Task 1: Comparison of FIPS 140-2, FIPS 140-3, and Common Criteria
1. Introduction
Security standards play a crucial role in ensuring the integrity, confidentiality, and
availability of information systems. This report compares FIPS 140-2, FIPS 140-3,
and Common Criteria (CC)—three widely recognized security evaluation frameworks.
2. FIPS 140-2 (Federal Information Processing Standard 140-2)
Overview
• Published by NIST (National Institute of Standards and Technology) in 2001.
• Defines security requirements for cryptographic modules used in government and
private sectors.
• Focuses on four security levels (Level 1 to Level 4), with increasing security
assurance.
Key Features
• Level 1: Basic security (e.g., encryption algorithms).
• Level 2: Adds role-based authentication and tamper-evident seals.
• Level 3: Requires physical tamper resistance and identity-based authentication.
• Level 4: Highest level, protecting against environmental attacks.
Limitations
• Lacks modern cryptographic algorithms (e.g., SHA-3, AES-256).
• Does not fully address side-channel attacks.
3. FIPS 140-3 (Federal Information Processing Standard 140-3)
Overview
• Released in 2019 as an update to FIPS 140-2.
• Aligns with ISO/IEC 19790:2012 for international consistency.
• Enhances testing methodologies via CMVP (Cryptographic Module Validation
Program).
Key Improvements Over FIPS 140-2
• Stronger cryptographic requirements (e.g., post-quantum resistance
considerations).
• Enhanced physical security (e.g., advanced tamper detection).
• More rigorous testing (e.g., side-channel attack resistance).
• Software/firmware integrity checks (e.g., secure boot).
Security Levels (Same as FIPS 140-2 but Enhanced)
• Level 1: Minimal security.
• Level 2-4: More stringent requirements for authentication, physical security, and
environmental failure testing.
4. Common Criteria (CC) for Information Security Evaluations
Overview
• An international standard (ISO/IEC 15408) for evaluating IT security products.
• Uses Protection Profiles (PPs) and Security Targets (STs) for assessments.
• Provides Evaluation Assurance Levels (EAL 1-7), where higher levels mean stricter
testing.
Key Components
• Security Functional Requirements (SFRs): Defines security capabilities (e.g.,
access control, audit logging).
• Security Assurance Requirements (SARs): Ensures correct implementation.
• Certification Process: Conducted by accredited labs (e.g., NIAP in the U.S.).
Comparison with FIPS 140-2/3
Feature FIPS 140-2 FIPS 140-3 Common Criteria
Cryptographic Cryptographic Broad IT security
Scope
modules modules products
Security Levels 1-4 1-4 EAL 1-7
Enhanced crypto &
Encryption & Comprehensive
Focus side-channel
physical security security evaluation
resistance
International ISO/IEC 15408
U.S. standard Aligns with ISO 19790
Alignment (Global)
Testing EAL-based
CMVP validation CMVP + ISO 19790
Methodology evaluation
5. Conclusion
• FIPS 140-2/3 are specialized for cryptographic modules, with FIPS 140-3 being more
modern.
• Common Criteria is broader, covering diverse IT security products with flexible
assurance levels.
• Organizations handling sensitive government data may require FIPS validation,
while enterprise security products often seek Common Criteria certification.
