808bits

DocuSign QSCD Appliance

FIPS 140-3 certificate #4782 · DocuSign, Inc. · data as of 2026-10-09

DocuSign QSCD Appliance, from DocuSign, Inc., holds FIPS 140-3 certificate #4782 at overall level 3. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its algorithm certificates, its validation history, and the list moves this tracker has observed, which NIST does not date.

Historical. Moved to historical list due to sunsetting. Federal agencies may reference historical validations for existing systems only, not for new procurement. Observed moving to historical on 2026-09-10.
Caveat: Interim validation. When operated in FIPS mode; The module generates cryptographic keys whose strengths are modified by available entropy.

Certificate

Certificate number4782
StandardFIPS 140-3
Statushistorical
Overall level3
Module typeHardware
EmbodimentMulti-Chip Stand Alone
VendorDocuSign, Inc. · website
Hardware versions2.0.0.0
Firmware versions1.2.0.7

Module description

Quoted from the NIST CMVP entry for this certificate.

The DocuSign QSCD Appliance is a digital signature product intended to be used as a Qualified Signature Creation Device (QSCD) in a secure operational environment. It is a highly secure, high capacity network attached HSM. The device consists of COTS hardware, tamper resistance hardware, a hardened operating system, an internal database and server software.

Security level exceptions

  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms (18)

AlgorithmCAVP certificates
AES-CBCA4400, A4404
AES-GCMA4404
ECDSA KeyGen (FIPS186-5)A4404
ECDSA SigGen (FIPS186-5)A4404
ECDSA SigVer (FIPS186-5)A4404
HMAC DRBGA4400
HMAC-SHA2-256A4400, A4404
HMAC-SHA2-384A4400, A4404
HMAC-SHA2-512A4400, A4404
KAS-ECC-SSC Sp800-56Ar3A4404
PBKDFA4404
RSA KeyGen (FIPS186-5)A4400
RSA SigGen (FIPS186-5)A4400, A4404
RSA SigVer (FIPS186-5)A4400
SHA2-256A4400, A4404
SHA2-384A4400, A4404
SHA2-512A4400, A4404
TLS v1.2 KDF RFC7627A4404

Tested configurations

  • N/A

Validation history

DateTypeLab
2024-08-28InitialEWA - Canada

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical at the time of the earliest snapshot
  • 2026-09-10: observed moving from active to historical
  • Validation dates on record: 2024-08-28

Source documents