NIST SP 800-22 vs FIPS 140-3
Statistical test suite for RNGs versus Cryptographic module validation. What each covers, and when it applies.Both are NIST standards for different jobs. NIST SP 800-22 is a suite of statistical tests that check whether an RNG's output behaves like true randomness. FIPS 140-3 is a validation standard for cryptographic modules, covering their security specification, physical tamper resistance and self-tests. One tests the randomness of output; the other validates the security of a crypto module.
Key differences
- SP 800-22 tests the statistical randomness of RNG output; FIPS 140-3 validates a cryptographic module's security.
- SP 800-22 is a test methodology; FIPS 140-3 is a validation with four increasing security levels.
- In gaming, SP 800-22 supports RNG certification; FIPS 140-3 applies to crypto modules and HSMs where required.
Use NIST SP 800-22 to check an RNG's output for statistical bias.
Full NIST SP 800-22 profile →Common questions
What's the difference between NIST SP 800-22 and FIPS 140-3?
Both are NIST standards for different jobs. NIST SP 800-22 is a suite of statistical tests that check whether an RNG's output behaves like true randomness. FIPS 140-3 is a validation standard for cryptographic modules, covering their security specification, physical tamper resistance and self-tests. One tests the randomness of output; the other validates the security of a crypto module.
What is NIST SP 800-22?
A NIST-published suite of statistical tests used to check whether an RNG's output behaves like true randomness.
What is FIPS 140-3?
The US/Canadian standard for validating that a cryptographic module meets defined security requirements.
Sources (4)
Facts from the NIST SP 800-22 and FIPS 140-3 profiles · verified 2026-08-03
Not legal advice. This is a neutral teaching comparison; confirm the current requirements against each standard’s own publication before relying on it. 18+.