Product Submissions to Federal Information Processing Standard FIPS 201 Compliance Lab NIST Program

1
Product Submissions to Federal Information
Processing Standard (FIPS) 201 Compliance Lab
NIST Program

• Ramaswamy Chandramouli (Mouli)
• mouli_at_nist.gov
• IAB Meeting, April 18, 2006

2
Topics

• FIPS 201 Product Compliance NIST Efforts
• Products under NPIVP Validation Scope
• NPIVP Key Events Artifacts
• PIV Card Application FIPS 201 Validation
  Process
• PIV Middleware FIPS 201 Validation Process
• Current Validation Status
• More Information

3
FIPS 201 Product Compliance NIST Efforts

• NIST Certification Validation Program NPIVP
  NIST Personal Identity Validation Program
• 11 Interim-Designated Test Facilities All are
  accredited CMVP Labs
• Process Underway to convert NPIVP interim
  designations to formal accreditation
• Only 2 Labs are actively testing commercial
  products one more may join soon.

4
Products under NPIVP Validation Scope

• PIV Card Application
• - For conformance to End-Point Card Application
  Card Command Interface (Chapter 7 of SP 800-73)
• PIV Middleware
• - For conformance to End-Point Client
  Application Interface (Chapter 6 of SP 800-73)

5
NPIVP Key Events Artifacts

• NVLAP through CMVP accredits NPIVP Labs
• NIST has published Derived Test Requirements and
  Test Assertions through SP 800-85A document
• NIST provides Testing Toolkit to NPIVP Labs
• Labs Test Vendor submissions of PIV Card
  Application and PIV Middleware and submit Test
  Reports to NIST/NPIVP
• NPIVP Validates Test Results, Issues
  Certificates, Maintains Product Validation Lists.

6
PIV Card Application FIPS 201 Validation Process
Tested for (SP 800-73-1- chapter 7) Interface
Conformance at NPIVP Lab
Crypto Module tested for FIPS 140-2 Conformance
at CMVP Lab
NPIVP Interface Validation Certificate PIV Card
Application
CMVP Validation Certificate
FIPS 201 Validation List PIV Card Application
PIV Card Application Interface Validation List
FIPS 140-2 Validation List
7
PIV Middleware FIPS 201 Validation Process
Tested for (SP 800-73-1- Chapter 6) Interface
Conformance at NPIVP Lab
NPIVP Interface Validation Certificate PIV
Middleware
PIV Middleware Interface Validation List
FIPS 201 Validation List PIV Middleware
8
Current Validation Status (As of April 15th ,
2006)

• PIV Card Application
• - 3 Products under Test in the labs
• - 1 Product Issued Certificate
• - 1 Product Test Results under Review by NPIVP
• PIV Middleware
• - 5 Products under Test in the labs
• Available under http//www.nist.gov/npivp
• (Validation Pre-Validation Lists)

9
More Information

• Contacts
• Mouli (Ramaswamy Chandramouli) -
  mouli_at_nist.gov
• Hildy (Hildy Ferraiolo) - hferraio_at_nist.gov
• Web Pages
• http//csrc.nist.gov/npivp/
• http//csrc.nist.gov/publications/nistpubs/800-85A
  /SP800-85A.pdf
• http//piv.nist.gov/pivqa/