Module, source code and design
Define boundaries, interfaces, security functions and high-level and detailed design.
Security & cloud
Define the cryptographic module and validated configuration
KCMVP validates cryptographic modules protecting non-classified operational information in Korean national and public networks. Using a cryptographic algorithm alone does not make a module validated.
Source record updated:
Discuss your certification →Scope and applicability
Korean cryptographic module security and implementation validation
Certain public procurement product categories require validated modules. Not every software product must develop and validate its own module; integration of an existing validated module may be possible.
Korean certification schemes and international standards are different. A translated guide does not extend a Korean certificate to other countries. Confirm the target market, product classification and current requirements with the relevant body.
Who this is for
- Cryptographic module developers
- Public sector security product suppliers
- Teams integrating validated cryptographic modules
Documents to prepare
Configuration and test documents
Trace development and release configurations to security tests.
Implementation and entropy evidence
Prepare applicable algorithm validation, noise source assessment and test environments.
Preparation process
Set module boundary and level
Distinguish new validation from integration of an existing validated module.
Contract and test
Submit materials, complete laboratory testing and address corrections.
Complete national validation
Support result review and maintain the listed validated configuration.
Timing
Allow for module readiness, submissions, testing, corrections and national review. Platform or configuration changes may affect revalidation.
Agency fees
Laboratory testing fees
Individual testing contract and quotation
Module type, security level, algorithms, platforms and revalidation scope determine cost.
Sources and references ↗Document automation and management cost KRW 300,000 per month. Expert services and certification body testing or assessment fees are separate. Specify supports preparation; the relevant authority or certification body makes the final decision.
Pricing and certification costs →Optional expert consulting
Expert review and consulting are optional, separately scoped services. Choose support for KCMVP Cryptographic Module Validation based on your team's readiness and the evidence or assessment preparation you need.
- Confirm institutional testing, assessment and registration fees separately in the contract.
- Development fixes, clinical studies where applicable, security equipment and infrastructure operations may require separate budgets.
- Confirm internal staffing, travel, translation, VAT, surveillance and renewal costs in the quotation.
Questions and answers
Does a Korean cryptographic algorithm make a module validated?
No. Algorithm implementation differs from satisfying module-level security and testing requirements.
What should we verify when integrating a validated module?
Check validation number, status, hash, security policy, supported OS and validated operating mode.
Must every product develop its own module?
Check product category requirements and whether an existing validated module can be licensed and integrated.