Regarding security levels 1 to 4 of FIPS 140-3, the certification standard for cryptographic modules, which correctly describes the requirements for physical security?

Answer: C. Level 2 requires traces left by opening, Level 3 resisting opening and erasing keys on detection, and Level 4 even intrusion detection over the whole enclosure and protection against abnormal voltage or temperature

FIPS 140-3 is the US NIST standard for cryptographic modules, based on the international standard ISO/IEC 19790, and certification under it began to be accepted in 2020 as the successor to FIPS 140-2. Level 1 needs only production-grade components; Level 2 requires seals or coatings that leave traces when opened; Level 3 requires making opening and probing difficult and erasing critical values such as keys when that is detected; and Level 4 requires detecting intrusion over the whole enclosure and protection when voltage or temperature leaves its range. Certification covers not only physical security but also correct implementation of cryptographic algorithms, key management, self-tests and more. Specifying a level is a common condition when procuring HSMs and security chips.

• A. It is the other way round. The higher the number, the stricter the requirements.
• B. The level expresses not key length but how strict the requirements are, for example for physical security and operator authentication.
• C. Correct. The higher the number, the stronger the requirements for countering physical attacks.