defense Information Systems Agency Unified Capabilities Certification Office (DISA UCCO) will remove any product from the UC APL that uses that crypto module. So any product found non-compliant with NIST’s guidance will be removed from the APL. DISA has not released details on when this process will begin. However, they have begun issuing warning emails to possibly non-compliant vendors like the one show below:
“Based on an initial audit by this office it appears that the COMPANY – PRODUCT- TN TRACKING NUMBER on the UC APL may be out of compliance with recent guidance from NIST. We are requesting that you provide a response to this office by 31 January 2016; failure to do so could negatively impact your UC APL status.
All UC APL products must have a FIPS 140-2 approved cryptographic module. Please respond to this office with a correction if this message was received in error, by providing the correct approved FIPS 140-2 Certification number that covers your product. If however the referenced product is affected by this issue please provide a way-ahead and expected FIPS submission timeline to update the cryptographic module used by the referenced UC APL Tracking Number. Questions can be directed to this office.
What You Can Do Now
If you are in the terrible situation of not knowing about this transition and subsequent removal until now, we recommend you get in touch with our UC APL consultants immediately so no future revenue is impacted!