# FIPS 140-3 (Federal Information Processing Standard 140-3)

> The US standard for validating cryptographic modules, required for federal systems handling sensitive information.

**FIPS 140-3** is the US government standard that specifies security requirements for cryptographic modules — the libraries and hardware that actually perform encryption. It is the successor to FIPS 140-2, and validation is carried out under the **CMVP** (the Cryptographic Module Validation Program), run jointly by **NIST** — the US National Institute of Standards and Technology, which publishes the standard — and its Canadian counterpart.

The distinction that causes the most confusion in practice is between *using* an approved algorithm and running a *validated module*. FIPS compliance is not satisfied by choosing a strong cipher such as AES over something weaker. It requires that the cryptographic module itself — a specific version of a specific library, built in a specific way — has been submitted for testing and appears on the CMVP validated list. A patched build of a validated module is, strictly, no longer the validated module.

For operating systems, this typically means enabling a vendor-supplied FIPS mode, which switches the system's crypto libraries into a validated configuration and disables algorithms that are not approved. That can break things: an SSH client offering a non-approved cipher, or an application pinned to MD5, will simply fail.

FIPS mode is frequently required alongside [STIG](https://primcoat.app/glossary/disa-stig) hardening in federal and defense environments, but it is a separate requirement, and satisfying one does not satisfy the other.

## Related

- https://primcoat.app/glossary/disa-stig.md
- https://primcoat.app/glossary/cis-benchmark.md

---

Source: https://primcoat.app/glossary/fips-140-3
Primcoat — a managed VM image factory. https://primcoat.app