If your FIPS 140-2 module includes any FIPS 186-2 algorithms (other than signature verification), then you may be one of the 100+ modules bumped to the CMVP’s historical list (aka “Do Not Buy List” for Federal Agencies).
On September 4, 2020, all of the ubiquitous OpenSSL FIPS Object Modules (FIPS 140-2 Certs. 1747, 2398, 2473) dropped to the CMVP historical list due to the Implementation Guidance for FIPS 140-2, G.18 transition (FIPS 186-2).
As a reminder, the following statement is published on the CMVP website:
If a validation certificate is marked as historical, Federal Agencies should not include these in new procurement.
Q1: What’s the TL;DR version of IG G.18?
A: FIPS 186-4 was published years ago. CMVP declared an end-of-life for FIPS 186-2. Over 100 FIPS 140-2 modules with FIPS 186-2 algorithms were moved to the Historical List after the IG G.18 transition date of September 1, 2020.
Q2: I am using one of the OpenSSL FIPS Object Modules (FIPS 140-2 Certs. 1747, 2398, 2473); what do I do?
A: There are options for you. You may switch to a compatible FIPS module (see Q3). You may decide to switch to another cryptographic module that includes FIPS 186-4 RSA KeyGen/SigGen.
Q3: Are there any open source FIPS 140-2 modules that I can use that are compatible with OpenSSL 1.0.2 and include FIPS 186-4 RSA KeyGen/SigGen?
A: Yes, here are two: (1) BoringCrypto (FIPS Certs. #3678, #3318 and #2964) from Google. (2) KeyPair FIPS Object Module for OpenSSL (FIPS Cert. #3503) is a rebrand of Oracle’s FIPS Cert. #3335.
Q4: My product does not generate RSA keys or signatures, but we are using the OpenSSL FOM. What can I do?
A: KeyPair has FIPS Cert. #3220 on the active modules list — our module is ideal for vendors that use the OpenSSL FIPS Object Module but do not make use of RSA KeyGen or SigGen. We tested the following additional configurations with our module: Android 8.1, CentOS 6, CentOS 7, and Ubuntu 16.04 LTS.
KeyPair Consulting provides expert guidance to meet your FIPS 140 goals