This page was not yet optimized for use on mobile devices.
Panorama 11.1/11.2 running on M-200, M-300, M-600 and M-700
Certificate details
| Certificate ID | #5352 |
|---|---|
| Status | active |
| Validation dates | 25.06.2026 |
| Sunset date | 24-06-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy |
| Exceptions |
|
| Description | The Panorama M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as "Panorama M-Series", "Panorama HW", "modules", or the "cryptographic modules" are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall. |
| Vendor | Palo Alto Networks, Inc. http://www.paloaltonetworks.com |
| Lab | Leidos Accredited Testing & Evaluation (AT&E) Lab |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES-192, AES, AES-, CAST, HMAC, HMAC-SHA-256, CBC-MACAsymmetric Algorithms
RSA 2048, RSA 3072, RSA 4096, ECDH, ECDHE, ECDSA, ECC, DH, DHEHash functions
SHA-1, SHA-256Schemes
MAC, Key AgreementProtocols
SSH, SSHv2, TLS v1.2, TLSv1.2, TLS, TLS 1.2, TLSv1.3, IKEv2, VPNRandomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521Block cipher modes
ECB, CBC, CTR, CFB, GCM, CCMTLS cipher suites
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Trusted Execution Environments
PSP, SSCSecurity level
level 2, Level 2Certification process
out of scope, in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validationStandards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS 186-2, FIPS 186-5, FIPS186, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-90B, PKCS 1, RFC7627, RFC 5288, RFC 5246, RFC762Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5352,
"dgst": "044c06ac12dc9063",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA3453",
"HMAC-SHA-1A3453",
"AES-CBCA3453",
"ECDSA SigVer (FIPS186-4)A3453",
"ECDSA SigGen (FIPS186-4)A3453",
"KAS-ECC-SSC Sp800-56Ar3A3453",
"AES-CTRA3453",
"HMAC-SHA2-512A3453",
"SHA2-224A3453",
"SHA2-384A3453",
"KDF SNMPA3453",
"ECDSA KeyVer (FIPS186-4)A3453",
"TLS v1.2 KDF RFC7627A3453",
"AES-CFB128A3453",
"RSA SigGen (FIPS186-4)A3453",
"#A3453",
"ECDSA KeyGen (FIPS186-4)A3453",
"HMAC-SHA2-256A3453",
"RSA KeyGen (FIPS186-4)A3453",
"Safe Primes Key GenerationA3453",
"AES-GCMA3453",
"SHA-1A3453",
"Counter DRBGA3453",
"SHA2-512A3453",
"HMAC-SHA2-224A3453",
"SHA2-256A3453",
"RSA SigVer (FIPS186-4)A3453",
"KAS-FFC-SSC Sp800-56Ar3A3453",
"KDF SSHA3453",
"HMAC-SHA2-384A3453"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"11.1",
"11.2"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A3453",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A3453",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3453",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3453",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3453",
"properties": "Prediction Resistance - No, Yes Mode - AES-256 Derivation Function Enabled - No, Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3453",
"properties": "Key Length - Key Length: 256-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A3453",
"properties": "Key Length - Key Length: 256-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3453",
"properties": "Key Length - Key Length: 256-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A3453",
"properties": "Key Length - Key Length: 256-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A3453",
"properties": "Key Length - Key Length: 256-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A3453",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A3453",
"properties": "Domain Parameter Generation Methods - MODP-2048, MODP-3072, MODP-4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A3453",
"properties": "Password Length - Password Length: 64, 2048",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A3453",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3453",
"properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A3453",
"properties": "Safe Prime Groups - MODP-2048, MODP- 3072, MODP-4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A3453",
"properties": "Safe Prime Groups - MODP-2048, MODP- 3072, MODP-4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3453",
"properties": "Message Length - Message Length: 8- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A3453",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3453",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3453",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3453",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A3453",
"properties": "Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provides a method to update the firmware of the module",
"indicator": "Configuration/ System Logs",
"inputs": "Uploadin g new firmware",
"name": "Firmwar e Update",
"outputs": "Status of the updated firmware installati on",
"rolesSspAccess": "Crypto Officer - Public key for firmware content load test: E",
"secFunImpl": "Firmware Load Test"
},
{
"description": "Networkin g parameter configurati on, logging configurati on, and other non- security relevant configurati on",
"indicator": "Configuration/ System Logs",
"inputs": "Input configura tions for other setup functions",
"name": "Other Configur ation",
"outputs": "Module uses configur ation",
"rolesSspAccess": "Crypto Officer - CO, User, RA VPN Password: G,W,E - DRBG Key: G,E - DRBG Seed : G,E - DRBG V: G,E - ECDSA Private Keys : G,W,E - Entropy Input String: G,E - RSA Private Keys: G,W,E - SSH Client",
"secFunImpl": "DRBG Function KAS-ECC (SSH) KAS-ECC (TLSv1.2) KAS-ECC- KeyGen (SSH) KAS-ECC- KeyGen (TLSv1.2) KAS-FFC (SSH) KAS-FFC (TLSv1.2) KAS-FFC- KeyGen (SSH) KAS-FFC- KeyGen (TLSv1.2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) KTS (TLSv1.2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: W,E - SSH DHE/ECD HE Private Componen ts: G,E,Z - SSH DHE/ECD HE Public Componen ts: G,R,W,E, Z - SSH Host Public Key: G,R,W,E - SSH Session Authentica tion Keys: G,E,Z - SSH Session Encryptio n Keys: G,E,Z - TLS DHE/ECD HE Private Componen ts: G,E,Z - TLS DHE/ECD HE Public Componen ts: G,R,W,E, Z - TLS",
"secFunImpl": "with AES and HMAC) KTS (TLSv1.2 with AES- GCM) Session Authentication (SMPv3) Session Authentication (SSHv2) Session Authentication (TLSv1.2) Session Encryption/De cryption (SNMPv3) Session Encryption/De cryption (SSH) Session Encryption/De cryption (TLSv1.2) SNMPv3 Keying Materials Development SSH ECDSA KeyGen SSH ECDSA SigGen SSH ECDSA SigVer SSH RSA KeyGen SSH RSA SigGen SSH RSA SigVer SSHv2 Keying Materials Development"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryptio n Keys: G,E,Z - TLS HMAC Keys: G,E,Z - TLS Master Secret: G,E,Z - TLS Pre- Master Secret: G,E,Z",
"secFunImpl": "TLS ECDSA KeyGen TLS ECDSA SigGen TLS ECDSA SigVer TLS RSA KeyGen TLS RSA SigGen TLS RSA SigVer TLSv1.2 Keying Materials Development CKG"
},
{
"description": "Configurin g and managing cryptograp hic parameters and setting/mod ifying security policy, including creating User accounts and additional CO accounts",
"indicator": "Configuration/ System Logs",
"inputs": "Input configura tion for various cryptogra phic functions",
"name": "Security Configur ation Manage ment",
"outputs": "Module uses the configur ation for cryptogr aphic purposes",
"rolesSspAccess": "Crypto Officer - CA Certificate s: G,R,W,E - CO, User, RA VPN Password: G,W,E - DRBG Key: G,E - DRBG Seed : G,E - DRBG V: G,E - ECDSA Private Keys : G,W,E - ECDSA Public Keys: G,R,W,E - Entropy Input",
"secFunImpl": "DRBG Function KAS-ECC (SSH) KAS-ECC (TLSv1.2) KAS-ECC- KeyGen (SSH) KAS-ECC- KeyGen (TLSv1.2) KAS-FFC (SSH) KAS-FFC (TLSv1.2) KAS-FFC- KeyGen (SSH) KAS-FFC- KeyGen (TLSv1.2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) KTS (TLSv1.2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "String: G,E - Protocol Secrets: W,E - Public key for firmware content load test: W,E - RSA Private Keys: G,W,E - RSA Public Keys: G,R,W,E - SNMPv3 Authentica tion Key: G,E,Z - SNMPv3 Authentica tion Secret: W,E - SNMPv3 Privacy Secret: G,E,Z - SNMPv3 Session Key: G,E,Z - SSH Client Public Key: W,E - SSH DHE/ECD HE Private",
"secFunImpl": "with AES and HMAC) KTS (TLSv1.2 with AES- GCM) Session Authentication (SMPv3) Session Authentication (SSHv2) Session Authentication (TLSv1.2) Session Encryption/De cryption (SNMPv3) Session Encryption/De cryption (SSH) Session Encryption/De cryption (TLSv1.2) SNMPv3 Keying Materials Development SSH ECDSA KeyGen SSH ECDSA SigGen SSH ECDSA SigVer SSH RSA KeyGen SSH RSA SigGen SSH RSA SigVer SSHv2 Keying Materials Development"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Componen ts: G,E,Z - SSH DHE/ECD HE Public Componen ts: G,R,W,E, Z - SSH Host Public Key: W,E - SSH Session Authentica tion Keys: G,E,Z - SSH Session Encryptio n Keys: G,E,Z - TLS DHE/ECD HE Private Componen ts: G,E,Z - TLS DHE/ECD HE Public Componen ts: G,R,W,E, Z - TLS Encryptio n Keys: G,E,Z - TLS HMAC Keys: G,E,Z",
"secFunImpl": "TLS ECDSA KeyGen TLS ECDSA SigGen TLS ECDSA SigVer TLS RSA KeyGen TLS RSA SigGen TLS RSA SigVer CKG"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Master Secret: G,E,Z - TLS Pre- Master Secret: G,E,Z",
"secFunImpl": ""
},
{
"description": "Initiates self-tests and integrity test",
"indicator": "System Logs",
"inputs": "Self-test comman d or rebooting the module",
"name": "Self- Tests",
"outputs": "Status of the self- tests",
"rolesSspAccess": "Crypto Officer - Public key for firmware content load test: E",
"secFunImpl": "None"
},
{
"description": "Provides status information of the module",
"indicator": "Configuration/ System Logs",
"inputs": "Initiate show status comman d",
"name": "Show Status",
"outputs": "Module provides status output of module",
"rolesSspAccess": "Crypto Officer - CO, User, RA VPN Password: E - DRBG Key: G,E - DRBG Seed : G,E - DRBG V: G,E - ECDSA Private Keys : E - Entropy Input String: G,E - RSA Private Keys: E - SSH DHE/ECD HE Private Componen",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ts: G,E,Z - SSH DHE/ECD HE Public Componen ts: G,R,W,E, Z - SSH Session Authentica tion Keys: G,E,Z - SSH Session Encryptio n Keys: G,E,Z - TLS DHE/ECD HE Private Componen ts: G,E,Z - TLS DHE/ECD HE Public Componen ts: G,R,W,E, Z - TLS Encryptio n Keys: G,E,Z - TLS HMAC Keys: G,E,Z - TLS Master Secret: G,E,Z - TLS Pre-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Master Secret: G,E,Z Unauthent icated User - CO, User, RA VPN Password: E - DRBG Key: G,E - DRBG Seed : G,E - DRBG V: G,E - ECDSA Private Keys : E - Entropy Input String: G,E - RSA Private Keys: E - SSH DHE/ECD HE Private Componen ts: G,E,Z - SSH DHE/ECD HE Public Componen ts: G,R,W,E, Z - SSH Session Authentica tion Keys:",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,E,Z - SSH Session Encryptio n Keys: G,E,Z - TLS DHE/ECD HE Private Componen ts: G,E,Z - TLS DHE/ECD HE Public Componen ts: G,R,W,E, Z - TLS Encryptio n Keys: G,E,Z - TLS HMAC Keys: G,E,Z - TLS Master Secret: G,E,Z - TLS Pre- Master Secret:",
"secFunImpl": ""
},
{
"description": "Provides status of the module",
"indicator": "LEDs",
"inputs": "N/A",
"name": "Show Status (LEDs)",
"outputs": "Status of the module via LEDs",
"rolesSspAccess": "G,E,Z Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Shows the version of the module",
"indicator": "Version displayed via System Logs / CLI / UI",
"inputs": "Input comman d for version",
"name": "Show Version",
"outputs": "Module displays version",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "informati on",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Read-only of non- security relevant configurati on",
"indicator": "Configuration/ System Logs",
"inputs": "Initiate comman d to read configura tion",
"name": "View Other Configur ation",
"outputs": "Module provides configur ation details",
"rolesSspAccess": "Crypto Officer - CO, User, RA VPN Password:",
"secFunImpl": ""
},
{
"description": "Destroys (zeroizes) all keys in the module",
"indicator": "Zeroization indicator",
"inputs": "Initiating zeroizati on comman d",
"name": "Zeroize",
"outputs": "Status of the zeroizati on process",
"rolesSspAccess": "W,E Crypto Officer - CA Certificate s: Z - CO, User, RA VPN Password: Z - DRBG Key: Z - DRBG Seed : Z - DRBG V: Z - ECDSA Private Keys : Z - ECDSA Public Keys: Z - Entropy Input String: Z - Firmware integrity verificatio n key : Z - Protocol Secrets: Z - Public key for firmware",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "content load test: Z - RSA Private Keys: Z - RSA Public Keys: Z - SNMPv3 Authentica tion Key: Z - SNMPv3 Authentica tion Secret: Z - SNMPv3 Privacy Secret: Z - SNMPv3 Session Key: Z - SSH Client Public Key: Z - SSH DHE/ECD HE Private Componen ts: Z - SSH DHE/ECD HE Public Componen ts: Z - SSH Host Public Key: Z - SSH Session",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Authentica tion Keys: Z - SSH Session Encryptio n Keys: Z - TLS DHE/ECD HE Private Componen ts: Z - TLS DHE/ECD HE Public Componen ts: Z - TLS Encryptio n Keys: Z - TLS HMAC Keys: Z - TLS Master Secret: Z - TLS Pre- Master Secret: Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The modules support RSA public-key based",
"mechanism": "Single-Factor Cryptographic Software",
"name": "RSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the module within a one",
"strength": "With a minimum modulus size of 2048, the"
},
{
"description": "authentication mechanism using a minimum of RSA 2048 bits",
"mechanism": "",
"name": "",
"perMinute": "minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.",
"strength": "probability that a random attempt will succeed is 1/(2^112)."
},
{
"description": "The modules support ECDSA public-key based authentication mechanism using a minimum ECDSA curve of P-256",
"mechanism": "Single-Factor Cryptographic Software",
"name": "ECDSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.",
"strength": "With a minimum curve of P- 256, the probability that a random attempt will succeed is 1/(2^128)."
},
{
"description": "Password based authentication",
"mechanism": "Memorized Secret (Unique Username/password)",
"name": "Password",
"perMinute": "The probability of successfully authenticating to the module within one minute is 10/(95^8). The firewall\u0027s configuration supports at most ten failed attempts to authenticate in a one-minute period.",
"strength": "The minimum length is eight (8) characters (95 possible characters). The probability that a random attempt will succeed or a false acceptance will occur is 1/(958)."
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES- CCM Decrypt (A3453)",
"condition": "After each power-on or via",
"details": "Decrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "192 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "self-test command",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES- CCM Encrypt (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Encrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "192 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- ECB Decrypt (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Decrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "128 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- ECB Encrypt (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Encrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "128 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM Decrypt (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Decrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM Encrypt (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Encrypt",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A3453)",
"condition": "After each power-on or via self-test command",
"details": "SP 800-90Arev1 Instantiate/Generate/Res eed Known Answer Tests",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA / KAS- ECC",
"condition": "On session",
"details": "ECDSA / KAS-ECC pairwise consistency test",
"indicator": "System log message s",
"testMethod": "PCT",
"testProps": "256 Bit Minimu m",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186 -4) (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Sign",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186 -4) (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Verify",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "On session",
"details": "Firmware load test on content load",
"indicator": "System log message s",
"testMethod": "FW Load Test",
"testProps": "2048 Bit",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Keyed Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "160 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 224 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Keyed Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "224 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Keyed Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 384 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Keyed Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "384 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Keyed Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "512 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "KAS Computation",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- FFC",
"condition": "On session",
"details": "KAS-FCC pairwise consistency test",
"indicator": "System log",
"testMethod": "PCT",
"testProps": "2048 Bits Minimu m",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "message s",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KAS- FFC-SSC Sp800- 56Ar3 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "KAS Computation",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "2048 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "RSA",
"condition": "On session",
"details": "RSA pairwise consistency test",
"indicator": "System log message s",
"testMethod": "PCT",
"testProps": "2048 Bits Minimu m",
"type": "PCT"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186 -4) (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Sign",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "2048 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186 -4) (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Verify",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "2048 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "160 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 256 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "256 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 384 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "384 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512 (A3453)",
"condition": "After each power-on or via self-test command",
"details": "Hash",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "512 Bits",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800- 90B RCT/AP T Health Tests on Entropy Source",
"condition": "After each power-on or via self-test command",
"details": "Health tests done on entropy source",
"indicator": "Self-test output message",
"testMethod": "Fault- Detectio n",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800- 135rev1 IKEv2 KDF with SHA-256",
"condition": "After each power-on or via self-test command",
"details": "IKEv2 with SHA-256",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800- 135rev1 SSH KDF with SHA-256",
"condition": "After each power-on or via self-test command",
"details": "SSHv2 with SHA-256",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800- 135rev1 TLS 1.2 with SHA-256 KDF",
"condition": "After each power-on or via self-test command",
"details": "TLSv1.2 with SHA-256",
"indicator": "Self-test output message",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SP 800- 56A Rev 3 Assuranc e Tests",
"condition": "On session",
"details": "Assurance tests for SP 800-56A Rev3",
"indicator": "System log message s",
"testMethod": "Critical Functio ns",
"testProps": "N/A",
"type": "Critical Functio n"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Signature verification failure",
"description": "Signature verification fails on firmware load",
"indicator": "System prints Invalid image message.",
"name": "Conditional Firmware Load Test Failure",
"recoveryMethod": "N/A"
},
{
"conditions": "PCT / Critical functions test",
"description": "Module fails a PCT or critical functions test",
"indicator": "System log prints an error message.",
"name": "Conditional Pairwise Consistency or Critical Functions Test Failure",
"recoveryMethod": "Reset session"
},
{
"conditions": "Self-test or Integrity Test failure",
"description": "Module fails a self-test or integrity test",
"indicator": "FIPS-CC mode failure. \u003cAlgorithm test\u003e failed.",
"name": "Self-Test / Integrity Test Failure",
"recoveryMethod": "Reboot Module or Factory Reset"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-200, M-300) Verify integrity of tamper-evident seals in the locations identified in Section 7 of this Security Policy.",
"mechanism": "Tamper-Evident Seals"
},
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-200, M-300) Verify that opacity shields and side rails have not been loosened or deformed from their original shape, thereby reducing their effectiveness.",
"mechanism": "Front and Rear Opacity Shields Side Rails"
},
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-200, M-300) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics.",
"mechanism": "Top Overlays"
},
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-600, M-700) Verify integrity of tamper-evident seals in the locations specified in Section 7 of this Security Policy.",
"mechanism": "Tamper Evident Seals"
},
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-600, M-700) Verify that the front and rear opacity shields have not been deformed from their original shape, thereby reducing their effectiveness",
"mechanism": "Front and Rear Opacity Shields"
},
{
"inspectFreq": "30 days",
"inspectGuidance": "(M-600, M-700) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics",
"mechanism": "Vent Overlays"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module has one approved mode of operation and is always in approved mode after initialization",
"name": "Approved Mode",
"statusIndicator": "Global indicator (\"FIPS-CC\")",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Module status via LED indicators",
"logicalInterface": "Status Output",
"physicalPort": "LED"
},
{
"data": "N/A",
"logicalInterface": "Power",
"physicalPort": "Power"
},
{
"data": "Self-test output",
"logicalInterface": "Status Output",
"physicalPort": "RJ45 Console"
},
{
"data": "TLS, SSH",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "RJ45 Ethernet"
},
{
"data": "TLS",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "SFP+ (M-600, M-700)"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "RSA-Based Certificate ECDSA-Based Certificate Password",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "RSA-Based Certificate ECDSA-Based Certificate Password",
"name": "User",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "3",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-4) (A3453)",
"details": "Signature Verification",
"indicator": "Self-Test successful",
"testMethod": "KAT",
"testProps": "P-256",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A3453)",
"details": "Keyed Checksum",
"indicator": "Self-Test successful",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "External (outside of module\u0027s boundary )",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "HDD"
},
{
"dest": "HDD",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "External (outside of module\u0027s boundary )"
},
{
"dest": "HDD",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via SSHv2 encrypted by AES-GCM",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "External (outside of module\u0027s boundary )"
},
{
"dest": "HDD",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
"source": "External (outside of module\u0027s boundary )"
},
{
"dest": "HDD",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via TLSv1.2 encrypted by AES-GCM",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "External (outside of module\u0027s boundary )"
},
{
"dest": "HDD",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (outside of module\u0027s boundary )"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Operator powers the module off or session terminates",
"method": "Power Cycle / Session Termination",
"operatorId": "Command via CLI or WebUI or by unplugging module",
"rationale": "Powering off the module or terminating the session will erase all SSPs stored in the RAM of the module."
},
{
"description": "CO issues zeroization service",
"method": "Zeroization Command",
"operatorId": "Entering into maintenance mode and selecting Factory Reset",
"rationale": "The zeroization command will erase all SSPs stored in the RAM or in the Flash of the module."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Non-Volatile Memory",
"name": "HDD",
"persistance": "Static"
},
{
"description": "Volatile Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "RJ45 interfaces, USB ports, LEDs",
"fwVersion": "11.1.3, 11.2.5",
"hwVersion": "910-000176 with 920-000208",
"modelPartNum": "Panorama M-200",
"processors": "Intel Xeon E5- 2620 V4"
},
{
"features": "RJ45 interfaces, USB ports, LEDs",
"fwVersion": "11.1.3, 11.2.5",
"hwVersion": "910-000271 with 920-000319",
"modelPartNum": "Panorama M-300",
"processors": "Intel Xeon (Silver) 4310"
},
{
"features": "RJ45 interfaces, USB ports, LEDs, SFP+ ports",
"fwVersion": "11.1.3, 11.2.5",
"hwVersion": "910-000175 with 920-000209",
"modelPartNum": "Panorama M-600",
"processors": "Intel Xeon E5- 2680 V4"
},
{
"features": "RJ45 interfaces, USB ports, LEDs, SFP+ ports",
"fwVersion": "11.1.3, 11.2.5",
"hwVersion": "910-000270 with 920-000318",
"modelPartNum": "Panorama M-700",
"processors": "Intel Xeon (Silver) 4316"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "Cryptographic Key Generation; SP 800- 133rev2 and IG D.H (symmetric keys and asymmetric seeds) from Section 4 Example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 15
},
"ECDH": {
"ECDH": 6,
"ECDHE": 2
},
"ECDSA": {
"ECDSA": 74
}
},
"FF": {
"DH": {
"DH": 2,
"DHE": 2
}
},
"RSA": {
"RSA 2048": 11,
"RSA 3072": 1,
"RSA 4096": 1
}
},
"certification_process": {
"OutOfScope": {
"in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation": 1,
"out of scope": 1
}
},
"cipher_mode": {
"CBC": {
"CBC": 2
},
"CCM": {
"CCM": 2
},
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 3
},
"ECB": {
"ECB": 2
},
"GCM": {
"GCM": 19
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKEv2": 3
},
"SSH": {
"SSH": 103,
"SSHv2": 57
},
"TLS": {
"TLS": {
"TLS": 89,
"TLS 1.2": 3,
"TLS v1.2": 8,
"TLSv1.2": 73,
"TLSv1.3": 1
}
},
"VPN": {
"VPN": 8
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 4
},
"MAC": {
"MAC": 3
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 18,
"P-384": 24,
"P-521": 20
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#11": 2,
"#12": 2,
"#13": 2,
"#14": 2,
"#15": 2,
"#18": 2,
"#19": 2
}
},
"fips_certlike": {
"Certlike": {
"AES (128": 1,
"AES 128/192/256": 1,
"AES 256": 2,
"AES-128": 1,
"AES-192": 1,
"AES-256": 3,
"DRBG 2": 1,
"HMAC- SHA-1": 2,
"HMAC- SHA-256": 1,
"HMAC-SHA-1": 4,
"HMAC-SHA-256": 6,
"PKCS 1": 4,
"RSA 2048": 11,
"RSA 3072": 1,
"RSA 4096": 1,
"SHA- 256": 1,
"SHA-1": 9,
"SHA-256": 11,
"SHA2- 224": 1,
"SHA2- 256": 2,
"SHA2- 384": 2,
"SHA2- 512": 2,
"SHA2-224": 3,
"SHA2-256": 10,
"SHA2-384": 5,
"SHA2-512": 6
}
},
"fips_security_level": {
"Level": {
"Level 2": 1,
"level 2": 1
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 9
},
"SHA2": {
"SHA-256": 11
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 59
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 7,
"FIPS 180-4": 5,
"FIPS 186-2": 1,
"FIPS 186-4": 9,
"FIPS 186-5": 1,
"FIPS 198-1": 5,
"FIPS186": 4,
"FIPS186-4": 27
},
"NIST": {
"SP 800-135": 3,
"SP 800-38A": 3,
"SP 800-38D": 1,
"SP 800-56A": 6,
"SP 800-90A": 1,
"SP 800-90B": 1
},
"PKCS": {
"PKCS 1": 2
},
"RFC": {
"RFC 5246": 1,
"RFC 5288": 1,
"RFC762": 4,
"RFC7627": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 41,
"AES-": 17,
"AES-128": 1,
"AES-192": 1,
"AES-256": 3
},
"CAST": {
"CAST": 52
}
},
"constructions": {
"MAC": {
"CBC-MAC": 3,
"HMAC": 41,
"HMAC-SHA-256": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 13
},
"IBM": {
"SSC": 5
}
},
"tls_cipher_suite": {
"TLS": {
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 1
}
},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA3453",
"HMAC-SHA-1A3453",
"AES-CBCA3453",
"ECDSA SigVer (FIPS186-4)A3453",
"ECDSA SigGen (FIPS186-4)A3453",
"KAS-ECC-SSC Sp800-56Ar3A3453",
"HMAC-SHA2-384A3453",
"HMAC-SHA2-512A3453",
"SHA2-224A3453",
"RSA SigVer (FIPS186-4)A3453",
"KDF SNMPA3453",
"ECDSA KeyVer (FIPS186-4)A3453",
"TLS v1.2 KDF RFC7627A3453",
"AES-CFB128A3453",
"RSA SigGen (FIPS186-4)A3453",
"ECDSA KeyGen (FIPS186-4)A3453",
"HMAC-SHA2-256A3453",
"RSA KeyGen (FIPS186-4)A3453",
"Safe Primes Key GenerationA3453",
"AES-GCMA3453",
"SHA-1A3453",
"Counter DRBGA3453",
"SHA2-512A3453",
"HMAC-SHA2-224A3453",
"SHA2-256A3453",
"SHA2-384A3453",
"KAS-FFC-SSC Sp800-56Ar3A3453",
"KDF SSHA3453",
"AES-CTRA3453"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3453"
]
},
"policy_metadata": {
"/CreationDate": "D:20260624083911-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260624083911-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1391056,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/advanced-url-filtering/advanced-url-filtering-administration.pdf",
"https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 80
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "c21411d9b9b67f294c39a3e36667c653c0833a5b1b16c72f98df959ca7e35174",
"source_hash": "2927af5c0889c25aed0914bbf628d8c1d6413171f405bc8b9c1963c45f1f7c1a",
"txt_hash": "8df7683d355ed0770b9d5a89ad870081e2ab8df96a0622b36309f1e7fe24bd3e"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
"date_sunset": "2031-06-24",
"description": "The Panorama M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as \"Panorama M-Series\", \"Panorama HW\", \"modules\", or the \"cryptographic modules\" are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Operational environment: N/A",
"Non-invasive security: N/A",
"Life-cycle assurance: Level 3",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "Panorama 11.1/11.2 running on M-200, M-300, M-600 and M-700",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-25",
"lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
"validation_type": "Initial"
}
],
"vendor": "Palo Alto Networks, Inc.",
"vendor_url": "http://www.paloaltonetworks.com"
}
}