We have read dozens of documents now - some that contradict each other - and cannot find a solid source of truth. Does FIPS 140-2 compliance allow for the use of elliptic curve cryptography as a key exchange for TLS communication? ECDH and ECDHE - if so, which P-xxx key sizes?

  • $\begingroup$ What are you trying to do? As far as I can see FIPS 140-2 has nothing to do with TLS communication. The first step should be figuring out which document is relevant for your case. $\endgroup$ Feb 10, 2017 at 15:32
  • $\begingroup$ TLS offers a list of cryptographic algorithms to choose from. And Fips requires that you only use algorithms listed in their standards. The intersection of both are the FIPS allowed TLS modes. A bit googling should also reveal that. $\endgroup$
    – user27950
    Feb 11, 2017 at 19:51
  • 1
    $\begingroup$ Yes it does, the following is for a specific device. In section 3.3.4 here csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/… $\endgroup$
    – Mike
    Jun 28, 2017 at 15:48

1 Answer 1


If you look at the FIPS Implementation Guidelines for FIPS-140-2 here https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/fips140-2/fips1402ig.pdf

In section D.8 Key Agreements, you will find the recommendations. This recommendation points to NIST SP-800-56A, where in Appendix D, there is a table of "Approved ECC Curves and FFC Safe-prime Groups."

SP-800-56A has references to FIPS186-4 and RFC4492 (for TLS) and RFC 5903 (for IKE). These references should be enough to justify use of ECDH in a FIPS140-2 approved device.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.