What Is FIPS 140? FIPS 140-2 vs. FIPS 140-3 Explained
-
FIPS 140 is the U.S. security standard for the hardware and software that protect cryptographic keys. Here's what its four levels mean, how FIPS 140-3 replaced FIPS 140-2, and why it matters for code signing.
-
-
*
What Is FIPS 140?
FIPS 140 (Federal Information Processing Standard 140) is a standard published by the U.S. National Institute of Standards and Technology (NIST). It sets security requirements for cryptographic modules: the USB tokens, hardware security modules (HSMs), and software libraries that generate, store, and use cryptographic keys.
Modules are tested by accredited laboratories and validated through the Cryptographic Module Validation Program (CMVP), run jointly by NIST and the Canadian Centre for Cyber Security. A validated module receives a certificate number and is listed in the public CMVP database. FIPS 140 validation is mandatory for U.S. federal agencies, and many private companies use it as a benchmark when choosing security hardware.
-
*
The Four Security Levels
FIPS 140 defines four security levels. Each level includes the requirements of the one below it and adds stricter protection:
Level What it requires Typical example Level 1 Approved cryptographic algorithms. No physical protection required. Software encryption library Level 2 Tamper-evident seals or coatings that show if someone tried to access the device, plus role-based login. USB tokens for code signing Level 3 Tamper resistance: the device detects attempts to open it and erases its keys. Identity-based login. Network and cloud HSMs Level 4 Full protection against physical and environmental attacks, such as voltage or temperature manipulation. Specialized high-security modules -
*
FIPS 140-2 vs. FIPS 140-3
FIPS 140-2 was published in 2001 and was the main version of the standard for two decades. FIPS 140-3 replaced it in September 2019. The new version is based on the international standard ISO/IEC 19790 and adds stricter testing, but it keeps the same four security levels.
The transition took several years. New FIPS 140-2 validations stopped in 2021, and on September 22, 2026, all remaining FIPS 140-2 certificates were moved to the CMVP's Historical list.
A module on the Historical list keeps working, and it can still be used in existing systems. However, it no longer counts as actively validated, so organizations that need FIPS-validated equipment for new purchases should look for FIPS 140-3.
Important: If you're buying a new token or HSM and your organization or customers require FIPS validation, check that the device has an active FIPS 140-3 certificate, not only a FIPS 140-2 one.
-
*
FIPS 140 and Code Signing
Since June 2023, the private key for every code signing certificate must be generated and stored in a hardware module certified to at least FIPS 140-2 Level 2, Common Criteria EAL 4+ (an international security certification), or an equivalent standard. This is why code signing keys now live on USB tokens, HSMs, or cloud HSMs instead of ordinary files. See Code Signing 2023 Industry Changes.
Level 2 is the minimum because its tamper-evident protection and login controls are enough to keep a signing key from being copied or exported, while still allowing compact devices like USB tokens.
Tip: If your certificate authority provides the token or you use a cloud signing service, the CA has already made sure the hardware meets these requirements. You only need to check FIPS or Common Criteria certification yourself if you plan to use your own HSM.
-
*
How to Check a Module
Every validated module has a certificate number. To check a device, ask the vendor for its CMVP certificate number and look it up in the NIST CMVP database. The record shows the standard version (FIPS 140-2 or 140-3), the security level, the exact hardware and firmware versions covered, and whether the certificate is Active or Historical.
-
