BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.5 Physical Security

NIST platform security: roots of trust, firmware and secure enclaves FIPS 140-2
All changes in this version
first version loaded 4 SECURITY REQUIREMENTS part of 4

Title

Physical Security

Control

A cryptographic module shall employ physical security mechanisms in order to restrict unauthorized physical access to the contents of the module and to deter unauthorized use or modification of the module (including substitution of the entire module) when installed. All hardware, software, firmware, and data components within the cryptographic boundary shall be protected.

A cryptographic module that is implemented completely in software such that the physical security is provided solely by the host platform is not subject to the physical security requirements of this standard.

Physical security requirements are specified for three defined physical embodiments of a cryptographic module:

• Single-chip cryptographic modules are physical embodiments in which a single integrated circuit (IC) chip may be used as a standalone device or may be embedded within an enclosure or a product that may not be physically protected. Examples of single-chip cryptographic modules include single IC chips or smart cards with a single IC chip.

Multiple-chip embedded cryptographic modules are physical embodiments in which two or more IC chips are interconnected and are embedded within an enclosure or a product that may not be physically protected. Examples of multiple-chip embedded cryptographic modules include adapters and expansion boards.

• Multiple-chip standalone cryptographic modules are physical embodiments in which two or more IC chips are interconnected and the entire enclosure is physically protected. Examples of multiple- chip, standalone cryptographic modules include encrypting routers or secure radios.

Depending on the physical security mechanisms of a cryptographic module, unauthorized attempts at physical access, use, or modification will have a high probability of being detected

• subsequent to an attempt by leaving visible signs (i.e., tamper evidence)

and/or

• during an attempt so that appropriate actions can be taken by the cryptographic module to protect plaintext secret and private keys and CSPs (i.e., tamper response).

Table 2 summarizes the physical security requirements, both general and embodiment-specific, for each of the four security levels. The general physical security requirements at each security level are all three distinct physical embodiments of a cryptographic module. The embodiment-specific physical security requirements at each security level enhance the general requirements at the same level, and the embodiment-specific requirements of the previous level. General Requirements for all Embodiments Single-Chip Cryptographic Modules Multiple-Chip Embedded Cryptographic Modules Multiple-Chip Standalone Cryptographic Modules Security Level 1 Production-grade components (with standard passivation). No additional requirements. If applicable, production-grade enclosure or removable cover. Production-grade enclosure.

Security Level 2 Evidence of tampering (e.g., cover, enclosure, or seal). Opaque tamper-evident coating on chip or enclosure. Opaque tamper-evident encapsulating material or enclosure with tamper-evident seals or pick-resistant locks for doors or removable covers. Opaque enclosure with tamper- evident seals or pick-resistant locks for doors or removable covers.

Security Level 3 Automatic zeroization when accessing the maintenance access interface. Tamper response and zeroization circuitry. Protected vents. Hard opaque tamper-evident coating on chip or strong removal-resistant and penetration resistant enclosure. Hard opaque potting material encapsulation of multiple chip circuitry embodiment or applicable Multiple-Chip Standalone Security Level 3 requirements. Hard opaque potting material encapsulation of multiple chip circuitry embodiment or strong enclosure with removal/penetration attempts causing serious damage.

Security Level 4 EFP or EFT for temperature and voltage. Hard opaque removal-resistant coating on chip. Tamper detection envelope with tamper response and zeroization circuitry. Tamper detection/ response envelope with tamper response and zeroization circuitry.

Table 2: Summary of physical security requirements

In general, Security Level 1 requires minimal physical protection. Security Level 2 requires the addition of tamper-evident mechanisms. Security Level 3 adds requirements for the use of strong enclosures with tamper detection and response mechanisms for removable covers and doors. Security Level 4 adds requirements for the use of strong enclosures with tamper detection and response mechanisms for the entire enclosure. Environmental failure protection (EFP) or environmental failure testing (EFT) is required at Security Level 4. Tamper detection and tamper response are not substitutes for tamper evidence.

Security requirements are specified for a maintenance access interface when a cryptographic module is designed to permit physical access (e.g., by the module vendor or other authorized individuals).