Cryptography Standards and Compliance
Cryptography Standards and Compliance
The exam tests which standard governs which requirement, and how to read a compliance claim critically.
Standards map
- FIPS 140-2 / 140-3. Validation of cryptographic modules across four increasing security levels: Level 1 basic; Level 2 tamper evidence plus role-based authentication; Level 3 tamper resistance with identity-based authentication and zeroisation; Level 4 physical envelope and environmental failure protection.
- NIST publications. FIPS 197 (AES), FIPS 180-4 (SHA family), FIPS 186 (DSA/ECDSA), SP 800-38 (modes, including GCM in 38D), SP 800-57 (key management lifecycle), SP 800-131A (algorithm transitions and deprecations).
- Common Criteria. EAL1–EAL7 measure assurance in the evaluation process, not a feature checklist. EAL7 is formally verified design.
- Management and industry. ISO/IEC 27001 for an ISMS, PCI DSS for cardholder data (no WEP, TLS 1.2+, no SSL), HIPAA and GDPR for regulated data, SOX for financial controls.
- Export control. The Wassenaar Arrangement and national regimes (US EAR) restrict export of strong cryptography.
Worked example
A team must ship a FIPS-aligned configuration. They choose AES-256-GCM (FIPS 197 plus SP 800-38D), SHA-384 for hashing, and RSA-3072 or ECDSA P-256 for signatures - all approved under SP 800-131A. They also confirm the module itself holds a FIPS 140-2 or 140-3 validation certificate at Level 2 or above for the exact version deployed. Approved algorithms inside an unvalidated module do not produce a validated solution.
Traps
- Accepting a vendor's "military-grade" or "FIPS compliant" marketing without a certificate number and version.
- Confusing Common Criteria EAL with a strength rating for cryptography.
- Assuming SHA-1 or 3DES remains acceptable because legacy systems still use them.
- Treating compliance as proof of security rather than evidence of process.
- Overlooking export restrictions when distributing strong crypto.