FIPS Standard

! the maintenance access interface shall include all physical access paths to the contents of the

cryptographic module, including any removable covers or doors,

! any removable covers or doors included within the maintenance access interface shall be

safeguarded using the appropriate physical security mechanisms,

! all plaintext secret and private keys and CSPs shall be zeroized when the maintenance access

interface is accessed, and

! documentation shall specify the maintenance access interface and how plaintext secret and

private keys and CSPs are zeroized when the maintenance access interface is accessed.

SECURITY LEVEL 1

The following requirements shall apply to all cryptographic modules for Security Level 1.

• The cryptographic module shall consist of production-grade components that shall include standard

passivation techniques (e.g., a conformal coating or a sealing coat applied over the module’s

circuitry to protect against environmental or other physical damage).

• When performing physical maintenance, all plaintext secret and private keys and other unprotected

CSPs contained in the cryptographic module shall be zeroized. Zeroization shall either be

performed procedurally by the operator or automatically by the cryptographic module.

SECURITY LEVEL 2

In addition to the general requirements for Security Level 1, the following requirement shall apply to all

cryptographic modules for Security Level 2.

• The cryptographic module shall provide evidence of tampering (e.g., on the cover, enclosure, and

seal) when physical access to the module is attempted.

SECURITY LEVEL 3

In addition to the general requirements for Security Levels 1 and 2, the following requirements shall apply

to all cryptographic modules for Security Level 3.

• If the cryptographic module contains any doors or removable covers or if a maintenance access

interface is defined, then the module shall contain tamper response and zeroization circuitry. The

tamper response and zeroization circuitry shall immediately zeroize all plaintext secret and private

keys and CSPs when a door is opened, a cover is removed, or when the maintenance access

interface is accessed. The tamper response and zeroization circuitry shall remain operational when

plaintext secret and private cryptographic keys or CSPs are contained within the cryptographic

module.

• If the cryptographic module contains ventilation holes or slits, then the holes or slits shall be

constructed in a manner that prevents undetected physical probing inside the enclosure (e.g., require

at least one 90 degree bend or obstruction with a substantial blocking material).

SECURITY LEVEL 4

In addition to the general requirements for Security Levels 1, 2, and 3, the following requirement shall

apply to all cryptographic modules for Security Level 4.