Planisphere Download for Mac

Defense · SHA-256 / FIPS 180-4

SHA-256 / FIPS 180-4 for defense AI workflows

SHA-256 / FIPS 180-4 in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceMandatory for federal agencies needing an approved hash; widely used voluntarily
Applies from4 Aug 2015
SectorDefense
Checked21 Oct 2026

01 / The rule

What SHA-256 / FIPS 180-4 requires

Federal agencies and vendors implementing approved hash functions; used worldwide in signatures, integrity checks and provenance records.

  1. 01Use a FIPS-approved hash algorithm (SHA-2 family; SHA-3 is in FIPS 202) where federal rules require one.
  2. 02Compute digests exactly as specified, including message padding and parsing into 512-bit blocks for SHA-256.
  3. 03Do not use SHA-1 for new applications; NIST plans to remove it by December 31, 2030.
  4. 04Use CAVP-validated implementations inside validated cryptographic modules for federal systems.

02 / In this sector

In a defense AI workflow

Hashing model weights, datasets, prompts and outputs with SHA-256 lets a third party check that an AI artifact is the one that was tested. The standard says nothing about AI specifically.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01Recorded SHA-256 digests of released artifacts
  2. 02CAVP algorithm validation certificate for the implementation
  3. 03Signed manifests or Merkle roots binding digests together

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

RELATED

Related: SHA-256 / FIPS 180-4: the full guide · SHA-256 / FIPS 180-4 for medicine · SHA-256 / FIPS 180-4 for law · SHA-256 / FIPS 180-4 for education