FIPS 140-3

FIPS 140-3 is the US government standard that specifies security requirements for cryptographic modules — the libraries and hardware that actually perform encryption. It is the successor to FIPS 140-2, and validation is carried out under the CMVP (the Cryptographic Module Validation Program), run jointly by NIST — the US National Institute of Standards and Technology, which publishes the standard — and its Canadian counterpart.

The distinction that causes the most confusion in practice is between using an approved algorithm and running a validated module. FIPS compliance is not satisfied by choosing a strong cipher such as AES over something weaker. It requires that the cryptographic module itself — a specific version of a specific library, built in a specific way — has been submitted for testing and appears on the CMVP validated list. A patched build of a validated module is, strictly, no longer the validated module.

For operating systems, this typically means enabling a vendor-supplied FIPS mode, which switches the system’s crypto libraries into a validated configuration and disables algorithms that are not approved. That can break things: an SSH client offering a non-approved cipher, or an application pinned to MD5, will simply fail.

FIPS mode is frequently required alongside STIG hardening in federal and defense environments, but it is a separate requirement, and satisfying one does not satisfy the other.