Demo: 2026-7-20
Prod:
- New Algorithms (Demo only):
- ctrDRBG / SP800-90Ar1, hashDRBG / SP800-90Ar1, and hmacDRBG / SP800-90Ar1 (Algo / Revision) - The new ctrDRBG, hashDRBG, and hmacDRBG SP800-90Ar1 testing revisions differ from their 1.0 counterparts in the following ways:
- the returnedBitsLen registration is changed from being an integer type to being a domain type
- the ctrDRBG / 1.0 testing does not support variable length counter fields. Variable length counter fields were introduced in SP 800-90Ar1. The new ctrDRBG SP800-90Ar1 testing revision adds the new counterFieldLen registration property.
- requested in usnistgov/ACVP#1622
- ML-KEM / encapDecap / FIPS203-tr1 and ML-DSA / sigGen / FIPS204-tr1 (Algo / Mode / Revision) - The new ML-KEM encapDecap and ML-DSA sigGen testing revisions add the possibility to use the seed, expanded private key format, or both in testing. This is accomplished by a new registration property: keyFormats.
- LMS / sigGen / SP800-208 and LMS / sigVer / SP800-208 (Algo / Mode / Revision) - The new LMS sigGen and LMS sigVer testing revisions add the messageLength registration property and allow IUTs to specify supported message lengths.
- The new LMS sigGen testing revision also adds checks for
Quniqueness across signatures generated from the same tree.
- The new LMS sigGen testing revision also adds checks for
- ctrDRBG / SP800-90Ar1, hashDRBG / SP800-90Ar1, and hmacDRBG / SP800-90Ar1 (Algo / Revision) - The new ctrDRBG, hashDRBG, and hmacDRBG SP800-90Ar1 testing revisions differ from their 1.0 counterparts in the following ways:
- RSA keyGen FIPS186-5
- Addresses an issue where the validation incorrectly specified test case failures when
"isSample" : trueand"infoGeneratedByServer" : false. - #450
- Addresses an issue where the validation incorrectly specified test case failures when
- KDF SPDM 1.0
- Removes the thLen registration property and fixes an issue with the v1.3 SPDM testing.
- usnistgov/ACVP#1631
- ConditioningComponents / BlockCipher_DF / v1.0 - corrects an issue where
outputLengthwas missing from the prompt. - ML-DSA sigGen FIPS204 and ML-DSA sigVer FIPS204 - resolves an issue where registrations that used incorrect casing for the externalMu property were not rejected by the ACVTS.
- ctrDRBG / 1.0 - addresses an issue with the implementation of CTR_DRBG_Update() that was present in the ctrDRBG / 1.0 testing where
V = (V+1) mod 2^blocklenwould be calculated incorrectly with a probability of 1 in 2^128. - LMS sigGen 1.0 - Adds checks for
Quniqueness across signatures generated from the same tree.