NIST, independent labs test products for FIPS-201 compliance

The National Institute of Standards has contracted with 10 independent laboratories to test vendor smart cards and readers to see whether they conform to Federal Information Processing Standard-201 and NIST Special Publication 800-73.

Curt Barker, co-chairman of NIST's Personal Identification Verification project, said his office plans to post the results of the tests on a public Web site as soon as the vendors and labs make them available?similar to the way NIST posts results for FIPS 140-2 for cryptographic modules.

"We don't know how many vendors are under contract," Barker said. "We have been told several labs have vendors under contract for testing, but they will let us know when it is appropriate."

Barker added that he knows of more than two products that are supposed to have been submitted to labs for conformance testing. Many times vendors do not want competitors or potential customers to know the labs are testing their products for fear of failure, Barker said.

NIST has certified the 10 of 11 labs that test for FIPS 140-2 to run assessments for FIPS-201.

"We are using the cryptography labs because those labs already had a test harness to perform tests," he said. "Going forward, we will do formal accreditation of those labs that choose to participate through the National Volunteer Laboratory Accreditation Program."

Jason Miller is an assistant managing editor of Washington Technology's sister publication, Government Computer News.