Cryptographic Product Certification: Fundamentals

Most confusion about certification starts with one sentence: “our HSM is certified.” Certified by whom, for what, and which part of it? This module teaches each scheme by the single question its certificate answers. Once you know the question, you also know which questions a certificate leaves open — and those are the ones a buyer, an evaluator or an auditor will ask next.

Throughout the module we follow one product: the Orrin N7fictional, a network-attached hardware security module (hsm), sold as an on-premises appliance and as a multi-tenant cloud hsm service. It sells into four markets — us federal agency, eu qualified trust service provider, smart-card / secure-element manufacturer, payment processor — and its vendor is adding ml-kem and ml-dsa, with optional hybrid. Every scheme sees a different object inside this one product.

One question per scheme

Notice what the table does not contain: a column that ranks the schemes. There is no exchange rate between a FIPS level, an EAL and a PCI approval, because they measure different things about different objects. A FIPS 140-3 validation says a defined module meets FIPS requirements (FIPS 140-3 — Security Requirements for Cryptographic Modules, as modified by SP 800-140A–F). A Common Criteria certificate says a TOE met the claims in its Security Target, to the depth of a named assurance package (Common Criteria 2022 Part 3 — Security Assurance Components (R1)). EUCC does the same under EU law (Commission Implementing Regulation (EU) 2024/482 — the EUCC cybersecurity certification scheme), with two assurance levels: substantial (AVA_VAN 1–2) and high (AVA_VAN 3–5). PCI SSC approves a payment device, and separately its standards assess the entities that run payment operations.

PCI is two questions, not one

The PCI row is the one learners most often collapse. PTS HSM approval covers the device — model, hardware version, firmware version — “up to the point of initial deployment”, after a PCI-recognized lab evaluates it and PCI SSC reviews and lists it (PCI SSC Publishes PCI PTS HSM v5.0 (PCI Perspectives blog)). PIN Security, P2PE and KMO assess how an acquirer, a solution provider or a key-injection facility operates. The same Orrin N7 can be a listed device, a component of a processor’s PIN environment, and the decryption HSM in a P2PE solution — three different assessments, one box.

Terms that must stay distinct

Algorithm standard

Defines an algorithm — for example FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA).

Algorithm validation (CAVP / ACVP)

Evidence that an identified implementation correctly performs identified algorithm operations and parameters. It is not a module certificate.

Cryptographic module validation (CMVP)

A defined module evaluated against FIPS 140-3 as modified by SP 800-140A–F, under the Management Manual and the Implementation Guidance.

Modules in Process (MIP)

A queue position with a status (Pending Review, Cost Recovery, Review, Comment Resolution, Finalization, Hold). Not evidence of any outcome.

Historical (CMVP)

No longer valid for new procurement. FIPS 140-2 modules moved there on 21/22 September 2026 and may be used only in existing systems.

Target of Evaluation (TOE)

The exact product, or part of a product, evaluated under Common Criteria.

Security Target (ST)

The product-specific security claims and requirements a CC evaluation checks.

Protection Profile (PP)

Reusable security requirements for a class of products, which a Security Target may claim.

Evaluation Assurance Level (EAL)

A predefined Common Criteria assurance package — how thoroughly the claims were checked. Not a cryptographic strength or a "security score".

EAL4+

EAL4 plus specifically named assurance components. The "+" means nothing until the list is read.

EUCC

The EU Common Criteria-based scheme under Implementing Regulation (EU) 2024/482 (applies from 27 February 2025), amended by 2024/3144 and 2025/2462. Levels: substantial (AVA_VAN 1–2) and high (AVA_VAN 3–5).

eIDAS 2.0

Regulation (EU) 2024/1183, amending eIDAS and establishing the European Digital Identity Framework. A regulation — not a Protection Profile.

PCI PTS HSM approval

Device approval "up to the point of initial deployment" after evaluation by a PCI-recognized lab. Not a FIPS or CC certificate.

PCI PIN / P2PE / KMO assessment

Assessment of an entity’s operations (acquirer, solution provider, key-injection facility) — not of a device.

Shortcuts a certificate never supports

Each of these sentences appears in real marketing, procurement and even training material. Each is false. Learn the correct statement beside it; the capstone checks your claims against this list.

• EAL4+ is equivalent to FIPS 140-3 Level 4.

  They measure different things. An EAL is how thoroughly a TOE’s claims were evaluated; a FIPS level is a set of security requirements a module meets. Neither converts into the other.

• Passing ACVP means the module is FIPS validated.

  ACVP / CAVP validates algorithm implementations. It is necessary evidence for a module validation, but only the CMVP issues the module’s validation record.

• Using a NIST-standardized PQC algorithm makes a product FIPS validated.

  An algorithm standard says what ML-KEM is. Validation says a specific implementation, inside a specific module, was tested and reviewed.

• A module on the CMVP Modules-in-Process list is FIPS validated, or "validation pending at Level N".

  The MIP list shows a queue position and a status. It is not evidence of any outcome or level.

• eIDAS 2.0 is a Protection Profile.

  eIDAS is a regulation. It leads, through implementing acts and EUCC, to Protection Profiles such as EN 419221-5, against which devices are certified.

• EUCC is simply the EU version of a CCRA certificate, recognized identically everywhere.

  EUCC is an EU legal scheme with its own rules and levels. EUCC certificates can carry the CCRA mark (CCMC-011, March 2025), but recognition depends on the scheme and the buyer.

• A FIPS Level 3 HSM automatically satisfies PCI PTS HSM, or an eIDAS / QSCD Protection Profile.

  PTS HSM approval and PP certification are separate evaluations. But see the nuance below: some PCI entity requirements accept a FIPS Level 3 HSM.

• PCI PTS HSM approval proves every exposed PQC algorithm was independently validated under ACVP.

  PTS approval is a device-security approval. It is not algorithm validation.

• A PCI listing’s PQC flag means a specific PQC algorithm or parameter set is approved.

  For v3-and-higher HSMs the listing notation “is for the existence of PQC support”. Algorithm detail is in the Security Policy; readiness detail comes from the vendor.

• An old EAL4+ claim is automatically comparable with a current CC:2022 or EUCC evaluation.

  The criteria version, the PP version, the augmentations and the attack landscape all differ. Compare the named components, not the label.

Three more shortcuts concern timing and process — a market deadline treated as a certification route, SP 1800-40 read as vendor self-certification, and Executive Order 14412 treated as if it had already changed the CMVP. They are taught in the deadlines section.

Worked example: one sentence, four customers

Suppose the Orrin N7 datasheet says: “FIPS 140-3 Level 3 validated.” Assume the validation is real. What has each customer learned?

• US federal agency: the answer to its question — if the validated module version and approved mode are the ones it will run. Scope is the next question.
• EU qualified trust service provider: nothing about the Protection Profile its eIDAS conformity assessment expects. It needs a CC evaluation under EUCC.
• Secure-element manufacturer: possibly useful evidence about a tool in its production site — whether its evaluator accepts it is a question to ask.
• Payment processor: not device approval. Possibly enough for its PIN or P2PE HSM requirement. Its own operations still need their own assessment.

One true sentence; four different amounts of information. The Which scheme answers the question? workshop step lets you practise this with real procurement claims.

Go deeper, one scheme at a time: FIPS 140-3 Certification, Common Criteria, EUCC & eIDAS Certification and PCI Certification.