FortifyIQ Security Validation & Compliance Assurance FAQ FAQ
FortifyIQ delivers cryptographic IP and software libraries, and roots of trust that are validated, documented, and can be configured to help your products meet even the highest standards of security and regulatory compliance. Using our advanced EDA tools and closely guided integration support, we ensure that the protections validated in our labs are preserved in your actual devices. This approach gives you a trusted foundation for NIST FIPS 140-3 level 4, Common Criteria up to EAL6+, and industry-specific certifications, while reducing the complexity, time, and cost of achieving compliance. Together, these validations give customers the confidence that FortifyIQ technology provides enduring security for today and tomorrow, including the post-quantum era.
How do I know FortifyIQ products are secure against advanced attacks?
What is FortifyIQ’s Security Validation & Assurance program?
It’s a comprehensive framework for verifying that all FortifyIQ software libraries and hardware IPs meet the highest security and compliance requirements. We combine rigorous practical attacks, statistical leakage testing (TVLA), formal proofs in simulation, on an FPGA board, and in silicon (where applicable), and third-party lab validations to ensure resilience against side-channel (SCA) and fault-injection (FIA) attacks, as well as software-level cache attacks. All solutions are engineered to meet or exceed even NIST FIPS 140-3 level 4, Common Criteria AVA_VAN.5, and other industry standards.
How does FortifyIQ validate resistance to side-channel and fault-injection attacks?
Validation is performed using FortifyIQ’s advanced EDA platform, FortiEDA, which supports massive side-channel trace acquisition. Using these traces, we validate our designs through TVLA statistical assessment and by executing a full range of side-channel and fault-injection (SCA and FIA) attacks against our own implementations. We then validate on FPGA boards and, when appropriate, in silicon. Where applicable, we also employ third-party evaluations. For example, our AES algorithm was validated at the highest security level by the Common Criteria–accredited SGS Brightsight laboratory.
Examples:
- RAMBAM AES IP Core – Validated past 1 billion TVLA traces with clear non-leakage, results published in peer-reviewed academic articles. Independently validated by SGS Brightsight, which concluded that, as a soft macro, the validation holds for any core using the RAMBAM algorithm.
- STORM AES Implementation – Proven secure both with a formal proof and through practical tests; in-silicon validation. Read the security proof.
- HMAC-SHA2 Implementations
- TI-based version: Validated against 100 million TVLA traces. Implements the security-proven Threshold Implementation for maximum protection. Read the security proof.
- Compact/Efficient version: Smaller and faster, with practical security demonstrated against all known attacks on HMAC-SHA2 implemented in HW.
- Public Key Accelerator (PKA) IP – Validated in-silicon against 100 million TVLA traces.
How does FortifyIQ’s leakage assessment prove that a design is secure against side-channel attacks?
In simple terms, if there is no leakage, there is nothing for an attacker to exploit, and side-channel attacks become impossible. More technically, our pre-silicon assessment applies the same statistical tests used by accredited evaluation labs for FIPS 140-3 and Common Criteria certification. Because the results are validated against real device measurements, a non-leaking outcome in our pre-silicon analysis demonstrates that the design should remain secure post-fabrication.
What compliance areas do FortifyIQ products support?
FortifyIQ solutions are designed to simplify certification and meet security standards:
- Cryptographic algorithms: AES, HMAC-SHA2, public key cryptography, and post-quantum cryptography (PQC) implementations, all SCA/FIA resistant.
Side-channel and fault-injection resistance: aligned with ISO/IEC 17825, FIPS 140-3 up to level 4 requirements, and Common Criteria to AVA_VAN.5 - FortifyIQ solutions provide secure boot and cryptographic integrity verification, aligned with NIST, EMVCo, automotive, and defense standards, ensuring tamper-resistant operation across a wide range of devices from smartcards to mission-critical embedded systems.
- Root of Trust (RoT): provides secure key storage, lifecycle state control, secure firmware loading, anti-rollback, attestation, and certain physical tamper detection/zeroization features, meeting regulatory requirements.
- PQC readiness in hardware and soon in software, fully resistant to side-channel and fault-injection attacks.
Do I still need a certification lab if I use FortifyIQ products?
Yes. Official certification requires an accredited third-party evaluation. We provide full documentation to make this easier:
- Our design’s security specifications: threat models, security requirements, and protection scope.
- Validation reports: lab results for SCA/FIA and other attacks.
- Security proofs and demonstrations: peer-reviewed research and practical evidence of non-leakage.
- Guidance for maintaining compliance: instructions on how to integrate and operate our solutions within regulatory frameworks.
- Formal academic publications, including two papers providing rigorous mathematical foundations of our AES protections, and additional papers detailing our EDA methodologies for evaluating resistance to side-channel and fault-injection attacks.
- Full validation reports, including TVLA results and attack coverage
- Trace analysis charts demonstrating clear non-leakage
- Compliance mapping to standards (FIPS, CC, NIST, ISO)
- Integration guidelines to preserve security properties
- Third-party lab validation reports (e.g., SGS Brightsight) where applicable
- Comprehensive design and development documentation supporting secure lifecycle and configuration management required for EAL4-6
- Formal Security Target and assurance case templates
- Traceability matrices linking requirements to design and test evidence
Our documentation package accelerates audits and reduces the risk and cost of certification.
How do FIPS 140-3 and Common Criteria AVA_VAN.5 help with industry-specific compliance?
A table is provided at the bottom of this page. These certifications provide a certified, standards-based cryptographic foundation. For example:
- PCI DSS (payments) requires secure cryptography for cardholder data.
- ISO 21434 (automotive) covers cybersecurity engineering practices, including cryptographic modules.
- IEC 62304 (medical) covers secure software development, including cryptography.
FortifyIQ products cover the cryptographic and RoT components, which are usually the most technically challenging parts of compliance.
Which regulations require post-quantum readiness, and does FortifyIQ address this?
Governments, financial institutions, and critical infrastructure sectors are moving toward mandatory deployment of post-quantum cryptography (PQC) in the coming decade.
FortifyIQ provides both hardware and software PQC implementations that are fully SCA/FIA resistant, giving customers a secure foundation for future-proof compliance. These are in advanced development and will be ready soon (end of 2025).
PQC Regulations: A General Timeline
Today, there are no regulations that mandate PQC specifically for the semiconductor design/IP sector of the industry. However, several application industries already face binding timelines:
Government & Defense (U.S.) – Federal agencies must follow NIST PQC standards (FIPS 203–205), with migration milestones under NSM-10 and CNSA 2.0, beginning in 2026 and extending through 2035.
Financial Institutions – Regulators and industry bodies (e.g., FFIEC in the U.S., ECB in Europe) are signaling PQC adoption requirements, since banking is part of critical infrastructure.
Critical Infrastructure & Energy (EU) – The EU PQC roadmap requires Member States to begin migration by 2026 and secure critical infrastructure with PQC by 2030.
Telecom & Automotive – Early draft standards already call for PQC-ready security in connected devices and networks.
FortifyIQ is developing PQC-protected IP cores and assessment tools, scheduled to be ready by the end of 2025. This ensures our customers can meet upcoming mandates across these regulated sectors well before enforcement deadlines.
What does FortifyIQ offer in terms of Post-Quantum readiness?
Our SCA/FIA-resistant hardware roots of trust and Cryptobox IPs support hybrid classical + PQC algorithms (including NIST’s ML-KEM and ML-DSA), including integration guidance for migration and key parameter support. Our SW libraries are in advanced development and will soon (Q1 2026) offer these PQC algorithms with SCA/FIA resistance.
Are FortifyIQ products certified?
Many FortifyIQ products are certification-ready, aligning with FIPS 140-3, Common Criteria, and other relevant standards. While not all products ship with certification, they are validated and documented to enable rapid certification in customer deployments.
What documentation does FortifyIQ provide for certification or security-assessment purposes?
Customers receive:
- Our design’s security specifications: threat models, security requirements, and protection scope.
- Validation reports: lab results for SCA/FIA and other attacks.
- Security proofs and demonstrations: peer-reviewed research and practical evidence of non-leakage.
- Guidance for maintaining compliance: instructions on how to integrate and operate our solutions within regulatory frameworks.
- Formal academic publications, including two papers providing rigorous mathematical foundations of our AES protections, and additional papers detailing our EDA methodologies for evaluating resistance to side-channel and fault-injection attacks.
- Full validation reports, including TVLA results and attack coverage
- Trace analysis charts demonstrating clear non-leakage
- Compliance mapping to standards (FIPS, CC, NIST, ISO)
- Integration guidelines to preserve security properties
- Third-party lab validation reports (e.g., SGS Brightsight) where applicable
- Comprehensive design and development documentation supporting secure lifecycle and configuration management required for EAL4-6
- Formal Security Target and assurance case templates
- Traceability matrices linking requirements to design and test evidence
What other services does FortifyIQ offer to support certification?
We offer the following services:
- Integration consulting to ensure compliance in the end product. The documentation provided should be sufficient.
- Access to our EDA tools for in-house evaluation after integration. While unnecessary, it is available.
- Reproducible testing methodologies so customers can replicate validation results
- Continuous updates to address emerging threats
- Optional assistance coordinating with certification labs during evaluation phases
- Optional training and consultancy on certification best practices
What types of attacks are covered by FortifyIQ validation?
- Side-Channel Attacks (SCA): FortifyIQ products are resistant to attacks that extract secrets from physical leakages of the device. Covered attacks include:
Power Analysis
- Differential Power Analysis (DPA)
- Correlation Power Analysis (CPA)
- Higher-Order DPA/CPA
- Simple Power Analysis (SPA)
Electromagnetic Analysis
- Correlation Electromagnetic Analysis (CEMA)
- Template attacks
Timing and Information-Theoretic Attacks
- Timing attacks
- Mutual Information Analysis (MIA)
- Fault-Injection Attacks (FIA): Protection against attacks that deliberately induce errors to compromise secrets. Covered attacks include:
Electrical / Optical Faults
- Voltage and clock glitching
- Laser injection
- Electromagnetic fault injection (EMFI)
- Optical fault injection
Statistical / Safe-Error Faults
- Statistical Ineffective Fault Attacks (SIFA) and Light SIFA
- Safe-error attacks
- Instruction-skip faults
- Microarchitectural Attacks: Cache-based side-channel attacks (arising from processor microarchitecture) only apply to software implementations. FortifyIQ software libraries include protections to mitigate these attacks.
- Known algorithm-specific attacks: e.g., compact HMAC-SHA2 protections against all known attacks on its construction.
Can customers validate FortifyIQ products themselves?
Yes. FortifyIQ offers access to its Side-Channel Studio and Fault Injection Studio as a service. Customers can license these EDA tools to perform TVLA testing and run practical SCA/FIA attacks.
How do your security products help with other compliance standards?
FortifyIQ Compliance Matrix
FortifyIQ products are built to meet the most stringent global security standards (while each product is configurable to meet your specific assurance and PPA needs). Internal validation has been performed according to CC AVA_VAN.5 methodology and FIPS 140-3 Level 3/4 requirements. External certifications (Common Criteria EAL, FIPS 140-3 CMVP) are supported on customer request.
Category
Product
Common Criteria
FIPS 140-3
ISO/IEC Standards
NIST Standards & Guidance
Category
Symmetric Cryptography
Product Family
AES (HW & SW)
Common Criteria
AVA_VAN.5
FIPS 140-3
FIPS 197, FIPS 140-3 L4
ISO/IEC Standards
SO/IEC 18033-3, ISO/IEC 19790
NIST Standards & Guidance
SP 800-38A, 38C, 38D/G
Category
Product Family
HMAC-SHA2 (HW & SW)
Common Criteria (CC)
AVA_VAN.5
FIPS 140-3
FIPS 198-1, FIPS 180-4, FIPS 140-3 L4
ISO/IEC Standards
ISO/IEC 10118-3, 9797-2, 19790
NIST Standards & Guidance
SP 800-107, 56C, 185
Category
Asymmetric Cryptography
Product Family
PKA (HW & SW, RSA/ECC)
Common Criteria (CC)
AVA_VAN.5
FIPS 140-3
FIPS 186-5, FIPS 140-3 L4
ISO/IEC Standards
ISO/IEC 14888, 15946
NIST Standards & Guidance
SP 800-56A/B, 57, 131A
Category
Product Family
PQC (HW & SW, KEM/DSA)
Common Criteria (CC)
AVA_VAN.5
FIPS 140-3
FIPS 140-3 (PQC profiles)
ISO/IEC Standards
ISO/IEC 18033-6 draft, 14888-3/4
NIST Standards & Guidance
SP 800-208, NIST PQC (ML-KEM, ML-DSA)
Category
Platforms & Tools
Product Family
Roots of Trust (RoT)
Common Criteria (CC)
AVA_VAN.5
FIPS 140-3
FIPS 140-3 L4, FIPS 186-5, SP 800-90 RNGs
ISO/IEC Standards
ISO/IEC 19790, 15408, 11770
NIST Standards & Guidance
SP 800-57, 90, 63, 193
Category
Product Family
Cryptobox IP (AES, HMAC, PKA, PQC)
Common Criteria (CC)
AVA_VAN.5
FIPS 140-3
FIPS 140-3 L4 composite
ISO/IEC Standards
ISO/IEC 19790, 11770, 14888, 18033
NIST Standards & Guidance
SP 800-56, 57, 131A, PQC suite
Category
Product Family
EDA Tools (SCA/FIA Evaluation)
Common Criteria (CC)
Supports AVA_VAN.5
FIPS 140-3
Pre-certification support for FIPS 140-3 L4
ISO/IEC Standards
ISO/IEC 15408-3, 17825
NIST Standards & Guidance
SP 800-90B, 140C/D/E