Self-Defending Key Management Service™
Self-Defending Key Management Service™, from Fortanix, Inc., holds FIPS 140-2 certificate #3326 at overall level 1. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.
Caveat: The module generates cryptographic keys whose strengths are modified by available entropy. When operated in FIPS mode
Certificate
| Certificate number | 3326 |
|---|---|
| Standard | FIPS 140-2 |
| Status | historical |
| Overall level | 1 |
| Module type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | Fortanix, Inc. · website |
| Software versions | 2.0.596 and 2.0.NOAESNI-182 |
Module description
Quoted from the NIST CMVP entry for this certificate.
Fortanix Self-Defending Key Management Service™ (SDKMS) is the world’s first cloud service secured with Intel® SGX and built using Fortanix’s patented Runtime Encryption Technology. With SDKMS, you can securely generate, store, and use cryptographic keys and certificates, as well as secrets, or any blob of data. You can integrate with SDKMS using legacy cryptographic interfaces or using its native RESTful interface. SDKMS ensures that you remain in complete control over your keys and secrets. It provides access control to users and applications to enforce authorized access to keys.
Security level exceptions
- Roles, Services, and Authentication: Level 3
- Physical Security: N/A
- Mitigation of Other Attacks: N/A
Approved algorithms (10)
| Algorithm | CAVP certificates |
|---|---|
| AES | 5328, 5329, 5379, 5380 |
| CKG | vendor affirmed |
| CVL | 1818, 1822 |
| DRBG | 2072, 2073 |
| ECDSA | 1418, 1419 |
| HMAC | 3526, 3527 |
| KDF | 191, 195 |
| KTS | |
| RSA | 2876, 2877 |
| SHS | 4280, 4281 |
Allowed algorithms
HMAC-MD5; NDRNG; RSA (key wrapping; key establishment methodology provides 112 bits of encryption strength)
Tested configurations
- Ubuntu 16.04 running on a General purpose x86 based server (SuperMicro SYS-5019S-MR) with Intel® Xeon® CPU E3-1230 V5 @3.40GHz with PAA
- Ubuntu 16.04 running on a General purpose x86 based server (SuperMicro SYS-5019S-MR) with Intel® Xeon® CPU E3-1230 V5 @3.40GHz without PAA (single-user mode)
Validation history
| Date | Type | Lab |
|---|---|---|
| 2018-11-13 | Initial | AEGISOLVE, Inc. |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status historical
- Validation dates on record: 2018-11-13