--- title: FIPS 140-3 is not a security guarantee, and auditors know it description: FIPS 140-3 validation certifies only that a cryptographic module correctly implements approved algorithms at a specific firmware version — it says nothing... canonical: https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FIPS 140-3 is not a security guarantee, and auditors know it | daily.dev og:description: FIPS 140-3 validation certifies only that a cryptographic module correctly implements approved algorithms at a specific firmware version — it says nothing... og:url: https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra og:image: https://api.daily.dev/og/posts/SBtkfnsra.png og:image:alt: FIPS 140-3 is not a security guarantee, and auditors know it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FIPS 140-3 is not a security guarantee, and auditors know it **[Hacker News](https://daily.dev/sources/hn)** · 16 min read · 0 upvotes · 0 comments ## Summary FIPS 140-3 validation certifies only that a cryptographic module correctly implements approved algorithms at a specific firmware version — it says nothing about the security of the surrounding system, key management practices, or operational configuration. Real-world examples show the gap: ROCA and EUCLEAK flaws lived inside FIPS-certified silicon for years, Dual_EC_DRBG was an approved backdoored RNG for a decade, and the 2019 YubiKey FIPS bug was actually caused by the mandatory FIPS self-tests, making the certified product less secure than the uncertified consumer version. The validation freeze creates a perverse incentive where vendors must choose between shipping a security fix and losing their certificate. FIPS mode also carries measurable performance costs (6-9x slower ECDSA key generation) and blocks entire ecosystems: Bitcoin's secp256k1 curve is not approved, Keccak-256 is not standard SHA-3, and BIP32's HMAC key is 96 bits — below the 112-bit floor — causing Go's FIPS-only mode to panic on the first derivation step. In practice, over 90% of FIPS HSM buyers reportedly run them with FIPS mode disabled. Competent auditors spend seconds on the certificate and hours on configuration drift, key provenance, quorum holder changes, backup procedures, and ceremony logs — the areas where actual incidents occur. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [FIPS 140-2 vs FIPS 140-3, Explained](https://daily.dev/posts/fips-140-2-vs-fips-140-3-explained-0hfu246f5) · Teleport · 0 upvotes · 0 comments - [Crypto4A QASM Module Achieves FIPS 140-3 Level 3 Validation](https://daily.dev/posts/crypto4a-qasm-module-achieves-fips-140-3-level-3-validation-knwaptizi) · The Quantum Insider · 0 upvotes · 0 comments - [Everything you need to know about FIPS 140-3 on Ubuntu](https://daily.dev/posts/everything-you-need-to-know-about-fips-140-3-on-ubuntu-dkza0cxz5) · Ubuntu · 0 upvotes · 0 comments - [FIPS 140-3 support in OpenSearch](https://daily.dev/posts/fips-140-3-support-in-opensearch-i7zurfqul) · OpenSearch · 0 upvotes · 0 comments - [Run Ruby applications in FIPS mode on Red Hat Enterprise Linux](https://daily.dev/posts/run-ruby-applications-in-fips-mode-on-red-hat-enterprise-linux-8fomlxjb6) · Red Hat Developer · 1 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FIPS 140-3 is not a security guarantee, and auditors know it","url":"https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra"},"datePublished":"2026-08-05T02:21:49.623Z","dateModified":"2026-08-05T02:22:16.884Z","description":"FIPS 140-3 validation certifies only that a cryptographic module correctly implements approved algorithms at a specific firmware version — it says nothing...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fips-140-3-is-not-a-security-guarantee-and-auditors-know-it-sbtkfnsra","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,cryptography","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"FIPS 140-3 is not a security guarantee, and auditors know it"}]} ```