IBM® Crypto for C
IBM® Crypto for C, from IBM® Corporation, holds FIPS 140-2 certificate #3064 at overall level 1. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.
Certificate
| Certificate number | 3064 |
|---|---|
| Standard | FIPS 140-2 |
| Status | historical |
| Overall level | 1 |
| Module type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | IBM® Corporation · website |
| Software versions | 8.6.0.0 [1], 8.6.1.0 [2] |
Module description
Quoted from the NIST CMVP entry for this certificate.
The IBM Crypto for C version 8.6.0.0 (ICC) cryptographic module is implemented in the C programming language. It is packaged as dynamic (shared) libraries usable by applications written in a language that supports C language linking conventions (e.g. C, C++, Java, Assembler, etc.) for use on commercially available operating systems. The ICC allows these applications to access cryptographic functions using an Application Programming Interface (API) provided through an ICC import library and based on the API defined by the OpenSSL group.
Security level exceptions
- Physical Security: N/A
- Mitigation of Other Attacks: N/A
Approved algorithms (11)
| Algorithm | CAVP certificates |
|---|---|
| AES | 4730, 4731, 4732, 4733, 4734, 4736, 4737, 4738 |
| CVL | 1369, 1370, 1371, 1372, 1373, 1375, 1376, 1377 |
| DRBG | 1616, 1617, 1618, 1619, 1620, 1622, 1623, 1624 |
| DSA | 1262, 1263, 1264, 1265, 1266, 1268, 1269, 1270 |
| ECDSA | 1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180 |
| HMAC | 3147, 3148, 3149, 3150, 3151, 3153, 3154, 3155 |
| KTS | |
| RSA | 2579, 2580, 2581, 2582, 2583, 2585, 2586, 2587 |
| SHA-3 | 30, 31, 32, 33, 34, 35, 36, 37 |
| SHS | 3875, 3876, 3877, 3878, 3879, 3881, 3882, 3883 |
| Triple-DES | 2512, 2513, 2514, 2515, 2516, 2517, 2518, 2519 |
Allowed algorithms
Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); EC Diffie-Hellman (CVL Certs. #1369, #1370, #1371, #1372, #1373, #1375, #1376 and #1377, key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength)
Tested configurations
- IBM Modular Extensible Security Architecture (MESA) with Linux kernel 3.10 64-bit under VMware ESXi 6.0, running on Dell PowerEdgeR630 XL with PAA[1]
- IBM Modular Extensible Security Architecture (MESA) with Linux kernel 3.10 64-bit under VMware ESXi 6.0, running on Dell PowerEdgeR630 XL without PAA[1] (single-user mode)
- Microsoft Windows Server 2012R2 64-bit running on Dell PowerEdgeR630 XL with PAA[2]
- Microsoft Windows Server 2012R2 64-bit running on Dell PowerEdgeR630 XL without PAA[2]
- Red Hat Linux Enterprise Server 7.3 64-bit running on Dell PowerEdgeR630 XL with PAA[1]
- Red Hat Linux Enterprise Server 7.3 64-bit running on Dell PowerEdgeR630 XL without PAA[1]
- Solaris 11 64-bit running on Netra SPARC T4-1 Server with PAA[1]
- Solaris 11 64-bit running on Netra SPARC T4-1 Server without PAA[1]
Validation history
| Date | Type | Lab |
|---|---|---|
| 2017-11-14 | Initial | atsec information security corporation |
| 2018-07-10 | Update | atsec information security corporation |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status historical
- Validation dates on record: 2017-11-14, 2018-07-10