FIPS 140-3 validated cryptography in nRF Connect SDK

[Jimmy012]

Hi,

Does Nordic offer, or have plans to add, a FIPS 140-3 validated cryptographic module directly in the nRF Connect SDK for the nRF54L15?

We are evaluating the wolfSSL crypto library for secure communication and data storage, but would prefer to limit additional third-party software dependencies. Given the nRF54 family's built-in cryptographic capabilities, a Nordic-supported option would be useful.

If this is not currently available, please treat this as a feature request.

Thanks,
Jim

[AHaug]

Hi Jim,

Checking in with the security team about this. From what I understand it might depend on hardware limitations. I'm not 100% sure what restrictions and requirements that FIPS 140-3 sets to crypto modules, but if one of the requirements is hardware related and it doesn't exist on the nRF54L15, then the answer is "no it will not get it". 

If it is a software related requirement, then the answer might be different (this is what I'm waiting an answer to). In the datasheet of the devices there should also be mentions of what cryptographic modules/methods is supported and if one of those modules are also covered by FIPS 140-3 then the answer is yes. Have you validated that neither of these have the "FIPS 140-3 green light"?  

As I understand it:

• FIPS 140-3 specifies the security requirements for cryptographic modules, including TRNGs.
• NIST SP 800-90B provides in-depth guidance for designing and validating the entropy sources that generate the randomness for TRNGs.
• A TRNG must pass the entropy source validation from NIST SP 800-90B to qualify under FIPS 140-3 certification.

In essence, NIST SP 800-90B is the technical companion to FIPS 140-3 for entropy source validation and testing, ensuring the cryptographic module (including the TRNG) meets stringent security requirements for randomness and unpredictability.

Let me know if you have any comments/thoughts w.r.t this and I'll get back to you once I've discussed if 1) we have a crypto module that fits the requirements and/or if there's any plans for a software based crypto module that meets the requirements.

Kind regards,
Andreas