This page was not yet optimized for use on mobile devices.
SAOS 10.11.1
Certificate details
| Certificate ID | #5293 |
|---|---|
| Status | active |
| Validation dates | 26.05.2026 |
| Sunset date | 25-05-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy. The tamper evident seals installed as indicated in the Security Policy |
| Exceptions |
|
| Description | The Ciena SAOS 10 MACSec Series of Service Access and Aggregation platforms use MACSec for traffic encryption/decryption. The platforms provide routing/switching functionalities for various use cases including enterprise, mobility, and converged network architectures. With Ethernet, MPLS, IP, and SR capabilities, the product supports emerging networks. |
| Vendor | Ciena Corporation http://www.ciena.com/ |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES-192, AES, AES-, CAST, HMACAsymmetric Algorithms
RSA 2048, RSA 4096, ECDH, ECDSA, ECC, DHHash functions
SHA-1Schemes
MAC, Key AgreementProtocols
SSH, SSHv2, TLS v1.2, TLSv1.2, TLS, TLS 1.2, IKERandomness
DRBG, RNG, RBGElliptic Curves
P-256, P-384, P-521Block cipher modes
GCMTrusted Execution Environments
PSPSecurity level
Level 2Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, SP 800-38A, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-90A, SP 800-56A, SP 800-135, SP 800-108, SP 800-52, RFC7627, RFC 5288, RFC 4419, RFC 7919Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5293,
"dgst": "1dba9a5bf22d8497",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA-1A6532",
"SHA-1A6532",
"AES-CMACA6532",
"AES-CBCA6532",
"AES-GCMC1877",
"SHA2-512A6532",
"#C1877",
"Counter DRBGA6532",
"SHA2-384A6532",
"RSA SigGen (FIPS186-5)A6532",
"AES-KWA6532",
"HMAC-SHA2-384A6532",
"KAS-FFC-SSC Sp800-56Ar3A6532",
"KDF SSHA6532",
"Safe Primes Key GenerationA6532",
"KDF SP800-108A6532",
"ECDSA SigGen (FIPS186-5)A6532",
"TLS v1.2 KDF RFC7627A6532",
"HMAC-SHA2-512A6532",
"KDF SNMPA6532",
"RSA KeyGen (FIPS186-5)A6532",
"AES-CTRA6532",
"KAS-ECC-SSC Sp800-56Ar3A6532",
"SHA2-256A6532",
"#A6532",
"#C894",
"ECDSA SigVer (FIPS186-5)A6532",
"HMAC-SHA2-256A6532",
"ECDSA KeyGen (FIPS186-5)A6532",
"RSA SigVer (FIPS186-5)A6532"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"10.11.1"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6532",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A6532",
"properties": "Direction - Generation, Verification Key Length - 128, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6532",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A6532",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.2 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A6532",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A6532",
"properties": "Prediction Resistance - No Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A6532",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A6532",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A6532",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A6532",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A6532",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A6532",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe4096, MODP-2048, MODP- 3072, MODP-4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A6532",
"properties": "Password Length - Password Length: 64, 128",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A6532",
"properties": "KDF Mode - Counter Supported Lengths - Supported Lengths: 128- 4096 Increment 8",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A6532",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Key Generation Mode - probableWithProbableAux Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6532",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A6532",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe4096, MODP-2048, MODP-3072, MODP-4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A6532",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6532",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6532",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6532",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A6532",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "AES 4550",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "C1877",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "C894",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 256",
"reference": "SP 800-38D"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provide Module\u0027s name and version information",
"indicator": "None",
"inputs": "Command to show version",
"name": "Show Version",
"outputs": "Module\u0027s ID and versioning information",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Provide Module\u0027s",
"indicator": "None",
"inputs": "Command to show status",
"name": "Show Status",
"outputs": "Module\u0027s current status",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "current status",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Perform Self-Tests (Pre- operational self-test and Conditional",
"indicator": "Syslog message",
"inputs": "Command to trigger Self-Test",
"name": "Perform Self-Tests",
"outputs": "Status of the self- tests results",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Perform Zeroization",
"indicator": "Syslog message \"Zeroizati on: started\" \"Zeroizati on: complete d\"",
"inputs": "Command \"system reset factory- defaults\" to zeroize the Module",
"name": "Perform Zeroization",
"outputs": "Status of the SSPs zeroization",
"rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State V value: Z - DRBG Key: Z - Crypto Officer Password: Z - User Password: Z - AES KeyStore Key: Z - SSH DH Private Key: Z - SSH DH Public Key: Z - SSH Peer DH Public Key: Z - SSH DH Shared Secret: Z - SSH ECDH Private Key: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH ECDH Public Key: Z - SSH Peer ECDH Public Key: Z - SSH ECDH Shared Secret: Z - SSH RSA Private Key: Z - SSH RSA Public Key: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authenticat ion Key: Z - TLSv1.2 DH Private Key: Z - TLSv1.2 DH Public Key: Z - TLSv1.2 Peer DH Public Key: Z - TLSv1.2 DH Shared Secret: Z - TLSv1.2 ECDH",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: Z - TLSv1.2 ECDH Public Key: Z - TLSv1.2 Peer ECDH Public Key: Z - TLSv1.2 ECDH Shared Secret: Z - TLSv1.2 RSA Private Key: Z - TLSv1.2 RSA Public Key: Z - TLSv1.2 ECDSA Private Key: Z - TLSv1.2 ECDSA Public Key: Z - TLSv1.2 Master Secret: Z - TLSv1.2 Session Encryption Key: Z - TLSv1.2 Session Authenticat ion Key: Z - SNMPv3 Shared Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticat",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ion Key: Z - MACsec Connectivit y Associatio n Key (CAK): Z - MACsec Key Encryption Key (KEK): Z - MACsec Security Associatio n Key (SAK): Z - MACsec Integrity Check Key (ICK): Z",
"secFunImpl": ""
},
{
"description": "Sets configurati on of the systems",
"indicator": "None",
"inputs": "Command s to configure the network",
"name": "Configure Network",
"outputs": "Status of the completion of network configurati on status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "CO Role Authenticat ion",
"indicator": "N/A",
"inputs": "CO Authenticat ion Request",
"name": "Crypto Officer Authenticat ion",
"outputs": "Status of the CO authenticat ion",
"rolesSspAccess": "Crypto Officer - Crypto Officer Password: W",
"secFunImpl": "None"
},
{
"description": "User Role Authenticat ion",
"indicator": "N/A",
"inputs": "User role authenticat ion request",
"name": "User Authenticat ion",
"outputs": "Status of the User role authenticat ion",
"rolesSspAccess": "User - User Password: W",
"secFunImpl": "None"
},
{
"description": "Configure SSHv2 Function",
"indicator": "SSHv2 configurat ion success status message",
"inputs": "Command s to configure SSHv2",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completion of the SSHv2 configurati on",
"rolesSspAccess": "Crypto Officer - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA KeyGen (SSHv2, TLSv1.2)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: W,E - SSH ECDSA Public Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG",
"secFunImpl": "ECDSA KeyGen (SSHv2, TLSv1.2) DRBG Function"
},
{
"description": "Configure TLSv1.2 Function",
"indicator": "TLSv1.2 configurat ion success status message",
"inputs": "Command s to configure TLSv1.2",
"name": "Configure TLSv1.2 Function",
"outputs": "Status of the completion of the TLSv1.2 configurati on",
"rolesSspAccess": "Key: W,E Crypto Officer - TLSv1.2 RSA Private Key: G,W,E - TLSv1.2 RSA Public Key: G,R,W - TLSv1.2 ECDSA Private Key: G,W,E - TLSv1.2 ECDSA Public Key: G,R,W - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,Z",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA KeyGen (SSHv2, TLSv1.2) ECDSA KeyGen (SSHv2, TLSv1.2) DRBG Function"
},
{
"description": "Configure SNMPv3 Function",
"indicator": "SNMPv3 configurat ion success syslog message",
"inputs": "Command s to configure SNMPv3",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completion of SNMPv3 configurati on",
"rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: G,W,E - SNMPv3 Authenticat ion Key: G,W,E",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) SNMPv3 Keying Materials Developmen t"
},
{
"description": "Configure MACsec Function",
"indicator": "MACsec configurat ion success syslog message",
"inputs": "Command s to configure MACsec",
"name": "Configure MACsec Function",
"outputs": "Status of the completion of MACsec configurati on",
"rolesSspAccess": "Crypto Officer - MACsec Connectivit y Associatio n Key (CAK): W",
"secFunImpl": "MACsec Session Authenticati on"
},
{
"description": "Execute SSHv2 Function",
"indicator": "Successf ul SSHv2 log message",
"inputs": "Initiate SSHv2 tunnel establishm ent",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 tunnel establishm ent",
"rolesSspAccess": "Crypto Officer - SSH DH Private Key: G,W,E - SSH DH Public Key: G,R,W - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: G,W,E - SSH ECDH Private Key: G,W,E - SSH ECDH",
"secFunImpl": "KAS-FFC (SSHv2) KAS-ECC (SSHv2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA SigGen (SSHv2, TLSv1.2) ECDSA SigGen (SSHv2, TLSv1.2) RSA SigVer (SSHv2, TLSv1.2) ECDSA SigVer (SSHv2,"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Public Key: G,R,W - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: G,W,E - SSH RSA Private Key: G,W,E - SSH RSA Public Key: G,R,W - SSH ECDSA Private Key: G,W,E - SSH ECDSA Public Key: G,R,W - SSH Session Encryption Key: G,W,E - SSH Session Authenticat ion Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E",
"secFunImpl": "TLSv1.2) SSHv2 Session Encrypt/Dec rypt SSHv2 Session Authenticati on SSHv2 Keying Materials Developmen t DRBG Function"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Key: G,W,E User - SSH DH Private Key: G,W,E - SSH DH Public Key: G,R,W - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: G,W,E - SSH ECDH Private Key: G,W,E - SSH ECDH Public Key: G,R,W - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: G,W,E - SSH RSA Private Key: G,W,E - SSH RSA Public Key: G,R,W - SSH ECDSA Private Key: G,W,E - SSH",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access ECDSA Public Key: G,R,W - SSH Session Encryption Key: G,W,E - SSH Session Authenticat ion Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key:",
"secFunImpl": ""
},
{
"description": "Execute TLSv1.2 Function",
"indicator": "Successf ul TLSv1.2 log message",
"inputs": "Initiate TLSv1.2 tunnel establishm ent",
"name": "Run TLSv1.2 Function",
"outputs": "Status of SSHv2 tunnel establishm ent",
"rolesSspAccess": "G,W,E Crypto Officer - TLSv1.2 DH Private Key: G,W,E - TLSv1.2 DH Public Key: G,R,W - TLSv1.2 Peer DH Public Key: W,E - TLSv1.2 DH Shared Secret: G,W,E - TLSv1.2 ECDH Private",
"secFunImpl": "KAS-FFC (TLSv1.2) KAS-ECC (TLSv1.2) RSA SigGen (SSHv2, TLSv1.2) ECDSA SigGen (SSHv2, TLSv1.2) RSA SigVer (SSHv2, TLSv1.2) ECDSA SigVer (SSHv2, TLSv1.2) TLSv1.2 Session Encrypt/Dec"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G,W,E - TLSv1.2 ECDH Public Key: G,R,W - TLSv1.2 Peer ECDH Public Key: W,E - TLSv1.2 ECDH Shared Secret: G,E - TLSv1.2 RSA Private Key: G,W,E - TLSv1.2 RSA Public Key: G,R,W - TLSv1.2 ECDSA Private Key: G,W,E - TLSv1.2 ECDSA Public Key: G,R,W - TLSv1.2 Master Secret: G,W,E - TLSv1.2 Session Encryption Key: G,W,E - TLSv1.2 Session Authenticat ion Key: G,W,E - DRBG",
"secFunImpl": "rypt TLSv1.2 Session Authenticati on TLSv1.2 Keying Materials Developmen t DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E User - TLSv1.2 DH Private Key: G,W,E - TLSv1.2 DH Public Key: G,R,W - TLSv1.2 Peer DH Public Key: W,E - TLSv1.2 DH Shared Secret: G,W,E - TLSv1.2 ECDH Private Key: G,W,E - TLSv1.2 ECDH Public Key: G,R,W - TLSv1.2 Peer ECDH Public Key: W,E - TLSv1.2 ECDH Shared Secret:",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,E - TLSv1.2 RSA Private Key: G,W,E - TLSv1.2 RSA Public Key: G,R,W - TLSv1.2 ECDSA Private Key: G,W,E - TLSv1.2 ECDSA Public Key: G,R,W - TLSv1.2 Master Secret: G,W,E - TLSv1.2 Session Encryption Key: G,W,E - TLSv1.2 Session Authenticat ion Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "Execute SNMPv3 Function",
"indicator": "Successf ul SNMPv3 log message",
"inputs": "Initiate SNMPv3 tunnel establishm ent",
"name": "Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel establishm ent",
"rolesSspAccess": "Access Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: G,W,E - SNMPv3 Authenticat ion Key: G,W,E User - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: G,W,E - SNMPv3 Authenticat ion Key:",
"secFunImpl": "SNMPv3 Session Encrypt/Dec rypt SNMPv3 Session Authenticati on SNMPv3 Keying Materials Developmen t DRBG Function"
},
{
"description": "Execute MACsec Function",
"indicator": "Successf ul MACsec log message",
"inputs": "Initiate MACsec tunnel establishm ent",
"name": "Run MACsec Function",
"outputs": "Status of MACsec tunnel establishm ent",
"rolesSspAccess": "G,W,E Crypto Officer - MACsec Key Encryption Key (KEK): G,E - MACsec Security Associatio n Key (SAK): G,E - MACsec Integrity Check Key (ICK): G,E User - MACsec Key Encryption Key (KEK): G,E",
"secFunImpl": "KTS (MACsec with AES- KW) MACsec Session Encrypt/Dec rypt MACsec Session Authenticati on MACsec Keying Materials Developmen t"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- MACsec Security Associatio n Key (SAK): G,E - MACsec Integrity Check Key (ICK): G,E",
"secFunImpl": ""
},
{
"description": "Execute firmware load test",
"indicator": "Syslog Message",
"inputs": "Image load",
"name": "Firmware Load Test",
"outputs": "Image load successful",
"rolesSspAccess": "Crypto Officer - Firmware Load Test Key: E",
"secFunImpl": "Firmware Load Test"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The minimum length is eight (8) characters (94 possible characters). The configuration supports at most ten failed attempts to authenticate in a one- minute period.",
"mechanism": "Password Based",
"name": "Password",
"perMinute": "The probability of successfully authenticating to the Module within one minute is 10/(94^8), which is less than 1/100,000.",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000."
},
{
"description": "The Modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the Module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the Module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than",
"mechanism": "RSA SigVer (FIPS186-5) (A6532)",
"name": "RSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the Module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details"
},
{
"description": "The Modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the Module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the",
"mechanism": "ECDSA SigVer (FIPS186-5) (A6532)",
"name": "ECDSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the Module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. Please refer to Description section in this table for more details"
},
{
"description": "probability of successfully authenticating to the Module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A6532)",
"condition": "Power up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A6532)",
"condition": "Power up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A6532)",
"condition": "Power up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A6532)",
"condition": "Power up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (C1877)",
"condition": "Power Up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (C1877)",
"condition": "Power Up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (AES 4550)",
"condition": "Power Up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (AES 4550)",
"condition": "Power Up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (C894)",
"condition": "Power Up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (C894)",
"condition": "Power Up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate/Generate/Re seed KAT (A6532)",
"condition": "Power up",
"details": "Instantiate, Generate, and Reseed KATs",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) KAT (A6532)",
"condition": "Power up",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve: P-256 with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) KAT (A6532)",
"condition": "Power up",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve: P-256 with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Continuous Health Tests",
"condition": "Performed continuou sly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Continuous Health Tests",
"condition": "Performed continuou sly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A6532)",
"condition": "Power up",
"details": "HMAC- SHA-1",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 KAT (A6532)",
"condition": "Power up",
"details": "HMAC- SHA2-256",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 KAT (A6532)",
"condition": "Power up",
"details": "HMAC- SHA2-384",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 KAT (A6532)",
"condition": "Power up",
"details": "HMAC- SHA2-512",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A6532)",
"condition": "Power up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve: P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A6532)",
"condition": "Power up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800-108 KAT (A6532)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "normal state",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KDF SNMP KAT (A6532)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A6532)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 5) KAT (A6532)",
"condition": "Power up",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186- 5) KAT (A6532)",
"condition": "Power up",
"details": "RSA",
"indicator": "Modulu s is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A6532)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) PCT (A6532)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A6532)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A6532)",
"condition": "first operation al use. Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186- 5) PCT (A6532)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "When firmware has been uploaded to the Module",
"details": "RSA 4096 SigVer with SHA2-256",
"indicator": "Module is in normal state",
"testMethod": "Signatur e Verificati on",
"testProps": "RSA 4096 SigVer with SHA2- 256",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "Conditional Bypass Test",
"condition": "Performs conditiona l bypass test before first operation al use of",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypas s"
},
{
"algorithmOrTest": "",
"condition": "bypass service",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "Manual Key Entry Test",
"condition": "Performs conditiona l manual key entry test before a manually entered key is entered to the module",
"details": "N/A",
"indicator": "Modulu s is in normal state",
"testMethod": "Duplicate Key Entry",
"testProps": "N/A",
"type": "Manu al Entry"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Self-test failure",
"description": "If self-test tests fail, the Module is put into an error state",
"indicator": "System Halt",
"name": "Error State",
"recoveryMethod": "Reboot the Module"
},
{
"conditions": "Asymmetric Pair-Wise consistency test failure Entropy Source Health Test failure",
"description": "If the Asymmetric Key Pair-Wise consistency tests or Entropy Health tests fails, the Module is put into an Soft Error State. Meaning the generated Asymmetric Key or gather entropy will be thrown out.",
"indicator": "Service failure, and respective error to log file",
"name": "Soft Error State",
"recoveryMethod": "Try service again"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of platform for residual evidence of tampering",
"mechanism": "Tamper labels"
},
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of platform for evidence of tampering, removal or access",
"mechanism": "Strong Enclosure"
},
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of components for evidence of tampering, removal or access",
"mechanism": "Production Grade Components"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The Module is always in the approved mode of operation after initial operations are performed.",
"name": "Approved Mode of Operation",
"statusIndicator": "Indicator that the Approved mode has been enabled: \"Security Mode | enhanced-security\"",
"type": "Approved"
},
{
"description": "If the conditional self-test for AES-GCM (Cert. #C894, #AES 4550, or #C1877) fails then the Module will enter the degraded mode. In the degraded mode, the hardware that implements this algorithm will be disabled and will no longer offer the services \"Configure MACsec Function\" or \"Run MACsec Function\"",
"name": "Degraded Mode of Operation",
"statusIndicator": "Indicator that the MACSec Services have been disabled: \"Oper State | disabled\"",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data input into the Module for all the services defined in Approved Services Table, including",
"logicalInterface": "Data Input",
"physicalPort": "SFP28 ports, SFP56 ports, SFP28+ ports, SFP+/SFP28/SFP-DD ports, QSFP28/QSFP56 ports, QSFP-DD/CFP2-"
},
{
"data": "TLSv1.2, SSHv2, SNMPv3 and MACsec service data.",
"logicalInterface": "",
"physicalPort": "DCO ports, RJ-45 Management (MGMT) port, USB-C Console port"
},
{
"data": "Data output from the Module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and MACsec service data.",
"logicalInterface": "Data Output",
"physicalPort": "SFP28 ports, SFP56 ports, SFP28+ ports, SFP+/SFP28/SFP-DD ports, QSFP28/QSFP56 ports, QSFP-DD/CFP2- DCO ports, RJ-45 Management (MGMT) port, USB-C Console port"
},
{
"data": "Control Data input into the Module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and MACsec service data.",
"logicalInterface": "Control Input",
"physicalPort": "RJ45 Mgmt. port, USB-C Console port, RJ- 45 BMC Mgmt. port, RJ-45 SYNC port, SMB Phase input port, SMB GNSS antenna"
},
{
"data": "Status Information output from the Module.",
"logicalInterface": "Status Output",
"physicalPort": "RJ-45 Mgmt. port, USB-C Console port, LEDs"
},
{
"data": "N/A",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Provide the Power Supply to the Module.",
"logicalInterface": "Power",
"physicalPort": "Power"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "User",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Bootloader Integrity Test",
"details": "Bootloader Integrity Test",
"indicator": "Success log message in /mnt/log/host/post- status.log",
"testMethod": "KAT",
"testProps": "32-bit Error Detection Code (CRC32)",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Kernel Integrity Test",
"details": "Kernel Integrity Test",
"indicator": "Success log message in /mnt/log/host/post- status.log",
"testMethod": "KAT",
"testProps": "32-bit Error Detection Code (CRC32)",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Firmware Integrity Test",
"details": "Firmware Integrity Test",
"indicator": "Success log message in /mnt/log/host/post- status.log",
"testMethod": "KAT",
"testProps": "32-bit Error Detection Code (CRC32)",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Pre- Operational Bypass Test",
"details": "Pre- Operational Bypass Test",
"indicator": "Success log message in /mnt/log/host/post- status.log",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypass"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "External (Outside of the Module\u0027s Boundary )",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password / Secret Input via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via SSHv2",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "encrypted by AES-GCM",
"sfiAlgo": "",
"source": "Boundary )"
},
{
"dest": "Module",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Password/ Secret Input via Console",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "External (Outside of the Module\u0027s Boundary )",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Secret output via MACsec by AES-KW",
"sfiAlgo": "KTS (MACsec with AES- KW)",
"source": "Module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service",
"method": "Zeroization Command",
"operatorId": "CLI command \"system reset factory-defaults\"",
"rationale": "The zeroization command will erase all SSPs stored in the DRAM or in the Flash of the Module."
},
{
"description": "Zeroization upon session termination",
"method": "Session Termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Zeroization upon rebooting the module",
"method": "Reboot",
"operatorId": "Reboot",
"rationale": "Reboot to zeroize all temporary SSPs stored in volatile memory"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile Memory",
"name": "DRAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile Memory",
"name": "Flash/SSD/eMMC",
"persistance": "Static"
},
{
"description": "Volatile Memory",
"name": "MACsec Phy",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "",
"fwVersion": "SAOS 10.11.1",
"hwVersion": "170-3926-921",
"modelPartNum": "Ciena 3926",
"processors": "ARM Cortex A53"
},
{
"features": "",
"fwVersion": "SAOS 10.11.1",
"hwVersion": "170-5171-920, (FRU PN) 170-0460-920",
"modelPartNum": "Ciena 5171- Gen2",
"processors": "Intel XeonD- 1747NTE"
},
{
"features": "",
"fwVersion": "SAOS 10.11.1",
"hwVersion": "170-8114-900, (FRU PN) 170-0404-900",
"modelPartNum": "Ciena 8114",
"processors": "Intel Xeon D-1559"
},
{
"features": "",
"fwVersion": "SAOS 10.11.1",
"hwVersion": "170-8140-910",
"modelPartNum": "Ciena 8140",
"processors": "Intel XeonD- 1747NTE"
},
{
"features": "",
"fwVersion": "SAOS 10.11.1",
"hwVersion": "170-8190-900",
"modelPartNum": "Ciena 8190",
"processors": "Intel XeonD- 1747NTE"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "The Module performs Cryptographic Key Generation (CKG) for asymmetric keys as detailed by example 1 in section 4 and section 5 of SP800-133r2"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 3
},
"ECDH": {
"ECDH": 60
},
"ECDSA": {
"ECDSA": 68
}
},
"FF": {
"DH": {
"DH": 60
}
},
"RSA": {
"RSA 2048": 1,
"RSA 4096": 3
}
},
"certification_process": {},
"cipher_mode": {
"GCM": {
"GCM": 9
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 1
},
"SSH": {
"SSH": 127,
"SSHv2": 120
},
"TLS": {
"TLS": {
"TLS": 7,
"TLS 1.2": 1,
"TLS v1.2": 6,
"TLSv1.2": 198
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 4
},
"MAC": {
"MAC": 4
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 46,
"P-384": 42,
"P-521": 42
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1,
"#4550": 1
}
},
"fips_certlike": {
"Certlike": {
"#AES": 1,
"AES -256": 1,
"AES 4550": 6,
"AES-128": 2,
"AES-192": 1,
"AES-256": 3,
"AES-GCM (Cert. #4550": 1,
"DRBG 384": 1,
"HMAC- SHA-1": 1,
"HMAC-SHA-1": 6,
"RSA 2048": 1,
"RSA 4096": 3,
"SHA-1": 6,
"SHA2- 256": 6,
"SHA2- 384": 1,
"SHA2- 512": 4,
"SHA2-256": 8,
"SHA2-384": 5,
"SHA2-512": 3,
"SHA3- 256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 6
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 77
},
"RNG": {
"RBG": 2,
"RNG": 1
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 10,
"FIPS 180-4": 4,
"FIPS 186-5": 10,
"FIPS 198-1": 4,
"FIPS186-5": 23
},
"NIST": {
"SP 800-108": 1,
"SP 800-135": 3,
"SP 800-38A": 2,
"SP 800-38B": 1,
"SP 800-38D": 5,
"SP 800-38F": 1,
"SP 800-52": 1,
"SP 800-56A": 3,
"SP 800-90A": 1
},
"RFC": {
"RFC 4419": 2,
"RFC 5288": 1,
"RFC 7919": 2,
"RFC7627": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 32,
"AES-": 9,
"AES-128": 2,
"AES-192": 1,
"AES-256": 3
},
"CAST": {
"CAST": 58
}
},
"constructions": {
"MAC": {
"HMAC": 17
}
}
},
"tee_name": {
"AMD": {
"PSP": 12
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA-1A6532",
"AES-CMACA6532",
"SHA-1A6532",
"AES-CBCA6532",
"AES-GCMC1877",
"SHA2-512A6532",
"Counter DRBGA6532",
"SHA2-384A6532",
"RSA SigGen (FIPS186-5)A6532",
"AES-KWA6532",
"HMAC-SHA2-384A6532",
"KAS-FFC-SSC Sp800-56Ar3A6532",
"KDF SSHA6532",
"Safe Primes Key GenerationA6532",
"KDF SP800-108A6532",
"ECDSA SigGen (FIPS186-5)A6532",
"TLS v1.2 KDF RFC7627A6532",
"HMAC-SHA2-512A6532",
"KDF SNMPA6532",
"RSA KeyGen (FIPS186-5)A6532",
"AES-CTRA6532",
"KAS-ECC-SSC Sp800-56Ar3A6532",
"SHA2-256A6532",
"ECDSA SigVer (FIPS186-5)A6532",
"HMAC-SHA2-256A6532",
"ECDSA KeyGen (FIPS186-5)A6532",
"RSA SigVer (FIPS186-5)A6532"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6532",
"#C894",
"#C1877"
]
},
"policy_metadata": {
"/CreationDate": "D:20260520144642-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260520144642-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 2530151,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://my.ciena.com/CienaPortal"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 76
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "d1b6ca265f52c59957465b85691b277adc41c82195e58a46ebd9898dad108fb9",
"source_hash": "64adbf475b47b19ce4ef1422b1dd2590faf1e5143513e5310dba6af7a9ee6fd1",
"txt_hash": "419b72f70947f7e832e1c1ba3f62a418baf9738b97f1d86bef09c0f22031b898"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy. The tamper evident seals installed as indicated in the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/May 2026_030626_0716.pdf",
"date_sunset": "2031-05-25",
"description": "The Ciena SAOS 10 MACSec Series of Service Access and Aggregation platforms use MACSec for traffic encryption/decryption. The platforms provide routing/switching functionalities for various use cases including enterprise, mobility, and converged network architectures. With Ethernet, MPLS, IP, and SR capabilities, the product supports emerging networks.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "SAOS 10.11.1",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-05-26",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Ciena Corporation",
"vendor_url": "http://www.ciena.com/"
}
}