What does the certification criterion of VSA require, and which levels of FIPS 140 does it build on?
At VSA4 the authenticator must be certified at least to FIPS 140-2 Level 3 or Common Criteria EAL 4+, giving the best possible protection against attacks; FIPS 140 has four levels, from basic requirements up to complete physical protection.
The questions behind the criterion: Is the authenticator certified? Does it offer the best possible protection against attacks? Only two values exist: no certification (VSA1 to VSA3) and certification (VSA4).
The FIPS 140 security levels for cryptographic modules:
| Level | Requirement |
|---|---|
| 1 | Basic security requirements (approved algorithms), no physical protection |
| 2 | Tamper evidence (seals, coatings) and role-based authentication |
| 3 | Stronger physical protection: attempts to tamper are detected or prevented, for example by wiping keys when the case is opened |
| 4 | Highest level: comprehensive protection against physical and environmental attacks |
Common Criteria EAL 4+ is the ISO/IEC 15408 alternative: EAL4 means "methodically designed, tested and reviewed", and the "+" marks extra assurance components.
Note on currency: FIPS 140-2 has been superseded by FIPS 140-3. NIST stopped accepting new FIPS 140-2 submissions in 2022, and all FIPS 140-2 validations were moved to the Historical List in September 2026. The eCH-0170 text (V2.0.1) still names FIPS 140-2 Level 3; for a new device you would look for an equivalent FIPS 140-3 validation.
Go deeper:
FIPS 140-2: Security levels (Wikipedia) — what each of the four levels demands.- NIST CMVP: FIPS 140-3 transition — the timeline that moved all FIPS 140-2 certificates to the Historical List in September 2026.
- Evaluation Assurance Level: EAL4 (Wikipedia) — what Common Criteria EAL4 certifies.