Glossary comparison
Common Criteria vs FIPS 140-3: what is the difference?
The difference
FIPS 140-3 is the standard used by the Cryptographic Module Validation Program, run by NIST and the Canadian Centre for Cyber Security, to validate cryptographic modules. Common Criteria evaluates a product's wider security claims, and a product can hold both.
Common Criteria (ISO/IEC 15408) evaluates a product against a chosen security target or protection profile and is recognised internationally. FIPS 140-3 tests cryptographic modules against one fixed set of requirements for the US and Canadian governments.
The two terms
Common Criteria
The ISO/IEC 15408 framework under which a product is evaluated against a protection profile and security target by an accredited laboratory, yielding an evaluation assurance level and mutual recognition across participating countries.
FIPS 140-3
The US and Canadian validation standard for cryptographic modules, defining four security levels covering algorithm correctness, key management, physical tamper evidence and response, and self-tests.
Side by side
| Field | Common Criteria | FIPS 140-3 |
|---|---|---|
| Stands for | Common Criteria for Information Technology Security Evaluation | Federal Information Processing Standard 140-3 |
| Type | Standard | Standard |
| Domain | Safety & Security | Safety & Security |
| Group | Security standards | Security standards |