# CHAINGUARD FIPS COMMITMENT

_Last Update: September 17, 2026_

This Chainguard Federal Information Processing Standards Commitment (“ **FIPS Commitment**”) describes certain services of Chainguard, Inc. (“ **Chainguard**”) in connection with Chainguard’s Products known as (“ **Chainguard FIPS Containers**”) _,_ as applicable under a given order (“ **Order**”) by and between a customer (“ **Customer**”) and Chainguard. Capitalized terms used, but not defined in this **FIPS** **Commitment**, have the meanings ascribed in the Agreement (as defined in such Order).

**FIPS** are publicly announced standards developed by the National Institute of Standards and Technology (“ **NIST**”) in accordance with the Federal Information Security Management Act (“ **FISMA**”) and approved by the United States Secretary of Commerce. **FIPS** compliance ensures that cryptographic security services within applications meet strict security and integrity standards, and are implemented and configured correctly. In furtherance thereof, **Chainguard FIPS Containers** may be used by Customer in fulfillment of its **FIPS** cryptography requirements under various industry-standard compliance frameworks, including but not limited to, _CMVP, NIST SP 800-53, NIST SP 800-171, FISMA, DoD CMMC, DoD CC SRG, FedRAMP, Common Criteria, FBI CJIS, NSA CNSA, IRS Publication 1075, HIPAA, PCI DSS, IETF RFC, German BSI, Australian ACSC IRAP, and UK NCSC_, subject to Customer preserving such compliance through its implementation and customization activities.

#### **1\. Commitment for Chainguard FIPS Containers.**

**1.1.** Chainguard warrants the following with respect to **Chainguard FIPS Containers**:

**1.1.1.** The **Chainguard FIPS Containers** available to be delivered in compliance with **FIPS** specifications are listed [here](https://images.chainguard.dev/directory?category=fips&__hstc=1638499.b79d7e72b9b2f25fc84c5352ef36e54e.1763562610339.1764960112600.1765221943225.9&__hssc=1638499.1.1765221943225&__hsfp=3647649972). **Chainguard FIPS Containers** indicated on Customer’s Order will be made available in compliance with applicable **FIPS** specifications.

**1.1.2.** The **Chainguard FIPS Containers** contain **FIPS**-validated software cryptographic modules and SP 800-90B compliant entropy sources as validated by **NIST**; provided that use of certain specified functions or services, which constitute “non-approved services” may result in the module operating outside of the **FIPS**-validated state for those specific operations.

**1.2.** Below are lists of current, anticipated, and historical validated modules shipped in **Chainguard FIPS Containers**. The Software Bill of Materials indicator (“ **SBOM Indicator**”) set forth below is a differentiator to uniquely identify the primary module location. Within **Chainguard FIPS Containers**, tags and hashes may be used to identify different modules.

**1.2.1.** Current (in-use) validated modules of **Chainguard FIPS Containers** include the following:

Cryptographic Module Validation Programme (CMVP):

|     |     |     |     |
| --- | --- | --- | --- |
| **Name** | **Standard** | **Certification** | **SBOM indicator** |
| Chainguard FIPS Provider for OpenSSL | FIPS 140-3 | [#5523](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5523) [#5132](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5132) [#5102](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5102) | NIST-CMVP-5523<br>NIST-CMVP-5132 <br>NIST-CMVP-5102 |
| Bouncy Castle FIPS Java API | FIPS 140-3 | [#4943](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943)<br>[#4743](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4743) | NIST-CMVP-4943 <br>NIST-CMVP-4743 |
| BoringCrypto | FIPS 140-3 | [#5104](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5244) | NIST-CMVP-5104 |
| Libgcrypt | FIPS 140-3 | [#4971](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4971) | NIST-CMVP-4971 |
| AWS LC | FIPS 140-3 | CMVP [#4953](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4953) [#5296](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5296) | NIST-CMVP-4953 <br>NIST-CMVP-5296 |
| Libgcrypt | FIPS 140-3 | CMVP [#4971](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4971) | NIST-CMVP-4971 |
| AWS LC | FIPS 140-3 | [#4759](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4759) [#4816](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4816) [#5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) [#5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) | NIST-CMVP-4759 <br>NIST-CMVP-4816 <br>NIST-CMVP-5298 <br>NIST-CMVP-5314 |
| Go Cryptographic Module | FIPS 140-3 | [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247) | NIST-CMVP-5247 |

Entropy Validation:

| **Name** | **Standard** | **Certification** | **SBOM Indicator** |
| --- | --- | --- | --- |
| Chainguard CPU Time Jitter RNG Entropy Source | SP 800-90B | [#E191](https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/191) | NIST-ESV-191 |
| Chainguard Kernel CPU Jitter Entropy Source | SP 800-90B | [#E340](https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/340) | NIST-ESV-340 |
| Jentropy Engine | SP 800-90B | [#E266](https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/266) | NIST-ESV-266 |
| BoringCrypto Jitter Entropy | SP 800-90B | [#E321](https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/321) | NIST-ESV-321 |
| Go Entropy Source | SP 800-90B | [#E318](https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/318) | NIST-ESV-318 |

**1.2.2.** Historical (previously used) validated modules of **Chainguard FIPS Containers** include the following:

|     |     |     |     |     |
| --- | --- | --- | --- | --- |
| **Name** | **Standard** | **Certification** | **Status** | **Last in Use** |
| Chainguard OpenSSL 3.0 FIPS Provider Module | FIPS 140-2 | [#4856](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4856) | Historical on 9/21/2026 | 05/22/2025 |
| BoringCrypto | FIPS 140-2 | [#4407](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4407) | Historical on 9/21/2026 | 07/03/2025 |
| Bouncy Castle FIPS Java API | FIPS 140-2 | [#4616](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4616) | Historical | 08/06/2024 |

For clarity, the information set forth in Sections 1.2.1. through 1.2.2. may be updated from time to time; for the most up-to-date information, please contact fips-contact@chainguard.dev.

#### **2\. Remediation for Chainguard FIPS Containers.**

Chainguard will use commercially reasonable efforts to ensure that applications for **Chainguard FIPS Containers** utilize **FIPS**-validated cryptographic modules for any applicable cryptographic operations, provided that the parties acknowledge and agree that certain behaviors or functionalities within such applications, which are beyond the direct control of Chainguard, may not fully adhere to **FIPS** requirements. To the extent common vulnerabilities and exposures (“ **CVEs**”) are identified in such **Chainguard FIPS Containers**, the terms of the [CVE Policy](/content/cve-sla/index.html) will apply as expressly set forth therein.

#### **3\. Order of Precedence.**

In the event of any conflict between the terms of this **FIPS Commitment**, the Agreement, and the applicable Order, the following order of precedence shall govern: (i) first, this **FIPS Commitment** (only with respect to the subject matter hereof); (ii) second, the Agreement; and (iii) third, the applicable **Order** (unless the applicable **Order** clearly specifies that it modifies the Agreement).