(title available in French only)
Official Binding
Note
US standard FIPS 140-3, which sets the security requirements for cryptographic modules used by federal agencies, according to four increasing qualitative levels.
The full text is not reproduced here (copyright): see the official source.
Summary
Purpose
NIST’s US standard FIPS PUB 140-3 (22 March 2019) sets the security requirements for cryptographic modules, that is, hardware or software components that perform encryption, signature or key management operations FIPS PUB 140-3, SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES. It supersedes FIPS 140-2 FIPS PUB 140-3, § 1. INTRODUCTION. It provides four levels:
The standard provides four increasing, qualitative levels of security: Level 1, Level 2, Level 3, and Level 4.
The document is short: it aligns with standard ISO/IEC 19790:2012 and refers, for testing, to standard ISO/IEC 24759:2017, with the modifications made by a series of NIST publications (SP 800-140 to 800-140F) FIPS PUB 140-3, § 1. INTRODUCTION FIPS PUB 140-3, § 3.2 International standards FIPS PUB 140-3, § 3.3 Documents Modifying ISO/IEC 19790:2012(E). Modules are validated by the CMVP programme, run by NIST and the Canadian Centre for Cyber Security. The standard states that conformance is not sufficient to ensure that a particular module is secure FIPS PUB 140-3, SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES.
Who it applies to
The standard is primarily aimed at US federal agencies FIPS PUB 140-3, SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES. Within the eIDAS framework, several implementing regulations accept it, at level 3 and until 31.12.2030, for certifying the “secure cryptographic device” that holds certain private keys of qualified providers. The wording, repeated from one act to the next with variations, is for example that for time-stamping. It offers three routes: the Common Criteria (ISO/IEC 15408 or version CC:2022, Parts 1 through 5) at level EAL 4 or higher, the European EUCC scheme at the same level, or FIPS PUB 140-3 level 3. Certification is to a security target, a protection profile or a module design and security documentation; an EUCC-certified device is configured and used in accordance with that certification List of reference standards and specifications for qualified time stamp services.
| Act and annex | Adapted standard | Requirement | Protected key | Intended effect |
|---|---|---|---|---|
| 2025/1929 List of reference standards and specifications for qualified time stamp services | ETSI EN 319 421 V1.3.1 ETSI EN 319 421 V1.3.1 | TIS-7.6.2-03, TIS-7.6.3-02 | generation and storage of the time-stamping unit’s keys | presumption (binding of date and time, and time source) Art. 42(1a) |
| 2025/1942 Annex | ETSI TS 119 441 V1.2.1 ETSI TS 119 441 V1.2.1 | OVR-7.5-03 (conditional) | key of the validation service, if reports are signed | presumption (validation service) Art. 33(2) Art. 40 |
| 2025/1943 Annex I Annex II | ETSI EN 319 411-2 V2.6.1 ETSI EN 319 411-2 V2.6.1 | GEN-6.5.2-02 | key pairs of the provider, including revocation and registration | presumption (qualified certificate) Art. 28(6) Art. 38(6) |
| 2025/1944 List of reference standards and specifications referred to in Article 1 | ETSI EN 319 521 V1.1.1 ETSI EN 319 521 V1.1.1 | REQ-ERDSP-7.5-03 | signing key of the registered delivery service | presumption (process for sending and receiving data) Art. 44(1a) |
| 2025/1946 List of reference standards and specifications referred to in Article 2 | ETSI TS 119 511 V1.1.1 ETSI TS 119 511 V1.1.1 | OVR-7.5-05 (conditional) | key of the preservation service, if it signs a preservation evidence | presumption (preservation service) Art. 34(1a) Art. 40 |
| 2025/2531 List of technical specifications and reference standards for qualified distributed electronic ledgers | ETSI EN 319 401 V3.1.1 ETSI EN 319 401 V3.1.1 | REQ-7.5-06 | keys of the ledger provider, if digital signatures are used | presumption (electronic ledger) Art. 45l(2) |
| 2025/2532 List of reference standards and specifications for qualified electronic archiving services | CEN/TS 18170:2025 CEN/TS 18170:2025 | cryptographic controls (§ 7.6), conditional | signing key of the archiving service, when it digitally signs an object or record; qualified device or device so certified | presumption (archiving service) Art. 45j(2) |
| 2025/1569 Annex I | ETSI TS 119 471 V1.1.1 ETSI TS 119 471 V1.1.1 | REQ-EAASP-7.5.3-02 | signatures or seals of the attestation service other than those of the attestation | obligation for both categories of providers Art. 3; “deemed” for public sector attestations Art. 45f(5) |
In the “intended effect” column, “presumption” refers to the exact word of the regulation: what is indicated in brackets is “presumed” to comply with the requirements concerned where it meets these standards, specifications and procedures; the requirement remains that of the regulation. Annex I to Implementing Regulation 2025/1569 follows a different pattern. Providers of qualified electronic attestations of attributes and providers of attestations issued by or on behalf of a public sector body responsible for an authentic source are required to comply with the standards in that annex Art. 3. For qualified attestations, the empowering article contains no presumption sentence Art. 45d(5). For public sector attestations, the regulation uses another word: the attestation is “deemed” to be compliant with the requirements laid down in paragraph 1 of the article where it complies with the standards, specifications and procedures referred to in paragraph 6 Art. 45f(5). Implementing Regulation 2026/1735, which replaced that annex, is adopted in particular on the basis of that paragraph 6 amending Implementing Regulation (EU) 2025/1569 as regards applicable standards and specifications.
Key points
- Level 3 only. No act in the corpus refers to another level of the standard (as observed on 30-10-2026).
- A deadline. The FIPS PUB 140-3 option applies “until 31.12.2030” in all these acts Annex Annex I.
- FIPS 140-2 for existing systems. Among the acts in the table, only Annex I to Implementing Regulation 2025/1569, applicable to the two categories of providers mentioned above Art. 3, also accepts FIPS-140-2 level 3 until 31.8.2027 for existing certified systems Annex I. That annex was replaced by Implementing Regulation 2026/1735 Art. 1. The text of FIPS 140-2 is not in the corpus.
- The qualified device first. For the attestation itself, the provider uses a qualified signature or seal creation device; FIPS certification only applies to its other signatures or seals Annex I.
Links
- Related standards: Common Criteria CC:2022 CC:2022 R1 Part 1, ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
- Learning path: step 4, trust services and step 5, reading a standard.
Cited version
Several acts in the table cite an intermediate standard in a version older than the latest published one according to the index of ETSI standards in the corpus, consulted on 31-10-2026: ETSI TS 119 441 V1.2.1 (2025/1942; index: V1.3.1) Annex ETSI TS 119 441 V1.2.1, ETSI TS 119 511 V1.1.1 (2025/1946; index: V1.2.1) List of reference standards and specifications referred to in Article 2 ETSI TS 119 511 V1.1.1, ETSI EN 319 401 V3.1.1 (2025/2531) List of technical specifications and reference standards for qualified distributed electronic ledgers ETSI EN 319 401 V3.1.1, of which V3.2.1 is in the corpus ETSI EN 319 401 V3.2.1. The acts name the versions indicated.
Error in the act
In several of these annexes, the Common Criteria route refers to “version CC:2002, Parts 1 through 5”: requirement TIS-7.6.3-02 of Implementing Regulation 2025/1929, requirement GEN-6.5.2-02 of Annexes I and II to Implementing Regulation 2025/1943, requirement REQ-ERDSP-7.5-03 of Implementing Regulation 2025/1944. The English version of these acts carries the same mention List of reference standards and specifications for qualified time stamp services Annex I Annex II List of reference standards and specifications referred to in Article 1. This is probably version CC:2022, which requirement TIS-7.6.2-03 of Implementing Regulation 2025/1929 cites in identical wording List of reference standards and specifications for qualified time stamp services. This reading is ours, not an official correction. The heading of Annex II to Implementing Regulation 2025/1943 refers, in French, to “certificats qualifiés de signature électronique” (qualified certificates for electronic signatures); the English version says electronic seals, and this annex corresponds to qualified certificates for electronic seals Annex II Art. 1. Probable reading of the French version: “certificats qualifiés de cachet électronique”.
Consolidation without official value
This summary cites the consolidated versions of Regulation 910/2014 and of Implementing Regulation 2025/1569 published on EUR-Lex Regulation (EU) No 910/2014 — consolidated version of 18/10/2024 Implementing Regulation (EU) 2025/1569 — consolidated version of 11/08/2026. They serve as documentation: only the texts published in the Official Journal are authentic.
Written by Asphalia.