This page was not yet optimized for use on mobile devices.
Windows OS Loader
Known vulnerabilities detected
Our automated heuristics have identified vulnerabilities that may be associated with this certificate. See the CVEs section for details.Certificate details
| Certificate ID | #5405 |
|---|---|
| Status | active |
| Validation dates | 31.08.2026 |
| Sunset date | 30-08-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software-Hybrid |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section 11.1 of the Security Policy. When operated in approved mode with module Boot Manager validated to FIPS 140-3 under Cert. #5404 operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. No assurance of FIPS 140-3 requirements met for the components of the RBG construct that are external to the module boundary (e.g., DRBG, ESV) except for SP 800-90C compliance and security strength of the provided random bits |
| Exceptions |
|
| Description | The Windows OS Loader (the "module") is the component that loads the operating system kernel (ntoskrnl.exe) and other boot stage binary image files. The module is a part of BitLocker Drive Encryption, which is a data protection feature of the Windows operating system that encrypts data on a storage volume. |
| Vendor | Microsoft Corporation http://www.microsoft.com |
| Lab | Leidos Accredited Testing & Evaluation (AT&E) Lab |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES, AES-, CAST, CBC-MACHash functions
SHA-1, SHA2Protocols
TLSRandomness
DRBG, RBGBlock cipher modes
CTR, GCM, CCM, XTSTrusted Execution Environments
PSPVendor
Microsoft Corporation, MicrosoftSecurity level
level 1, Level 1Standards
FIPS 140-3, FIPS 186-4, FIPS PUB 140-3, FIPS186-4, FIPS 180-4, FIPS 186-5, FIPS 186, FIPS 197, SP 800-38A, SP 800-38C, SP 800-38D, SP 800-38E, SP 800-90A, SP 800-90B, NIST SP 800-38A, NIST SP 800-38C, NIST SP 800-38D, NIST SP 800-38E, NIST SP 800-90A, NIST SP 800-90B, PKCS 1, PKCS #1, ISO/IEC 19790:2012Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.CPE matches
CVE matches
| ID | Links | Severity | CVSS Score | Published on |
|---|---|---|---|---|
| Base score | ||||
| CVE-1999-0524 | LOW | 2.1 | 01.08.1997 | |
| CVE-2008-6194 | HIGH | 7.8 | 19.02.2009 | |
| CVE-2010-2157 | LOW | 2.1 | 07.06.2010 | |
| CVE-2010-3139 | HIGH | 9.3 | 27.08.2010 | |
| CVE-2010-3143 | HIGH | 9.3 | 27.08.2010 | |
| CVE-2010-3888 | HIGH | 7.2 | 08.10.2010 | |
| CVE-2010-3889 | HIGH | 7.2 | 08.10.2010 | |
| CVE-2011-0638 | MEDIUM | 6.9 | 25.01.2011 | |
| CVE-2011-3389 | MEDIUM | 4.3 | 06.09.2011 | |
| CVE-2011-5049 | MEDIUM | 4.3 | 04.01.2012 | |
| CVE-2012-2971 | HIGH | 7.5 | 20.10.2012 | |
| CVE-2012-2972 | MEDIUM | 5.0 | 20.10.2012 | |
| CVE-2018-0598 | HIGH | 7.8 | 26.06.2018 | |
| CVE-2018-0599 | HIGH | 7.8 | 26.06.2018 | |
| CVE-2021-36958 | HIGH | 9.3 | 12.08.2021 |
Showing 5 out of 15.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5405,
"dgst": "193dfde4a2d3ab02",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"RSA SigVer (FIPS186-4)A3768",
"#A4009",
"#A3767",
"SHA2-384A4009",
"#A3768",
"AES-CBCA4009",
"SHA2-256A4009",
"AES-GCMA4009",
"SHA-1A4009",
"#A4008",
"SHA2-512A4009",
"AES-CCMA4009",
"Counter DRBGA4009",
"AES-XTS Testing Revision 2.0A4009",
"#5404"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:arm64:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": {
"_type": "Set",
"elements": [
"CVE-2010-3889",
"CVE-2021-36958",
"CVE-2010-2157",
"CVE-2011-0638",
"CVE-2010-3143",
"CVE-2011-3389",
"CVE-2012-2972",
"CVE-2018-0598",
"CVE-2011-5049",
"CVE-2010-3139",
"CVE-1999-0524",
"CVE-2008-6194",
"CVE-2010-3888",
"CVE-2018-0599",
"CVE-2012-2971"
]
},
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4008",
"properties": "Key Length - 128",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4009",
"properties": "Key Length - 128",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A4008",
"properties": "Key Length - 128",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A4009",
"properties": "Key Length - 128",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4008",
"properties": "Direction - Decrypt Key Length - 128",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4009",
"properties": "Direction - Decrypt Key Length - 128",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A4008",
"properties": "Key Length - 128",
"reference": "SP 800-38E"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A4009",
"properties": "Key Length - 128",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A4008",
"properties": "Prediction Resistance - No Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A4009",
"properties": "Prediction Resistance - No Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3767",
"properties": "Signature Type - PKCS 1.5 Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3768",
"properties": "Signature Type - PKCS 1.5 Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4008",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4009",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4008",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4009",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4008",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4009",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4008",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4009",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3767",
"properties": "Signature Type - PKCS 1.5 Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3768",
"properties": "Signature Type - PKCS 1.5 Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4008",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4009",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "The module uses an SP 800-90B entropy source. At startup, this service collects the initial entropy for the system.",
"indicator": "Initial entropy is collected and the Windows boot process continues.",
"inputs": "This service is fully automatic and occurs after self-tests pass and, if the system volume is encrypted, after decryption of the required system volume sectors.",
"name": "Collect Initial Entropy",
"outputs": "Initial entropy is collected for DRBG initialization.",
"rolesSspAccess": "Cryptographic Officer (CO)",
"secFunImpl": "ENT1"
},
{
"description": "Validates the integrity of the following OS components and then loads them: the Windows OS kernel (ntoskrnl.exe), the Windows hypervisor (hvix64.exe), and other boot stage binary image files, including Code Integrity (ci.dll), Secure Kernel Code Integrity (skci.dll), and the Kernel Mode Cryptographic Primitives Library (cng.sys). This service also initializes the DRBG using the entropy input string, and then uses the DRBG output to provide random bits as input to the Kernel Mode Cryptographic Primitives Library (cng.sys).",
"indicator": "The Windows boot process continues after integrity checks are complete.",
"inputs": "This service is fully automatic after Boot Manager has loaded the Windows OS Loader.",
"name": "Load the OS (Trusted Boot)",
"outputs": "After the verified kernel and boot stage binary image files are loaded, Windows OS Loader passes the execution control to the NT operating system kernel, and the Virtual Secure Mode kernel, and it terminates its own execution. If the integrity of any module is not verified, Windows OS Loader does not transfer the execution to the kernel and displays the boot failure page.",
"rolesSspAccess": "Cryptographic Officer (CO) - Microsoft Root Certificate Authority Public Key (This is not an SSP): E - SHA Hashes (This is not an SSP): E - Full Volume Encryption Key (FVEK): W,E - AES-CTR DRBG Entropy Input String and Nonce: G,E - AES-CTR DRBG Seed: G,E - AES-CTR DRBG V: G,E - AES-CTR DRBG Key: G,E",
"secFunImpl": "BC1 DigSig- Legacy DigSig1 DRBG1 SHS1"
},
{
"description": "Validates the early boot stage components using secure hash functions. Collects boot process log measurements from Windows and the computer\u0027s firmware, which can be sent to a trusted remote server for objective assessment of the health of early boot stage components.",
"indicator": "Measured boot data is output, e.g. to a log file.",
"inputs": "This service is fully automatic after Measured Boot has been enabled.",
"name": "Measured Boot",
"outputs": "Measured boot data is made available to a remote trusted attestation server.",
"rolesSspAccess": "Cryptographic Officer (CO) - SHA Hashes (This is not an SSP): W,E",
"secFunImpl": "SHS1"
},
{
"description": "The module provides a power-up self-test service that is automatically executed when the module is loaded into memory.",
"indicator": "Self-test success is indicated by module and algorithm availability; failure is indicated by an error.",
"inputs": "This service is fully automatic, executed when the module is loaded into memory.",
"name": "Perform Cryptographic Algorithm Self- Tests",
"outputs": "The availability of the module is the service output. See section 10 Self-Tests for more information.",
"rolesSspAccess": "Cryptographic Officer (CO)",
"secFunImpl": "BC1 DRBG1 DigSig- Legacy DigSig1 DigSig2 SHS1"
},
{
"description": "The pre-operational integrity test is executed by the [EVM] Boot Manager (IG 1.A Documentation Requirements 5) before the OS Loader module is loaded into memory.",
"indicator": "Integrity test success is indicated by module and algorithm availability; failure is indicated by an error.",
"inputs": "This service is fully automatic and executed by the EVM before the module is loaded into memory.",
"name": "Perform Pre- operational Software Integrity Test [EVM]",
"outputs": "The availability of the module is the service output. See section 10 Self-Tests for more information.",
"rolesSspAccess": "Cryptographic Officer (CO)",
"secFunImpl": "DigSig2 SHS1"
},
{
"description": "Zeroizes cryptographic material.",
"indicator": "Volatile keys are zeroized. See Section 9.3 SSP Zeroization Methods for more information.",
"inputs": "This service is fully automatic.",
"name": "Perform Zeroization",
"outputs": "Keys are zeroized and the module unloads from memory.",
"rolesSspAccess": "Cryptographic Officer (CO) - AES-CTR DRBG Entropy Input String and Nonce: Z - AES-CTR DRBG Seed: Z - AES-CTR DRBG V: Z - AES-CTR DRBG Key: Z - Full Volume Encryption Key (FVEK): Z",
"secFunImpl": "BC1 DRBG1"
},
{
"description": "Provides the module status response.",
"indicator": "Provided via NTSTATUS by all functions of approved services.",
"inputs": "This service is fully automatic and occurs when any function is called.",
"name": "Show Status",
"outputs": "Status is output across the module\u0027s Status Output logical interface, to the computer monitor or to log files.",
"rolesSspAccess": "Cryptographic Officer (CO)",
"secFunImpl": "None"
},
{
"description": "Provides the module version number.",
"indicator": "Version information is provided in the Portable Executable (PE) header of each module binary. The PE header contains Windows-specific fields such as the major and minor version (10.0.22621.1 for Windows 11 and 10.0.20348.1668 for Windows Server). See the PE Format public documentation published on https://learn.microsoft.com/ for more information.",
"inputs": "Module binary file.",
"name": "Show Version",
"outputs": "Version information is embedded in the PE header of the binary.",
"rolesSspAccess": "Cryptographic Officer (CO)",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC (A4008) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4008) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4009) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4009) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A4008) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A4008) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A4009) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A4009) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4008) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4009) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4008) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES-XTS",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4008) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for XTS-AES",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4008) - Key Equivalence Test",
"condition": "Checks AES- XTS keys before using the algorithm.",
"details": "XTS-AES Key_1 Key_2 check in compliance with FIPS 140-3 IG C.I.",
"indicator": "Cryptographic operations execute.",
"testMethod": "Key Equivalence Test",
"testProps": "128-bit AES key (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4009) - Encrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Encrypt KAT for AES-XTS",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4009) - Decrypt",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Decrypt KAT for AES-XTS",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4009) - Key Equivalence Test",
"condition": "Checks AES- XTS keys before using the algorithm.",
"details": "XTS-AES Key_1 Key_2 check in compliance with FIPS 140-3 IG C.I.",
"indicator": "Cryptographic operations execute.",
"testMethod": "Key Equivalence Test",
"testProps": "128-bit AES key (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A4008)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Instantiate, generate, and reseed",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "AES-256 with derivation function and without prediction resistance (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A4009)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Instantiate, generate, and reseed",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "AES-256 with derivation function and without prediction resistance (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A3767)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Signature verification.",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "RSA PKCS#1v1.5 with 2048-bit key and SHA2-256 (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A3768)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Signature verification",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "RSA PKCS#1v1.5 with 2048-bit key and SHA2-256 (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A4008)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute",
"testMethod": "KAT",
"testProps": "160 bits (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A4009)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "160 bits (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A4008)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "256 bits (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A4009)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "256 bits (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A4008)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "384 bits (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A4009)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "384 bits (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A4008)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "512 bits (Windows 11 version 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A4009)",
"condition": "Run at every module initialization after the module integrity is verified.",
"details": "Secure hash",
"indicator": "Cryptographic operations execute.",
"testMethod": "KAT",
"testProps": "512 bits (Windows Server 2022)",
"type": "CAST"
},
{
"algorithmOrTest": "[EVM] RSA SigVer (FIPS186-4) (A3767)",
"condition": "Run at every module initialization before the module integrity is verified.",
"details": "[EVM] Signature verification.",
"indicator": "The module\u0027s integrity verification executes.",
"testMethod": "KAT",
"testProps": "RSA PKCS#1v1.5 2048-bit key with SHA2-256.",
"type": "CAST"
},
{
"algorithmOrTest": "[EVM] RSA SigVer (FIPS186-4) (A3768)",
"condition": "Run at every module initialization before the module integrity is verified.",
"details": "[EVM] Signature verification.",
"indicator": "The module\u0027s integrity verification executes.",
"testMethod": "KAT",
"testProps": "RSA PKCS#1v1.5 2048-bit key with SHA2-256.",
"type": "CAST"
},
{
"algorithmOrTest": "[EVM] Intel- based Entropy Source (E216)",
"condition": "Run at start-up and continuously.",
"details": "[EVM] Start-up and continuous noise source health tests and start-up logic integrity self- test.",
"indicator": "The entropy source is instantiated and a status is returned via the interface.",
"testMethod": "Fault detection",
"testProps": "256-bit entropy input (Windows 11 22H2)",
"type": "CAST"
},
{
"algorithmOrTest": "[EVM] Intel- based Entropy Source (E189)",
"condition": "Run at start-up and continuously.",
"details": "[EVM] Start-up and continuous noise source health tests and start-up logic integrity self- test.",
"indicator": "The entropy source is instantiated and a status is returned via the interface.",
"testMethod": "Fault detection",
"testProps": "256-bit entropy input (Windows Server 2022)",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "1) Error state occurs if the OS Loader integrity test fails; 2) If any of the cryptographic algorithm self-tests fail; 3) If any of the signature verifications fail for the Code Integrity module (CI.DLL), Secure Kernel Code Integrity module (SKCI.DLL), Kernel Mode Cryptographic Primitives Library module (CNG.SYS), or operating system kernel (NTOSKRNL.EXE); 4) If any of the health tests fail for the entropy source thus failing to instantiate the DRBG, or if the DRBG KAT fails.",
"description": "Boot failure",
"indicator": "Boot failure blue screen error message",
"name": "Boot Fail",
"recoveryMethod": "Restart the computer"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Normal operation of the computer, Windows OS, and module. This is the only mode claimed by the module.",
"name": "Approved Mode",
"statusIndicator": "N/A",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "The Data Input Interface is represented by the BlFileReadEx function and the BlDeviceRead function. BlFileReadEx is responsible for reading the binary data of unverified components from the computer hard drive. In addition, the BitLocker Full Volume Encryption Key (FVEK) can also be entered into the module over the module\u0027s data input interface. BlDeviceRead is responsible for reading data directly from devices.",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "The Data Output Interface is represented by the AhCreateLoadOptionsString function. OslArchTransferToKernel is responsible for transferring the execution from Windows OS Loader to the initial execution point of the Windows kernel. Data exits the module in the form of the initial instruction address of the Windows kernel. Data exits the module from the AhCreateLoadOptionsString function in the form of boot application parameters passed to the Windows kernel and, for computers with a TPM running in Virtual Secure Mode, in the form of keys sealed by the TPM.",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "The Windows OS Loader Control Input Interface is the set of internal functions responsible for intercepting control input. These functions are: OslMain (WINLOAD) - Receives and parses the Boot Application parameters, which are passed to the module when execution is passed from Boot Manager. BlBdInitialize - Reads the system status to determine if a boot debugger is attached. BlInitializeLibrary - Parses Boot Application parameters. BlXmiRead - Reads the operator selection from the Windows OS Loader user interface.",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "The Status Output Interface is the BlXmiWrite function that is responsible for displaying any integrity verification errors to the display. The Status Output Interface is also defined as the BlLogData responsible for writing the name of the corrupt driver to the bootlog.",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
},
{
"data": "N/A",
"logicalInterface": "Power",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Cryptographic Officer (CO)",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "1",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A3767)",
"details": "[EVM] Signature verification.",
"indicator": "Perform Cryptographic Algorithm Self-Tests service runs.",
"testMethod": "Software Integrity",
"testProps": "Signature verification using RSA PKCS#1v1.5 with 2048-bit key and SHA2-256 (Windows 11 version 22H2).",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A3768)",
"details": "[EVM] Signature verification.",
"indicator": "Perform Cryptographic Algorithm Self-Tests service runs.",
"testMethod": "Software Integrity",
"testProps": "Signature verification using RSA PKCS#1v1.5 with 2048-bit key and SHA2-256 (Windows Server 2022).",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input in plaintext",
"sfiAlgo": "",
"source": "[EVM] Boot manager"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Operators may choose to overwrite CSPs in non- volatile storage by reformatting and overwriting the storage media for the operating system. Operators may zeroize SSPs in volatile storage by powering off the host GPC.",
"method": "Procedural zeroization",
"operatorId": "Operators may use the Format.exe command together with the /P parameter to format and overwrite every sector on the volume with zeros. Operators may specify the number of overwrite passes using the /P parameter. See the public documentation for the Format command for more information. Operators may power off or reboot the host GPC to zeroize SSPs stored in volatile RAM.",
"rationale": "Reformatting and overwriting the OS volume at least once ensures adequate zeroization. Operators may choose to overwrite multiple times at their discretion. SSPs in volatile storage are effectively overwritten with zeroes when power is lost."
},
{
"description": "The module overwrites the temporary storage area for volatile SSPs when the module is unloaded from memory, when control has been transferred to NTOSKRNL.exe.",
"method": "Zeroization after use",
"operatorId": "None (programmatically executed by the module after CSPs are used).",
"rationale": "Zeroization is performed by overwriting the memory area with zeros using a forced inline function to minimize execution time. Because the memory word is explicitly set to \u00270\u0027, it is not necessary to do a read-back test. Windows uses only one type of system memory."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Persistent SSPs are stored on the operating system volume (see: Hard Disk in the block diagram).",
"name": "Hard Disk",
"persistance": "Static"
},
{
"description": "Volatile SSPs are temporarily stored in the computer\u0027s memory (see: RAM in the block diagram).",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "Microsoft Surface Laptop 5",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows 11 version 22H2, Enterprise Edition",
"paa_pai": "Yes",
"processors": "12th Gen Intel Core i7-1265U",
"version": "Windows 11 version 22H2, build 10.0.22621.1"
},
{
"hardwarePlatform": "Microsoft Surface Laptop 5",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows 11 version 22H2, Home Edition",
"paa_pai": "Yes",
"processors": "12th Gen Intel Core i7-1265U",
"version": "Windows 11 version 22H2, build 10.0.22621.1"
},
{
"hardwarePlatform": "Microsoft Surface Laptop 5",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows 11 version 22H2, IoT Enterprise Edition",
"paa_pai": "Yes",
"processors": "12th Gen Intel Core i7-1265U",
"version": "Windows 11 version 22H2, build 10.0.22621.1"
},
{
"hardwarePlatform": "HP ZBook Power G8",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows 11 version 22H2, Pro Edition",
"paa_pai": "Yes",
"processors": "11th Gen Intel Core i5-11500H",
"version": "Windows 11 version 22H2, build 10.0.22621.1"
},
{
"hardwarePlatform": "Dell Latitude 7420",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows 11 version 22H2, Education Edition",
"paa_pai": "Yes",
"processors": "11th Gen Intel Core i7-1185G7",
"version": "Windows 11 version 22H2, build 10.0.22621.1"
},
{
"hardwarePlatform": "Dell PowerEdge R640",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows Server 2022 Standard, including the March 2023 Updates",
"paa_pai": "Yes",
"processors": "Intel Xeon Gold 6130",
"version": "Windows Server 2022, build 10.0.20348.1668"
},
{
"hardwarePlatform": "Dell PowerEdge R640",
"hypervisorHostOs": "N/A",
"operatingSystem": "Windows Server 2022 Datacenter, including the March 2023 Updates",
"paa_pai": "Yes",
"processors": "Intel Xeon Gold 6130",
"version": "Windows Server 2022, build 10.0.20348.1668"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "Any UEFI-based x64 computer.",
"operatingSystem": "Any Microsoft operating system which is a relabeled version of the operating systems listed in Section 2.2."
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {},
"certification_process": {},
"cipher_mode": {
"CCM": {
"CCM": 1
},
"CTR": {
"CTR": 4
},
"GCM": {
"GCM": 1
},
"XTS": {
"XTS": 2
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"TLS": {
"TLS": {
"TLS": 4
}
}
},
"crypto_scheme": {},
"device_model": {},
"ecc_curve": {},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1,
"#5404": 2
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 4,
"AES- 128": 2,
"AES-256": 6,
"DRBG1": 9,
"PKCS #1": 1,
"PKCS 1": 4,
"RSA PKCS #1": 1,
"SHA-1": 10,
"SHA2": 4,
"SHA2-256": 15,
"SHA2-384": 6,
"SHA2-512": 10,
"SHS1": 6
}
},
"fips_security_level": {
"Level": {
"Level 1": 3,
"level 1": 1
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 10
},
"SHA2": {
"SHA2": 4
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 36
},
"RNG": {
"RBG": 5
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 8,
"FIPS 180-4": 11,
"FIPS 186": 3,
"FIPS 186-4": 13,
"FIPS 186-5": 6,
"FIPS 197": 1,
"FIPS PUB 140-3": 1,
"FIPS186-4": 20
},
"ISO": {
"ISO/IEC 19790:2012": 1
},
"NIST": {
"NIST SP 800-38A": 1,
"NIST SP 800-38C": 1,
"NIST SP 800-38D": 1,
"NIST SP 800-38E": 1,
"NIST SP 800-90A": 1,
"NIST SP 800-90B": 1,
"SP 800-38A": 2,
"SP 800-38C": 2,
"SP 800-38D": 2,
"SP 800-38E": 2,
"SP 800-90A": 2,
"SP 800-90B": 1
},
"PKCS": {
"PKCS #1": 1,
"PKCS 1": 4
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 33,
"AES-": 8,
"AES-256": 6
},
"CAST": {
"CAST": 66
}
},
"constructions": {
"MAC": {
"CBC-MAC": 2
}
}
},
"tee_name": {
"AMD": {
"PSP": 1
}
},
"tls_cipher_suite": {},
"vendor": {
"Microsoft": {
"Microsoft": 34,
"Microsoft Corporation": 55
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"RSA SigVer (FIPS186-4)A3768",
"SHA2-384A4009",
"AES-CBCA4009",
"SHA2-256A4009",
"AES-GCMA4009",
"SHA-1A4009",
"SHA2-512A4009",
"AES-CCMA4009",
"Counter DRBGA4009",
"AES-XTS Testing Revision 2.0A4009"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4009",
"#A3767",
"#A4008",
"#A3768",
"#5404"
]
},
"policy_metadata": {
"/Author": "Robert Durff",
"/CreationDate": "D:20260825072747-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_ActionId": "ecb8c4a0-a6b5-43c7-984e-0529691b71b3",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_ContentBits": "0",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_Enabled": "true",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_Method": "Privileged",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_Name": "Third Party Protected Information",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_SetDate": "2026-08-19T13:12:40Z",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_SiteId": "b64da4ac-e800-4cfc-8931-e607f720a1b8",
"/MSIP_Label_09028634-1b4d-412c-bf5f-1be49c7e2c2f_Tag": "10, 0, 1, 1",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "180250b5-f515-447c-b295-4c272bff8ae1",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-08-25T11:22:17Z",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1",
"/ModDate": "D:20260825072747-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1244985,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/publications/detail/sp/800-90a/rev-1/final",
"https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/use/manage-servers",
"https://csrc.nist.gov/publications/detail/sp/800-38d/final",
"https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E216_PublicUse.pdf",
"https://csrc.nist.gov/pubs/fips/186-5/final",
"https://csrc.nist.gov/publications/detail/sp/800-38e/final",
"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-itemproperty",
"https://csrc.nist.gov/publications/detail/fips/186/4/final",
"https://csrc.nist.gov/publications/detail/fips/197/final",
"https://csrc.nist.gov/publications/detail/sp/800-38c/final",
"https://www.microsoft.com/en-us/howtotell/default.aspx",
"https://csrc.nist.gov/publications/detail/fips/180/4/final",
"https://csrc.nist.gov/publications/detail/sp/800-90b/final",
"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature",
"https://csrc.nist.gov/publications/detail/sp/800-38a/final",
"https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E189_PublicUse.pdf",
"https://csrc.nist.gov/publications/detail/fips/140/3/final"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 46
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "dd2a1ef9f0d9ad05002bc74d6cbc697c9b81ee4cc8eb07477de07ff7951a608b",
"source_hash": "328d4acf26046633a257c74c22b401c1d4b22f40126049c2a3d15bd5d4d4907c",
"txt_hash": "c288f9b494d4a0592e7d4bd10f0b6d47f21bfeffac620e0d3b010cd3a15b5948"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. When operated in approved mode with module Boot Manager validated to FIPS 140-3 under Cert. #5404 operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. No assurance of FIPS 140-3 requirements met for the components of the RBG construct that are external to the module boundary (e.g., DRBG, ESV) except for SP 800-90C compliance and security strength of the provided random bits",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
"date_sunset": "2031-08-30",
"description": "The Windows OS Loader (the \"module\") is the component that loads the operating system kernel (ntoskrnl.exe) and other boot stage binary image files. The module is a part of BitLocker Drive Encryption, which is a data protection feature of the Windows operating system that encrypts data on a storage volume.",
"embodiment": "MultiChipStand",
"exceptions": [
"Non-invasive security: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {
"5404": 1
},
"module_name": "Windows OS Loader",
"module_type": "Software-Hybrid",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-08-31",
"lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
"validation_type": "Initial"
}
],
"vendor": "Microsoft Corporation",
"vendor_url": "http://www.microsoft.com"
}
}