This page was not yet optimized for use on mobile devices.
Cisco Adaptive Security Appliance Virtual Cryptographic Module
Certificate details
| Certificate ID | #5114 |
|---|---|
| Status | active |
| Validation dates | 19.12.2025 |
| Sunset date | 18-12-2030 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Firmware-Hybrid |
| Embodiment | Multi-Chip Stand Alone |
| Caveat | When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy |
| Exceptions |
|
| Description | Cisco Virtual Adaptive Security Appliances offers the combination of the industry's most deployed stateful firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications. Delivering robust user and application policy enforcement, multi-vector attack protection, and secure connectivity services in cost-effective, easy-to-deploy solutions. |
| Vendor | Cisco Systems, Inc. http://www.cisco.com |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES-192, AES, AES-, CAST, HMACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1Schemes
MAC, Key AgreementProtocols
SSHv2, SSH, TLS v1.2, TLSv1.2, TLS, TLS 1.2, IKEv2, IKE, VPNRandomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521Block cipher modes
GCMTrusted Execution Environments
PSPVendor
Cisco Systems, Inc, Cisco, Cisco SystemsSecurity level
Level 1, level 1Certification process
out of scope, from the approved mode of operation. Any firmware that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configureStandards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, SP 800-140, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-52, PKCS 1, RFC7627, RFC 5288, RFC 7296, RFC 4419, RFC 7919, RFC 3526, ISO/IEC 19790Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.CPE matches
- cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*
- cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5114,
"dgst": "251d298116e31fdd",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A4595",
"HMAC-SHA2-384A4595",
"Safe Primes Key GenerationA4595",
"ECDSA KeyGen (FIPS186-4)A4595",
"RSA SigVer (FIPS186-4)A4595",
"SHA2-224A4595",
"HMAC-SHA2-512A4595",
"KDF SSHA4595",
"SHA2-256A4595",
"SHA2-384A4595",
"TLS v1.2 KDF RFC7627A4595",
"HMAC-SHA2-224A4595",
"KDF SNMPA4595",
"AES-CBCA4595",
"HMAC-SHA-1A4595",
"SHA2-512A4595",
"RSA KeyGen (FIPS186-4)A4595",
"ECDSA SigGen (FIPS186-4)A4595",
"#A4595",
"KAS-ECC-SSC Sp800-56Ar3A4595",
"KAS-FFC-SSC Sp800-56Ar3A4595",
"SHA-1A4595",
"ECDSA SigVer (FIPS186-4)A4595",
"KDF IKEv2A4595",
"AES-GCMA4595",
"RSA SigGen (FIPS186-4)A4595",
"Counter DRBGA4595"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*",
"cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*",
"cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*",
"cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*",
"cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4595",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4595",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A4595",
"properties": "Prediction Resistance - Yes Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4595",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A4595",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4595",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4595",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4595",
"properties": "Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A4595",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme -",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "ephemeralUnified - KAS Role - initiator, responder",
"reference": ""
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A4595",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A4595",
"properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A4595",
"properties": "Password Length - Password Length: 256, 64",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A4595",
"properties": "Cipher - AES-128, AES-192, AES-256",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A4595",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A4595",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp- 4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4595",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A4595",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4595",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4595",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4595",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A4595",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provide Module\u0027s current status",
"indicator": "None",
"inputs": "API command to show status.",
"name": "Show Status",
"outputs": "Module\u0027s current status.",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Provide Module\u0027s name/ID and versioning informatio n.",
"indicator": "None",
"inputs": "API command \"show version\"",
"name": "Show Version",
"outputs": "Module\u0027s name \"ASAv Adaptive Security Virtual Appliance\" and versioning information",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform Self-Tests (Pre- operationa l self-tests and",
"indicator": "None",
"inputs": "API command s to conduct on- demand",
"name": "Perform Self-Tests",
"outputs": "Status of the self- tests results.",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Condition al Self- Tests)",
"indicator": "",
"inputs": "Self- Tests.",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Perform Zeroizatio n.",
"indicator": "None",
"inputs": "API command s to conduct Zeroizatio n operation or Power down the tested platform.",
"name": "Perform Zeroizatio n",
"outputs": "Status of the SSPs zeroization.",
"rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State V value: Z - DRBG Key: Z - SSH DH Private Key: Z - SSH DH Public Key: Z - SSH Peer DH Public Key: Z - SSH DH Shared Secret: Z - SSH ECDH Private Key: Z - SSH ECDH Public Key: Z - SSH Peer ECDH Public Key: Z - SSH ECDH Shared Secret: Z - SSH RSA Private Key: Z - SSH RSA Public Key:",
"secFunImpl": "None"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authenticati on Key: Z - TLS DH Private Key: Z - TLS DH Public Key: Z - TLS Peer DH Public Key: Z - TLS DH Shared Secret: Z - TLS ECDH Private Key: Z - TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z - TLS RSA Private Key: Z - TLS RSA",
"secFunImpl": "Functions"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Public Key: Z - TLS ECDSA Private Key: Z - TLS ECDSA Public Key: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authenticati on Key: Z - IPsec/IKEv2 DH Private Key: Z - IPsec/IKEv2 DH Public Key: Z - IPsec/IKEv2 Peer DH Public Key: Z - IPsec/IKEv2 DH Shared Secret: Z - IPsec/IKEv2 ECDH Private Key: Z - IPsec/IKEv2 ECDH Public Key: Z -",
"secFunImpl": "Functions"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access IPsec/IKEv2 Peer ECDH Public Key: Z - IPsec/IKEv2 ECDH Shared Secret: Z - IPsec/IKEv2 RSA Private Key: Z - IPsec/IKEv2 RSA Public Key: Z - IPsec/IKEv2 ECDSA Private Key: Z - IPsec/IKEv2 ECDSA Public Key: Z - IPsec/IKEv2 Pre-Shared Key: Z - SKEYSEED : Z - IPsec/IKEv2 Session Encryption Key: Z - IPsec/IKEv2 Authenticati on Key: Z - SNMPv3 Authenticati on/ Privacy Password: Z - SNMPv3",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryption Key: Z - SNMPv3 Authenticati on Key: Z - RADIUS Secret: Z - TACACS+ Secret: Z",
"secFunImpl": ""
},
{
"description": "Sets configurati on of the systems.",
"indicator": "None",
"inputs": "API command s to configure the module.",
"name": "Configure Network",
"outputs": "Status of the completion of network related configuratio n.",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Sets the Bypass capability",
"indicator": "None",
"inputs": "API command s to configure the Bypass capability.",
"name": "Configure Bypass capability",
"outputs": "Status of the completion of Bypass capability configuratio n.",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Configure SSHv2 Function",
"indicator": "Global Indicator and SSHv2 configurati on success status message.",
"inputs": "API command s to configure SSHv2.",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completion of SSHv2 configuratio n.",
"rolesSspAccess": "Crypto Officer - SSH RSA Private Key: G,W,E - SSH RSA Public Key: G,R,W - SSH ECDSA Private Key: G,W,E - SSH ECDSA Public Key: G,R,W - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2, IKEv2)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "State V value: G,W,E - DRBG Key: G,W,E - RADIUS Secret: W - TACACS+ Secret: W",
"secFunImpl": "DRBG Function"
},
{
"description": "Configure HTTPS over TLSv1.2 Function.",
"indicator": "Global Indicator and HTTPS over TLSv1.2 configurati on success status message.",
"inputs": "API command s to configure HTTPS over TLSv1.2",
"name": "Configure HTTPS over TLSv1.2 Function",
"outputs": "Status of the completion of HTTPS over TLSv1.2 configuratio n.",
"rolesSspAccess": "Crypto Officer - TLS RSA Private Key: G,W,E - TLS RSA Public Key: G,R,W - TLS ECDSA Private Key: G,W,E - TLS ECDSA Public Key: G,R,W - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2, IKEv2) DRBG Function"
},
{
"description": "Configure IPsec/IKE v2 Functions",
"indicator": "Global Indicator with IPsec/IKE v2 configurati on success status message.",
"inputs": "API command s to configure IPsec/IKE v2.",
"name": "Configure IPsec/IKE v2 Functions",
"outputs": "Status of the completion of IPsec/IKEv 2 secure tunnel configuratio n.",
"rolesSspAccess": "Crypto Officer - IPsec/IKEv2 RSA Private Key: G,W,E - IPsec/IKEv2 RSA Public Key: G,W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) KTS (SSHv2 with AES"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access - IPsec/IKEv2 ECDSA Private Key: G,W,E - IPsec/IKEv2 ECDSA Public Key: G,W,E - IPsec/IKEv2 Pre-Shared Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG",
"secFunImpl": "and HMAC) KTS (SSHv2 with AES- GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2, IKEv2) DRBG Function"
},
{
"description": "Configure SNMPv3 Function",
"indicator": "Global Indicator and SNMPv3 configurati on success status message.",
"inputs": "API command s to configure SNMPv3.",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completion of SNMPv3 configuratio n.",
"rolesSspAccess": "Key: G,W,E Crypto Officer - SNMPv3 Authenticati on/ Privacy Password: W,E - SNMPv3 Encryption Key: G,W,E - SNMPv3 Authenticati on Key: G,W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) SNMPv3 Keying Materials Development"
},
{
"description": "Execute SSHv2 Function",
"indicator": "Global Indicator and",
"inputs": "API command s to",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 secure",
"rolesSspAccess": "Crypto Officer - SSH DH",
"secFunImpl": "KAS-FFC (SSHv2) KAS-ECC"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "Successfu l SSHv2 log message.",
"inputs": "execute SSHv2 service.",
"name": "",
"outputs": "tunnel establishme nt.",
"rolesSspAccess": "Private Key: G,W,E - SSH DH Public Key: G,R,W - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: G,W,E - SSH ECDH Private Key: G,W,E - SSH ECDH Public Key: G,R,W - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: G,W,E - SSH RSA Private Key: G,W,E - SSH RSA Public Key: G,R,W - SSH ECDSA Private Key: G,W,E - SSH ECDSA Public Key: G,R,W - SSH Session Encryption Key: G,W,E - SSH Session",
"secFunImpl": "Functions (SSHv2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES- GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2, IKEv2) RSA SigVer (SSHv2, TLSv1.2, IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, IKEv2) SSHv2 Session Encrypt/Decr ypt SSHv2 Session Authenticatio n SSHv2 Keying Materials Development DRBG Function"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Authenticati on Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E - RADIUS Secret: W,E - TACACS+",
"secFunImpl": ""
},
{
"description": "Execute HTTPS over TLSv1.2 Function.",
"indicator": "Global Indicator and Successfu l HTTPS over TLSv1.2 log message.",
"inputs": "API command to execute HTTPS over TLSv1.2 service.",
"name": "Run HTTPS over TLSv1.2 Function",
"outputs": "Status of HTTPS over TLSv1.2 establishme nt.",
"rolesSspAccess": "Secret: W,E Crypto Officer - TLS DH Private Key: G,W,E - TLS DH Public Key: G,R,W - TLS Peer DH Public Key: W,E - TLS DH Shared Secret: G,W,E - TLS ECDH Private Key: G,W,E - TLS ECDH Public Key: G,R,W - TLS Peer ECDH Public Key: W,E - TLS",
"secFunImpl": "KAS-FFC (TLSv1.2) KAS-ECC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2, IKEv2) RSA SigVer (SSHv2, TLSv1.2, IKEv2) ECDSA SigVer (SSHv2,"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDH Shared Secret: G,W,E - TLS RSA Private Key: G,W,E - TLS RSA Public Key: G,R,W - TLS ECDSA Private Key: G,W,E - TLS ECDSA Public Key: G,R,W - TLS Master Secret: G,W,E - TLS Session Encryption Key: G,W,E - TLS Session Authenticati on Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": "TLSv1.2, IKEv2) TLSv1.2 Session Encrypt/Decr ypt TLSv1.2 Session Authenticatio n TLSv1.2 Keying Materials Development DRBG Function"
},
{
"description": "Execute IPsec/IKE v2 Functions",
"indicator": "Global Indicator and Successfu",
"inputs": "API command to execute",
"name": "Run IPsec/IKE v2 Functions",
"outputs": "Status of IPsec/IKEv 2 secure tunnel",
"rolesSspAccess": "Crypto Officer - IPsec/IKEv2",
"secFunImpl": "KAS-FFC (IKEv2) KAS-ECC (IKEv2)"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "l IPsec/IKE v2 log message.",
"inputs": "IPsec/IKE v2",
"name": "",
"outputs": "establishme nt",
"rolesSspAccess": "Access DH Private Key: G,W,E - IPsec/IKEv2 DH Public Key: G,R,W - IPsec/IKEv2 Peer DH Public Key: W,E - IPsec/IKEv2 DH Shared Secret: G,W,E - IPsec/IKEv2 ECDH Private Key: G,W,E - IPsec/IKEv2 ECDH Public Key: G,R,W - IPsec/IKEv2 Peer ECDH Public Key: W,E - IPsec/IKEv2 ECDH Shared Secret: G,W,E - IPsec/IKEv2 RSA Private Key: G,W,E - IPsec/IKEv2 RSA Public Key: G,W,E - IPsec/IKEv2 ECDSA Private Key:",
"secFunImpl": "Functions RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2, IKEv2) RSA SigVer (SSHv2, TLSv1.2, IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, IKEv2) IPsec/IKEv2 Session Encrypt/Decr ypt IPsec/IKEv2 Session Authenticatio n IPsec/IKEv2 Keying Materials Development DRBG Function"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access G,W,E - IPsec/IKEv2 ECDSA Public Key: G,W,E - IPsec/IKEv2 Pre-Shared Key: G,W,E - SKEYSEED : G,W,E - IPsec/IKEv2 Session Encryption Key: G,W,E - IPsec/IKEv2 Authenticati on Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG",
"secFunImpl": "Functions"
},
{
"description": "Execute SNMPv3 Function.",
"indicator": "Global Indicator and Successfu l SNMPv3 log message.",
"inputs": "API command to execute SNMPv3 service.",
"name": "Run SNMPv3 Functions",
"outputs": "Status of SNMPv3 service.",
"rolesSspAccess": "Key: G,W,E Crypto Officer - SNMPv3 Authenticati on/ Privacy Password: W,E - SNMPv3 Encryption Key: G,W,E - SNMPv3 Authenticati",
"secFunImpl": "SNMPv3 Session Encrypt/Decr ypt SNMPv3 Session Authenticatio n SNMPv3 Keying Materials Development"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "on Key: G,W,E",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC encrypt KAT (A4595)",
"condition": "Power up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC decrypt KAT (A4595)",
"condition": "Power up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM authenticated encrypt KAT (A4595)",
"condition": "Power up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM authenticated decrypt KAT (A4595)",
"condition": "Power up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate/Generate/Res eed KAT (A4595)",
"condition": "Power up",
"details": "Instantiate, Generate, and Reseed KATs",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-4) KAT (A4595)",
"condition": "Power up",
"details": "ECDSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-4) KAT (A4595)",
"condition": "Power up",
"details": "ECDSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Continuous Health Tests",
"condition": "Performed continuous ly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Continuous Health Tests",
"condition": "Performed continuous ly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 224",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A4595)",
"condition": "Power up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve P- 256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A4595)",
"condition": "Power up",
"details": "Primitive Z KAT",
"indicator": "Module is in",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "normal state",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KDF IKEv2 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SNMP KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 4) KAT (A4595)",
"condition": "Power up",
"details": "RSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) KAT (A4595)",
"condition": "Power up",
"details": "RSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A4595)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-4) PCT (A4595)",
"condition": "Performs all required pair-wise consistenc y tests on the newly generated key pairs before the first operationa l use.",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A4595)",
"condition": "Performs all required pair-wise consistenc y tests on",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "the newly generated key pairs before the first operationa l use.",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A4595)",
"condition": "Performs all required pair-wise consistenc y tests on the newly generated key pairs before the first operationa l use.",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186- 4) PCT (A4595)",
"condition": "Performs all required pair-wise consistenc y tests on the newly generated key pairs before the first operationa",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bit modulus",
"type": "PCT"
},
{
"algorithmOrTest": "Conditional Bypass",
"condition": "l use. Performs conditional bypass test before first operationa l use of bypass service",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypas s"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Self-test failure",
"description": "If self-test tests fail, the module is put into an error state.",
"indicator": "System halt",
"name": "Error State",
"recoveryMethod": "Reboot the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "Production grade components"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module is always in the approved mode of operation after initial operations are performed.",
"name": "Approved",
"statusIndicator": "Approved mode indicator: \"FIPS is currently enabled.\"",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Arguments for an API that provide the data to be used for processed by the module.",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "Arguments output from an API call.",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "Arguments for an API call used to control and configure module operation.",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "N/A",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Return values, and/or log messages.",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
},
{
"data": "Provide the Power Supply to the module.",
"logicalInterface": "Power",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "Crypto Officer",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A4595)",
"details": "RSA SigVer",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "RSA 2048 SigVer with SHA2-512",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Pre-Operational Bypass Test",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypass"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via SSHv2 encrypted by GCM",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Public key Output via SSHv2 encrypted by GCM",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Public key Output via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via TLS encrypted by GCM",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Manual",
"entry": "Electronic",
"format": "Encrypted",
"name": "Public key Output via TLS encrypted by GCM",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via TLS encrypted by AES and HMAC",
"sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Public key Output via TLS encrypted by AES and HMAC",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "Module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service",
"method": "Zeroization Command",
"operatorId": "`configure factory- default`",
"rationale": "The zeroization command will erase all SSPs stored in the DRAM and Flash of the module."
},
{
"description": "Zeroization upon session termination",
"method": "Session Termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Zeroization upon rebooting the module",
"method": "Reboot",
"operatorId": "Reboot",
"rationale": "Reboot to zeroize all temporary SSPs stored in volatile memory"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile memory provided by the ESXi host for the module temporary.",
"name": "DRAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile memory provided by the ESXi host for the module to retain memory across power-cycles.",
"name": "Flash",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [
{
"features": "",
"fwVersion": "N/A",
"hwVersion": "1.0",
"modelPartNum": "Intel Xeon Platinum 8160 (Skylake)",
"processors": "Intel Xeon Platinum 8160 (Skylake)"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [
{
"features": "",
"integrityTest": "RSA 2048 SigVer with SHA2-512",
"packageFileName": "asav9-20-3.zip",
"swFwVersion": "9.20(3)"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "UCS C220 M5 SFF Server",
"hypervisorHostOs": "VMware ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS) on VMware ESXi 7.0",
"paa_pai": "Yes",
"processors": "Intel Xeon Platinum 8160 (Skylake)",
"version": "9.20(3)"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "The Module performs Cryptographic Key Generation (CKG) for asymmetric keys as detailed by example 1 in section 4 and section 5 of SP800-133r2"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "UCS C220 M6 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS C220 M7 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS C225 M6 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS C240 M5 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS C240 M6 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS C480 M5 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
},
{
"hardwarePlatform": "UCS-E1100D M6 SFF Server w/ESXi 7.0",
"operatingSystem": "Linux 4 (FX-OS)"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 4
},
"ECDH": {
"ECDH": 79
},
"ECDSA": {
"ECDSA": 76
}
},
"FF": {
"DH": {
"DH": 76,
"Diffie-Hellman": 1
},
"DSA": {
"DSA": 3
}
},
"RSA": {
"RSA 2048": 3
}
},
"certification_process": {
"OutOfScope": {
"from the approved mode of operation. Any firmware that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configure": 1,
"out of scope": 1
}
},
"cipher_mode": {
"GCM": {
"GCM": 56
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 2,
"IKEv2": 71
},
"SSH": {
"SSH": 109,
"SSHv2": 150
},
"TLS": {
"TLS": {
"TLS": 149,
"TLS 1.2": 1,
"TLS v1.2": 6,
"TLSv1.2": 117
}
},
"VPN": {
"VPN": 4
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 6
},
"MAC": {
"MAC": 4
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 54,
"P-384": 56,
"P-521": 56
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 2,
"AES-128": 2,
"AES-192": 1,
"AES-256": 3,
"DRBG 384": 1,
"HMAC-SHA-1": 6,
"HMACSHA-1": 1,
"PKCS 1": 2,
"RSA 2048": 3,
"SHA-1": 5,
"SHA2- 224": 1,
"SHA2- 256": 7,
"SHA2- 384": 1,
"SHA2- 512": 4,
"SHA2-224": 1,
"SHA2-256": 4,
"SHA2-384": 4,
"SHA2-512": 5,
"SHA3- 256": 1
}
},
"fips_security_level": {
"Level": {
"Level 1": 3,
"level 1": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 5
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 80
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 10,
"FIPS 180-4": 5,
"FIPS 186-4": 11,
"FIPS 198-1": 5,
"FIPS186-4": 23
},
"ISO": {
"ISO/IEC 19790": 2
},
"NIST": {
"SP 800-135": 4,
"SP 800-140": 1,
"SP 800-38A": 1,
"SP 800-38D": 1,
"SP 800-52": 1,
"SP 800-56A": 3,
"SP 800-90A": 1
},
"PKCS": {
"PKCS 1": 2
},
"RFC": {
"RFC 3526": 2,
"RFC 4419": 2,
"RFC 5288": 1,
"RFC 7296": 1,
"RFC 7919": 2,
"RFC7627": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 56,
"AES-": 16,
"AES-128": 2,
"AES-192": 1,
"AES-256": 3
},
"CAST": {
"CAST": 48
}
},
"constructions": {
"MAC": {
"HMAC": 53
}
}
},
"tee_name": {
"AMD": {
"PSP": 18
}
},
"tls_cipher_suite": {},
"vendor": {
"Cisco": {
"Cisco": 7,
"Cisco Systems": 1,
"Cisco Systems, Inc": 72
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A4595",
"HMAC-SHA2-384A4595",
"Safe Primes Key GenerationA4595",
"ECDSA KeyGen (FIPS186-4)A4595",
"RSA SigVer (FIPS186-4)A4595",
"SHA2-224A4595",
"HMAC-SHA2-512A4595",
"KDF SSHA4595",
"SHA2-256A4595",
"SHA2-384A4595",
"TLS v1.2 KDF RFC7627A4595",
"HMAC-SHA2-224A4595",
"KDF SNMPA4595",
"AES-CBCA4595",
"HMAC-SHA-1A4595",
"SHA2-512A4595",
"RSA KeyGen (FIPS186-4)A4595",
"ECDSA SigGen (FIPS186-4)A4595",
"KAS-ECC-SSC Sp800-56Ar3A4595",
"KAS-FFC-SSC Sp800-56Ar3A4595",
"SHA-1A4595",
"ECDSA SigVer (FIPS186-4)A4595",
"KDF IKEv2A4595",
"AES-GCMA4595",
"RSA SigGen (FIPS186-4)A4595",
"Counter DRBGA4595"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4595"
]
},
"policy_metadata": {
"/Author": "",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20251216160016-05\u002700\u0027",
"/Creator": "Acrobat PDFMaker 25 for Word",
"/Keywords": "",
"/ModDate": "D:20251216160233-05\u002700\u0027",
"/Producer": "Adobe PDF Library 25.1.201",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 678961,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"mailto:[email protected]"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 68
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "691833850a0cd4275404cde68e5962c50c7c82b92b3253649fc70d4adcd435d2",
"source_hash": "699460b5e7fa913e60b49dbd751f3151a105de835f43645b38f4d2650fde5540",
"txt_hash": "4a1e9b7ba4996701994f21e0b6ff98e9c152aeffe285204544404e378ff475d7"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/December 2025_230126_1053.pdf",
"date_sunset": "2030-12-18",
"description": "Cisco Virtual Adaptive Security Appliances offers the combination of the industry\u0027s most deployed stateful firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications. Delivering robust user and application policy enforcement, multi-vector attack protection, and secure connectivity services in cost-effective, easy-to-deploy solutions.",
"embodiment": "Multi-Chip Stand Alone",
"exceptions": [
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Cisco Adaptive Security Appliance Virtual Cryptographic Module",
"module_type": "Firmware-Hybrid",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-12-19",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Cisco Systems, Inc.",
"vendor_url": "http://www.cisco.com"
}
}