808bits

Windows Server 2003 Kernel Mode Cryptographic Module (FIPS.SYS)

FIPS 140-2 certificate #405 · Microsoft Corporation · data as of 2026-10-21

Windows Server 2003 Kernel Mode Cryptographic Module (FIPS.SYS), from Microsoft Corporation, holds FIPS 140-2 certificate #405 at overall level 1. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Historical. Moved to historical list due to sunsetting. Federal agencies may reference historical validations for existing systems only, not for new procurement.
Caveat: When operated in FIPS mode

Certificate

Certificate number405
StandardFIPS 140-2
Statushistorical
Overall level1
Module typeSoftware
EmbodimentMulti-chip standalone
VendorMicrosoft Corporation · website
Software versions5.2.3790.0 and 5.2.3790.1830 [SP1]

Module description

Quoted from the NIST CMVP entry for this certificate.

Microsoft Corporation’s Windows Server 2003 Kernel Mode Cryptographic Module (FIPS.SYS) is a FIPS 140-2 Level 1 compliant, general-purpose, software-based, cryptographic module residing at the Kernel Mode level of the Windows Operating System. It runs as a kernel mode export driver (a kernel-mode DLL) and encapsulates several different cryptographic algorithms in an easy-to-use cryptographic module accessible by other kernel mode drivers. It can be linked into other kernel mode services to permit the use of FIPS 140-2 Level 1 compliant cryptography.

Security level exceptions

  • EMI/EMC: Level 3

Approved algorithms (2)

AlgorithmCAVP certificates
SHS177, 371
Triple-DES201, 370

Other algorithms

DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

Tested configurations

  • Windows Server 2003 (x86) [1] and Windows Server 2003 Service Pack 1 (x86, x64, and IA64) [2] (single user mode)

Validation history

DateTypeLab
2004-03-18InitialSAIC-VA
2005-10-07Update
2005-10-25Update
2007-10-15Update

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical
  • Validation dates on record: 2004-03-18, 2005-10-07, 2005-10-25, 2007-10-15

Source documents