Short answer: no. StreamSec Tools is not FIPS 140-2 or FIPS 140-3 validated, and it does not carry a CMVP certificate. "FIPS compliant" is a property of a validated cryptographic module on the NIST CMVP list, established through independent lab testing - it is not something a library can self-declare from its source code. So the accurate statement is that StreamSec Tools is not a FIPS-validated module, and any product that needs to tick a FIPS-140 box today should obtain that box from an already-validated module (see below).

That said, the library is a strong engineering foundation for FIPS work, and the gap between it and a validation is well understood.

WHAT IS ALREADY IN GOOD SHAPE

• Broad approved-algorithm coverage: AES in every SP 800-38 mode including GCM, CCM and KW; SHA-1/2/3 and SHAKE; HMAC; PBKDF2 and HKDF; RSA PKCS#1 v1.5, PSS and OAEP; ECDSA on the NIST curves with a deterministic (RFC 6979) constant-time path; Ed25519/Ed448; and the NIST post-quantum set - ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205).
• The post-quantum algorithms are implemented to the final FIPS 203/204/205 standards and checked against the NIST test vectors (KATs). They are standards-conformant today even though the module is not validated. (Composite ML-DSA and ML-KEM track the current IETF LAMPS drafts.)
• RSA key generation defaults to the FIPS 186 provable-prime path.
• The default RNG is a structurally faithful SP 800-90A AES-256 CTR_DRBG with a derivation function, reached through a single library-wide factory - so an application can register a FIPS-validated DRBG in its place.
• Zeroization discipline is strong and consistently applied: a multi-pass secure-wipe primitive and key containers that wipe on destruction, across TLS 1.3 and SSH intermediate secrets.
• Fixed-vector self-tests (KATs) already exist for several primitives.

WHAT A VALIDATION WOULD REQUIRE

A fixed, separately built crypto-only module boundary; pre-operational and conditional self-tests orchestrated at start-up plus a module-integrity check; a full SP 800-90B entropy assessment (or re-sourcing to an approved entropy source); approved-mode enforcement and a per-operation service indicator; and a few key-material-handling refinements. Beyond the code, validation means algorithm testing through an accredited laboratory against ACVP and submission to the CMVP - a multi-quarter, five-to-six-figure engagement.

IF YOU NEED FIPS TODAY

• Use an already-validated module for the cryptographic operations - Windows CNG / BCrypt in FIPS mode, or the OpenSSL 3 FIPS provider - and use StreamSec Tools for the protocol and PKI logic (TLS and SSH state machines, X.509, CMS, PKCS, OCSP) on top. The one thing to get right is the boundary: the actual cryptographic operations must execute inside the validated module.
• If you intend to pursue your own validation, StreamSec Tools is a credible, auditable, single-language base to build that module from. A file-and-line gap analysis is available on request.

Return to the Why StreamSec overview.