Compare

SHA-256 / FIPS 180-4 vs FIPS 140-3: how they differ, side by side

How SHA-256 / FIPS 180-4 and FIPS 140-3 differ: what each is, who owes it, when it applies and who enforces it.

SHA-256 / FIPS 180-4Mandatory for federal agencies needing an approved hash; widely used voluntarily

FIPS 140-3Mandatory for federal agencies using cryptography to protect sensitive information; binding on vendors through procurement

Checked21 Oct 2026

01 / Side by side

SHA-256 / FIPS 180-4 and FIPS 140-3, side by side

	SHA-256 / FIPS 180-4	FIPS 140-3
What it is	federal standard	federal standard
Jurisdiction	United States (federal)	United States (federal)
Legal force	Mandatory for federal agencies needing an approved hash; widely used voluntarily	Mandatory for federal agencies using cryptography to protect sensitive information; binding on vendors through procurement
Status	In force	In force
Applies from	4 Aug 2015	22 Sep 2019
Who owes it	Federal agencies and vendors implementing approved hash functions; used worldwide in signatures, integrity checks and provenance records.	Federal agencies and the vendors whose cryptographic modules they buy; validated jointly by NIST and Canada's Cyber Centre through the CMVP.
Enforcement	None directly; enforced through federal procurement, CMVP/CAVP validation and system authorization.	NIST and Canada's Cyber Centre run validation; agencies enforce through procurement and authorization (FISMA, FedRAMP). No direct penalties.

02 / SHA-256 / FIPS 180-4

What SHA-256 / FIPS 180-4 requires

Hashing model weights, datasets, prompts and outputs with SHA-256 lets a third party check that an AI artifact is the one that was tested. The standard says nothing about AI specifically.

01Use a FIPS-approved hash algorithm (SHA-2 family; SHA-3 is in FIPS 202) where federal rules require one.
02Compute digests exactly as specified, including message padding and parsing into 512-bit blocks for SHA-256.
03Do not use SHA-1 for new applications; NIST plans to remove it by December 31, 2030.
04Use CAVP-validated implementations inside validated cryptographic modules for federal systems.

03 / FIPS 140-3

What FIPS 140-3 requires

Applies to AI systems as to any system: encryption of model weights, training data and inference traffic in federal settings must use validated modules.

01Use cryptographic modules validated under the CMVP to protect sensitive federal information.
02Have modules tested by an accredited lab against ISO/IEC 19790 and 24759 as modified by SP 800-140x.
03Meet requirements for the chosen security level (1 to 4), covering interfaces, roles, self-tests, key management and physical security.
04Use only approved security functions and keep modules in their validated configuration.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES