F5OS-A Cryptographic Module

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5505,
  "dgst": "065aab207e6fe875",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "RSA KeyGen (FIPS186-5)A7031",
        "SHA-1A7032",
        "KAS-ECC-SSC Sp800-56Ar3A7031",
        "SHA2-384A7032",
        "RSA SigVer (FIPS186-5)A7031",
        "TLS v1.2 KDF RFC7627A7031",
        "RSA SigVer (FIPS186-4)A7031",
        "ECDSA SigGen (FIPS186-5)A7031",
        "AES-GCMA7032",
        "HMAC-SHA2-384A7032",
        "ECDSA KeyVer (FIPS186-5)A7031",
        "AES-GMACA7032",
        "AES-CBCA7032",
        "KDF SSHA7031",
        "HMAC-SHA2-256A7032",
        "#A7032",
        "#A7031",
        "RSA SigGen (FIPS186-5)A7031",
        "Counter DRBGA7032",
        "HMAC-SHA-1A7032",
        "ECDSA SigVer (FIPS186-5)A7031",
        "ECDSA KeyGen (FIPS186-5)A7031",
        "ECDSA SigVer (FIPS186-4)A7031",
        "AES-ECBA7032",
        "AES-CTRA7032",
        "SHA2-256A7032"
      ]
    },
    "cpe_matches": {
      "_type": "Set",
      "elements": [
        "cpe:2.3:o:f5:f5os-a:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:f5:f5os:-:*:*:*:*:*:*:*"
      ]
    },
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 1,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A7031, A7032",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "A7031, A7032",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - Yes Incremental Counter - Yes Counter Tests Performed - Yes",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A7031, A7032",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7031, A7032",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 128, 256, 104, 408 AAD Length - AAD Length: 128, 384, 160, 720, 0",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A7031, A7032",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 AAD Length - AAD Length: 0, 128, 160, 384, 720",
            "reference": ""
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A7031",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 256, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128 Personalization String Length - Personalization String Length: 0-256 Increment 128, Personalization String Length: 0-384 Increment 128",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A7032",
            "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0-256 Increment 128 Returned Bits - 512",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Curve - P-256, P-384 Secret Generation Mode - testing candidates",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Curve - P-256, P-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-4)",
            "cavpCertName": "A7031",
            "properties": "Component - No Curve - P-256, P-384 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Component - No Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A7031, A7032",
            "properties": "MAC - MAC: 160 Key Length - Key Length: 8, 16, 64, 128, 1024",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A7031, A7032",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 8, 16, 64, 128, 1024",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A7031, A7032",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 8, 16, 64, 128, 1024",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A7031",
            "properties": "Domain Parameter Generation Methods - P-256, P-384 Scheme - ephemeralUnified -",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A7031",
            "properties": "Cipher - AES-128, AES-256 Hash Algorithm - SHA2-256, SHA2-384",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A7031",
            "properties": "Signature Type - PKCS 1.5 Modulo - 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Salt Length - 20 Public Exponent Mode - Fixed Fixed Public Exponent - 010001",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A7031",
            "properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A7031, A7032",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7031, A7032",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A7031, A7032",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
            "cavpCertName": "A7031",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384 Key Block Length - Key Block Length: 1024",
            "reference": "SP 800-135 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Display list of all user accounts",
            "indicator": "None",
            "inputs": "None",
            "name": "List users",
            "outputs": "List of user accounts",
            "rolesSspAccess": "Administrato r Resource Admin Operator",
            "secFunImpl": "None"
          },
          {
            "description": "Create additional user",
            "indicator": "None",
            "inputs": "Username / password",
            "name": "Create additional User",
            "outputs": "Confirmation of account creation",
            "rolesSspAccess": "Administrato r - Password: W",
            "secFunImpl": "None"
          },
          {
            "description": "Modify existing users",
            "indicator": "None",
            "inputs": "Username / modification (new username, role, password expiry date/tally count)",
            "name": "Modify existing Users",
            "outputs": "Confirmation of account modification",
            "rolesSspAccess": "Administrato r",
            "secFunImpl": "None"
          },
          {
            "description": "Delete existing user",
            "indicator": "None",
            "inputs": "Username",
            "name": "Delete User",
            "outputs": "Confirmation of deletion",
            "rolesSspAccess": "Administrato r",
            "secFunImpl": "None"
          },
          {
            "description": "Remove lock from user who has exceeded login attempts",
            "indicator": "None",
            "inputs": "Username",
            "name": "Unlock User",
            "outputs": "Confirmation of unlock",
            "rolesSspAccess": "Administrato r",
            "secFunImpl": "None"
          },
          {
            "description": "Update own password",
            "indicator": "None",
            "inputs": "Own password",
            "name": "Update own password",
            "outputs": "Confirmation of update of password",
            "rolesSspAccess": "Administrato r - Password: W Resource Admin - Password: W Operator - Password: W",
            "secFunImpl": "None"
          },
          {
            "description": "Update others password",
            "indicator": "None",
            "inputs": "Username / password",
            "name": "Update others password",
            "outputs": "Confirmation of update",
            "rolesSspAccess": "Administrato r - Password: W",
            "secFunImpl": "None"
          },
          {
            "description": "Set password policy features",
            "indicator": "None",
            "inputs": "New password policy",
            "name": "Configure Password Policy",
            "outputs": "Confirmation of configuration change",
            "rolesSspAccess": "Administrato r",
            "secFunImpl": "None"
          },
          {
            "description": "Self-signed certificate creation",
            "indicator": "Successful creation of certificate",
            "inputs": "Certificate identification information",
            "name": "Create TLS Certificate",
            "outputs": "Confirmation of certificate creation",
            "rolesSspAccess": "Administrato r - TLS RSA public key: W,E - TLS RSA private key: W,E - TLS ECDSA public key: W,E - TLS ECDSA private key: W,E Resource Admin - TLS RSA public key: W,E - TLS RSA private key: W,E - TLS ECDSA public key: W,E - TLS ECDSA private key:",
            "secFunImpl": "Signature Generation"
          },
          {
            "description": "Create key for the SSL Certificate key file",
            "indicator": "Successful creation of key",
            "inputs": "Key identification information",
            "name": "Create TLS Key",
            "outputs": "Confirmation of key creation",
            "rolesSspAccess": "W,E Administrato r - TLS RSA public key: G - TLS RSA private key: G - TLS ECDSA public key: G - TLS ECDSA private key: G Resource Admin - TLS RSA public key: G",
            "secFunImpl": "Random Number Generation Key pair generation"
          },
          {
            "description": "Self-signed certificate / key deletion",
            "indicator": "None",
            "inputs": "Key identification information",
            "name": "Delete TLS Certificate / Key",
            "outputs": "Confirmation of key deletion",
            "rolesSspAccess": "- TLS ECDSA private key: G Administrato r - TLS RSA public key: Z - TLS RSA private key: Z - TLS ECDSA public key: Z - TLS ECDSA private key: Z Resource Admin - TLS RSA public key: Z - TLS RSA private key: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Display / log expiration data of installed certificates",
            "indicator": "None",
            "inputs": "List of certificates to display",
            "name": "List Certificate",
            "outputs": "Certificate expiration information",
            "rolesSspAccess": "Z Administrato r Resource Admin",
            "secFunImpl": "None"
          },
          {
            "description": "List private keys",
            "indicator": "None",
            "inputs": "List of private keys to display",
            "name": "List private keys",
            "outputs": "List of private keys",
            "rolesSspAccess": "Administrato r Resource Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Display logs/files of configuration changes",
            "indicator": "None",
            "inputs": "None",
            "name": "View System Audit Log",
            "outputs": "Display of system audit logs",
            "rolesSspAccess": "Administrato r Resource Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Export analytics logs system",
            "indicator": "None",
            "inputs": "None",
            "name": "Export Analytics Logs System",
            "outputs": "Exported system audit logs",
            "rolesSspAccess": "Administrato r",
            "secFunImpl": "None"
          },
          {
            "description": "Create tenant deployment",
            "indicator": "None",
            "inputs": "password / tenant console role",
            "name": "Create Tenant",
            "outputs": "Confirmation of the tenant-console role",
            "rolesSspAccess": "Administrato r - Password: W,E Resource Admin - Password: W,E",
            "secFunImpl": "None"
          },
          {
            "description": "Connecting to tenant-console via SSH",
            "indicator": "None",
            "inputs": "F5 rSeries platform management address / tenant- console / password",
            "name": "Tenant SSH establish connection",
            "outputs": "Confirmation of Access to the tenant-console remotely over SSH",
            "rolesSspAccess": "Tenant- console",
            "secFunImpl": "None"
          },
          {
            "description": "Closing the tenant- console SSH session",
            "indicator": "None",
            "inputs": "None",
            "name": "Tenant SSH close connection",
            "outputs": "Confirmation of tenant-console SSH session closure",
            "rolesSspAccess": "Tenant- console",
            "secFunImpl": "None"
          },
          {
            "description": "Enable / Disable SSH access, configure IP address allow list",
            "indicator": "None",
            "inputs": "SSH access / IP address list",
            "name": "Configure SSH access options",
            "outputs": "Confirmation of configuration of SSH access options",
            "rolesSspAccess": "Administrato r Resource Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Update ssh/ authorized_keys file for user authentication",
            "indicator": "None",
            "inputs": "SSH ECDSA key pair (public)",
            "name": "Configure SSH user configuratio n",
            "outputs": "Confirmation of configuration of SSH user configuration",
            "rolesSspAccess": "Administrato r - SSH ECDSA private key: W - SSH ECDSA public key :",
            "secFunImpl": "None"
          },
          {
            "description": "Restart the cryptographic module",
            "indicator": "Module reboots",
            "inputs": "None",
            "name": "Reboot System",
            "outputs": "Confirmation of system reboot",
            "rolesSspAccess": "Administrato r - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS AES- GCM IV: Z - TLS derived session key : Z",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "Name",
            "outputs": "",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "",
            "outputs": "Outputs",
            "rolesSspAccess": "- SSH EC Diffie- Hellman public key: Z - SSH EC Diffie- Hellman private key: Z - SSH shared secret: Z - SSH derived session key : Z - Entropy input string : Z - DRBG seed : Z - DRBG internal state (V and key values): Z - Intermediate key generation value: Z Resource Admin - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS AES- GCM IV: Z - TLS derived session key : Z - SSH EC",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Diffie- Hellman public key: Z - SSH EC Diffie- Hellman private key: Z - SSH shared secret: Z - SSH derived session key : Z - Entropy input string : Z - DRBG seed : Z - DRBG internal state (V and key values): Z - Intermediate key generation",
            "secFunImpl": ""
          },
          {
            "description": "Full system zeroization",
            "indicator": "Module end of life",
            "inputs": "Selection option",
            "name": "Secure Erase",
            "outputs": "Confirmation of full system zeroization",
            "rolesSspAccess": "Administrato r - TLS RSA public key: Z - TLS RSA private key: Z - TLS ECDSA public key: Z - TLS ECDSA private key: Z - SSH ECDSA public key : Z - SSH ECDSA private key: Z - Password: Z Resource",
            "secFunImpl": "None"
          },
          {
            "description": "SSH key exchange",
            "indicator": "SSH connectio n successful",
            "inputs": "Password; SSH ECDSA private key",
            "name": "Establish SSH session",
            "outputs": "EC public key, Confirmation of SSH session establishment",
            "rolesSspAccess": "Z Administrato r - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - Intermediate key generation value: G,E,Z - SSH ECDSA public key : E - SSH ECDSA private key: E - Password: Resource Admin",
            "secFunImpl": "Signature Generation Signature Verification Signature Verification (Legacy) Key pair generation Key pair verification SSH Handshake"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "Name",
            "outputs": "",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "",
            "outputs": "Outputs",
            "rolesSspAccess": "- SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - Intermediate key generation value: G,E,Z - SSH ECDSA public key : E - SSH ECDSA private key: E - Password: W,E Operator - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - Intermediate key generation value: G,E,Z - SSH ECDSA public key : E - SSH ECDSA private key: E",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP Access - Password:",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "SSH data encryption/decryptio n, SSH data integrity",
            "indicator": "SSH connectio n successful",
            "inputs": "Plaintext/Cipherte xt",
            "name": "Maintain SSH Session",
            "outputs": "ciphertext/plaintex t, MAC tag",
            "rolesSspAccess": "W,E Administrato r - SSH derived session key : E Resource Admin - SSH derived session key : E Operator - SSH derived session key : E",
            "secFunImpl": "Key Wrapping/Unwrappi ng with encryption and authentication in SSH"
          },
          {
            "description": "Close SSH session",
            "indicator": "SSH connectio n closed",
            "inputs": "None",
            "name": "Close SSH Session",
            "outputs": "Confirmation of SSH session closure",
            "rolesSspAccess": "Administrato r - SSH EC Diffie- Hellman public key: Z - SSH EC Diffie- Hellman private key: Z - SSH shared secret: Z - SSH derived session key : Z Resource Admin - SSH EC Diffie- Hellman public key: Z - SSH EC Diffie- Hellman private key: Z - SSH shared secret: Z - SSH derived session key : Z",
            "secFunImpl": "None"
          },
          {
            "description": "Key exchange in TLS",
            "indicator": "Successful TLS connectio n",
            "inputs": "Ciphersuites",
            "name": "Establish TLS Session",
            "outputs": "TLS EC Diffie- Hellman public key, Confirmation of establishment of TLS session",
            "rolesSspAccess": "private key: Z - SSH shared secret: Z - SSH derived session key : Z Administrato r - TLS EC Diffie- Hellman public key: E - TLS EC Diffie- Hellman private key: E",
            "secFunImpl": "Signature Generation Signature Verification Signature Verification (Legacy) TLS Handshake"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "Name",
            "outputs": "",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "",
            "outputs": "Outputs",
            "rolesSspAccess": "- TLS EC Diffie- Hellman public key: E - TLS EC Diffie- Hellman private key: E - TLS pre- primary secret : G,E - TLS primary secret: G,E - TLS derived session key : G - TLS AES- GCM IV: G - TLS RSA public key: E - TLS RSA private key: E Operator - TLS pre- primary secret : G,E - TLS primary secret: G,E - TLS AES- GCM IV: G - TLS derived session key : G - TLS ECDSA public key: E - TLS ECDSA private key: E - TLS RSA public key: E - TLS RSA private key: E",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "TLS data encryption/decryptio n, TLS data authentication",
            "indicator": "Successful TLS connectio n",
            "inputs": "Ciphersuites, plaintext/ciphertex t",
            "name": "Maintain TLS Session",
            "outputs": "ciphertext/plaintex t, MAC tag",
            "rolesSspAccess": "SSP Access Administrato r - TLS AES- GCM IV: E - TLS derived session key : E Resource Admin - TLS AES- GCM IV: E - TLS derived session key : E Operator - TLS AES- GCM IV: E - TLS derived session key : E",
            "secFunImpl": "Key Wrapping/Unwrappi ng with encryption and authentication or with authenticated encryption in TLS"
          },
          {
            "description": "Close TLS session",
            "indicator": "TLS connectio n closed",
            "inputs": "None",
            "name": "Close TLS session",
            "outputs": "Confirmation of TLS session closure",
            "rolesSspAccess": "Administrato r - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS AES- GCM IV: Z - TLS derived session key : Z Resource Admin - TLS EC Diffie- Hellman public key: Z - TLS EC",
            "secFunImpl": "None"
          },
          {
            "description": "Return the module name and version",
            "indicator": "None",
            "inputs": "None",
            "name": "Show version",
            "outputs": "Version information, and module name",
            "rolesSspAccess": "Z Administrato r Resource Admin Operator",
            "secFunImpl": "None"
          },
          {
            "description": "Return license indication",
            "indicator": "None",
            "inputs": "None",
            "name": "Show license",
            "outputs": "FIPS license information",
            "rolesSspAccess": "Administrato r Resource Admin Operator",
            "secFunImpl": "None"
          },
          {
            "description": "Return the module status",
            "indicator": "None",
            "inputs": "None",
            "name": "Show status",
            "outputs": "Status of the specific service passed in the show status command",
            "rolesSspAccess": "Administrato r Resource Admin Operator",
            "secFunImpl": "None"
          },
          {
            "description": "Execute integrity test; Execute the CASTs",
            "indicator": "None",
            "inputs": "None",
            "name": "Self-test",
            "outputs": "Pass/ fail results of self-tests",
            "rolesSspAccess": "Administrato r Resource Admin Operator",
            "secFunImpl": "AES-ECB AES-GMAC Random Number Generation Signature Generation Signature Verification Key pair generation Key pair verification SHA TLS Handshake SSH Handshake Key Wrapping/Unwrappi ng with encryption and authentication in SSH"
          },
          {
            "description": "Lists tenant information",
            "indicator": "None",
            "inputs": "None",
            "name": "Show tenant",
            "outputs": "Lists tenant information",
            "rolesSspAccess": "Administrato r Resource Admin Operator",
            "secFunImpl": "None"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The password must consist of a minimum of 8 characters with at least one from each of the three- character classes. Character classes are defined as: digits (0-9), ASCII lowercase letters (a-z), ASCII uppercase letters (A-Z). Assuming a worst-case scenario where the password contains six numerical digits, one ASCII lowercase letter and one ASCII uppercase letter. The probability of guessing every character successfully is (1/10)^6 * (1/26)^1 * (1/26)^1 = 1/676,000,000. Note: this is less than 1/1,000,000. The maximum number of login attempts is limited to 3 after which the account is locked. This means that, in the worst case, an attacker has the probability of guessing the password in one minute as 3/676,000,000. Note: This is less than 1/100,000.",
            "mechanism": "Password-based authentication",
            "name": "Role-based authentication with Password (CLI or WebUI)",
            "perMinute": "3/676,000,000",
            "strength": "1/676,000,000"
          },
          {
            "description": "The ECDSA using P-256 or P-384 curves for key based authentication yields a minimum security-strength of 128 bits. The chance of a random authentication attempt falsely succeeding is at most 1/(2^128) that is less than 1/1,000,000. The maximum number of login attempts is limited to 1 after which the account switches to password authentication. Then the attacker\u0027s probability to establish the connection depends on the probability of guessing the password and it is, as above, 3/676,000,000 less than 1/100,000.",
            "mechanism": "ECDSA Signature Verification",
            "name": "Role-based authentication with SSH ECDSA key-pair (CLI only)",
            "perMinute": "3/676,000,000",
            "strength": "1/(2^128)"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [],
        "found": false,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "HMAC-SHA2-384 KAT failure or HMAC-SHA2- 384 integrity test failure Failure of any of the CASTs Failure of any of the PCTs Failure of the APT, RCT at restart (power-on) Failure of the APT, RCT at runtime",
            "description": "Module is no longer operational. The data output is inhibited.",
            "indicator": "Module will not load after failing any of the CASTs, the integrity test or APT/RCT at restart (power on; Module will reboot after failing a PCT or APT/RCT at runtime",
            "name": "Error State",
            "recoveryMethod": "The module must reboot or be re- loaded with a fresh image"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "N/A",
            "inspectGuidance": "N/A",
            "mechanism": "Production grade enclosure (SL1)"
          },
          {
            "inspectFreq": "N/A",
            "inspectGuidance": "N/A",
            "mechanism": "Opaque enclosure (SL2)"
          },
          {
            "inspectFreq": "Once per month",
            "inspectGuidance": "The CO checks the quality of the tamper evident labels for any sign of removal, replacement, tearing. If the tamper evident labels require replacement, a kit providing 25 tamper labels is available for purchase (P/N: F5-ADD-BIG-FIPS140).",
            "mechanism": "Tamper Evident Seals (SL2)"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [],
        "found": false,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only)",
            "name": "Administrator",
            "operatorType": "CO",
            "type": "Role"
          },
          {
            "authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only)",
            "name": "Resource Admin",
            "operatorType": "User",
            "type": "Role"
          },
          {
            "authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only)",
            "name": "Operator",
            "operatorType": "User",
            "type": "Role"
          },
          {
            "authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only)",
            "name": "Tenant-console",
            "operatorType": "User",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "2",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "2",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "HMAC- SHA2-384 (A7031)",
            "details": "Integrity of the module is verified by comparing the HMAC-SHA2-384 value calculated at runtime with the HMAC-SHA2- 384 value stored in the module that was computed at build time",
            "indicator": "Module is operational and services are available for use",
            "testMethod": "Message authentication",
            "testProps": "HMAC key: 384-bits",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-384 (A7032)",
            "details": "Integrity of the module is verified by comparing the HMAC-SHA2-384 value calculated at runtime with the HMAC-SHA2- 384 value stored in the module that was computed at build time",
            "indicator": "Module is operational and services are available for use",
            "testMethod": "Message authentication",
            "testProps": "HMAC key: 384-bits",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "User",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public key output during protocol handshake",
            "sfiAlgo": "Key Wrapping/Unwrapping with encryption and authentication or with authenticated encryption in TLS",
            "source": "Module"
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public SSPs during protocol handshake",
            "sfiAlgo": "Key Wrapping/Unwrapping with encryption and authentication in SSH",
            "source": "User"
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input over encrypted TLS/SSH session",
            "sfiAlgo": "Key Wrapping/Unwrapping with encryption and authentication in SSH",
            "source": "User"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Single pass zeroization erasing the entire module",
            "method": "Secure Erase",
            "operatorId": "The Administrator and Resource Admin calling Reboot System service calling the Secure Erase service which can only be triggered during reboot of the test platform.",
            "rationale": "All SSPs present in the module are erased including the one in the non-volatile memory"
          },
          {
            "description": "Clear the SSPs present in RAM memory",
            "method": "Reboot System",
            "operatorId": "The Administrator and Resource Admin calling Reboot System service",
            "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed"
          },
          {
            "description": "Zeroization of temporary values",
            "method": "Closing TLS/SSH Connection",
            "operatorId": "Closing TLS/SSH Connection",
            "rationale": "SSP temporary values generated during key generation services are zeroized by the module"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "The keys are stored in plaintext form. The static SSPs remain on the system across power cycle. SSPs are only accessible to the authenticated operator, to which the SSPs are associated.",
            "name": "SSD",
            "persistance": "Static"
          },
          {
            "description": "The keys are stored in plaintext form. The memory occupied by SSPs is allocated by regular memory allocation operating system calls.",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "rSeries r4800",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "Yes",
            "processors": "Intel\u00ae Atom\u00ae P5342 Snow Ridge NS",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r4800",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "No",
            "processors": "Intel\u00ae Atom\u00ae P5342 Snow Ridge NS",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r5900",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "Yes",
            "processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r5900",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "No",
            "processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r5920-DF",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "Yes",
            "processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r5920-DF",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "No",
            "processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r10900",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "Yes",
            "processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r10900",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "No",
            "processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "rSeries r10920- DF",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "Yes",
            "processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
            "version": "1.5.3-40435 EHF"
          },
          {
            "hardwarePlatform": "Hardware Platform",
            "hypervisorHostOs": "Version(s)",
            "operatingSystem": "Operating System",
            "paa_pai": "PAA/PAI Hypervisor or Host OS",
            "processors": "Processors",
            "version": ""
          },
          {
            "hardwarePlatform": "rSeries r10920- DF",
            "hypervisorHostOs": "1.5.3-40435 EHF",
            "operatingSystem": "F5OS-A 1.5.3-40435 EHF",
            "paa_pai": "No N/A",
            "processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
            "version": ""
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 1
          },
          "ECDH": {
            "ECDH": 5
          },
          "ECDSA": {
            "ECDSA": 65
          }
        },
        "FF": {
          "DH": {
            "Diffie-Hellman": 12
          },
          "DSA": {
            "DSA": 1
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 1
        },
        "CCM": {
          "CCM": 2
        },
        "CFB": {
          "CFB": 1
        },
        "CTR": {
          "CTR": 1
        },
        "ECB": {
          "ECB": 1
        },
        "GCM": {
          "GCM": 14
        },
        "OFB": {
          "OFB": 1
        },
        "XTS": {
          "XTS": 2
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "SSH": {
          "SSH": 127,
          "SSHv2": 1
        },
        "TLS": {
          "SSL": {
            "SSL": 1
          },
          "TLS": {
            "TLS": 157,
            "TLS 1.2": 3,
            "TLS v1.2": 3
          }
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 1,
          "Key agreement": 2
        },
        "KEX": {
          "Key exchange": 1
        },
        "MAC": {
          "MAC": 8
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 34,
          "P-384": 14
        }
      },
      "eval_facility": {
        "atsec": {
          "atsec": 54
        }
      },
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 1,
          "AES-128": 1,
          "AES-256": 4,
          "HMAC-SHA-1": 4,
          "HMAC-SHA-384": 4,
          "PKCS 1": 1,
          "PKCS#1": 2,
          "SHA-1": 7,
          "SHA-3": 1,
          "SHA2-256": 8,
          "SHA2-384": 9,
          "SHA2-512": 3,
          "SHA3-256": 1
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 3
        }
      },
      "hash_function": {
        "SHA": {
          "SHA1": {
            "SHA-1": 7
          },
          "SHA3": {
            "SHA-3": 1,
            "SHA3-256": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 25
        },
        "RNG": {
          "RBG": 2,
          "RNG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140": 1,
          "FIPS 140-3": 57,
          "FIPS 180-4": 3,
          "FIPS 186-4": 3,
          "FIPS 186-5": 8,
          "FIPS 198-1": 3,
          "FIPS PUB 140-3": 2,
          "FIPS140-3": 1,
          "FIPS180-4": 1,
          "FIPS186-4": 5,
          "FIPS186-5": 20,
          "FIPS197": 1,
          "FIPS198-1": 1,
          "FIPS202": 1
        },
        "NIST": {
          "SP 800-108": 1,
          "SP 800-131A": 1,
          "SP 800-132": 1,
          "SP 800-133": 1,
          "SP 800-135": 4,
          "SP 800-140B": 1,
          "SP 800-140F": 1,
          "SP 800-38A": 4,
          "SP 800-38B": 1,
          "SP 800-38C": 1,
          "SP 800-38D": 4,
          "SP 800-38E": 1,
          "SP 800-38F": 1,
          "SP 800-38G": 1,
          "SP 800-56A": 1,
          "SP 800-56C": 1,
          "SP 800-57": 1,
          "SP 800-67": 1,
          "SP 800-90A": 3,
          "SP 800-90B": 2
        },
        "PKCS": {
          "PKCS 1": 1,
          "PKCS#1": 1
        },
        "RFC": {
          "RFC 4253": 1,
          "RFC 5288": 2,
          "RFC 6668": 1,
          "RFC3394": 1,
          "RFC5649": 1,
          "RFC7627": 2
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 12,
            "AES-": 8,
            "AES-128": 1,
            "AES-256": 4
          },
          "CAST": {
            "CAST": 19
          }
        },
        "DES": {
          "3DES": {
            "TDEA": 1,
            "TDES": 1,
            "Triple-DES": 1
          },
          "DES": {
            "DES": 1
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 2,
            "HMAC": 12,
            "HMAC-SHA-384": 2
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 6
        },
        "IBM": {
          "SSC": 2
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "RSA KeyGen (FIPS186-5)A7031",
        "SHA-1A7032",
        "KAS-ECC-SSC Sp800-56Ar3A7031",
        "SHA2-384A7032",
        "RSA SigVer (FIPS186-5)A7031",
        "TLS v1.2 KDF RFC7627A7031",
        "RSA SigVer (FIPS186-4)A7031",
        "ECDSA SigGen (FIPS186-5)A7031",
        "AES-GCMA7032",
        "HMAC-SHA2-384A7032",
        "ECDSA KeyVer (FIPS186-5)A7031",
        "AES-GMACA7032",
        "AES-CBCA7032",
        "KDF SSHA7031",
        "HMAC-SHA2-256A7032",
        "RSA SigGen (FIPS186-5)A7031",
        "Counter DRBGA7032",
        "HMAC-SHA-1A7032",
        "ECDSA SigVer (FIPS186-5)A7031",
        "ECDSA KeyGen (FIPS186-5)A7031",
        "ECDSA SigVer (FIPS186-4)A7031",
        "AES-ECBA7032",
        "AES-CTRA7032",
        "SHA2-256A7032"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A7032",
        "#A7031"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260824104054-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260824104054-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 752577,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
          "https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/85",
          "http://www.ietf.org/rfc/rfc3447.txt",
          "https://www.f5.com/",
          "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf",
          "http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
          "http://www.ietf.org/rfc/rfc5649.txt",
          "http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf",
          "http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf",
          "http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
          "http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
          "http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
          "http://www.ietf.org/rfc/rfc3394.txt",
          "http://www.atsec.com/",
          "http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
          "http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
          "http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf",
          "http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
          "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf",
          "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 53
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "32f324d7c3a323305f81d129347468af43b0c69dee5e63ee706cb6ee83cb9d42",
      "source_hash": "d6b80559819ae915ee68398e3f2817d43500e5564ca0057d852a0cbb705d4f74",
      "txt_hash": "b4e35b583ed3ac0b3852e4dff5697d34cc3839efef222dc135cd21030290b38c"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. Tamper evident labels contained in F5-ADD-BIG-FIPS140 kit and installed as indicated in the Security Policy section 7. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
    "date_sunset": "2031-08-24",
    "description": "F5OS-A Cryptographic Module Platform layer services for F5 appliance platforms",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "F5OS-A Cryptographic Module",
    "module_type": "Firmware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-08-25",
        "lab": "atsec information security corporation",
        "validation_type": "Initial"
      }
    ],
    "vendor": "F5, Inc.",
    "vendor_url": "f5.com"
  }
}