NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing to do the work?
Could a C25519/ED25519 cryptographic module be FIPS certified?
Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy.
On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; the particular curves Curve25519, Curve448, edwards25519, and edwards448; and the EdDSA signature scheme instantiated with them, as defined in RFC 7748 and RFC 8032. Comments are due by 2020-01-20.
(The updates do not cover the X25519/X448 DH functions, but NIST's late 2017 announcement of the upcoming changes also mentioned future updates to NIST SP 800-56A, which covers key agreement.)
As of February 3, 2023
One thing that I noticed on the NIST late 2017 transition plan blog for key establishment is this paragraph.
In addition, NIST guidelines on Elliptic Curve Cryptography are also being revised to propose the adoption of new elliptic curves specified in the Internet Engineering Task Force (IETF) RFC 7748. The upcoming draft of SP 800-186, which will specify approved elliptic curves, will include the curves currently specified in FIPS 186-4 and two additional curves: Curve25519 and Curve448. Their associated key agreement schemes, X25519 and X448, will be considered for inclusion in a subsequent revision to SP 800-56A. The CMVP does not intend to enforce compliance with SP 800-56A until these revisions are complete.
Does that mean that there now that SP 800-186 and FIPS 186-5 are published we can still get CMVP certified for x25519 while they wait for the SP 800-56A update?
that's unclear I'll try emailing the blog post address to confirm.