Navigating The Seas Of FIPS 140-2 CMVP With Certified Root Of Trust And TRNG IP

No captain worth his salt would set sail without an experienced navigator at his side. Likewise, when navigating the FIPS 140-2 CMVP process, it’s extremely valuable to have a partner that has already successfully made the journey. More specifically, working with a partner that offers CMVP-certified IP can streamline the process and increase the success of achieving CMVP certification of chips and systems.

The CMVP (Cryptographic Module Validation Program) is a joint effort between the US National Institute of Standards and Technology (NIST) and the Canadian Communications Security Establishment (CSE). It covers these broad areas for systems processing sensitive information: cryptographic module specification, cryptographic module ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.

Rambus has successfully completed the rigorous CMVP process for multiple generations of our Rambus RT-130 Root of Trust. You can find information on the certification here. As part of reaching CMVP certification, the crypto accelerators in the RT-130 are also certified to the Cryptographic Algorithm Validation Program (CAVP) and the certified algorithmic capabilities including AES-GCM, AES-XTS, HMAC and SHA can be found here.

The RT-130 is part of a broad family of Rambus Root of Trust solutions. It employs a state machine architecture for processing cryptographic algorithms. For some use cases, deployment of customer-defined security applications is desired requiring programmability in the root of trust. The Rambus RT-600 Root of Trust offers programmable capabilities building on a security co-processor architecture. The RT-630 is in process for CMVP certification as shown on the NIST CMVP “Modules in Process List.”

One of the key components of any root of trust that performs cryptographic functions is an entropy source, or in other words a random number generator, to seed its security algorithms. Both the RT-130 and RT-630 incorporate the Rambus TRNG-IP-76 True Random Number Generator (TRNG) which is itself NIST certified.

NIST developed the Special Publication (SP) 800-90 series of standards for the construction and validation of Random Bit Generators (RBGs). As NIST describes in the scope of these publications, the SP 800-90 series “provide a basis of validation by NIST’s Cryptographic Algorithm Validation Program (CAVP) and Cryptographic Module Validation Program (CMVP)” for FIPS 140-2 certification.

SP 800-90B lays out the rigorous design and testing requirements for entropy sources. To date, only three parties have successfully certified their products against this standard, and Rambus has done this with the TRNG-IP-76 for security IP that can be incorporated into an SoC or FPGA. In addition to its incorporation in Rambus Root of Trust solutions including the RT-130, the RT-630, and the RT-660, the TRNG-IP-76 is available as a stand-alone IP block for licensing. In addition, the TRNG-IP-76 is available in multiple configurations: entropy generator only NRBG (Non-Deterministic Random Bit Generator); entropy generator with SP800-90B hardware conditioning; and entropy generator with various SP800-90A DRBG (Deterministic Random Bit Generator) options.

Use cases for the TRNG-IP-76 are many and include:

• Seeding of cryptographic algorithms with a security level of 256 bits
• Generation of cryptographic key material
• Generation of initialization vectors (IV)
• Generation of cookies, nonces and PRNG seeds
• Generation of DPA masking
• Obtaining cryptographically secure random data, the Conditioning Function and/or DRBG post- processing of the Noise Source data as required, per SP 800-90A, SP 800-90B and SP 800-90C (draft)
• Statistical Sampling
• Re-try timers in communications protocols
• Noise generation

The upshot is, when you’re ready to set off on the voyage of FIPS CMVP certification, check out our FIPS 140 support package, with all the appropriate documentation, test files and lab contacts to help take your chip incorporating our certified IP through the CMVP process. In addition, we’ve updated the RT-130, RT-630 and RT-660 to meet the new FIPS 140-3 revision CMVP requirements.

Additional Information:

• Rambus Root of Trust Solutions
• RT-130 Root of Trust
• RT-630 Root of Trust
• RT-660 Root of Trust
• TRNG-IP-76 True Random Number Generator