FIPS Compliance Readiness for Federal Customers

Customers operating in regulated industries such as government, defense, and federal contracting may require cryptographic components that comply with FIPS 140-2 or FIPS 140-3 standards. This document outlines Aryaka’s current alignment with FIPS requirements and the use of secure cryptographic protocols.

FIPS 140 is a U.S. government standard defining how cryptographic modules must be designed, implemented, and tested for federal use.

• FIPS 140-2 is widely adopted and still recognized for compliance.
• FIPS 140-3 is the updated version and gradually replacing 140-2, adding more stringent validation.

Cryptographic Module Usage

Aryaka security services enforce strong encryption practices aligned with FIPS guidelines by restricting cipher suites and algorithms to those approved under FIPS standards. This approach ensures robust cryptographic controls where regulatory compliance is required.

TLS Cipher Usage by Function:

• SSL Inspection:

• SSL Optimization:

Note: Non-FIPS-approved ciphers can be restricted to maintain alignment with FIPS requirements.

TLS & Encryption Standards

• TLS Versions Supported: TLS 1.2 and TLS 1.3
• Encryption Algorithms: AES-256 GCM, SHA-2 family (e.g., SHA-256)
• Data Protection: AES-256 for both data at rest and in transit
• Security Standards: SOC 2, ISO 27001, GDPR, and other global standards

FIPS-Aligned Deployment Recommendations

Customers in regulated industries can enable a FIPS-aligned configuration by:

• Using TLS 1.2 or higher with FIPS-approved cipher suites
• Integrating with audit logging and SIEM systems for compliance visibility

Certification Status

Aryaka is not currently FIPS 140-2 or 140-3 certified across the full product stack. However:

• We utilize FIPS-validated cryptographic modules
• We operate in a FIPS-aligned posture, restricting algorithms and cipher usage to match FIPS standards
• Formal certification is under evaluation, driven by increased demand from federal and defense sectors

Is Aryaka FIPS 140-2 certified?

Not at this time. While we are not certified as a whole product, we do utilize FIPS-validated crypto modules and follow FIPS aligned practices in our encryption pipeline.

Can I deploy your solution in a FIPS-compliant manner?

Yes, you can deploy our solution in a FIPS-aligned mode that enforces FIPS-approved cryptography. Please contact our support team for guidance on suitable configurations.

Is FIPS 140-3 supported?

FIPS 140-3 is the successor to 140-2. While our roadmap includes alignment with this newer standard, our current focus remains on customer needs for 140-2 compatibility.