Why You Need to Upgrade to FIPS 140-3 Level 3, Military-Grade Mobile Data Protection

FIPS 140-3 Enhancements over FIPS 140-2

Since FIPS 140-2 was defined in the 20th century and approved in 2001, there was a need to define the 21st century update. FIPS 140-3 is the update for the remainder of the 2020 decade, and the next update for the following decade will include stronger protections for quantum computing.

XTS-AES 256-bit encryption used in hardware-encrypted storage drives work as follows: A user creates a password for a brand-new or newly formatted drive. The secure microprocessor in the drive generates a hardware AES encryption key using its random number generator following the NIST standard and approved algorithms. If the random number generator is not truly random in the mathematical sense, it can create a vulnerability that can be exploited by supercomputers to attempt to recreate this unique encryption key.

FIPS 140-3 required manufacturers of secure microprocessors to enhance their internal random number generator to increase entropy (or randomness). Suffice to say that this single cryptographic enhancement has major mathematical consequences to ensure that XTS-AES encryption remains resilient to computer cracking for years if not decades longer – including sufficient protection against near-term quantum computers.

The following changes were also added:

• Minimum PIN or password length: Passwords were increased from 7 to 8 characters for stronger password protection against automated password attacks. Note that brute force password protection should also be present to crypto-erase the drive to stop such attacks early on.
• No preset PIN or password at the factory: All users must set a PIN or password upon first use of the drive.
• Periodic self-testing: Each drive must perform self-testing to ensure security is fully functional. If a problem is detected, the drive must shut down. This protection can detect malfunctions and potential attacks on the circuitry, which can manifest as malfunctions.
• Automatic shutdown under excessive thermal and voltage conditions: If a drive exceeds preset levels, it must shut down. Hackers sometimes use side-channel attacks that result in extreme thermal and voltage conditions. This response can block specific attacks.

This is a massive simplification of the FIPS 140-3 Level 3 standard as it also includes many other protections and safeguards, many of them with complex cryptographic purposes. Typically, a new FIPS 140 standard requires up to two years of effort by manufacturers to redesign their secure microprocessors, enhance their drive firmware and how it processes Critical Security Parameters (CSPs), go through NIST-certified lab testing which even includes source code reviews in addition to thorough testing, and finally introduce their drives to the market.

Note that drives can be designated as FIPS 140-3 Level 3 (Pending) because, after lab testing is complete, NIST can take up to 18 months to issue the final certificate due to the backlog of software and hardware certifications in its queue. Kingston only markets its drives after lab testing is complete. You can see pending certifications on this NIST website.