About

The sec-certs project aims to be the one-stop shop to explore the Common Criteria / FIPS 140 certification ecosystem.

It all started in 2019, when we found a vulnerability in a Common Criteria-certified device. We wanted to investigate devices using the vulnerable one and understand the vulnerability impact. However, such analysis proved to be extremely laborious due to the lack of machine-processable data. We thus started aggregating and analyzing certification data, which enabled unified search, trend analysis, dependency visualization, and other features. Over time, we started interconnecting with other public datasets, most notably the list of CVEs.

In the spirit of open research, we decided to publish the dataset as well as the Python library to explore it for free. You're welcome to check out the library documentation as well as the full project and website source code.

Over time, we have written multiple research publications on the tool itself and the insights into the certification ecosystem gained using it. For the list of all publications, see the Research page. We welcome collaboration of any kind – if you are interested, feel free to get in touch at [email protected].