What is FIPS 140-3?
The US NIST standard setting security requirements for cryptographic modules and the basis of their certification. It is based on the international standard ISO/IEC 19790, and as the successor to FIPS 140-2 its certification began to be accepted in 2020. It evaluates the implementation of cryptographic algorithms, key management, self-tests, physical security and more, and has four security levels, 1 to 4. It is often used as a procurement requirement for HSMs and security chips.
Japanese name: FIPS 140-3
FIPS 140-3 appears in 2 practice questions across 2 topics, including Hardware Security: Advanced Topics and Trends, Applied Cryptography.
Field: Hardware Security: Advanced Topics and Trends
Four security levels
Level 1 requires only correct implementation of approved cryptographic algorithms and, physically, little more than production-grade components. Level 2 adds tamper evidence, such as seals or coatings that leave traces when opened, and role-based authentication of operators. Level 3 requires making opening and probing difficult and erasing critical values such as keys when that is detected, together with identity-based authentication. Level 4 goes further, requiring that intrusion from any direction into the enclosure be detected with immediate erasure of those values, and protection when voltage or temperature leaves its range.
What is evaluated and how
The object of evaluation is a cryptographic module, which can be an IC, a board, a whole appliance or a software library, as long as its boundary is defined. Accredited laboratories test whether the algorithm implementations produce correct results and examine how keys are generated, stored and erased, the self-tests run at power-up and other times, physical protections and so on, and the program run by NIST and its Canadian counterpart (CMVP) issues the certificate. FIPS 140-3 also addresses, at the higher levels, mitigation of non-invasive attacks that leak information through power or timing.
FAQ
Can products certified under FIPS 140-2 still be used?
Under NIST's transition plan, all FIPS 140-2 certificates are moved to the Historical list on September 21, 2026. Modules on the Historical list may still be bought and used for existing systems, but for new procurement the reliable approach is to check the current list for FIPS 140-3 certification (as of October 2026).
Which level should be chosen?
It depends on the value of the keys to be protected and the environment. Level 3 is common where physical attacks are also assumed, as in data-center key management, and Level 4 is sometimes chosen for top-level keys or harsh environments. Higher levels also bring higher cost and more constraints.