What is FIPS 140-2 Level 3 HSM

Post Quantum Cryptography

What is the quantum risk and its impact on data security?What are the implications of data sensitivity vs time?When will quantum computing pose a threat to encryption methods?Which protocols and certificates may become vulnerable in the post-quantum era?How can enterprises prepare data security strategies for the post-quantum era?Do current cloud platforms support post-quantum algorithms?What is the concept of cryptographic agility?How does cryptographic agility impact risk management for enterprises?Why is data classification important in the context of post-quantum readiness?How does crypto agility affect disaster recovery planning and insurance costs?What is the technical impact of post-quantum agility on organizations?How does Fortanix DSM help achieve cryptographic agility?What features does Fortanix DSM offer for key lifecycle management in PQC implementation?How does Fortanix DSM facilitate integration with leading applications in PQC implementation?

What is FIPS 140-2 Level 3 HSM

(Federal Information Processing Standard) FIPS 140-2 Level 3 certified HSMs are designed to prevent physical tampering with tamper-evident seals, intrusion sensors, and self-destruct mechanisms. These devices meet the requirements of Level 3 of the FIPS 140-2 standard. They undergo rigorous testing and certification to meet the highest security standards. With Level 3 certification, organizations can rest assured that sensitive information and cryptographic keys are well-protected against physical attacks. 

FIPS standards are developed by NIST's Computer Security Division and are widely adopted in both government and non-government sectors worldwide as a security benchmark. 

FIPS 140-3 is the latest benchmark for validating the effectiveness of cryptographic hardware, and products with FIPS 140-3 certification have been formally validated by both the US and Canadian governments.  

The US Secretary of Commerce signed FIPS 140-3 on May 1, 2019, and starting from April 1, 2022, new submissions must comply with the FIPS PUB 140-3 Security Requirements for Cryptographic Modules, replacing FIPS 140-2. 

The US government uses FIPS 140-2 to verify that private sector cryptographic modules and solutions (hardware and software) meet NIST standards and adhere to the Federal Information Security Management Act of 2002 (FISMA).  

FIPS 140-2 has four levels. For a cryptographic module to meet the stringent requirements of Level 3 under the FIPS 140-2, it must undergo rigorous testing to demonstrate compliance with all four levels of the standard 

Security Level 1 specifies basic security requirements for a cryptographic module. No physical security mechanisms are required except for production-grade equipment. Examples include IC cards, add-on security products, and PC encryption boards. Software cryptographic functions are allowed in a general-purpose PC. This level is suitable for low-level security applications where hardware is too expensive. 

Security Level 2 adds physical security to a Security Level 1 cryptographic module. This level requires tamper-evident coatings, seals, or pick-resistant locks. The coating or seal must be broken to attain physical access to the plaintext cryptographic keys and other critical security parameters within the module. Role-based authentication is also required. Software cryptography is allowed in multi-user timeshared systems when used with a C2 or equivalent trusted operating system. 

Security Level 3 requires enhanced physical security to prevent intruders from accessing critical security parameters held within the module. For example, a multi-chip embedded module must be contained in a strong enclosure. The critical security parameters are zeroized if a cover is removed or a door is opened. This level also requires identity-based authentication and stronger requirements for entering and outputting critical security parameters. Software cryptography is allowed in multi-user timeshared systems when a B1 or equivalent trusted operating system is employed along with a trusted path for the entry and output of critical security parameters. 

Security Level 4 provides the highest level of security. It provides an envelope of protection around the cryptographic module. Level 4 physical security aims to detect penetration of the device from any direction, and critical security parameters should be zeroized. This level also protects a module against compromising its security due to environmental conditions or fluctuations outside of the module's normal operating ranges for voltage and temperature. Level 4 devices are particularly useful for operation in a physically unprotected environment.

Learn more about:

Fortanix HSM Gateway

How to leverage Runtime Encryption® in industry’s first HSM as a Service

HSM-as-a-Service- Innovate before it's too late

HSM as a Service

FIPS 140-2 Level 3 Hardware Security Module (HSM) - Datasheet