Page 1 of 64
Palo Alto Networks, Inc.
PAN-OS 11.1 and 11.2 VM-Series
FIPS 140-3 Non-Proprietary Security Policy
Page 2 of 64
Table of Contents
1 General................................................................................................................................... 5
1.1 Overview .......................................................................................................................... 5
1.2 Security Levels ................................................................................................................. 5
2 Cryptographic Module Specification........................................................................................ 5
2.1 Description ....................................................................................................................... 5
2.2 Tested and Vendor Affirmed Module Version and Identification........................................ 6
2.3 Excluded Components...................................................................................................... 7
2.4 Modes of Operation.......................................................................................................... 7
2.5 Algorithms ........................................................................................................................ 8
2.6 Security Function Implementations..................................................................................10
2.7 Algorithm Specific Information .........................................................................................18
2.8 RBG and Entropy ............................................................................................................19
2.9 Key Generation................................................................................................................20
2.10 Key Establishment.........................................................................................................20
2.11 Industry Protocols..........................................................................................................20
3 Cryptographic Module Interfaces............................................................................................21
3.1 Ports and Interfaces ........................................................................................................21
4 Roles, Services, and Authentication.......................................................................................21
4.1 Authentication Methods ...................................................................................................21
4.2 Roles...............................................................................................................................22
4.3 Approved Services ..........................................................................................................23
4.4 Non-Approved Services...................................................................................................37
4.5 External Software/Firmware Loaded................................................................................37
5 Software/Firmware Security ...................................................................................................37
5.1 Integrity Techniques ........................................................................................................37
5.2 Initiate on Demand ..........................................................................................................37
6 Operational Environment........................................................................................................37
6.1 Operational Environment Type and Requirements ..........................................................37
7 Physical Security....................................................................................................................38
8 Non-Invasive Security ............................................................................................................38
9 Sensitive Security Parameters Management..........................................................................38
9.1 Storage Areas .................................................................................................................38
9.2 SSP Input-Output Methods..............................................................................................38
9.3 SSP Zeroization Methods................................................................................................39
9.4 SSPs ...............................................................................................................................39
Page 3 of 64
9.5 Transitions.......................................................................................................................55
10 Self-Tests.............................................................................................................................56
10.1 Pre-Operational Self-Tests ............................................................................................56
10.2 Conditional Self-Tests....................................................................................................56
10.3 Periodic Self-Test Information........................................................................................60
10.4 Error States ...................................................................................................................62
10.5 Operator Initiation of Self-Tests .....................................................................................62
11 Life-Cycle Assurance ...........................................................................................................62
11.1 Installation, Initialization, and Startup Procedures..........................................................62
11.2 Administrator Guidance .................................................................................................63
11.3 Non-Administrator Guidance..........................................................................................63
11.4 Design and Rules ..........................................................................................................63
11.5 End of Life .....................................................................................................................64
12 Mitigation of Other Attacks ...................................................................................................64
Page 4 of 64
List of Tables
Table 1: Security Levels............................................................................................................. 5
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets).... 6
Table 3: Tested Operational Environments - Software, Firmware, Hybrid .................................. 7
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid ................... 7
Table 5: Modes List and Description .......................................................................................... 7
Table 6: Approved Algorithms.................................................................................................... 9
Table 7: Vendor-Affirmed Algorithms ......................................................................................... 9
Table 8: Security Function Implementations..............................................................................18
Table 9: Entropy Certificates.....................................................................................................19
Table 10: Entropy Sources........................................................................................................20
Table 11: Ports and Interfaces ..................................................................................................21
Table 12: Authentication Methods.............................................................................................22
Table 13: Roles.........................................................................................................................22
Table 14: Approved Services ....................................................................................................37
Table 15: Storage Areas ...........................................................................................................38
Table 16: SSP Input-Output Methods........................................................................................39
Table 17: SSP Zeroization Methods..........................................................................................39
Table 18: SSP Table 1..............................................................................................................46
Table 19: SSP Table 2..............................................................................................................55
Table 20: Pre-Operational Self-Tests........................................................................................56
Table 21: Conditional Self-Tests ...............................................................................................60
Table 22: Pre-Operational Periodic Information.........................................................................60
Table 23: Conditional Periodic Information................................................................................62
Table 24: Error States...............................................................................................................62
List of Figures
Figure 1 - Cryptographic Boundary ............................................................................................ 6
Page 5 of 64
1 General
1.1 Overview
This document may freely be reproduced and distributed in its entirety.
The table below provides the security levels of the various sections of FIPS 140-3 in relation to
the Palo Alto Networks PAN-OS VM-Series.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 3
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 3
12 Mitigation of other attacks N/A
Overall Level 1
Table 1: Security Levels
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The module provides network security by enabling enterprises to see and control applications,
users, and content – not just ports, IP addresses, and packets – using three unique
identification technologies: App-ID, User-ID, and Content-ID. These identification technologies,
found in Palo Alto Networks' enterprise firewalls, enable enterprises to create business-relevant
security policies – safely enabling organizations to adopt new applications, instead of the
traditional “all-or-nothing” approach offered by traditional port-blocking firewalls used in many
security infrastructures.
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Module Characteristics:
Cryptographic Boundary:
Page 6 of 64
The PAN-OS VM-Series is a software cryptographic module that requires an underlying general
purpose computer (GPC) environment
Figure 1 - Cryptographic Boundary
Tested Operational Environment’s Physical Perimeter (TOEPP):
The TOEPP for the module is defined by the enclosure around the host GPC on which it runs
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Hardware:
N/A for this module.
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File Name Software/ Firmware Version Features Integrity Test
PanOS_vm-11.1.8 11.1.8 N/A Yes
PanOS_vm-11.2.5 11.2.5 N/A Yes
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Tested Module Identification – Hybrid Disjoint Hardware:
N/A for this module.
Tested Operational Environments - Software, Firmware, Hybrid:
Page 7 of 64
Operating
System
Hardware Platform Processors PAA/PAI Hypervisor or Host OS Version(s)
N/A Dell PowerEdge
R740
Intel Xeon
Gold 6248
No Hyper-V 2019 on Microsoft
Hyper-V Server 2019
11.1.8
11.2.5
N/A Dell PowerEdge
R740
Intel Xeon
Gold 6248
No KVM 4 on Ubuntu 20.04 11.1.8
11.2.5
N/A Dell PowerEdge
R740
Intel Xeon
Gold 6248
No VMware ESXi v7.0 11.1.8
11.2.5
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
Operating System Hardware Platform
Amazon Web
Services (AWS)
x86 Architecture (Note: Specific processor/hardware is dependent on
Instance/Machine Type selected for operation system)
Google Cloud
Platform (GCP)
x86 Architecture (Note: Specific processor/hardware is dependent on
Instance/Machine Type selected for operation system)
Microsoft Azure x86 Architecture (Note: Specific processor/hardware is dependent on
Instance/Machine Type selected for operation system)
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid
CMVP makes no statement as to the correct operation of the module or the security strengths of
the generated keys when so ported if the specific operational environment is not listed on the
validation certificate.
2.3 Excluded Components
N/A
2.4 Modes of Operation
Modes List and Description:
Mode Name Description Type Status Indicator
Approved
Mode
The module has one approved mode of
operation and is always in approved mode after
initialization
Approved Global indicator
("FIPS-CC")
Table 5: Modes List and Description
The module has one approved mode of operation and is always in the approved mode of
operation after initial operations are performed (See Section 11). The module does not claim
implementation of a degraded mode of operation. Section 4 provides details on the service
indicator implemented by the module.
Mode Change Instructions and Status:
See Life-Cycle Assurance section.
Page 8 of 64
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP Cert Properties Reference
AES-CBC A3454 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A3454 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CTR A3454 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A3454 Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 192, 256
SP 800-38D
Counter DRBG A3454 Prediction Resistance - No, Yes
Mode - AES-256
Derivation Function Enabled - No, Yes
SP 800-90A
Rev. 1
ECDSA KeyGen
(FIPS186-4)
A3454 Curve - P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3454 Curve - P-256, P-384, P-521 FIPS 186-4
ECDSA SigGen
(FIPS186-4)
A3454 Curve - P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256,
SHA2-384, SHA2-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3454 Curve - P-256, P-384, P-521
Hash Algorithm - SHA-1, SHA2-224, SHA2-
256, SHA2-384, SHA2-512
FIPS 186-4
HMAC-SHA-1 A3454 Key Length - Key Length: 256-2048 Increment
8
FIPS 198-1
HMAC-SHA2-224 A3454 Key Length - Key Length: 256-2048 Increment
8
FIPS 198-1
HMAC-SHA2-256 A3454 Key Length - Key Length: 256-2048 Increment
8
FIPS 198-1
HMAC-SHA2-384 A3454 Key Length - Key Length: 256-2048 Increment
8
FIPS 198-1
HMAC-SHA2-512 A3454 Key Length - Key Length: 256-2048 Increment
8
FIPS 198-1
KAS-ECC-SSC
Sp800-56Ar3
A3454 Domain Parameter Generation Methods - P-
256, P-384, P-521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KAS-FFC-SSC
Sp800-56Ar3
A3454 Domain Parameter Generation Methods -
MODP-2048, MODP-3072, MODP-4096
Scheme -
dhEphem -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KDF IKEv2 (CVL) A3454 Diffie-Hellman Shared Secret Length - Diffie-
Hellman Shared Secret Length: 256, 384,
SP 800-135
Rev. 1
Page 9 of 64
Algorithm CAVP Cert Properties Reference
2048
Derived Keying Material Length - Derived
Keying Material Length: 800-3072 Increment 8
Hash Algorithm - SHA2-256, SHA2-384,
SHA2-512
KDF SNMP (CVL) A3454 Password Length - Password Length: 64,
2048
SP 800-135
Rev. 1
KDF SSH (CVL) A3454 Cipher - AES-128, AES-192, AES-256
Hash Algorithm - SHA-1, SHA2-256, SHA2-
512
SP 800-135
Rev. 1
RSA KeyGen
(FIPS186-4)
A3454 Key Generation Mode - B.3.6
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Private Key Format - Standard
FIPS 186-4
RSA SigGen
(FIPS186-4)
A3454 Signature Type - PKCS 1.5
Modulo - 2048, 3072, 4096
FIPS 186-4
RSA SigVer
(FIPS186-4)
A3454 Signature Type - ANSI X9.31, PKCS 1.5,
PKCSPSS
Modulo - 2048, 3072, 4096
FIPS 186-4
Safe Primes Key
Generation
A3454 Safe Prime Groups - MODP-2048, MODP-
3072, MODP-4096
SP 800-56A
Rev. 3
Safe Primes Key
Verification
A3454 Safe Prime Groups - MODP-2048, MODP-
3072, MODP-4096
SP 800-56A
Rev. 3
SHA-1 A3454 Message Length - Message Length: 8-65536
Increment 8
FIPS 180-4
SHA2-224 A3454 Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
SHA2-256 A3454 Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
SHA2-384 A3454 Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
SHA2-512 A3454 Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
TLS v1.2 KDF
RFC7627 (CVL)
A3454 Hash Algorithm - SHA2-256, SHA2-384 SP 800-135
Rev. 1
Table 6: Approved Algorithms
Note: Only the algorithms specified in the table above are supported by the module in approved
mode of operation.
Vendor-Affirmed Algorithms:
Name Properties Implementation Reference
CKG Key Type:Symmetric
and Asymmetric
N/A Cryptographic Key Generation; SP 800-
133rev2 and IG D.H (symmetric keys and
asymmetric seeds) from Section 4 Example 1
Table 7: Vendor-Affirmed Algorithms
Page 10 of 64
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
N/A for this module.
2.6 Security Function Implementations
Name Type Description Properties Algorithms
CKG CKG Symmetric key
generation for
AES
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
IPSec/IKE ECDSA
KeyGen
AsymKeyPair-
KeyGen
CKG
ECDSA
KeyGen for
IPSec/IKEv2
ECDSA
KeyGen
(FIPS186-4):
(A3454)
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
IPSec/IKE ECDSA
SigGen
DigSig-SigGen ECDSA
SigGen for
IPSec/IKEv2
ECDSA
SigGen
(FIPS186-4):
(A3454)
IPSec/IKE ECDSA
SigVer
DigSig-SigVer ECDSA SigVer
for
IPSec/IKEv2
ECDSA
SigVer
(FIPS186-4):
(A3454)
IPSec/IKE Keying
Materials
Development
KAS-135KDF IPSec/IKE
session keying
materials, used
to derive
KDF IKEv2:
(A3454)
Page 11 of 64
Name Type Description Properties Algorithms
IPSec/IKE
session keys
IPSec/IKE RSA
KeyGen
AsymKeyPair-
KeyGen
CKG
RSA KeyGen
for
IPSec/IKEv2
RSA KeyGen
(FIPS186-4):
(A3454)
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
IPSec/IKE RSA
SigGen
DigSig-SigGen RSA SigGen
for
IPSec/IKEv2
RSA SigGen
(FIPS186-4):
(A3454)
IPSec/IKE RSA
SigVer
DigSig-SigVer RSA SigVer for
IPSec/IKEv2
RSA SigVer
(FIPS186-4):
(A3454)
KAS-ECC
(IPSec/IKE)
KAS-Full Full KAS-ECC
Key Agreement
used for
IPSec/IKEv2
service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
KAS-ECC-
SSC Sp800-
56Ar3:
(A3454)
KDF IKEv2:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
KAS-ECC (SSH) KAS-Full Full KAS-ECC
Key Agreement
used for
SSHv2 service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
KAS-ECC-
SSC Sp800-
56Ar3:
(A3454)
KDF SSH:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
Page 12 of 64
Name Type Description Properties Algorithms
security
strength
KAS-ECC (TLSv1.2) KAS-Full Full KAS-ECC
Key Agreement
used for
TLSv1.2
service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
KAS-ECC-
SSC Sp800-
56Ar3:
(A3454)
TLS v1.2 KDF
RFC7627:
(A3454)
KAS-ECC-KeyGen
(IPSec/IKE)
CKG
KAS-KeyGen
KAS ECC
keygen used in
IPSec/IKEv2
service
Curves:P-256,
P-384, and P-
521
Encryption
Strength:128,
192, or 256 bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
KAS-ECC-KeyGen
(SSH)
CKG
KAS-KeyGen
KAS ECC
keygen used in
SSHv2 service
Curves:P-256,
P-384, and P-
521
Encryption
Strength:128,
192, or 256 bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
KAS-ECC-KeyGen
(TLSv1.2)
CKG
KAS-KeyGen
KAS ECC
keygen used in
TLSv1.2
service
Curves:P-256,
P-384, and P-
521
Encryption
Strength:128,
192, or 256 bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
KAS-FFC (IPSec/IKE) KAS-Full Full KAS-FFC
Key Agreement
used for
IPSec/IKEv2
service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
KAS-FFC-SSC
Sp800-56Ar3:
(A3454)
KDF IKEv2:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
Page 13 of 64
Name Type Description Properties Algorithms
establishment
methodology
providing
between 112
and 150 bits of
security
strength
SHA2-512:
(A3454)
KAS-FFC (SSH) KAS-Full Full KAS-FFC
Key Agreement
used for
SSHv2 service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
establishment
methodology
providing 112
bits of security
strength
KAS-FFC-SSC
Sp800-56Ar3:
(A3454)
KDF SSH:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
KAS-FFC (TLSv1.2) KAS-Full Full KAS-FFC
Key Agreement
used for
TLSv1.2
service
IG:IG D.F
Scenario 2 Path
2, split
Key
Confirmation:No
Key
Derivation:IG
2.4.B SP 800-
135rev1 CVL
Caveat:Key
establishment
methodology
providing 112
bits of security
strength
KAS-FFC-SSC
Sp800-56Ar3:
(A3454)
TLS v1.2 KDF
RFC7627:
(A3454)
Safe Primes
Key
Generation:
(A3454)
Safe Primes
Key
Verification:
(A3454)
KAS-FFC-KeyGen
(IPSec/IKE)
CKG
KAS-KeyGen
KAS FFC
keygen used in
IPSec/IKEv2
service
Key Sizes:2048,
3072, and
4096-bits
Key
Strengths:112,
128, or 150-bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
KAS-FFC-KeyGen
(SSH)
CKG
KAS-KeyGen
KAS FFC
keygen used in
SSHv2 service
Key Size:2048-
bits
Key
Strength:112-
bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Page 14 of 64
Name Type Description Properties Algorithms
Symmetric and
Asymmetric
KAS-FFC-KeyGen
(TLSv1.2)
CKG
KAS-KeyGen
KAS FFC
keygen used in
TLSv1.2
service
Key Size:2048-
bits
Key
Strength:112-
bits
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
KTS (SSHv2 with
AES and HMAC)
KTS-Wrap KTS via SSHv2
service by
using AES and
HMAC
Standard:SP
800-38F
IG
D.G:Approved
Key Wrapping
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
AES-CBC:
(A3454)
HMAC-SHA2-
256: (A3454)
HMAC-SHA2-
384: (A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
KTS (SSHv2 with
AES-GCM)
KTS-Wrap KTS via SSHv2
service by
using AES-
GCM
Standard:SP
800-38F
IG
D.G:Approved
Key Wrapping
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
AES-GCM:
(A3454)
KTS (TLSv1.2 with
AES and HMAC)
KTS-Wrap KTS via
TLSv1.2
service by
using AES and
HMAC
Standard:SP
800-38F
IG
D.G:Approved
Key Wrapping
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
AES-CBC:
(A3454)
HMAC-SHA2-
256: (A3454)
HMAC-SHA2-
384: (A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
TLS v1.2 KDF
RFC7627:
(A3454)
KTS (TLSv1.2 with
AES-GCM)
KTS-Wrap KTS via
TLSv1.2
Standard:SP
800-38F
AES-GCM:
(A3454)
Page 15 of 64
Name Type Description Properties Algorithms
service by
using AES-
GCM
IG
D.G:Approved
Key Wrapping
Caveat:Key
establishment
methodology
providing
between 128
and 256 bits of
security
strength
Session
Authentication
(IPSec/IKE)
MAC IPSec/IKE
session
authentication
HMAC-SHA-1:
(A3454)
HMAC-SHA2-
256: (A3454)
HMAC-SHA2-
384: (A3454)
HMAC-SHA2-
512: (A3454)
SHA-1:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
Session
Authentication
(SMPv3)
MAC SNMPv3
session
authentication
HMAC-SHA-1:
(A3454)
HMAC-SHA2-
224: (A3454)
SHA-1:
(A3454)
SHA2-224:
(A3454)
Session
Authentication
(SSHv2)
MAC SSHv2 session
authentication
HMAC-SHA-1:
(A3454)
HMAC-SHA2-
256: (A3454)
HMAC-SHA2-
512: (A3454)
SHA-1:
(A3454)
SHA2-256:
(A3454)
SHA2-512:
(A3454)
Session
Authentication
(TLSv1.2)
MAC TLSv1.2
session
authentication
HMAC-SHA2-
256: (A3454)
HMAC-SHA2-
Page 16 of 64
Name Type Description Properties Algorithms
384: (A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
Session
Encryption/Decryption
(IPSec/IKE)
BC-Auth
BC-UnAuth
IPSec/IKE
session
protection
AES-CBC:
(A3454)
AES-GCM:
(A3454)
Session
Encryption/Decryption
(SNMPv3)
BC-Auth
BC-UnAuth
SNMPv3
session
protection
AES-CFB1:
(A3454)
AES-CFB8:
(A3454)
AES-CFB128:
(A3454)
Session
Encryption/Decryption
(SSH)
BC-Auth
BC-UnAuth
SSHv2 session
protection
AES-CBC:
(A3454)
AES-CTR:
(A3454)
AES-GCM:
(A3454)
Session
Encryption/Decryption
(TLSv1.2)
BC-Auth
BC-UnAuth
TLSv1.2
session
protection
AES-CBC:
(A3454)
AES-GCM:
(A3454)
SNMPv3 Keying
Materials
Development
KAS-135KDF SNMPv3
session keying
materials, used
to derive
SNMPv3
session keys
KDF SNMP:
(A3454)
Software Load Test DigSig-SigVer Signature
verification for
software load
test
RSA SigVer
(FIPS186-4):
(A3454)
SHA2-256:
(A3454)
SSH ECDSA KeyGen AsymKeyPair-
KeyGen
CKG
ECDSA
KeyGen for
SSHv2
ECDSA
KeyGen
(FIPS186-4):
(A3454)
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
SSH ECDSA SigGen DigSig-SigGen ECDSA
SigGen for
SSHv2
ECDSA
SigGen
Page 17 of 64
Name Type Description Properties Algorithms
(FIPS186-4):
(A3454)
SSH ECDSA SigVer DigSig-SigVer ECDSA SigVer
for SSHv2
ECDSA
SigVer
(FIPS186-4):
(A3454)
ECDSA
KeyVer
(FIPS186-4):
(A3454)
SSH RSA KeyGen AsymKeyPair-
KeyGen
CKG
SSH KeyGen
for SSHv2
RSA KeyGen
(FIPS186-4):
(A3454)
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
SSH RSA SigGen DigSig-SigGen RSA SigGen
for SSHv2
RSA SigGen
(FIPS186-4):
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
SSH RSA SigVer DigSig-SigVer RSA SigVer for
SSHv2
RSA SigVer
(FIPS186-4):
(A3454)
SHA2-224:
(A3454)
SHA2-256:
(A3454)
SHA2-384:
(A3454)
SHA2-512:
(A3454)
SSHv2 Keying
Materials
Development
KAS-135KDF SSHv2 session
keying
materials, used
to derive
SSHv2 session
keys.
KDF SSH:
(A3454)
TLS ECDSA KeyGen AsymKeyPair-
KeyGen
CKG
ECDSA
KeyGen for
TLSv1.2
ECDSA
KeyGen
(FIPS186-4):
(A3454)
Page 18 of 64
Name Type Description Properties Algorithms
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
TLS ECDSA SigGen DigSig-SigGen ECDSA
SigGen for
TLSv1.2
ECDSA
SigGen
(FIPS186-4):
(A3454)
TLS ECDSA SigVer DigSig-SigVer ECDSA SigVer
for TLSv1.2
ECDSA
SigVer
(FIPS186-4):
(A3454)
TLS RSA KeyGen AsymKeyPair-
KeyGen
CKG
RSA KeyGen
for TLSv1.2
RSA KeyGen
(FIPS186-4):
(A3454)
Counter
DRBG:
(A3454)
CKG: ()
Key Type:
Symmetric and
Asymmetric
TLS RSA SigGen DigSig-SigGen RSA SigGen
for TLSv1.2
RSA SigGen
(FIPS186-4):
(A3454)
TLS RSA SigVer DigSig-SigVer RSA SigVer for
TLSv1.2
RSA SigVer
(FIPS186-4):
(A3454)
TLSv1.2 Keying
Materials
Development
KAS-135KDF TLSv1.2
session keying
materials, used
to derive
TLSv1.2
session keys
TLS v1.2 KDF
RFC7627:
(A3454)
Table 8: Security Function Implementations
2.7 Algorithm Specific Information
The module is compliant to IG C.H: GCM is used in the context of TLS, IPsec/IKEv2, SSH:
● For TLS, The GCM implementation meets Scenario 1 of IG C.H: it is used in a
manner compliant with SP 800-52rev2 and in accordance with Section 4 of RFC
5288 for TLS key establishment, and ensures when the nonce_explicit part of the
IV exhausts all possible values for a given session key, that a new TLS
handshake is initiated per sections 7.4.1.1 and 7.4.1.2 of RFC 5246. During
Page 19 of 64
operational testing, the module was tested against an independent version of
TLS and found to behave correctly
o From this RFC, the GCM cipher suites in use are
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384.
● For IPsec/IKEv2, The GCM implementation meets Scenario 1 of IG C.H: it is
used in a manner compliant with RFCs 4106 and 7296 (RFC 5282 is not
applicable, as the module does not use GCM within IKEv2 itself). During
operational testing, the module was tested against an independent version of
IPsec with IKEv2 and found to behave correctly.
● For SSH, the module meets Scenario 1 of IG C.H. The module conforms to
RFCs 4252, 4253, and 5647. The fixed field is 32 bits in length and is derived
using the SSH KDF; this ensures the fixed field is unique for any given GCM
session. The invocation field is 64 bits in length and is incremented for each
invocation of GCM; this prevents the IV from repeating until the entire invocation
field space of 264 is exhausted. (It would take hundreds of years for this to
occur.)
In all of the above cases, the nonce_explicit is always generated deterministically. AES
GCM keys are zeroized when the module is power-cycled. For each new TLS or SSH
session, a new AES GCM key is established.
The module is compliant to IG C.F:
The module utilizes Approved modulus sizes 2048, 3072, and 4096 bits for RSA
signatures. This functionality has been CAVP tested as noted above. The minimum
number of Miller Rabin tests for each modulus size is implemented according to Table
C.2 of FIPS 186-4. For modulus size 4096, the module implements the largest number
of Miller-Rabin tests shown in Table C.2. RSA SigVer is CAVP tested for all three
supported modulus sizes as noted above. The module does not perform FIPS 186-2
SigVer. All supported modulus sizes are CAVP testable and tested as noted above. The
module does not implement RSA key transport in the approved mode.
The module is compliant to IG C.K:
The CAVP testing for Cert. #A3454 was performed prior to the transition date for this IG.
Additionally, The FIPS 186-4 CAVP implemented in this module tests are mathematically
identical to FIPS 186-5 tests.
2.8 RBG and Entropy
Cert
Number
Vendor Name
E69 Palo Alto Networks
Table 9: Entropy Certificates
Page 20 of 64
Name Type Operational Environment
Sample
Size
Entropy
per
Sample
Conditioning
Component
Palo Alto Networks
DRNG Entropy Source
- Skylake 28 Core Die
with FCLGA3647
Package
Physical Intel Corporation Intel(R)
Xeon(R) Skylake-28
FCLGA3647 Intel(R)
Xeon(R) Platinum
8276CL Processor
128-
bits
128-
bits
A1791
(AES-CBC-
MAC)
Table 10: Entropy Sources
The Intel DRNG utilizes a vetted conditioner (AES-CBC-MAC) that outputs full entropy (128-bits
per 128-bits of output). Upon boot, the AES-256 Counter DRBG (security strength of 256-bits)
requests 384-bits from the Intel DRNG entropy source. Therefore, it is fully seeded with 384 bits
of entropy.
2.9 Key Generation
The module implements CKG where symmetric keys and seeds used for asymmetric key pair
generation are produced using the unmodified/direct output of the DRBG
2.10 Key Establishment
The module provides the following key/SSP establishment services in the approved mode of
operation:
• KAS-ECC Shared Secret Computation
• The module provides SP800-56Arev3 compliant key establishment according
to FIPS 140-3 IG D.F scenario 2 path (1) with KAS-ECC shared secret
computation. The shared secret computation provides between 128 and 256
bits of encryption strength.
• KAS-FFC Shared Secret Computation
• The module provides SP800-56Arev3 compliant key establishment according
to FIPS 140-3 IG D.F scenario 2 path (1) with KAS-FFC shared secret
computation. The shared secret computation provides between 112 and 150
bits of encryption strength.
2.11 Industry Protocols
The module supports the following industry protocols:
• TLS 1.2
• SSHv2
• IPSec and IKEv2
• SNMPv3
No parts of the SSH, TLS, SNMP and IPSec/IKE protocols, other than the KDFs, have been
tested by the CAVP/CMVP.
Page 21 of 64
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Power Power supplies
N/A Status Output Self-test status output
N/A Data Input
Data Output
Control Input
Status Output
HTTPS, TLS, SNMP, IPsec, and SSH traffic data.
Table 11: Ports and Interfaces
4 Roles, Services, and Authentication
4.1 Authentication Methods
Method
Name
Description
Security
Mechanism
Strength Each Attempt Strength per Minute
RSA-
Based
Certificate
The modules
support RSA
public-key
based
authentication
mechanism
using a
minimum of
RSA 2048 bits
RSA
SigVer
(FIPS186-
4) (A3454)
With a minimum
modulus size of
2048, the probability
that a random
attempt will succeed
is 1/(2^112).
The probability of
successfully
authenticating to the
module within a one
minute period is
288,000,000/(2112).
The module supports at
most 4,800,000 new
sessions per second.
ECDSA-
Based
Certificate
The modules
support ECDSA
public-key
based
authentication
mechanism
using a
minimum
ECDSA curve of
P-256
ECDSA
SigVer
(FIPS186-
4) (A3454)
With a minimum
curve of P-256, the
probability that a
random attempt will
succeed is 1/(2^128).
The probability of
successfully
authenticating to the
module within a one
minute period is
288,000,000/(2112).
The module supports at
most 4,800,000 new
sessions per second.
Password Password
based
authentication
Password
Based
The minimum length
is eight (8) characters
(95 possible
characters). The
probability that a
random attempt will
succeed or a false
The probability of
successfully
authenticating to the
module within one
minute is 10/(958). The
firewall's configuration
supports at most ten
failed attempts to
Page 22 of 64
Method
Name
Description
Security
Mechanism
Strength Each Attempt Strength per Minute
acceptance will occur
is 1/(958).
authenticate in a one-
minute period.
Pre-
Shared
Secret
PSK
authentication
Password
Based
The pre-shared key
authentication
method has a
minimum security
strength of 956. The
probability of
successfully
authenticating to the
module is 1/(956).
The number of
authentication
attempts is limited by
the number of new
connections per
second supported
(4,800,000) on the
fastest platform of the
Palo Alto Networks
firewalls.
The probability of
successfully
authenticating to the
module within a one
minute period is
288,000,000/(956).
Table 12: Authentication Methods
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Identity CO RSA-Based Certificate
ECDSA-Based Certificate
Password
Pre-Shared Secret
User Identity User RSA-Based Certificate
ECDSA-Based Certificate
Password
Pre-Shared Secret
Remote Access VPN (RA
VPN)
Identity CO RSA-Based Certificate
ECDSA-Based Certificate
Password
Pre-Shared Secret
Site-to-Site VPN (S-S
VPN)
Identity CO Password
Pre-Shared Secret
Table 13: Roles
Page 23 of 64
4.3 Approved Services
Name Description Indicator Inputs Outputs Security Functions SSP Access
Other
Configur
ation
Networking
parameter
configurati
on, logging
configurati
on, and
other non-
security
relevant
configurati
on
Configuration/
System Logs
Input
configura
tions for
other
setup
functions
Module
uses
configur
ation
KAS-ECC-
KeyGen (SSH)
KAS-ECC-
KeyGen
(TLSv1.2)
KAS-FFC-
KeyGen (SSH)
KAS-FFC-
KeyGen
(TLSv1.2)
KAS-ECC
(SSH)
KAS-ECC
(TLSv1.2)
KAS-ECC
(IPSec/IKE)
KAS-FFC
(SSH)
KAS-FFC
(TLSv1.2)
KAS-FFC
(IPSec/IKE)
KTS (TLSv1.2
with AES and
HMAC)
KTS (TLSv1.2
with AES-
GCM)
KTS (SSHv2
with AES and
HMAC)
KTS (SSHv2
with AES-
GCM)
SSH ECDSA
KeyGen
SSH ECDSA
SigGen
SSH ECDSA
SigVer
SSH RSA
KeyGen
SSH RSA
SigGen
SSH RSA
SigVer
TLS RSA
KeyGen
Crypto
Officer
- CO,
User, RA
VPN
Password:
G,W,E
-
DHE/ECD
HE Shared
Secret Z:
G,R,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
- DRBG V:
G,E
- ECDSA
Private
Keys :
G,W,E
- Entropy
Input
String: G,E
- IKEv2
SKEYSEE
D: G,R,E
- RSA
Private
Keys:
G,W,E
- SSH
Client
Public
Key: W,E
- SSH
DHE/ECD
HE Private
Componen
ts: G,E,Z
- SSH
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- SSH
Page 24 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
TLS RSA
SigGen
TLS RSA
SigVer
TLS ECDSA
KeyGen
TLS ECDSA
SigGen
TLS ECDSA
SigVer
Session
Encryption/De
cryption (SSH)
Session
Encryption/De
cryption
(TLSv1.2)
Session
Encryption/De
cryption
(SNMPv3)
Session
Authentication
(SSHv2)
Session
Authentication
(TLSv1.2)
Session
Authentication
(SMPv3)
SSHv2 Keying
Materials
Development
TLSv1.2
Keying
Materials
Development
SNMPv3
Keying
Materials
Development
Host
Public
Key:
G,R,W,E
- SSH
Session
Authentica
tion Keys:
G,E,Z
- SSH
Session
Encryption
Keys:
G,E,Z
- TLS
Encryption
Keys:
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Security
Configur
ation
Manage
ment
Configurin
g and
managing
cryptograp
hic
parameters
and
setting/mo
difying
Configuration/
System Logs
Input
configura
tion for
various
cryptogra
phic
functions
Module
uses the
configur
ation for
cryptogr
aphic
purpose
s
KAS-ECC-
KeyGen (SSH)
KAS-ECC-
KeyGen
(TLSv1.2)
KAS-FFC-
KeyGen (SSH)
KAS-FFC-
KeyGen
Crypto
Officer
- CA
Certificate
s:
G,R,W,E
- CO,
User, RA
VPN
Page 25 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
security
policy,
including
creating
User
accounts
and
additional
CO
accounts
(TLSv1.2)
KAS-ECC
(SSH)
KAS-ECC
(TLSv1.2)
KAS-ECC
(IPSec/IKE)
KAS-FFC
(SSH)
KAS-FFC
(TLSv1.2)
KAS-FFC
(IPSec/IKE)
KTS (TLSv1.2
with AES and
HMAC)
KTS (TLSv1.2
with AES-
GCM)
KTS (SSHv2
with AES and
HMAC)
KTS (SSHv2
with AES-
GCM)
SSH ECDSA
KeyGen
SSH ECDSA
SigGen
SSH ECDSA
SigVer
SSH RSA
KeyGen
SSH RSA
SigGen
SSH RSA
SigVer
TLS RSA
KeyGen
TLS RSA
SigGen
TLS RSA
SigVer
TLS ECDSA
KeyGen
TLS ECDSA
SigGen
TLS ECDSA
SigVer
Session
Password:
G,W,E
-
DHE/ECD
HE Shared
Secret Z:
G,R,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
- DRBG V:
G,E
- ECDSA
Private
Keys :
G,W,E
- ECDSA
Public
Keys:
G,R,W,E
- Entropy
Input
String: G,E
- IKEv2
SKEYSEE
D: G,R,E
- Protocol
Secrets:
W,E
- Public
key for
software
content
load test:
W,E
- RSA
Private
Keys:
G,W,E
- RSA
Public
Keys:
G,R,W,E
- SNMPv3
Authentica
tion Key:
G,E,Z
- SNMPv3
Authentica
Page 26 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
Encryption/De
cryption (SSH)
Session
Encryption/De
cryption
(TLSv1.2)
Session
Encryption/De
cryption
(SNMPv3)
Session
Authentication
(SSHv2)
Session
Authentication
(TLSv1.2)
Session
Authentication
(SMPv3)
SSHv2 Keying
Materials
Development
TLSv1.2
Keying
Materials
Development
SNMPv3
Keying
Materials
Development
tion
Secret:
W,E
- SNMPv3
Privacy
Secret:
W,E
- SNMPv3
Session
Key: G,E,Z
- SSH
Client
Public
Key: W,E
- SSH
DHE/ECD
HE Private
Componen
ts: G,E,Z
- SSH
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- SSH
Host
Public
Key:
G,R,W,E
- SSH
Session
Encryption
Keys:
G,E,Z
- TLS
DHE/ECD
HE Private
Componen
ts: G,E,Z
- TLS
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- TLS
Encryption
Keys:
G,E,Z
Page 27 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
- TLS
HMAC
Keys:
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Self-
Tests
Initiates
self-tests
and
integrity
test
System Logs Self-test
comman
d or
rebooting
the
module
Status of
the self-
tests
None Crypto
Officer
Show
Status
Provides
status
information
of the
module
Configuration/
System Logs
Initiate
show
status
comman
d
Module
provides
status
output of
module
None Crypto
Officer
- CO,
User, RA
VPN
Password:
G,W,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
- DRBG V:
G,E
- ECDSA
Private
Keys : E
- Entropy
Input
String: G,E
- RSA
Private
Keys: E
- SSH
DHE/ECD
HE Private
Componen
ts: G,E,Z
- SSH
DHE/ECD
HE Public
Componen
ts:
Page 28 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
G,R,W,E,Z
- SSH
Session
Authentica
tion Keys:
G,E,Z
- SSH
Session
Encryption
Keys:
G,E,Z
- TLS
DHE/ECD
HE Private
Componen
ts: G,E,Z
- TLS
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- TLS
Encryption
Keys:
G,E,Z
- TLS
HMAC
Keys:
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Unauthenti
cated
User
- CO,
User, RA
VPN
Password:
G,W,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
Page 29 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
- DRBG V:
G,E
- ECDSA
Private
Keys : E
- Entropy
Input
String: G,E
- RSA
Private
Keys: E
- SSH
DHE/ECD
HE Private
Componen
ts: G,E,Z
- SSH
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- SSH
Session
Authentica
tion Keys:
G,E,Z
- SSH
Session
Encryption
Keys:
G,E,Z
- TLS
DHE/ECD
HE Private
Componen
ts: G,E,Z
- TLS
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- TLS
Encryption
Keys:
G,E,Z
- TLS
HMAC
Keys:
Page 30 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Show
Version
Shows the
version of
the module
Version
displayed via
System Logs /
CLI / UI
Input
comman
d for
version
Module
displays
version
informati
on
None Crypto
Officer
Unauthenti
cated
Software
Update
Provides a
method to
update the
software of
the module
Configuration/
System Logs
Uploadin
g new
software
Status of
the
updated
software
installati
on
Software Load
Test
Crypto
Officer
- Public
key for
software
content
load test:
E
View
Other
Configur
ation
Read-only
of non-
security
relevant
configurati
on
Configuration/
System Logs
Initiate
comman
d to read
configura
tion
Module
provides
configur
ation
details
None Crypto
Officer
- CO,
User, RA
VPN
Password:
W,E
User
- CO,
User, RA
VPN
Password:
W,E
VPN Provide
network
access for
remote
users or
site-to-site
connection
Configuration/
System Logs
Initiating
VPN
connecti
ons
Module
provides
VPN
connecti
on
KAS-ECC-
KeyGen
(IPSec/IKE)
KAS-FFC-
KeyGen
(IPSec/IKE)
KAS-ECC
(IPSec/IKE)
IPSec/IKE
RSA KeyGen
IPSec/IKE
RSA SigGen
IPSec/IKE
RSA SigVer
IPSec/IKE
Remote
Access
VPN (RA
VPN)
- CA
Certificate
s: W,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
- DRBG V:
G,E
- ECDSA
Private
Page 31 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
ECDSA
KeyGen
IPSec/IKE
ECDSA
SigGen
IPSec/IKE
ECDSA
SigVer
Session
Encryption/De
cryption
(IPSec/IKE)
Session
Authentication
(IPSec/IKE)
IPSec/IKE
Keying
Materials
Development
CKG
Keys : E
- ECDSA
Public
Keys: W,E
- Entropy
Input
String: G,E
- RA VPN
IPSec
Authentica
tion :
G,E,Z
- RA VPN
IPSec
Session
Keys:
G,E,Z
- RSA
Private
Keys: E
- RSA
Public
Keys: W,E
- S-S VPN
IPSec Pre-
Shared
Keys: W,E
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Private
Componen
ts: G,E,Z
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Public
Componen
ts:
G,R,W,E,Z
- S-S VPN
IPSec/IKE
Session
Keys:
G,E,Z
- TLS
DHE/ECD
HE Private
Page 32 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
Componen
ts: G,E,Z
- TLS
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- TLS
Encryption
Keys:
G,E,Z
- TLS
HMAC
Keys:
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Site-to-Site
VPN (S-S
VPN)
- CA
Certificate
s: W,E
- DRBG
Key: G,E
- DRBG
Seed : G,E
- DRBG V:
G,E
- ECDSA
Private
Keys : E
- ECDSA
Public
Keys: W,E
- Entropy
Input
String: G,E
- RA VPN
IPSec
Authentica
tion :
G,E,Z
Page 33 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
- RA VPN
IPSec
Session
Keys:
G,E,Z
- RSA
Private
Keys: E
- RSA
Public
Keys: W,E
- S-S VPN
IPSec Pre-
Shared
Keys: W,E
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Private
Componen
ts: G,E,Z
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Public
Componen
ts:
G,R,W,E,Z
- S-S VPN
IPSec/IKE
Session
Keys:
G,E,Z
- TLS
DHE/ECD
HE Private
Componen
ts: G,E,Z
- TLS
DHE/ECD
HE Public
Componen
ts:
G,R,W,E,Z
- TLS
Encryption
Keys:
G,E,Z
Page 34 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
- TLS
HMAC
Keys:
G,E,Z
- TLS
Master
Secret:
G,E,Z
- TLS Pre-
Master
Secret:
G,E,Z
Zeroize Destroys
(Zeroizes)
all keys in
the module
Zeroization
indicator
Initiating
zeroizati
on
comman
d
Status of
the
zeroizati
on
process
None Unauthenti
cated
- CA
Certificate
s: Z
- CO,
User, RA
VPN
Password:
Z
-
DHE/ECD
HE Shared
Secret Z: Z
- DRBG
Key: Z
- DRBG
Seed : Z
- DRBG V:
Z
- ECDSA
Private
Keys : Z
- ECDSA
Public
Keys: Z
- Entropy
Input
String: Z
- IKEv2
SKEYSEE
D: Z
- Protocol
Secrets: Z
- Public
key for
software
content
Page 35 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
load test: Z
- RA VPN
IPSec
Authentica
tion : Z
- RA VPN
IPSec
Session
Keys: Z
- RSA
Private
Keys: Z
- RSA
Public
Keys: Z
- S-S VPN
IPSec Pre-
Shared
Keys: Z
- S-S VPN
IPSec/IKE
Authentica
tion Keys:
Z
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Private
Componen
ts: Z
- S-S VPN
IPSec/IKE
DHE or
ECDHE
Public
Componen
ts: Z
- S-S VPN
IPSec/IKE
Session
Keys: Z
- SNMPv3
Authentica
tion Key: Z
- SNMPv3
Authentica
tion
Secret: Z
- SNMPv3
Page 36 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
Privacy
Secret: Z
- SNMPv3
Session
Key: Z
- SSH
Client
Public
Key: Z
- SSH
DHE/ECD
HE Private
Componen
ts: Z
- SSH
DHE/ECD
HE Public
Componen
ts: Z
- SSH
Host
Public
Key: Z
- SSH
Session
Authentica
tion Keys:
Z
- SSH
Session
Encryption
Keys: Z
- TLS
DHE/ECD
HE Private
Componen
ts: Z
- TLS
DHE/ECD
HE Public
Componen
ts: Z
- TLS
Encryption
Keys: Z
- TLS
HMAC
Keys: Z
- TLS
Master
Page 37 of 64
Name Description Indicator Inputs Outputs Security Functions SSP Access
Secret: Z
- TLS Pre-
Master
Secret: Z
Table 14: Approved Services
4.4 Non-Approved Services
N/A for this module.
4.5 External Software/Firmware Loaded
The module supports the software load test by using RSA 2048 bits with SHA2-256 (RSA Cert.
#A3454) for the new validated software to be uploaded into the module. A Software Load Test
Key was preloaded to the module’s binary at the factory and used for software load test. In
order to load new software, the Crypto Officer must authenticate into the module before loading
any software. This ensures that unauthorized access and use of the module is not performed.
The module will load the new update upon reboot. The update attempt will be rejected if the
verification fails.
5 Software/Firmware Security
5.1 Integrity Techniques
The module performs the Software Integrity test by using HMAC-SHA-256 and ECDSA
signature verification (HMAC and ECDSA Cert. #A3454) during the Pre-Operational Self-Test.
5.2 Initiate on Demand
The pre-operational self-tests can be initiated by power cycling the module. When this is
performed, the module automatically runs the cryptographic algorithm self-tests in addition to
the pre-operational software integrity test.
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Modifiable
Page 38 of 64
7 Physical Security
N/A for this module.
8 Non-Invasive Security
N/A for this module.
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description
Persistence
Type
HDD Non-Volatile Memory Static
RAM Volatile Memory Dynamic
Table 15: Storage Areas
9.2 SSP Input-Output Methods
Name From To Format Type
Distribution
Type
Entry Type
SFI or
Algorithm
Module Public
Key Output
HDD External
(Outside
of
Module's
Boundary)
Plaintext Automated Electronic
Password/Secret
Input via SSHv2
encrypted by
AES and HMAC
External
(Outside
of
Module's
Boundary)
HDD Encrypted Automated Electronic KTS
(SSHv2
with AES
and
HMAC)
Password/Secret
Input via SSHv2
encrypted by
AES-GCM
External
(Outside
of
Module's
Boundary)
HDD Encrypted Automated Electronic KTS
(SSHv2
with
AES-
GCM)
Password/Secret
Input via TLSv1.2
encrypted by
AES and HMAC
External
(Outside
of
Module's
Boundary)
HDD Encrypted Automated Electronic KTS
(TLSv1.2
with AES
and
HMAC)
Password/Secret
Input via TLSv1.2
encrypted by
AES-GCM
External
(Outside
of
Module's
Boundary)
HDD Encrypted Automated Electronic KTS
(TLSv1.2
with
AES-
GCM)
Page 39 of 64
Name From To Format Type
Distribution
Type
Entry Type
SFI or
Algorithm
Peer Public Key
Input
External
(Outside
of
Module's
Boundary)
HDD Plaintext Automated Electronic
Table 16: SSP Input-Output Methods
9.3 SSP Zeroization Methods
Zeroization Method Description Rationale Operator Initiation
Power Cycle /
Session
Termination
Operator powers
the module off or
session terminates
Powering off the module or
terminating the session will
erase all SSPs stored in the
RAM of the module.
Command via CLI or
WebUI or by
unplugging module
Zeroization
Command
CO issues
zeroization service
The zeroization command
will erase all SSPs stored in
the RAM or in the Flash of
the module.
Entering into
maintenance mode
and selecting Factory
Reset
Table 17: SSP Zeroization Methods
Once the module is rebooted and zeroization is initiated, the module cannot be accessed in any
way and the zeroization process cannot be stopped, thus the SSPs would not be compromised
during the time of zeroization. The Crypto Officer shall be in control of the module until the
zeroization process is complete.
9.4 SSPs
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
CA
Certificates
ECDSA/RSA
Public key -
Used to trust a
root CA
intermediate
CA and leaf
/end entity
certificates
(RSA 2048,
3072, and
4096 bits)
(ECDSA P-
256, P-384,
and P-521)
2048
bits -
4096
bits
128 -
256 bits
- 112
bits
minimu
m
Public Key
- PSP
Counte
r
DRBG
(A3454
)
TLS RSA
SigGen
TLS RSA SigVer
TLS ECDSA
SigGen
TLS ECDSA
SigVer
Page 40 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
CO, User,
RA VPN
Password
Authentication
string with a
minimum
length of eight
(8) characters.
8
charact
ers
minimu
m - N/A
Authenticat
ion Data -
CSP -
CSP
Externa
l
DHE/ECD
HE Shared
Secret Z
Used to derive
encryption
keys
2048
bits,
3072
bits,
4096
bits;
256
bits,
384
bits,
521 bits
- 112
bits,128
bits,
150
bits;
128
bits,192
bits,
256 bits
Key
Agreement
shared
secret -
CSP
KDF
IKEv2
(A3454
)
KDF
SSH
(A3454
)
KAS-ECC
(IPSec/IKE)
KAS-FFC
(IPSec/IKE)
DRBG Key AES 256 CTR
DRBG state
Key used in
the generation
of a random
values
256 bits
- 256
bits
DRBG Key
- CSP -
CSP
Entropy
as per
SP
800-
90B
Counter DRBG
(A3454)
DRBG
Seed
DRBG seed
coming from
the entropy
source Seed
length = 384
bits
384 bits
- 256
bits
DRBG
Seed -
CSP - CSP
Entropy
as per
SP
800-
90B
Counter DRBG
(A3454)
DRBG V AES 256 CTR
DRBG state V
used in the
generation of
a random
values
128 bits
- 128
bits
DRBG
Internal
State V
value -
CSP - CSP
Entropy
as per
SP
800-
90B
Counter DRBG
(A3454)
ECDSA
Private
Keys
ECDSA
Private key for
generation of
signatures and
authentication
128 -
256 bits
- 128
bits
minimu
m
Private
Key - CSP
Counte
r
DRBG
(A3454
)
TLS ECDSA
SigGen
Page 41 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
(P-256, P-384,
or P-521)
ECDSA
Public
Keys
ECDSA public
keys managed
as certificates
for the
verification of
signatures,
establishment
of TLS,
operator
authentication
and peer
authentication.
(ECDSA P-
256, P-384, or
P-521)
128 -
256 bits
- 128
bits
minimu
m
Public Key
- PSP
Counte
r
DRBG
(A3454
)
TLS ECDSA
SigVer
Entropy
Input
String
Entropy input
string coming
from the
entropy
source Input
length = 384
bits
384 bits
- 256
bits
DRBG
CSP - CSP
Entropy
as per
SP
800-
90B
Counter DRBG
(A3454)
IKEv2
SKEYSEE
D
Used to derive
encryption
keys
160
bits,
256
bits,
384
bits, or
512 bits
- 160
bits,
256
bits,
384
bits, or
512 bits
Key
Agreement
seed -
CSP
KDF
IKEv2
(A3454
)
KAS-ECC
(IPSec/IKE)
KAS-FFC
(IPSec/IKE)
Protocol
Secrets
Secrets used
by RADIUS or
TACACS+ (8
characters
minimum)
8
charact
ers
minimu
m - N/A
Authenticat
ion Data -
CSP -
CSP
Public key
for
software
content
load test
Used to
authenticate
software and
content to be
installed on
the firewall
112 bits
- 112
bits
Public Key
- PSP -
PSP
Software Load
Test
Page 42 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
(RSA 2048
with SHA-256)
RA VPN
IPSec
Authenticat
ion
(HMAC-SHA-
1, 160 bits)
Used in
authentication
of remote
access IPSec
data.
160 bits
- 160
bits
Session
Key - CSP
- CSP
CKG Session
Authentication
(IPSec/IKE)
RA VPN
IPSec
Session
Keys
Used to
encrypt
remote access
sessions
utilizing IPSec.
(AES 128-
CBC,
128/256-
GCM)
128 or
256 bits
- 128
bits
minimu
m
Session
Key - CSP
- CSP
CKG Session
Encryption/Decry
ption (IPSec/IKE)
RSA
Private
Keys
RSA Private
keys for
generation of
signatures,
authentication
or key
establishment.
(RSA 2048,
3072, or 4096-
bit)
2048 -
4096
bits -
112 bits
minimu
m
Private
Key - CSP
Counte
r
DRBG
(A3454
)
TLS RSA
SigGen
RSA
Public
Keys
RSA public
keys managed
as certificates
for the
verification of
signatures,
establishment
of TLS,
operator
authentication
and peer
authentication.
(RSA 2048,
3072, or 4096-
bit)
2048 -
4096
bits -
112 bits
minimu
m
Public Key
- PSP
Counte
r
DRBG
(A3454
)
TLS RSA SigVer
S-S VPN
IPSec Pre-
Shared
Keys
PSK used in
conjunction
with HMAC
listed above
for
authentication.
N/A -
N/A
Shared
Secret -
CSP - CSP
IPSec/IKE
Keying Materials
Development
Page 43 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
Entered into
the module by
the Crypto
Officer once
authenticated
S-S VPN
IPSec/IKE
Authenticat
ion Keys
(HMAC-SHA-
1, SHA-256,
SHA-384 or
SHA-512)
Used to
authenticate
the peer in an
IKE/IPSec
tunnel
connection.
(160, 256,
384, 512 bits)
160 -
512 bits
- 160
bits
minimu
m
Session
Key - CSP
- CSP
KDF
IKEv2
(A3454
)
KAS-
ECC
(IPSec/I
KE)
KAS-
FFC
(IPSec/I
KE)
Session
Authentication
(IPSec/IKE)
S-S VPN
IPSec/IKE
DHE or
ECDHE
Private
Componen
ts
Diffie-Hellman
or EC Diffie-
Hellman
private
component
used in key
establishment
(DHE 2048,
DHE 3072,
DHE 4096,
ECDHE P-
256, P-384, P-
521)
2048 -
4096
bits;
128 -
256 bits
- 112
bits
minimu
m
Private
Key - CSP
- CSP
Counte
r
DRBG
(A3454
)
IPSec/IKE
Keying Materials
Development
S-S VPN
IPSec/IKE
DHE or
ECDHE
Public
Componen
ts
Diffie-Hellman
or EC Diffie-
Hellman public
component
used in key
agreement
(DHE 2048,
DHE 3072,
DHE 4096,
ECDHE P-
256, P-384, P-
521)
2048 -
4096
bits;
128 -
256 bits
- 112
bits
minimu
m
Public Key
- PSP -
PSP
Counte
r
DRBG
(A3454
)
IPSec/IKE
Keying Materials
Development
S-S VPN
IPSec/IKE
Session
Keys
Used to
encrypt
IKE/IPSec
data. These
are AES (128,
192, or 256
CBC) IKE
128 -
256 bits
- 128
bits
minimu
m
Session
Key - CSP
- CSP
KDF
IKEv2
(A3454
)
KAS-
ECC
(IPSec/I
KE)
KAS-
FFC
Session
Encryption/Decry
ption (IPSec/IKE)
Page 44 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
keys and (128,
192 or 256
CBC, , 128 or
256 GCM)
IPSec keys
(IPSec/I
KE)
SNMPv3
Authenticat
ion Key
HMAC-SHA-
1/224/256/384
/512
Authentication
protocol key
(160 bits)
160 -
512 bits
- 160
bits
minimu
m
Session
Key - CSP
- CSP
KDF
SNMP
(A3454
)
Session
Authentication
(SMPv3)
SNMPv3
Authenticat
ion Secret
Used to
support
SNMPv3
services
(Minimum 8
characters)
8
charact
ers
minimu
m - N/A
Authenticat
ion Key -
CSP - CSP
SNMPv3 Keying
Materials
Development
SNMPv3
Privacy
Secret
Used to
support
SNMPv3
services
(Minimum 8
characters)
8
charact
ers
minimu
m - N/A
Authenticat
ion Key -
CSP - CSP
SNMPv3 Keying
Materials
Development
SNMPv3
Session
Key
Privacy
protocol
encryption key
(AES
128/192/256
CFB)
128 -
256 bits
- 128
bits
minimu
m
Session
Key - CSP
- CSP
KDF
SNMP
(A3454
)
Session
Encryption/Decry
ption (SNMPv3)
SSH Client
Public Key
Public RSA
key used to
authenticate
client. (RSA
2048, 3072,
and 4096 bits)
2048 -
4096
bits -
112 bits
minimu
m
Public Key
- PSP -
PSP
SSH RSA SigVer
SSH
DHE/ECD
HE Private
Componen
ts
Diffie Hellman
or EC Diffie-
Hellman
private (DH
Group 14,
ECDH P-256,
ECDH P-384,
ECDH P-521)
2048
bits;
128 -
256 bits
- 112
bits
minimu
m
Private
Key - CSP
- CSP
Counte
r
DRBG
(A3454
)
KAS-
ECC
(SSH)
KAS-
FFC
(SSH)
SSHv2 Keying
Materials
Development
SSH
DHE/ECD
HE Public
Componen
ts
Diffie Hellman
or EC Diffie-
Hellman public
component
(DH Group 14,
ECDH P-256,
2048
bits;
128 -
256 bits
- 112
bits
Public Key
- PSP -
PSP
Counte
r
DRBG
(A3454
)
KAS-
ECC
(SSH)
KAS-
FFC
(SSH)
SSHv2 Keying
Materials
Development
Page 45 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
ECDH P-384,
ECDH P-521)
minimu
m
SSH Host
Public Key
SSH Host
Public Key
(RSA 2048,
RSA 3072,
RSA 4096,
ECDSA P-
256, P-384, or
P-521)
2048 -
4096
bits;
128 -
256 bits
- 112
bits
minimu
m
Public Key
- PSP -
PSP
Counte
r
DRBG
(A3454
)
SSH ECDSA
SigVer
SSH RSA SigVer
SSH
Session
Authenticat
ion Keys
Authentication
keys used in
all SSH
connections to
the security
module's
command line
interface
(HMAC-SHA-
1, HMAC-
SHA2-256,
HMAC-SHA2-
512) (160,
256, 512 bits)
160,
256, or
512 bits
- 160
bits
minimu
m
Session
Key - CSP
- CSP
KDF
SSH
(A3454
)
KAS-
ECC
(SSH)
KAS-
FFC
(SSH)
Session
Authentication
(SSHv2)
SSH
Session
Encryption
Keys
Used in all
SSH
connections to
the security
module's
command line
interface.
(128, 192, or
256 bits: AES
CBC or CTR)
(128 or 256
bits: AES
GCM)
128 -
256 bits
- 128
bits
minimu
m
Session
Key - CSP
- CSP
KDF
SSH
(A3454
)
KAS-
ECC
(SSH)
KAS-
FFC
(SSH)
Session
Encryption/Decry
ption (SSH)
TLS
DHE/ECD
HE Private
Componen
ts
Ephemeral
Diffie-Hellman
private FFC or
EC
component
used in TLS
(DHE 2048,
ECDHE P-
256, P-384, P-
521)
2048
bits -
4096
bits
128 -
256 bits
- 112
bits
minimu
m
Private
Key - CSP
Counte
r
DRBG
(A3454
)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
TLSv1.2 Keying
Materials
Development
Page 46 of 64
Name Description
Size -
Strength
Type -
Category
Generate
d By
Established
By
Used By
TLS
DHE/ECD
HE Public
Componen
ts
Diffie_Hellman
or EC Diffie-
Hellman
Ephemeral
values used in
key
agreement
(DHE 2048,
ECDHE P-
256, P-384, P-
521)
2048
bits -
4096
bits
128 -
256 bits
- 112
bits
minimu
m
Public Key
- PSP
Counte
r
DRBG
(A3454
)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
TLSv1.2 Keying
Materials
Development
TLS
Encryption
Keys
AES (128 or
256 bit) keys
used in TLS
connections
(GCM; CBC)
128 -
256 bits
- 128
bits
minimu
m
Session
Key - CSP
- CSP
TLS
v1.2
KDF
RFC76
27
(A3454
)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
Session
Encryption/Decry
ption (TLSv1.2)
TLS
HMAC
Keys
HMAC keys
used in TLS
connections
(HMAC-SHA2-
256/384) (
256, 384 bits)
256 -
384 bits
- 256
bits
minimu
m
Session
Key - CSP
- CSP
TLS
v1.2
KDF
RFC76
27
(A3454
)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
Session
Authentication
(TLSv1.2)
TLS
Master
Secret
Secret value
used to derive
the TLS
session keys
48
bytes -
N/A
Master
Secret -
CSP - CSP
TLS
v1.2
KDF
RFC76
27
(A3454
)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
TLSv1.2 Keying
Materials
Development
TLS Pre-
Master
Secret
Secret value
used to derive
the TLS
Master Secret
along with
client and
server random
nonces
48
bytes -
N/A
Shared
Secret -
CSP
KAS-
ECC
(TLSv1
.2)
KAS-
FFC
(TLSv1
.2)
KAS-
ECC
(TLSv1.2
)
KAS-
FFC
(TLSv1.2
)
TLSv1.2 Keying
Materials
Development
Table 18: SSP Table 1
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
CA
Certificates
Peer Public
Key Input
HDD:Plaintext
RAM:Plaintext
Duration
of use
Zeroizatio
n
RSA Public
Keys:Encrypts
Page 47 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
(Plaintex
t)
Command
Power
Cycle /
Session
Terminatio
n
RSA Private
Keys:Encrypts
ECDSA Public
Keys:Encrypts
ECDSA Private
Keys :Encrypts
CO, User,
RA VPN
Password
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
HDD:Encrypt
ed
N/A Zeroizatio
n
Command
DHE/ECDH
E Shared
Secret Z
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
SSH DHE/ECDHE
Private
Components:Paire
d With
SSH DHE/ECDHE
Page 48 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
Public
Components:Paire
d With
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Paire
d With
S-S VPN
IPSec/IKE DHE or
ECDHE Public
Components:Paire
d With
DRBG Key RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
Entropy Input
String:Paired With
DRBG Seed
:Paired With
DRBG V:Paired
With
DRBG Seed RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
Entropy Input
String:Paired With
DRBG Key:Paired
With
DRBG V:Paired
With
DRBG V RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
Entropy Input
String:Paired With
DRBG Seed
:Paired With
DRBG Key:Paired
With
ECDSA
Private Keys
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
HDD:Plaintext
RAM:Plaintext
Duration
of use
(Plaintex
t)
Zeroizatio
n
Command
Power
Cycle /
Session
Terminatio
n
ECDSA Public
Keys:Paired With
Page 49 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
et Input via
SSHv2
encrypted by
AES-GCM
ECDSA
Public Keys
Peer Public
Key Input
Module Public
Key Output
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
HDD:Plaintext
RAM:Plaintext
Duration
of use
(Plaintex
t)
Zeroizatio
n
Command
ECDSA Private
Keys :Paired With
Entropy
Input String
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
DRBG Seed
:Paired With
DRBG Key:Paired
With
DRBG V:Paired
With
IKEv2
SKEYSEED
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Paire
d With
S-S VPN
IPSec/IKE DHE or
ECDHE Public
Components:Paire
d With
Protocol
Secrets
Password/Secr
et Input via
TLSv1.2
HDD:Plaintext
RAM:Plaintext
Duration
of use
Zeroizatio
n
Command
Page 50 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
(plaintext
)
Public key
for software
content load
test
HDD:Plaintext N/A N/A
RA VPN
IPSec
Authenticatio
n
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
RA VPN
IPSec
Session
Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
RSA Private
Keys
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HDD:Plaintext
RAM:Plaintext
Duration
of use
(Plaintex
t)
Zeroizatio
n
Command
Power
Cycle /
Session
Terminatio
n
RSA Public
Keys:Paired With
Page 51 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
RSA Public
Keys
Peer Public
Key Input
Module Public
Key Output
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
HDD:Plaintext
RAM:Plaintext
Duration
of use
(Plaintex
t)
Zeroizatio
n
Command
RSA Private
Keys:Paired With
S-S VPN
IPSec Pre-
Shared Keys
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
Page 52 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
S-S VPN
IPSec/IKE
Authenticatio
n Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Deriv
ed From
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Paire
d With
S-S VPN
IPSec/IKE DHE or
ECDHE Public
Components:Paire
d With
S-S VPN
IPSec/IKE
DHE or
ECDHE
Private
Components
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
S-S VPN
IPSec/IKE DHE or
ECDHE Public
Components:Paire
d With
S-S VPN
IPSec/IKE
DHE or
ECDHE
Public
Components
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Paire
d With
S-S VPN
IPSec/IKE
Session
Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Deriv
ed From
S-S VPN
IPSec/IKE DHE or
ECDHE Private
Components:Paire
d With
S-S VPN
IPSec/IKE DHE or
ECDHE Public
Components:Paire
d With
Page 53 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
SNMPv3
Authenticatio
n Key
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
SNMPv3
Authentication
Secret:Derived
From
SNMPv3 Privacy
Secret:Derived
From
SNMPv3
Authenticatio
n Secret
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
SNMPv3
Privacy
Secret
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
Page 54 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
encrypted by
AES-GCM
SNMPv3
Session Key
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
SNMPv3
Authentication
Secret:Derived
From
SNMPv3 Privacy
Secret:Derived
From
SSH Client
Public Key
Peer Public
Key Input
Password/Secr
et Input via
TLSv1.2
encrypted by
AES and
HMAC
Password/Secr
et Input via
TLSv1.2
encrypted by
AES-GCM
Password/Secr
et Input via
SSHv2
encrypted by
AES and
HMAC
Password/Secr
et Input via
SSHv2
encrypted by
AES-GCM
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
SSH
DHE/ECDH
E Private
Components
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
SSH DHE/ECDHE
Public
Components:Paire
d With
SSH
DHE/ECDH
E Public
Components
Peer Public
Key Input
Module Public
Key Output
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
SSH DHE/ECDHE
Private
Components:Paire
d With
SSH Host
Public Key
HDD:Plaintext
RAM:Plaintext
Duration
of use
(plaintext
)
Zeroizatio
n
Command
SSH
Session
RAM:Plaintext Duration
of use
Power
Cycle /
SSH DHE/ECDHE
Private
Page 55 of 64
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
Authenticatio
n Keys
Session
Terminatio
n
Components:Deriv
ed From
SSH DHE/ECDHE
Public
Components:Deriv
ed From
SSH
Session
Encryption
Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
SSH DHE/ECDHE
Private
Components:Deriv
ed From
SSH DHE/ECDHE
Public
Components:Deriv
ed From
TLS
DHE/ECDH
E Private
Components
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
TLS DHE/ECDHE
Public
Components:Paire
d With
TLS
DHE/ECDH
E Public
Components
Peer Public
Key Input
Module Public
Key Output
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
TLS DHE/ECDHE
Private
Components:Paire
d With
TLS
Encryption
Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
TLS Master
Secret:Derived
From
TLS HMAC
Keys
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
TLS Master
Secret:Derived
From
TLS Master
Secret
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
TLS Pre-Master
Secret:Derived
From
TLS Pre-
Master
Secret
RAM:Plaintext Duration
of use
Power
Cycle /
Session
Terminatio
n
Table 19: SSP Table 2
9.5 Transitions
Page 56 of 64
Key Sizes
• Key sizes with a security strength less than 128-bits will be non-Approved for all uses
starting January 1, 2031.
SHA-1
• The module implements SHA-1 for use in non-digital signature applications. This
implementation will be non-Approved for all uses starting January 1, 2031.
10 Self-Tests
10.1 Pre-Operational Self-Tests
Algorithm or Test
Test
Properties
Test
Method
Test Type Indicator Details
ECDSA SigVer
(FIPS186-4) (A3454)
P-256 KAT SW/FW
Integrity
Self-Test
successful
Signature
Verification
HMAC-SHA2-256
(A3454)
SHA2-
256
KAT SW/FW
Integrity
Self-Test
successful
Keyed
Checksum
Table 20: Pre-Operational Self-Tests
The CASTs for the underlying ECDSA Signature Verification and HMAC-SHA2-256 algorithms
are performed prior to the execution of the software integrity test listed in this section.
10.2 Conditional Self-Tests
Algorithm or
Test
Test
Properties
Test
Method
Test Type Indicator Details Conditions
AES
GCM
(A3454)
Decrypt
256 Bits KAT CAST Self-test
output
message
Decrypt After
each
power-
on or via
self-test
comman
d
AES
GCM
(A3454)
Encrypt
256 Bits KAT CAST Self-test
output
message
Encrypt After
each
power-
on or via
self-test
comman
d
AES-ECB
Decrypt
(A3454)
128 Bits KAT CAST Self-test
output
message
Decrypt After
each
power-
on or via
self-test
comman
d
Page 57 of 64
Algorithm or
Test
Test
Properties
Test
Method
Test Type Indicator Details Conditions
Counter
DRBG
(A3454)
N/A KAT CAST Self-test
output
message
SP 800-90Arev1
Instantiate/Generate/Rese
ed Known Answer Tests
After
each
power-
on or via
self-test
comman
d
ECDSA /
KAS-ECC
256 Bit
Minimu
m
PCT PCT System
log
message
s
ECDSA / KAS-ECC
pairwise consistency test
On
session
ECDSA
SigGen
(FIPS186
-4)
(A3454)
256 Bits KAT CAST Self-test
output
message
Sign After
each
power-
on or via
self-test
comman
d
ECDSA
SigVer
(FIPS186
-4)
(A3454)
256 Bits KAT CAST Self-test
output
message
Verify After
each
power-
on or via
self-test
comman
d
HMAC-
SHA-1
(A3454)
160 Bits KAT CAST Self-test
output
message
Keyed Hash After
each
power-
on or via
self-test
comman
d
HMAC-
SHA2-
224
(A3454)
224 Bits KAT CAST Self-test
output
message
Keyed Hash After
each
power-
on or via
self-test
comman
d
HMAC-
SHA2-
256
(A3454)
256 Bits KAT CAST Self-test
output
message
Keyed Hash After
each
power-
on or via
self-test
comman
d
HMAC-
SHA2-
384 Bits KAT CAST Self-test
output
message
Keyed Hash After
each
power-
Page 58 of 64
Algorithm or
Test
Test
Properties
Test
Method
Test Type Indicator Details Conditions
384
(A3454)
on or via
self-test
comman
d
HMAC-
SHA2-
512
(A3454)
512 Bits KAT CAST Self-test
output
message
Keyed Hash After
each
power-
on or via
self-test
comman
d
KAS-
ECC-SSC
Sp800-
56Ar3
(A3454)
256 Bits KAT CAST Self-test
output
message
KAS Computation After
each
power-
on or via
self-test
comman
d
KAS-FFC 2048 Bit
Minimu
m
PCT PCT System
log
message
s
KAS-FCC pairwise
consistency test
On
session
KAS-
FFC-SSC
Sp800-
56Ar3
(A3454)
2048
Bits
KAT CAST Self-test
output
message
KAS Computation After
each
power-
on or via
self-test
comman
d
KDF
IKEv2
(A3454)
N/A KAT CAST Self-test
output
message
IKEv2 with SHA-256 After
each
power-
on or via
self-test
comman
d
KDF SSH
(A3454)
N/A KAT CAST Self-test
output
message
SSHv2 with SHA-256 After
each
power-
on or via
self-test
comman
d
KDF TLS
(A3454)
N/A KAT CAST Self-test
output
message
TLSv1.2 with SHA-256 After
each
power-
on or via
self-test
Page 59 of 64
Algorithm or
Test
Test
Properties
Test
Method
Test Type Indicator Details Conditions
comman
d
RSA 2048 Bit
Minimu
m
PCT PCT System
log
message
s
RSA pairwise consistency
test
On
session
RSA
SigGen
(FIPS186
-4)
(A3454)
2048 KAT CAST Self-test
output
message
Sign After
each
power-
on or via
self-test
comman
d
RSA
SigVer
(FIPS186
-4)
(A3454)
2048 KAT CAST Self-test
output
message
Verify After
each
power-
on or via
self-test
comman
d
Safe
Primes
Key
Generatio
n (A3454)
2048 Bit
Minimu
m
PCT PCT System
log
message
s
KAS-FCC pairwise
consistency test
On
session
SHA-1
(A3454)
160 Bits KAT CAST Self-test
output
message
Hash After
each
power-
on or via
self-test
comman
d
SHA2-
256
(A3454)
256 Bits KAT CAST Self-test
output
message
Hash After
each
power-
on or via
self-test
comman
d
SHA2-
384
(A3454)
384 Bits KAT CAST Self-test
output
message
Hash After
each
power-
on or via
self-test
comman
d
SHA2-
512
(A3454)
512 Bits KAT CAST Self-test
output
message
Hash After
each
power-
Page 60 of 64
Algorithm or
Test
Test
Properties
Test
Method
Test Type Indicator Details Conditions
on or via
self-test
comman
d
Software
Load Test
2048
Bits
SW
Load
Test
SW/FW
Load
System
log
message
s
Software load test on
content load
On
session
SP 800-
90B
RCT/APT
Health
Tests on
Entropy
Source
N/A Fault-
Detectio
n Test
CAST Self-test
output
message
Health tests done on
entropy source
After
each
power-
on or via
self-test
comman
d
SP 800-
56A Rev
3
Assuranc
e Tests
N/A Critical
Function
s
Critical
Functio
n
System
log
message
s
Assurance tests for SP
800-56A Rev3
On
session
Table 21: Conditional Self-Tests
10.3 Periodic Self-Test Information
Algorithm or Test Test Method Test Type Period Periodic Method
ECDSA SigVer
(FIPS186-4)
(A3454)
KAT SW/FW Integrity On Demand Manually or
Scheduled
HMAC-SHA2-
256 (A3454)
KAT SW/FW Integrity On Demand Manually or
Scheduled
Table 22: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
AES GCM
(A3454) Decrypt
KAT CAST On Demand Manually or
Scheduled
AES GCM
(A3454) Encrypt
KAT CAST On Demand Manually or
Scheduled
AES-ECB
Decrypt (A3454)
KAT CAST On Demand Manually or
Scheduled
Counter DRBG
(A3454)
KAT CAST On Demand Manually or
Scheduled
ECDSA / KAS-
ECC
PCT PCT On session On session
Page 61 of 64
Algorithm or Test Test Method Test Type Period Periodic Method
ECDSA SigGen
(FIPS186-4)
(A3454)
KAT CAST On Demand Manually or
Scheduled
ECDSA SigVer
(FIPS186-4)
(A3454)
KAT CAST On Demand Manually or
Scheduled
HMAC-SHA-1
(A3454)
KAT CAST On Demand Manually or
Scheduled
HMAC-SHA2-
224 (A3454)
KAT CAST On Demand Manually or
Scheduled
HMAC-SHA2-
256 (A3454)
KAT CAST On Demand Manually or
Scheduled
HMAC-SHA2-
384 (A3454)
KAT CAST On Demand Manually or
Scheduled
HMAC-SHA2-
512 (A3454)
KAT CAST On Demand Manually or
Scheduled
KAS-ECC-SSC
Sp800-56Ar3
(A3454)
KAT CAST On Demand Manually or
Scheduled
KAS-FFC PCT PCT On session On session
KAS-FFC-SSC
Sp800-56Ar3
(A3454)
KAT CAST On Demand Manually or
Scheduled
KDF IKEv2
(A3454)
KAT CAST On Demand Manually or
Scheduled
KDF SSH
(A3454)
KAT CAST On Demand Manually or
Scheduled
KDF TLS
(A3454)
KAT CAST On Demand Manually or
Scheduled
RSA PCT PCT On session On session
RSA SigGen
(FIPS186-4)
(A3454)
KAT CAST On Demand Manually or
Scheduled
RSA SigVer
(FIPS186-4)
(A3454)
KAT CAST On Demand Manually or
Scheduled
Safe Primes Key
Generation
(A3454)
PCT PCT On session On session
SHA-1 (A3454) KAT CAST On Demand Manually or
Scheduled
SHA2-256
(A3454)
KAT CAST On Demand Manually or
Scheduled
SHA2-384
(A3454)
KAT CAST On Demand Manually or
Scheduled
SHA2-512
(A3454)
KAT CAST On Demand Manually or
Scheduled
Software Load
Test
SW Load Test SW/FW Load On session On session
Page 62 of 64
Algorithm or Test Test Method Test Type Period Periodic Method
SP 800-90B
RCT/APT Health
Tests on
Entropy Source
Fault-Detection
Test
CAST On Demand Manually or
Scheduled
SP 800-56A Rev
3 Assurance
Tests
Critical
Functions
Critical Function On session On session
Table 23: Conditional Periodic Information
10.4 Error States
Name Description Conditions
Recovery
Method
Indicator
Conditional Pairwise
Consistency or Critical
Functions Test Failure
Module fails a
PCT or critical
functions test
PCT / Critical
functions test
Reset
session
System log prints
an error
message.
Conditional Software
Load Test Failure
Signature
verification fails
on software load
Signature
verification
failure
N/A System prints
Invalid image
message.
Self-Test / Integrity
Test Failure
Module fails a
self-test or
integrity test
Self-test or
Integrity Test
failure
Reboot
Module or
Factory
Reset
FIPS-CC mode
failure.
<Algorithm test>
failed.
Table 24: Error States
10.5 Operator Initiation of Self-Tests
Perform a power-cycle to initiate the Self-Tests.
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
The following procedure will put the modules into the Approved mode of operation:
• During initial boot up, break the boot sequence via the console port connection (by
pressing the maint button when instructed to do so) to access the main menu.
• Select “Continue.”
• Select the “Set FIPS-CC Mode” option to enter the Approved mode.
• Select “Enable FIPS-CC Mode”.
• When prompted, select “Reboot” and the module will re-initialize and continue into
“FIPS-CC” mode (Approved mode).
• The module will reboot.
• In “FIPS-CC” mode, the console port is available as a status output port.
Page 63 of 64
• Once the module has finished booting, the Crypto Officer can authenticate using the
default credentials that come with the module
• Once authenticated, the module will automatically require the operator to
change their password; and the default credential is overwritten
The module will automatically indicate the Approved mode of operation in the following manner:
• Status output interface will indicate “**** FIPS-CC MODE ENABLED ****” via the CLI
session.
• Status output interface will indicate “FIPS-CC mode enabled successfully” via the
console port.
• The module will display “FIPS-CC” at all times in the status bar at the bottom of the
web interface.
Should one or more power-up self-tests fail, the Approved mode of operation will not be
achieved. Feedback will consist of:
• The module will output “FIPS-CC failure”
• The module will reboot and enter a state in which the reason for the reboot can be
determined.
• To determine which self-test caused the system to reboot into the error state, connect
the console cable and follow the on-screen instructions to view the self-test output.
Note: Disabling FIPS-CC mode causes a complete factory reset, which is described in the
Zeroization section below.
11.2 Administrator Guidance
The Administrator Guidance can be obtained from Palo Alto Network’s public site:
https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/11-1/pan-os-
admin/pan-os-admin.pdf
11.3 Non-Administrator Guidance
N/A
11.4 Design and Rules
In FIPS-CC mode, the following rules shall apply:
1. The operator should not enable or use TLSv1.3
a. Checked via CLI using “show profiles” command
2. If using RADIUS, it must be configured using TLS.
a. Checked via CLI using “show shared” command
3. If using TACACS+, configure the service route via an IPSec tunnel, and ensure the
TACACS+ server is configured for a minimum password length of eight (8) characters or
greater.
a. Checked via CLI using “show deviceconfig” command
Page 64 of 64
11.5 End of Life
The following procedure will zeroize the module:
• Access the module’s CLI via SSH, and command the module to enter maintenance
mode; the module will reboot
• Note: Establish a serial connection to the console port
• After reboot, select “Continue.”
• Select “Factory Reset”
• The module will perform a zeroization, and provide the following message once
complete:
• “Factory Reset Status: Success”
Note: Following the completion of this procedure, the module will be placed back into an
uninitialized state.
12 Mitigation of Other Attacks
N/A for this module.