We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded very similarly but have no certification at all.

What is the actual or usual difference between HSMs and similar devices which have FIPS / CC certification in one model and no or less certification for another model?

As an example I'd like to name the Thales nShield HSMs which are available with level 2 and level 3 certification, the Gemalto ID Prime MD smartcards which have FIPS and Common Criteria certification for one model (830), only CC for another (840) and nothing for a third (3810) and the last but not least the considerations of Yubico to launch a FIPS certified YubiHSM for a much higher price-tag.

  • In short: whether or not they've written up all the docs, and payed to run it through a certification lab. In all liklihood the products are identical. – Mike Ounsworth Apr 22 '16 at 14:08
  • Make sure that the functionality that is required is actually validated at the right level for you. It isn't required to test all of the product to get certified. It is possible to specify a subset and certify just that. – Maarten Bodewes May 18 '16 at 15:58

[Disclaimer: I'm a developer on a FIPS 140-2 Level 2 software module, and I'm a little disgruntled about the whole process]

The main difference I've seen is that things that are FIPS 140-2 certified are at least 6 months out of date when you get them, and cannot be patched in the case of a vulnerability.

Getting something FIPS / CC certified costs $$$, developer effort, and about 6 months of waiting. It's completely infeasible to certify patches, especially emergency security patches. Once we have a commercial FIPS-certified build, that build gets code-frozen for X years until we do another FIPS validation, so customers requiring FIPS 140-2 certified software are forced to use an older, unpatched product.

(Of course we try to work around this as best we can by providing our FIPS customers with external scripts / tools, or hacks to code outside the FIPS boundary, but sometimes the fix just has to wait for our next re-validation. The phrase "How do we solve this without breaking FIPS?" comes up more often than you would expect. So our non-FIPS customers actually have a cleaner (and sometimes more secure) product with a faster patch cycle.)

Less snarky:

The advantages of a FIPS 140-2 / CC certified product is that you know it's built on top of other FIPS 140-2 certified libraries (ex. Linux's RNG /dev/random) and that the out-of-the-box configurations will meet a minimum standard for entropy collection, ramdomization, private key protection, etc.

Final note: I'm speaking to FIPS certified software because that's what I know. As @Polynomial points out in his comment, it's possible that hardware manufacturers may omit the intrusion-detection sensors on their non-FIPS models, or may pre-load it with configurations that improve performance at the expense of security (for example, using /dev/urandom rather than /dev/random). I imagine an HSM sales person would be pretty open about this sort of thing (if you manage to get a sales person who's technical enough).

  • 1
    So "TL;DR: Chances are you're actually better off with the non validated products because they have more recent patches and updates, if you trust the company which you can because they brought the FIPS version through FIPS validation"? – SEJPM Apr 22 '16 at 14:09
  • @SEJPM Yeah, basically. Of course, the FIPS-validated build has been through much more rigorous QA than any other build, and this out-weighs the patching issue for people like banks and governments who lock their servers inside highly secure networks. – Mike Ounsworth Apr 22 '16 at 14:12
  • @SEJPM Our customer support team certainly has much more flexibility if the customer is non-FIPS. – Mike Ounsworth Apr 22 '16 at 14:14
  • 2
    It's about the same for Common Criteria certification (disclaimer etc.). There have been some steps towards a more flexible setup. But the fact that you can claim conformance years after new attacks have been found is strange to say the least. Also note that the labs mainly specialize in the process itself, rather than your specific use case. Still, you know that the process, tests etc. at least exist and are well described (at the time of evaluation, anyway). – Maarten Bodewes May 18 '16 at 15:52

The answer is quite well explained on the FIPS 140-2 Wikipedia article.

The requirements for different levels of certification are as follows (quoting directly from the article; no infringement intended):

Security Level 1 provides the lowest level of security. Basic security requirements are specified for a cryptographic module (e.g., at least one Approved algorithm or Approved security function shall be used). No specific physical security mechanisms are required in a Security Level 1 cryptographic module beyond the basic requirement for production-grade components. An example of a Security Level 1 cryptographic module is a personal computer (PC) encryption board.


In addition to the tamper-evident physical security mechanisms required at Security Level 2, Security Level 3 attempts to prevent the intruder from gaining access to CSPs held within the cryptographic module. Physical security mechanisms required at Security Level 3 are intended to have a high probability of detecting and responding to attempts at physical access, use or modification of the cryptographic module. The physical security mechanisms may include the use of strong enclosures and tamper detection/response circuitry that zeroes all plain text CSPs when the removable covers/doors of the cryptographic module are opened.

Security Level 4 provides the highest level of security. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access.

Penetration of the cryptographic module enclosure from any direction has a very high probability of being detected, resulting in the immediate deletion of all plaintext CSPs.


So, in summary:

  • Level 1 is essentially just "it uses a FIPS certified cipher".
  • Level 2 additionally requires tamper evidence, with some effort put towards physical containment.
  • Level 3 additionally requires active responses to tampering attempts, e.g. deleting the access keys to data if someone attempts to open the device.
  • Level 4 additionally requires environmental monitoring to further prevent the security of the device being compromised by movement, temperature, etc.

Each of these feature sets is more expensive, and the FIPS certification itself is not without cost, so it stands to reason that the higher level devices cost more.

As an anecdote, while I'm unsure whether they do indeed maintain any official FIPS certification, most chip & pin / EMV devices have anti-tamper features which are roughly in-line with levels 3 and 4. For example, most of them have two separate boards internally which are screwed to opposite sides of the chassis, with one board containing power circuitry and a battery, and the other having the firmware on a volatile storage medium (e.g. SDRAM). The two boards are interconnected using a conductive foam or rubber pad, and attempting to open the device separates the boards, causing the firmware and any key material to be lost.

EDIT: So it seems I answered a different question to the intended one.

A common trick in PCB manufacture is to manufacture one board which supports the maximum amount of functionality of a series of devices, then remove components for cut-down versions of the product. This is really common in consumer devices like routers where the same system-on-chip (SoC) design is common among a series of devices, but the feature sets differ. This is a cost-saving exercise, because you can spin up one board and get it produced in large numbers, then tailor the components based on demand of each edition. Why am I talking about PCBs and routers? Because HSMs likely do exactly the same thing: build a common chassis and common internal hardware set, then add the additional modules as and when needed. The different anti-tamper hardware devices and features can be added as and when needed. The practice is a variant of selective assembly.

  • 1
    I think the question was "If the same model of the same product comes both with, and without FIPS 140-2, is there any difference in practice?". I don't think quoting the FIPS definitions addresses this question. – Mike Ounsworth Apr 22 '16 at 14:06
  • Indeed @MikeOunsworth is correct on his interpretation (I know the FIPS levels and this stuff already quite well) – SEJPM Apr 22 '16 at 14:10
  • @MikeOunsworth On the contrary; I suspect they work very similarly to how consumer electronics devices work (especially stuff like routers), whereby one board is produced with pads and traces for all possible components, but some of the components are not populated for certain versions of the device. I suspect that in this realm the HSM devices simply don't include the additional detection hardware, despite being in the same chassis. – Polynomial Apr 22 '16 at 14:10
  • @Polynomial That would be a good answer, if you can find some references for it. – Mike Ounsworth Apr 22 '16 at 14:15
  • Is it your experience / did you read any reports that indicate the selective assembly or is it just your guess / worst assumption / extrapolation of business practices from the consumer industry to the (high) security industry? – SEJPM Apr 22 '16 at 20:59

Your Answer

