Lightship Security and the OpenSSL Corporation Submit OpenSSL 3.5.4 for FIPS 140-3 Validation

Lightship Security and the OpenSSL Corporation have jointly submitted OpenSSL version 3.5.4 to the Cryptographic Module Validation Program (CMVP) for FIPS 140-3 validation, marking a milestone in delivering validated cryptographic solutions. The submission confirms that the code is complete and that all included algorithms have passed NIST testing and independent laboratory review, with the final CMVP review and certificate issuance remaining as the last step.

OpenSSL 3.5.4, released in April 2025, introduces support for post-quantum cryptographic algorithms, including ML-KEM, ML-DSA, and SLH-DSA, aligning with NIST’s PQC standardisation and supporting a PQC-ready module upon validation completion. Jason Lawlor, President of Lightship Security, described the submission as sustaining standards-based cryptography in one of the world’s most widely used open‑source libraries.

Tim Hudson, President of the OpenSSL Corporation, added that the module is ready and meets FIPS 140-3 requirements while introducing post-quantum readiness for the years ahead, according to CyberNewswire.