An open-source PKCS#11 v3.2 cryptographic module under Simorgh Labs
No submission is planned. This checklist enumerates what a CST lab or CC evaluator asks for. It is kept because knowing what the evidence looks like is how you build to it — and because that list is difficult to find outside a paid engagement. FreeHSM is not certified and will not be: the cost is the barrier this project exists to route around. Read this as a specification of rigour, not as a plan.
What a NIST-accredited Cryptographic and Security Testing (CST) lab asks for when evaluating a module against FIPS 140-3 Level 1. Used here as a specification of the evidence to produce, not as a submission plan.
Status : developer-side artefact list, compiled from published lab requirements. Anyone actually submitting would receive a Statement of Work asking for more; treat this as the floor of what is expected, not the ceiling. The checkboxes track whether the evidence exists in this repository — they do not track progress toward anything.
dist/refs/v1.1.0.sha256 (committed and GPG-signed)Dockerfile.build SHA-256 (committed)make repro && make dist-verify returns 0 on at least two independent build machinesdocs/FIPS_140_3_SECURITY_TARGET.md (this repo)docs/MECHANISMS.md (78-mechanism table with FIPS-approval status)docs/ARCHITECTURE.md §3 (binary layout) + ELF .fhsm_digest section infodocs/AGD_PRE.md + docs/AGD_OPE.md (FR + EN)docs/AGD_OPE.md §4tests/*.sh (4 integration scripts) + tests/*_e2e.c (3 dlsym harnesses)freehsm-c-src.tar.xz (tarball) + GPG signatureMakefile + Dockerfile.build + docs/AGD_PRE.md §3The lab will require published CAVP certificates for every approved mechanism advertised. The OpenSSL FIPS provider already has cert #4282 covering the underlying primitives, but the lab will ask for our own CMVP-Implementation-Under-Test (IUT) certs derived from CAVP runs of our integration.
fhsm_kat_results after C_Initialize for every approved mechanism on the tested OE. tests/test_smoke prints all 62 vectors and is the driver to use — a tests/kat_report.c was named here and never written.text section causes C_Initialize to return FHSM_RV_INTEGRITY_FAILEDCTR_DRBG-AES-256 stuck-check); a dedicated tests/test_drbg.c is still to be created, and this box cannot be ticked from the boot KAT aloneC_GenerateKeyPair showing the sign+verify post-keygenfhsm_zeroize test that demonstrates buffers are zero after C_Logout/C_Finalize (use gdb snapshots)freehsm-audit dump output showing only length-only event paramsscripts/verify_reproducibility.shDockerfile.build pinning gcc 14.2.0, binutils 2.40, OpenSSL 3.5.6docs/INCIDENT_RESPONSE.mdtests/integration_pkcs11.sh (17 assertions) ; tests/multi_slot_pkcs11.sh (13) ; tests/full_crypto_pkcs11.sh (20)tests/mlkem_e2e, tests/mldsa_e2e, tests/slhdsa_e2e (3 binaries)docs/AGD_PRE.md §7) ; python-pkcs11 alternative clienttests/coverage_matrix.sh exists and exercises every wired C_* function × every wired mechanism — but its default run is not evidence, and was listed here as though it were. It exports FHSM_INTEGRITY_ALLOW_UNSIGNED=1, FHSM_KAT_ALLOW_FAIL=1 and OPENSSL_CONF=/dev/null, so the integrity self-test is skipped, a failing KAT does not stop the module, and every EVP fetch is served by the default provider rather than the validated one. A matrix collected that way attests to none of §7.10.2, §7.10.3 or §7.11. The script now prints a NOTE when the bypass is active so a pasted table says so itself.
Measured 2026-09-04. FHSM_COV_EVIDENCE=1 runs it inside the boundary — integrity verified, KATs enforced, system openssl.cnf and therefore the FIPS provider — and gives PASS = 24, FAIL = 0, SKIP = 9 (total 33), identical to the bypass run. Nothing in this matrix depends on the three escapes.
So this item is submittable, on one condition: the matrix attached must be one produced with FHSM_COV_EVIDENCE=1, and the header line of the report says which mode produced it. A default run remains a regression check and is not evidence.
Note the shape of the original error: the claim was true and unfounded. It was removed because nobody had checked, not because it was wrong — and the check took thirty seconds once the script had a switch that worked. scripts/run_fips_tests.sh (37 of 37 at v2.0.2, provider load proven by tests/probe_fips_loaded) remains the stronger basis for §7.11 because it proves the provider is loaded rather than assuming the configuration did it.freehsm-audit dump output showing the 13 event types over a full sessiontests/multi_slot_pkcs11.sh proof of cross-slot PIN rejection and object isolationC_* rejectingmake integrity refuses to sign on a build that contains non-FIPS providers loadedC_GetInfo outputC_GetTokenInfoThe lab will perform :
Total expected timeline : 6-12 months from initial submission to listed certificate.
Total expected cost : 80-200 k€ for Level 1, 200-500 k€ for Level 2 (excluding code remediation).
C_GenerateKeyPair (currently TBD)fhsm_rng_bytes (currently smoke-only)docs/SIDE_CHANNEL.md)src/fhsm_tpm.c once implemented)These items are tracked in the project’s task list (#152, #153, #154 and follow-ups).