Page 1 of 83
Red Hat, Inc.
Red Hat Enterprise Linux 9 libgcrypt
FIPS 140-3 Non-Proprietary Security Policy
Document Version: 1.5
Last Modified: 06/04/2026
Prepared by:
atsec information security corporation
4516 Seton Center Parkway, Suite 250
Austin, TX 78759
www.atsec.com
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 2 of 83
Table of Contents
List of Tables.............................................................................................................................................4
List of Figures............................................................................................................................................4
1 General.......................................................................................................................................................5
1.1 Overview .............................................................................................................................................5
1.2 Security Levels....................................................................................................................................5
1.3 Additional Information .........................................................................................................................5
2 Cryptographic Module Specification ..........................................................................................................6
2.1 Description ..........................................................................................................................................6
2.2 Tested and Vendor Affirmed Module Version and Identification.........................................................6
2.3 Excluded Components........................................................................................................................7
2.4 Modes of Operation.............................................................................................................................7
2.5 Algorithms ...........................................................................................................................................8
2.6 Security Function Implementations...................................................................................................27
2.7 Algorithm Specific Information ..........................................................................................................32
2.7.1 AES XTS ........................................................................................................................................32
2.7.2 Key Derivation using SP 800-132 PBKDF.....................................................................................32
2.7.3 SHA-3.............................................................................................................................................32
2.7.4 Authenticated Encryption/Decryption.............................................................................................33
2.7.5 SHA-1 Use .....................................................................................................................................33
2.8 RBG and Entropy..............................................................................................................................33
2.9 Key Generation .................................................................................................................................34
2.10 Key Establishment ..........................................................................................................................34
2.11 Industry Protocols ...........................................................................................................................34
3 Cryptographic Module Interfaces .............................................................................................................35
3.1 Ports and Interfaces..........................................................................................................................35
4 Roles, Services, and Authentication ........................................................................................................36
4.1 Authentication Methods.....................................................................................................................36
4.2 Roles .................................................................................................................................................36
4.3 Approved Services............................................................................................................................36
4.4 Non-Approved Services ....................................................................................................................41
4.5 External Software/Firmware Loaded.................................................................................................41
4.6 Additional Information .......................................................................................................................41
5 Software/Firmware Security.....................................................................................................................43
5.1 Integrity Techniques..........................................................................................................................43
5.2 Initiate on Demand............................................................................................................................43
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 3 of 83
6 Operational Environment .........................................................................................................................44
6.1 Operational Environment Type and Requirements...........................................................................44
6.2 Configuration Settings and Restrictions............................................................................................44
6.3 Additional Information .......................................................................................................................44
7 Physical Security......................................................................................................................................45
8 Non-Invasive Security ..............................................................................................................................46
9 Sensitive Security Parameters Management...........................................................................................47
9.1 Storage Areas ...................................................................................................................................47
9.2 SSP Input-Output Methods ...............................................................................................................47
9.3 SSP Zeroization Methods .................................................................................................................47
9.4 SSPs .................................................................................................................................................48
9.5 Transitions.........................................................................................................................................52
10 Self-Tests ...............................................................................................................................................53
10.1 Pre-Operational Self-Tests .............................................................................................................53
10.2 Conditional Self-Tests.....................................................................................................................54
10.3 Periodic Self-Test Information.........................................................................................................68
10.4 Error States .....................................................................................................................................77
10.5 Operator Initiation of Self-Tests ......................................................................................................77
11 Life-Cycle Assurance .............................................................................................................................78
11.1 Installation, Initialization, and Startup Procedures..........................................................................78
11.2 Administrator Guidance...................................................................................................................78
11.3 Non-Administrator Guidance...........................................................................................................78
11.4 End of Life .......................................................................................................................................78
12 Mitigation of Other Attacks.....................................................................................................................79
12.1 Attack List........................................................................................................................................79
12.2 Mitigation Effectiveness ..................................................................................................................79
A Glossary and Abbreviations.....................................................................................................................80
B References ..............................................................................................................................................82
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 4 of 83
List of Tables
Table 1: Security Levels................................................................................................................................5
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)....................7
Table 3: Tested Operational Environments - Software, Firmware, Hybrid ...................................................7
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid....................................7
Table 5: Modes List and Description.............................................................................................................8
Table 6: Approved Algorithms.....................................................................................................................27
Table 7: Vendor-Affirmed Algorithms..........................................................................................................27
Table 8: Non-Approved, Not Allowed Algorithms .......................................................................................27
Table 9: Security Function Implementations...............................................................................................32
Table 10: Entropy Certificates.....................................................................................................................33
Table 11: Entropy Sources..........................................................................................................................33
Table 12: Ports and Interfaces....................................................................................................................35
Table 13: Roles ...........................................................................................................................................36
Table 14: Approved Services......................................................................................................................40
Table 15: Non-Approved Services ..............................................................................................................41
Table 16: Storage Areas .............................................................................................................................47
Table 17: SSP Input-Output Methods .........................................................................................................47
Table 18: SSP Zeroization Methods ...........................................................................................................48
Table 19: SSP Table 1................................................................................................................................50
Table 20: SSP Table 2................................................................................................................................52
Table 21: Pre-Operational Self-Tests .........................................................................................................53
Table 22: Conditional Self-Tests.................................................................................................................68
Table 23: Pre-Operational Periodic Information..........................................................................................69
Table 24: Conditional Periodic Information.................................................................................................76
Table 25: Error States.................................................................................................................................77
List of Figures
Figure 1: Block Diagram................................................................................................................................6
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 5 of 83
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy for version 1.10.0- 8b6840b590cedd43 of
the Red Hat Enterprise Linux 9 libgcrypt. It contains the security rules under which the module must operate
and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal
Information Processing Standards Publication 140-3) for an overall Security Level 1 module.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 1
12 Mitigation of other attacks 1
Overall Level 1
Table 1: Security Levels
1.3 Additional Information
This Security Policy describes the features and design of the module named Red Hat Enterprise Linux 9
libgcrypt using the terminology contained in the FIPS 140-3 specification. The FIPS 140-3 Security
Requirements for Cryptographic Module specifies the security requirements that will be satisfied by a
cryptographic module utilized within a security system protecting sensitive but unclassified information. The
NIST/CCCS Cryptographic Module Validation Program (CMVP) validates cryptographic module to FIPS
140-3. Validated products are accepted by the Federal agencies of both the USA and Canada for the
protection of sensitive or designated information.
This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and intact and
including this notice. Other documentation is proprietary to their authors.
In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for
consolidation without altering the technical statements therein contained. The further refining of the Security
Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy
was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would
also supply additional documentation, which the laboratory formatted into the existing Security Policy, and
resubmitted to the vendor for their final editing.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 6 of 83
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The Red Hat Enterprise Linux 9 libgcrypt (hereafter referred to as “the module”) is a software library
implementing general purpose cryptographic algorithms. The module provides cryptographic services to
applications running in the user space of the underlying operating system through an application program
interface (API).
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Module Characteristics:
Cryptographic Boundary:
The module consists of the shared library file (i.e. libgcrypt.so.20.4.0) which constitutes the cryptographic
boundary. The block diagram in Figure 1 shows the cryptographic boundary of the module, its interfaces
with the operational environment and the flow of information between the module and operator.
Tested Operational Environment’s Physical Perimeter (TOEPP):
The TOEPP of the module is defined as the general-purpose computer on which the module is installed.
Figure 1: Block Diagram
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File Name Software/ Firmware
Version
Features Integrity Test
/usr/lib64/libgcrypt.so.20.4.0 1.10.0-
8b6840b590cedd43
N/A HMAC-SHA-256
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 7 of 83
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Tested Operational Environments - Software, Firmware, Hybrid:
Operating System Hardware
Platform
Processors PAA/PAI Hypervisor
or Host OS
Version(s)
Red Hat Enterprise
Linux 9
Dell
PowerEdge
R440
Intel(R)
Xeon(R) Silver
4216
Yes N/A 1.10.0-
8b6840b590cedd43
Red Hat Enterprise
Linux 9
Dell
PowerEdge
R440
Intel(R)
Xeon(R) Silver
4216
No N/A 1.10.0-
8b6840b590cedd43
Red Hat Enterprise
Linux 9
IBM z16
3931-A01
IBM z16 Yes N/A 1.10.0-
8b6840b590cedd43
Red Hat Enterprise
Linux 9
IBM z16
3931-A01
IBM z16 No N/A 1.10.0-
8b6840b590cedd43
Red Hat Enterprise
Linux 9 with
PowerVM
FW1040.00 with
VIOS 3.1.3.00
IBM 9080-
HEX
IBM
POWER10
Yes N/A 1.10.0-
8b6840b590cedd43
Red Hat Enterprise
Linux 9 with
PowerVM
FW1040.00 with
VIOS 3.1.3.00
IBM 9080-
HEX
IBM
POWER10
No N/A 1.10.0-
8b6840b590cedd43
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
Operating System Hardware
Platform
Red Hat Enterprise Linux 9 Intel(R) Xeon(R) E5
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid
CMVP makes no statement as to the correct operation of the module or the security strengths of the
generated keys when so ported if the specific operational environment is not listed on the validation
certificate.
2.3 Excluded Components
There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.
2.4 Modes of Operation
Modes List and Description:
Mode Name Description Type Status Indicator
Approved
Mode
Automatically entered whenever an
approved service is requested
Approved Equivalent to the indicator of
the requested service
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 8 of 83
Mode Name Description Type Status Indicator
Non-approved
Mode
Automatically entered whenever a non-
approved service is requested
Non-
Approved
Equivalent to the indicator of
the requested service
Table 5: Modes List and Description
Mode Change Instructions and Status:
When the module starts up successfully, after passing all the pre-operational self-test and the cryptographic
algorithms self-tests (CASTs), the module is operating in the approved mode of operation by default and
can only be transitioned into the non-approved mode by calling one of the non-approved services listed in
the non-approved Services table. The module will transition back to approved mode when approved service
is called. Section 4 provides details on the service indicator implemented by the module. The service
indicator identifies when an approved service is called.
Degraded Mode Description:
The module does not implement a degraded mode of operation.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP
Cert
Properties Reference
AES-CBC A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A4675 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A4676 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CCM A3757 Key Length - 128, 192, 256
Tag Length - 112, 128, 32, 48, 64, 80, 96
IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104
Payload Length - Payload Length: 0-256 Increment 8
AAD Length - AAD Length: 0, 256, 65536
SP 800-38C
AES-CCM A3759 Key Length - 128, 192, 256
Tag Length - 112, 128, 32, 48, 64, 80, 96
IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104
Payload Length - Payload Length: 0-256 Increment 8
AAD Length - AAD Length: 0, 256, 65536
SP 800-38C
AES-CCM A3760 Key Length - 128, 192, 256
Tag Length - 112, 128, 32, 48, 64, 80, 96
IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104
Payload Length - Payload Length: 0-256 Increment 8
AAD Length - AAD Length: 0, 256, 65536
SP 800-38C
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 9 of 83
Algorithm CAVP
Cert
Properties Reference
AES-CCM A3762 Key Length - 128, 192, 256
Tag Length - 112, 128, 32, 48, 64, 80, 96
IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104
Payload Length - Payload Length: 0-256 Increment 8
AAD Length - AAD Length: 0, 256, 65536
SP 800-38C
AES-CFB128 A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A4675 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A4676 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A4675 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A4676 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CMAC A3757 Direction - Generation, Verification
Key Length - 128, 192, 256
MAC Length - MAC Length: 128
Message Length - Message Length: 8-524288
Increment 8
SP 800-38B
AES-CMAC A3759 Direction - Generation, Verification
Key Length - 128, 192, 256
MAC Length - MAC Length: 128
Message Length - Message Length: 8-524288
Increment 8
SP 800-38B
AES-CMAC A3760 Direction - Generation, Verification
Key Length - 128, 192, 256
MAC Length - MAC Length: 128
Message Length - Message Length: 8-524288
Increment 8
SP 800-38B
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 10 of 83
Algorithm CAVP
Cert
Properties Reference
AES-CMAC A3762 Direction - Generation, Verification
Key Length - 128, 192, 256
MAC Length - MAC Length: 128
Message Length - Message Length: 8-524288
Increment 8
SP 800-38B
AES-CTR A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-CTR A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-CTR A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-CTR A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-CTR A4675 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-CTR A4676 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 8-128 Increment 8
Supports Counter larger than maximum value - No
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
AES-ECB A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 11 of 83
Algorithm CAVP
Cert
Properties Reference
AES-ECB A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A4675 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A4676 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-KW A3757 Direction - Decrypt, Encrypt
Cipher - Cipher
Key Length - 128, 192, 256
Payload Length - Payload Length: 128-4096 Increment
128
SP 800-38F
AES-KW A3759 Direction - Decrypt, Encrypt
Cipher - Cipher
Key Length - 128, 192, 256
Payload Length - Payload Length: 128-4096 Increment
128
SP 800-38F
AES-KW A3760 Direction - Decrypt, Encrypt
Cipher - Cipher
Key Length - 128, 192, 256
Payload Length - Payload Length: 128-4096 Increment
128
SP 800-38F
AES-KW A3762 Direction - Decrypt, Encrypt
Cipher - Cipher
Key Length - 128, 192, 256
Payload Length - Payload Length: 128-4096 Increment
128
SP 800-38F
AES-OFB A3757 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-OFB A3759 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-OFB A3760 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-OFB A3762 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-XTS
Testing Revision
2.0
A3757 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
AES-XTS
Testing Revision
2.0
A3759 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 12 of 83
Algorithm CAVP
Cert
Properties Reference
AES-XTS
Testing Revision
2.0
A3760 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
AES-XTS
Testing Revision
2.0
A3762 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
AES-XTS
Testing Revision
2.0
A4675 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
AES-XTS
Testing Revision
2.0
A4676 Direction - Decrypt, Encrypt
Key Length - 128, 256
Payload Length - Payload Length: 128-65536 Increment
128
Tweak Mode - Hex
Data Unit Length Matches Payload Length - Yes
SP 800-38E
Counter DRBG A3757 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - AES-128, AES-192, AES-256
Derivation Function Enabled - Yes
Additional Input - Additional Input: 0
Entropy Input - Entropy Input: 128, Entropy Input: 192,
Entropy Input: 256
Nonce - Nonce: 128, Nonce: 64
Personalization String Length - Personalization String
Length: 0
Returned Bits - 1024, 512
SP 800-90A
Rev. 1
Counter DRBG A3759 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - AES-128, AES-192, AES-256
Derivation Function Enabled - Yes
Additional Input - Additional Input: 0
Entropy Input - Entropy Input: 128, Entropy Input: 192,
Entropy Input: 256
Nonce - Nonce: 128, Nonce: 64
Personalization String Length - Personalization String
Length: 0
Returned Bits - 1024, 512
SP 800-90A
Rev. 1
Counter DRBG A3760 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - AES-128, AES-192, AES-256
SP 800-90A
Rev. 1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 13 of 83
Algorithm CAVP
Cert
Properties Reference
Derivation Function Enabled - Yes
Additional Input - Additional Input: 0
Entropy Input - Entropy Input: 128, Entropy Input: 192,
Entropy Input: 256
Nonce - Nonce: 128, Nonce: 64
Personalization String Length - Personalization String
Length: 0
Returned Bits - 1024, 512
Counter DRBG A3762 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - AES-128, AES-192, AES-256
Derivation Function Enabled - Yes
Additional Input - Additional Input: 0
Entropy Input - Entropy Input: 128, Entropy Input: 192,
Entropy Input: 256
Nonce - Nonce: 128, Nonce: 64
Personalization String Length - Personalization String
Length: 0
Returned Bits - 1024, 512
SP 800-90A
Rev. 1
ECDSA KeyGen
(FIPS186-4)
A3757 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen
(FIPS186-4)
A3759 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen
(FIPS186-4)
A3760 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen
(FIPS186-4)
A3761 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen
(FIPS186-4)
A3762 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3757 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3759 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3760 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3761 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer
(FIPS186-4)
A3762 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA SigGen
(FIPS186-4)
A3757 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigGen
(FIPS186-4)
A3759 Component - No
Curve - P-224, P-256, P-384, P-521
FIPS 186-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 14 of 83
Algorithm CAVP
Cert
Properties Reference
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
ECDSA SigGen
(FIPS186-4)
A3760 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigGen
(FIPS186-4)
A3761 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigGen
(FIPS186-4)
A3762 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3757 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3759 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3760 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3761 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-4)
A3762 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384,
SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-4
Hash DRBG A3757 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
SP 800-90A
Rev. 1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 15 of 83
Algorithm CAVP
Cert
Properties Reference
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
Hash DRBG A3759 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
Hash DRBG A3760 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
Hash DRBG A3761 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
Hash DRBG A3762 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
HMAC DRBG A3757 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
SP 800-90A
Rev. 1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 16 of 83
Algorithm CAVP
Cert
Properties Reference
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
HMAC DRBG A3759 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
HMAC DRBG A3760 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
HMAC DRBG A3761 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
HMAC DRBG A3762 Prediction Resistance - No, Yes
Supports Reseed - No
Mode - SHA-1, SHA2-256, SHA2-512
Entropy Input - Entropy Input: 160, Entropy Input: 256
Nonce - Nonce: 160, Nonce: 256
Personalization String Length - Personalization String
Length: 0, 160, Personalization String Length: 0, 256
Additional Input - Additional Input: 0, 160, Additional
Input: 0, 256
Returned Bits - 320, 512, 768
SP 800-90A
Rev. 1
HMAC-SHA-1 A3757 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA-1 A3758 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 17 of 83
Algorithm CAVP
Cert
Properties Reference
HMAC-SHA-1 A3759 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA-1 A3760 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA-1 A3761 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA-1 A3762 MAC - MAC: 160
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
224
A3757 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
224
A3759 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
224
A3760 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
224
A3761 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
224
A3762 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A3757 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A3759 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A3760 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A3761 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A3762 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A3757 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A3759 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A3760 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A3761 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A3762 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512
A3757 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 18 of 83
Algorithm CAVP
Cert
Properties Reference
HMAC-SHA2-
512
A3759 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512
A3760 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512
A3761 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512
A3762 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/224
A3757 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/224
A3759 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/224
A3760 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/224
A3761 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/224
A3762 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/256
A3757 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/256
A3759 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/256
A3760 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/256
A3761 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA2-
512/256
A3762 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
224
A3757 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
224
A3761 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
224
A3762 MAC - MAC: 224
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
256
A3757 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
256
A3761 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
256
A3762 MAC - MAC: 256
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 19 of 83
Algorithm CAVP
Cert
Properties Reference
HMAC-SHA3-
384
A3757 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
384
A3761 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
384
A3762 MAC - MAC: 384
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
512
A3757 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
512
A3761 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
HMAC-SHA3-
512
A3762 MAC - MAC: 512
Key Length - Key Length: 112-524288 Increment 8
FIPS 198-1
PBKDF A3757 Iteration Count - Iteration Count: 1000-10000000
Increment 1
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256,
SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
Key Data Length - Key Data Length: 128-4096
Increment 8
SP 800-132
PBKDF A3759 Iteration Count - Iteration Count: 1000-10000000
Increment 1
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256,
SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
Key Data Length - Key Data Length: 128-4096
Increment 8
SP 800-132
PBKDF A3760 Iteration Count - Iteration Count: 1000-10000000
Increment 1
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256,
SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
Key Data Length - Key Data Length: 128-4096
Increment 8
SP 800-132
PBKDF A3761 Iteration Count - Iteration Count: 1000-10000000
Increment 1
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256,
SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
SP 800-132
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 20 of 83
Algorithm CAVP
Cert
Properties Reference
Key Data Length - Key Data Length: 128-4096
Increment 8
PBKDF A3762 Iteration Count - Iteration Count: 1000-10000000
Increment 1
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256,
SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256,
SHA3-224, SHA3-256, SHA3-384, SHA3-512
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
Key Data Length - Key Data Length: 128-4096
Increment 8
SP 800-132
RSA KeyGen
(FIPS186-4)
A3757 Key Generation Mode - B.3.3
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Info Generated By Server - No
Public Exponent Mode - Random
Private Key Format - Standard
FIPS 186-4
RSA KeyGen
(FIPS186-4)
A3759 Key Generation Mode - B.3.3
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Info Generated By Server - No
Public Exponent Mode - Random
Private Key Format - Standard
FIPS 186-4
RSA KeyGen
(FIPS186-4)
A3760 Key Generation Mode - B.3.3
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Info Generated By Server - No
Public Exponent Mode - Random
Private Key Format - Standard
FIPS 186-4
RSA KeyGen
(FIPS186-4)
A3761 Key Generation Mode - B.3.3
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Info Generated By Server - No
Public Exponent Mode - Random
Private Key Format - Standard
FIPS 186-4
RSA KeyGen
(FIPS186-4)
A3762 Key Generation Mode - B.3.3
Modulo - 2048, 3072, 4096
Primality Tests - Table C.2
Info Generated By Server - No
Public Exponent Mode - Random
Private Key Format - Standard
FIPS 186-4
RSA SigGen
(FIPS186-4)
A3757 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigGen
(FIPS186-4)
A3759 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
FIPS 186-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 21 of 83
Algorithm CAVP
Cert
Properties Reference
Hash Pair -
Hash Algorithm - SHA2-224
RSA SigGen
(FIPS186-4)
A3760 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigGen
(FIPS186-4)
A3761 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigGen
(FIPS186-4)
A3762 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigVer
(FIPS186-2)
A3757 Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 1536
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
FIPS 186-4
RSA SigVer
(FIPS186-2)
A3759 Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 1536
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
FIPS 186-4
RSA SigVer
(FIPS186-2)
A3760 Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 1536
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
FIPS 186-4
RSA SigVer
(FIPS186-2)
A3761 Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 1536
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
FIPS 186-4
RSA SigVer
(FIPS186-2)
A3762 Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 1536
Hash Pair -
FIPS 186-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 22 of 83
Algorithm CAVP
Cert
Properties Reference
Hash Algorithm - SHA2-224
Salt Length - 28
RSA SigVer
(FIPS186-4)
A3757 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer
(FIPS186-4)
A3759 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer
(FIPS186-4)
A3760 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer
(FIPS186-4)
A3761 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer
(FIPS186-4)
A3762 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Salt Length - 28
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
SHA-1 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA-1 A3758 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA-1 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 23 of 83
Algorithm CAVP
Cert
Properties Reference
SHA-1 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA-1 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA-1 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A4675 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 24 of 83
Algorithm CAVP
Cert
Properties Reference
SHA2-256 A4676 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A4675 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A4676 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/224 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 25 of 83
Algorithm CAVP
Cert
Properties Reference
SHA2-512/224 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/224 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/224 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/224 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/256 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/256 A3759 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/256 A3760 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/256 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512/256 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA3-224 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-224 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-224 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-256 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-256 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 26 of 83
Algorithm CAVP
Cert
Properties Reference
SHA3-256 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-384 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-384 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-384 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-512 A3757 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-512 A3761 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHA3-512 A3762 Message Length - Message Length: 0-65536 Increment
8
Large Message Sizes - 1, 2, 4, 8
FIPS 202
SHAKE-128 A3757 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
SHAKE-128 A3761 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
SHAKE-128 A3762 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
SHAKE-256 A3757 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
SHAKE-256 A3761 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
SHAKE-256 A3762 Supports Bit-Oriented Messages - No
Supports Empty Message - Yes
Supports Bit-Oriented Output - No
Output Length - Output Length: 16-65536 Increment 8
FIPS 202
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 27 of 83
Table 6: Approved Algorithms
The above table lists all approved cryptographic algorithms of the module, including specific key lengths
employed for approved services, and implemented modes or methods of operation of the algorithms.
Vendor-Affirmed Algorithms:
Name Properties Implementation Reference
Cryptographic Key
Generation (CKG)
Key
Type:Asymmetric
N/A SP 800-133r2, section 4,
example 1
Table 7: Vendor-Affirmed Algorithms
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
Name Use and Function
MD5 Message Digest
ECDH Shared Secret Computation
AES-GCM, AES-GCM-SIV, AES-OCB, AES-EAX Symmetric encryption and decryption
RSA Signature Primitives Signature generation/verification
primitives
RSA Encrypt/Decrypt Primitives Encryption/decryption primitives
RSA Key Gen using public key flags not listed in section
4.8
Key generation
RSA Sig Gen using public key flags not listed in section 4.8 Signature generation/verification
ECDSA Signature generation/verification
primitives
ECDSA Key Gen using public key flags not listed in section
4.8
Key generation
ECDSA Sig Gen using public key flags not listed in section
4.8
Signature generation/verification
Table 8: Non-Approved, Not Allowed Algorithms
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Encryption BC-UnAuth Encryption using
AES
AES-CBC:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-CFB128:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 28 of 83
Name Type Description Properties Algorithms
AES-CFB8:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-CTR:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-ECB:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-OFB:
(A3757, A3759,
A3760, A3762)
AES-XTS Testing
Revision 2.0:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
Decryption BC-UnAuth Decryption using
AES
AES-CBC:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-CFB128:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-CFB8:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-CTR:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-ECB:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
AES-OFB:
(A3757, A3759,
A3760, A3762)
AES-XTS Testing
Revision 2.0:
(A3757, A3759,
A3760, A3762,
A4675, A4676)
Message
authentication
CMAC
MAC Message
Authentication
Code Generation,
Message
AES-CMAC:
(A3757, A3759,
A3760, A3762)
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 29 of 83
Name Type Description Properties Algorithms
Authentication
Code Verification
Authenticated
encryption
BC-Auth Encryption AES-KW: (A3757,
A3759, A3760,
A3762)
AES-CCM:
(A3757, A3759,
A3760, A3762)
Authenticated
decryption
BC-Auth Decryption AES-KW: (A3757,
A3759, A3760,
A3762)
AES-CCM:
(A3757, A3759,
A3760, A3762)
Random number
generation
DRBG Random number
generation
Counter DRBG:
(A3757, A3759,
A3760, A3762)
HMAC DRBG:
(A3757, A3759,
A3760, A3761,
A3762)
Hash DRBG:
(A3757, A3759,
A3760, A3761,
A3762)
Key pair
generation
CKG Key Pair
Generation
ECDSA KeyGen
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
RSA KeyGen
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
Cryptographic Key
Generation
(CKG): ()
Key Pair
verification
AsymKeyPair-
KeyVer
Key Pair
verification
ECDSA KeyVer
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
Signature
generation
DigSig-SigGen Signature
Generation
ECDSA SigGen
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
RSA SigGen
(FIPS186-4):
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 30 of 83
Name Type Description Properties Algorithms
(A3757, A3759,
A3760, A3761,
A3762)
Signature
Verification
DigSig-SigVer Signature
Verification
ECDSA SigVer
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
RSA SigVer
(FIPS186-4):
(A3757, A3759,
A3760, A3761,
A3762)
RSA SigVer
(FIPS186-2):
(A3757, A3759,
A3760, A3761,
A3762)
Message
authentication
HMAC
MAC Message
Authentication
Code Generation,
Message
Authentication
Code Verification
HMAC-SHA-1:
(A3757, A3758,
A3759, A3760,
A3761, A3762)
HMAC-SHA2-224:
(A3757, A3759,
A3760, A3761,
A3762)
HMAC-SHA2-256:
(A3757, A3759,
A3760, A3761,
A3762)
HMAC-SHA2-384:
(A3757, A3759,
A3760, A3761,
A3762)
HMAC-SHA2-512:
(A3757, A3759,
A3760, A3761,
A3762)
HMAC-SHA2-
512/224: (A3757,
A3759, A3760,
A3761, A3762)
HMAC-SHA2-
512/256: (A3757,
A3759, A3760,
A3761, A3762)
HMAC-SHA3-224:
(A3757, A3761,
A3762)
HMAC-SHA3-256:
(A3757, A3761,
A3762)
HMAC-SHA3-384:
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 31 of 83
Name Type Description Properties Algorithms
(A3757, A3761,
A3762)
HMAC-SHA3-512:
(A3757, A3761,
A3762)
Password Based
Key Derivation
PBKDF Password Based
Key Derivation
PBKDF: (A3757,
A3759, A3760,
A3761, A3762)
Message Digest SHA Message Digest SHA-1: (A3757,
A3758, A3759,
A3760, A3761,
A3762)
SHA2-224:
(A3757, A3759,
A3760, A3761,
A3762)
SHA2-256:
(A3757, A3759,
A3760, A3761,
A3762, A4675,
A4676)
SHA2-384:
(A3757, A3759,
A3760, A3761,
A3762)
SHA2-512:
(A3757, A3759,
A3760, A3761,
A3762, A4675,
A4676)
SHA2-512/224:
(A3757, A3759,
A3760, A3761,
A3762)
SHA2-512/256:
(A3757, A3759,
A3760, A3761,
A3762)
SHA3-224:
(A3757, A3761,
A3762)
SHA3-256:
(A3757, A3761,
A3762)
SHA3-384:
(A3757, A3761,
A3762)
SHA3-512:
(A3757, A3761,
A3762)
SHAKE-128:
(A3757, A3761,
A3762)
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 32 of 83
Name Type Description Properties Algorithms
SHAKE-256:
(A3757, A3761,
A3762)
Table 9: Security Function Implementations
2.7 Algorithm Specific Information
2.7.1 AES XTS
The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 220 AES blocks, that
is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E.
To meet the requirement stated in IG C.I, the module implements a check to ensures, before performing
any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. As the module
does not generate symmetric keys, the check is performed when keys are input the service APIs.
AES-XTS keys (i.e., Key_1 and Key_2) entered into the module shall be generated and/or established
independently according to NIST SP 800-133rev2, Section 6.3 for an approved use of AES-XTS.
The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not
be used for other purposes, such as the encryption of data in transit.
2.7.2 Key Derivation using SP 800-132 PBKDF
The module provides password-based key derivation (PBKDF), compliant with SP 800-132. The module
supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used
directly as the Data Protection Key (DPK). In accordance with SP 800-132 and FIPS 140-3 IG D.N, the
following requirements shall be met:
• Derived keys shall only be used in storage applications. The MK shall not be used for other
purposes. The module accepts a minimum length of 112 bits for the MK or DPK.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic
keys.
• The length of the password or passphrase shall be at least 8 characters, and shall consist of
lowercase, uppercase, and numeric characters. The probability of guessing the value is estimated
to be at most 10-8. Combined with the minimum iteration count as described below, this provides
an acceptable trade-off between user experience and security against brute-force attacks.
• A portion of the salt, with a length of at least 128 bits (this is verified by the module to determine
the service is approved), shall be generated randomly using the SP 800-90Ar1 DRBG provided by
the module.
• The iteration count shall be selected as large as possible, as long as the time required to generate
the key using the entered password is acceptable for the users. The module only allows minimum
iteration count to be 1000.
The calling application shall also observe the rest of the requirements and recommendations specified in
[SP800-132].
2.7.3 SHA-3
The module provides SHA-3 hash functions and SHAKE functions compliant with IG C.C. Every
implementation of each SHA-3 functions and SHAKE functions were tested and validated on all the
module’s operating environments. SHA-3 hash functions are also used as part of a higher-level algorithm
for HMAC.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 33 of 83
2.7.4 Authenticated Encryption/Decryption
The module does not establish SSP’s using an approved key transport scheme (KTS). However, it does
offer approved authenticated algorithms that can be used by an external operator /application as part of an
approved KTS.
2.7.5 SHA-1 Use
SHA-1 is non-approved for digital signature generation and deprecated through December 31, 2030, for
non-digital signature applications.
Within the module services, the use of SHA-1 is only approved when used in approved modes for
message digest, HMAC, Hash DRBG, HMAC DRBG, and PBKDF.
2.8 RBG and Entropy
Cert
Number
Vendor
Name
E47 Red Hat, Inc.
Table 10: Entropy Certificates
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
RHEL
Userspace
CPU Time
Jitter RNG
Entropy
Source
Non-
Physical
Red Hat Enterprise Linux 9 running
on Dell PowerEdge R440 with
Intel(R) Xeon(R) Silver 4216; Red
Hat Enterprise Linux 9 running on
IBM z16 3931-A01 with IBM z16;
Red Hat Enterprise Linux 9 with
PowerVM FW1040.00 with VIOS
3.1.3.00 running on IBM 9080-HEX
with IBM POWER10
256-bits 238-bits HMAC-SHA2-
512 DRBG
Table 11: Entropy Sources
The Module provides an SP800-90A-compliant Deterministic Random Bit Generator (DRBG) for creation
of key components of asymmetric keys, and random number generation.
The seeding (and automatic reseeding) of the DRBG is done with getrandom().
The module supports the Hash_DRBG, HMAC_DRBG and CTR_DRBG. The DRBG is initialized during
module initialization; the module loads by default the DRBG using the HMAC_DRBG mechanism with SHA-
256 and without prediction resistance. A different DRBG mechanism can be chosen by invoking the
gcry_control(GCRYCTL_DRBG_REINIT) function.
The module uses an [SP800-90B]-compliant entropy source specified in the above table. This entropy
source is located within the module’s physical perimeter but outside of the module’s cryptographic
boundary. The module obtains 384 bits to seed the DRBG and 256 bits to reseed it, respectively
corresponding to 337 bits of entropy for seeding and 225 bits for reseeding, which is not full entropy.
Therefore, the module generates SSPs (e.g., keys) whose strengths are modified by available entropy.
The module performs the DRBG health tests as defined in Section 11.3 of [SP800-90A].
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 34 of 83
2.9 Key Generation
The module provides an [SP800-90Arev1]-compliant Deterministic Random Bit Generator (DRBG) for the
creation of key components of asymmetric keys, and random number generation.
The Cryptographic Key Generation (CKG) methods implemented in the module for Approved services in
approved mode are compliant with section 5.1 of [SP800-133rev2] and with IG D.H. For generating RSA
and ECDSA keys the module implements asymmetric key generation services compliant with [FIPS186-4].
A seed (i.e., the random value) used in asymmetric key generation is directly obtained from the [SP800-
90Arev1] DRBG.
Intermediate key generation values are not output from the module and are explicitly zeroized after
processing the service.
2.10 Key Establishment
The module does not implement any key establishment methods/services.
2.11 Industry Protocols
The module does not implement industry protocols, therefore this section is not applicable.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 35 of 83
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Data Input API input parameters for data.
N/A Data Output API output parameters for data.
N/A Control Input API function calls, API input parameters for control input,
/proc/sys/crypto/fips_enabled control file.
N/A Status
Output
API return codes, API output parameters for status output.
Table 12: Ports and Interfaces
As a software-only module, the module does not have physical ports. The operator can only interact with
the module through the API provided by the module. Thus, the physical ports are interpreted to be the
physical ports of the hardware platform on which the module runs.
All data output via data output interface is inhibited when the module is performing pre- operational test or
zeroization or when the module enters error state.
The module does not implement a control output interface.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 36 of 83
4 Roles, Services, and Authentication
4.1 Authentication Methods
The module does not implement any authentication methods.
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Role CO None
Table 13: Roles
The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the
operator of the module. No support is provided for multiple concurrent operators.
4.3 Approved Services
Name Description Indicator Inputs Outpu
ts
Securit
y
Functio
ns
SSP
Acces
s
Symmetric
encryption and
decryption
Encrypt a
plaintext /
Decrypt a
ciphertext
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_CIPHE R, ...)
returns
GPG_ERR_NO_ER
ROR
AES key,
plaintext/ci
phertext
Cipher
text/
plainte
xt
Encrypti
on
Decrypti
on
Authenti
cated
encrypti
on
Authenti
cated
decrypti
on
Crypto
Officer
- AES
keys:
W,E
Key Pair
Generation with
RSA
Generate a key
pair
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) returns
GPG_ERR_NO_ER
ROR
Modulus
bits
RSA
public
key,
RSA
private
key
Key pair
generati
on
Crypto
Officer
- RSA
Private
Key:
G,R
- RSA
Public
Key:
G,R
-
Interme
diate
key
generat
ion
value:
G,E,Z
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 37 of 83
Name Description Indicator Inputs Outpu
ts
Securit
y
Functio
ns
SSP
Acces
s
Key Pair
Generation with
ECDSA
Generate a key
pair
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) returns
GPG_ERR_NO_ER
ROR
Curve ECDS
A
public
key,
ECDS
A
private
key
Key pair
generati
on
Crypto
Officer
-
ECDS
A
Private
Key:
G,R
-
ECDS
A
Public
Key:
G,R
-
Interme
diate
key
generat
ion
value:
G,E,Z
Digital signature
generation with
RSA
Generate a
signature
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) and
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MD, ...) return
GPG_ERR_NO_ER
ROR
RSA
private
key,
message
Signat
ure
Signatur
e
generati
on
Crypto
Officer
- RSA
Private
Key:
W,E
Digital signature
generation with
ECDSA
Generate a
signature
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) and
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MD, ...) return
GPG_ERR_NO_ER
ROR
ECDSA
private
key,
message
Signat
ure
Signatur
e
generati
on
Crypto
Officer
-
ECDS
A
Private
Key:
W,E
Digital signature
verification with
RSA
Verify a
signature
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) and
RSA public
key,
message,
signature
Pass/f
ail
Signatur
e
Verificat
ion
Crypto
Officer
- RSA
Public
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 38 of 83
Name Description Indicator Inputs Outpu
ts
Securit
y
Functio
ns
SSP
Acces
s
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MD, ...) return
GPG_ERR_NO_ER
ROR
Key:
W,E
Digital signature
verification with
ECDSA
Verify a
signature
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_PK_FLA GS,
...) and
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MD, ...) return
GPG_ERR_NO_ER
ROR
ECDSA
public key,
message,
signature
Pass/f
ail
Signatur
e
Verificat
ion
Crypto
Officer
-
ECDS
A
Public
Key:
W,E
Public key
verification
Verify ECDSA
public key
gcry_mpi_ec_curve
_point() returns
GPG_ERR_NO_ER
ROR
ECDSA
public key
Pass/f
ail
Key Pair
verificati
on
Crypto
Officer
-
ECDS
A
Public
Key:
W,E
Random
Number
Generation with
CTR_DRBG/HM
AC_DRBG
Generate
random
bitstrings from
CTR_DRBG/HM
AC_DRBG
gcry_randomize(),
gcry_random_bytes
(),
gcry_random_bytes
_secure() return
GPG_ERR_NO_ER
ROR
Output
length
Rando
m
bytes
Random
number
generati
on
Crypto
Officer
-
Entrop
y Input:
W,E
-
DRBG
seed:
G,E
-
DRBG
internal
state
(V
value,
Key):
G,W,E
Random
Number
Generation with
Hash_DRBG
Generate
random
bitstrings from
Hash_DRBG
gcry_randomize(),
gcry_random_bytes
(),
gcry_random_bytes
_secure() return
Output
length
Rando
m
bytes
Random
number
generati
on
Crypto
Officer
-
Entrop
y Input:
W,E
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 39 of 83
Name Description Indicator Inputs Outpu
ts
Securit
y
Functio
ns
SSP
Acces
s
GPG_ERR_NO_ER
ROR
-
DRBG
seed:
G,E
-
DRBG
internal
state
(V
value,
C
value):
G,W,E
Message digest Compute SHA
hashes
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MD, ...) returns
GPG_ERR_NO_ER
ROR
Message Digest
value
Messag
e Digest
Crypto
Officer
Message
authentication
code (MAC) with
HMAC
Compute HMAC gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MAC, .. .)
returns
GPG_ERR_NO_ER
ROR
HMAC key MAC
tag
Messag
e
authenti
cation
HMAC
Crypto
Officer
-
HMAC
keys:
W,E
Message
authentication
code (MAC) with
CMAC
Compute AES-
based CMAC
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_MAC, .. .)
returns
GPG_ERR_NO_ER
ROR
AES key MAC
tag
Messag
e
authenti
cation
CMAC
Crypto
Officer
- AES
keys:
W,E
Key derivation Perform key
derivation
gcry_control(GCRY
CTL_FIPS_
SERVICE_INDICAT
OR_KDF, ... )
returns
GPG_ERR_NO_ER
ROR
Password,
salt,
iteration
count
Derive
d key
Passwo
rd
Based
Key
Derivati
on
Crypto
Officer
-
Passw
ord or
passph
rase:
W,E
-
Derive
d key:
G,R
On-demand
Integrity test
Perform on-
demand integrity
test
N/A N/A Pass/f
ail
Messag
e
authenti
Crypto
Officer
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 40 of 83
Name Description Indicator Inputs Outpu
ts
Securit
y
Functio
ns
SSP
Acces
s
cation
HMAC
Show status Show module
status
N/A N/A Modul
e
status
None Crypto
Officer
Zeroization Zeroize all SSPs N/A Any SSP N/A None Crypto
Officer
Self-tests Perform self-
tests
N/A N/A Pass/f
ail
None Crypto
Officer
Show module
name and
version
Show module
name and
version
N/A N/A Modul
e
name
and
versio
n
inform
ation
None Crypto
Officer
Table 14: Approved Services
The table above lists the approved services. For each service, the table lists the associated cryptographic
algorithm(s), the role to perform the service, the cryptographic keys or CSPs involved, and their access
type(s). The following convention is used to specify access rights to a CSP:
• G = Generate: The module generates or derives the SSP.
• R = Read: The SSP is read from the module (e.g., the SSP is output).
• W = Write: The SSP is updated, imported, or written to the module.
• E = Execute: The module uses the SSP in performing a cryptographic operation.
• Z = Zeroise: The module zeroises the SSP.
• N/A: the calling application does not access any CSP or key during its operation.
The details of the approved cryptographic algorithms including the CAVP certificate numbers can be found
in the Approved Algorithm table. In order to check whether it utilizes an approved security function or not,
the operator is responsible to invoke the gcry_control() API along with dedicated controls in the form of API
input parameters.
The module implements the following controls depending on the requested service:
1. GCRYCTL_FIPS_SERVICE_INDICATOR_CIPHER - For symmetric algorithms and the related
modes.
2. GCRYCTL_FIPS_SERVICE_INDICATOR_KDF - For KDF operations.
3. GCRYCTL_FIPS_SERVICE_INDICATOR_PK_FLAGS - For asymmetric operations.1
4. GCRYCTL_FIPS_SERVICE_INDICATOR_MD - For digest operations.
5. GCRYCTL_FIPS_SERVICE_INDICATOR_MAC - For MAC operations.
1 The list of public key flags allowed in approved mode of operation is described in Section 4.6 Additional Information.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 41 of 83
In addition to that, for the below-mentioned services, the approved service indicator corresponds to the
GPG_ERR_NO_ERROR returned from listed functions in the indicator column below. They don’t use
gcry_control() API:
1. Random number generation service: gcry_randomize(), gcry_random_bytes(),
gcry_random_bytes_secure().
2. Public key validation service: gcry_mpi_ec_curve_point().
For all approved services, GPG_ERR_NO_ERROR (i.e., “0”) return code indicates the service is approved.
In case the above-mentioned controls are used in conjunction, the operator is responsible to check that all
of the called functions return GPG_ERR_NO_ERROR (i.e., “0”). For all non-approved services, "non-zero"
return code indicates the service is not approved.
4.4 Non-Approved Services
Name Description Algorithms Role
Symmetric
encryption/decryption
AES encryption/decryption using
non-approved AES modes
AES-GCM, AES-GCM-
SIV, AES-OCB, AES-EAX
CO
Message digest Non-approved message digest MD5 CO
Shared Secret Computation ECDH Shared Secret Computation ECDH CO
Key generation with RSA Generate RSA key pairs using
public key flags not listed in section
4.8.
RSA Key Gen using
public key flags not listed
in section 4.8
RSA Sig Gen using public
key flags not listed in
section 4.8
CO
Key generation with ECDSA Generate ECDSA key pairs using
public key flags not listed in section
4.8.
ECDSA Key Gen using
public key flags not listed
in section 4.8
ECDSA Sig Gen using
public key flags not listed
in section 4.8
CO
Digital signature
generation/verification with
RSA
Generate/verify a signature using
RSA Signature
generation/verification primitives
RSA Signature Primitives CO
Digital signature
generation/verification with
ECDSA
Generate/verify a signature using
ECDSA Signature
generation/verification primitives
ECDSA CO
Asymmetric
encryption/decryption
Perform encryption/decryption
using RSA encryption/decryption
primitives
RSA Encrypt/Decrypt
Primitives
CO
Table 15: Non-Approved Services
4.5 External Software/Firmware Loaded
The module does not have the capability of loading software or firmware from an external source.
4.6 Additional Information
Below are listed the approved public key flags for an input s-expression:
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 42 of 83
curve d data e ecdsa flags sig-val
genkey hash n nbits pkcs1 private-key value
pss public-key q r raw rsa salt-length
rsa-use-e s
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 43 of 83
5 Software/Firmware Security
5.1 Integrity Techniques
The integrity of the module is verified comparing the HMAC-SHA-256 value calculated at run time with the
HMAC-SHA-256 value embedded in the module’s ELF header that was computed at build time for each
software component of the module. If the HMAC values do not match, the test fails and the module enters
the error state.
5.2 Initiate on Demand
Integrity tests are performed as part of the Pre-Operational Self-Tests.
The module provides the Self-Test service to perform self-tests on demand which includes the pre-
operational tests (i.e., integrity test) and cryptographic algorithm self-tests (CASTs). This service can be
invoked relying on the gcry_control(GCRYCTL_SELFTEST) API function call or by powering-off and
reloading the module. During the execution of the on-demand self-tests, services are not available, and no
data output or input is possible.
In order to verify whether the self-tests have succeeded and the module is in the Operational state, the
calling application may invoke the gcry_control(GCRYCTL_OPERATIONAL_P). The function will return
TRUE if the module is in the operational state, FALSE if the module is in the Error state.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 44 of 83
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Modifiable
How Requirements are Satisfied:
The module should be compiled and installed as stated in section 11. The user should confirm that the
module is installed correctly by running:
1. fips-mode-setup --check command to verify that the system is operating in Approved mode
2. check the output of the gcry_get_config() API, which should output Red Hat Enterprise Linux 9
libgcrypt 1.10.0-8b6840b590cedd43
The module does not support concurrent operators.
6.2 Configuration Settings and Restrictions
Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other
tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the
operational environment. The use of any of these tools implies that the cryptographic module is running in
a non-validated operational environment.
6.3 Additional Information
The module shall be installed as stated in Section 11. If properly installed, the operating system provides
process isolation and memory protection mechanisms that ensure appropriate separation for memory
access among the processes on the system. Each process has control over its own data and uncontrolled
access to the data of other processes is prevented.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 45 of 83
7 Physical Security
The module is comprised of software only and therefore this section is not applicable.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 46 of 83
8 Non-Invasive Security
This module does not implement any non-invasive security mechanism and therefore this section is not
applicable.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 47 of 83
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description Persistence
Type
RAM Temporary storage for SSPs used by the module as part of service
execution. The module does not perform persistent storage of SSPs
Dynamic
Table 16: Storage Areas
The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in
plaintext form. SSPs are provided to the module by the calling process and are destroyed when released
by the appropriate zeroization function calls.
9.2 SSP Input-Output Methods
Name From To Format
Type
Distribution
Type
Entry
Type
SFI or
Algorithm
API input
parameters
(plaintext)
Calling
application
within TOEPP
Cryptographic
module
Plaintext Manual Electronic
API output
parameters
(plaintext)
Cryptographic
module
Calling
application
within TOEPP
Plaintext Manual Electronic
Table 17: SSP Input-Output Methods
The module does not support manual SSP entry or intermediate SSP generation output. The SSPs are
provided to the module via API input parameters in plaintext form and output via API output parameters in
plaintext form within the physical perimeter of the operational environment. This is allowed by [FIPS140-
3_IG] 9.5.A, according to the “CM Software to/from App via TOEPP Path” entry on the Key Establishment
Table.
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator Initiation
Wipe and
Free memory
block
allocated
Zeroizes the
SSPs contained
within the cipher
handle.
Memory occupied by
SSPs is overwritten with
zeroes and then it is
released, which renders
the SSP values
irretrievable. The
completion of the
zeroization routine
indicates that the
zeroization procedure
succeeded.
By calling the cipher related zeroization
API which are the following:
gcry_free(), gcry_cipher_close(),
gcry_mac_close(),
gcry_sexp_release(),
gcry_mpi_release(), gcry_ctx_release(),
gcry_mpi_point_release(),
gcry_ctrl(GCRYCTL_TE
RM_SECMEM)
Automatic Automatically
zeroized by the
Memory occupied by
SSPs is overwritten with
N/A
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 48 of 83
Zeroization
Method
Description Rationale Operator Initiation
module when
no longer
needed
zeroes, which renders
the SSP values
irretrievable.
Module
Reset
De-allocates the
volatile memory
used to store
SSPs
Volatile memory used by
the module is overwritten
within nanoseconds
when power is removed.
By unloading and reloading the module
Table 18: SSP Zeroization Methods
The memory occupied by SSPs is allocated by regular memory allocation operating system calls. The
application that is acting as the CO is responsible for calling the appropriate zeroization functions provided
in the module's API and listed in the above table. Calling gcry_free(), which will zeroize the SSPs and also
invoke the corresponding API functions listed in the above table to zeroize SSPs. The zeroization functions
overwrite the memory occupied by SSPs with “zeros” and deallocate the memory with the regular memory
deallocation operating system call. In case of abnormal termination, or swap in/out of a physical memory
page of a process, the keys in physical memory are overwritten by the Linux kernel before the physical
memory is allocated to another process. The completion of a zeroization routine(s) will indicate that a
zeroization procedure succeeded.
9.4 SSPs
Name Description Size - Strength Type -
Category
Generate
d By
Establishe
d By
Used By
AES keys AES key
used for
encryption,
decryption,
and
computing
MAC tags
AES-XTS: 128,
256; Other
modes: 128,
192, 256 - AES-
XTS: 128, 256;
Other modes:
128, 192, 256
Symmetric
key - CSP
Encryption
Decryption
Authenticate
d encryption
Authenticate
d decryption
Message
authenticatio
n CMAC
HMAC
keys
HMAC key
used for
computing
MAC tags
112-256 bits -
112-256 bits
Symmetric
key - CSP
Message
authenticatio
n HMAC
RSA
Private Key
Private key
used for
RSA
signature
generation
2048, 3072,
4096 bits - 112,
128, 149 bits
Private key
- CSP
Key pair
generatio
n
Signature
generation
RSA Public
Key
Public key
used for
RSA
signature
verification
2048, 3072,
4096 bits bits -
112, 128, 149
bits
Public key
- PSP
Key pair
generatio
n
Signature
Verification
ECDSA
Private Key
Private key
used for
ECDSA
P-224, P-256,
P-384, P-521 -
Private key
- CSP
Key pair
generatio
n
Key Pair
verification
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 49 of 83
Name Description Size - Strength Type -
Category
Generate
d By
Establishe
d By
Used By
signature
generation
112, 128, 192,
256 bits
Signature
generation
ECDSA
Public Key
Public key
used for
ECDSA
signature
verification
P-224, P-256,
P-384, P-521 -
112, 128, 192,
256 bits
Public key
- PSP
Key pair
generatio
n
Signature
Verification
Intermediat
e key
generation
value
Intermediate
key pair
generation
value
generated
during key
generation
and key
derivation
services (SP
800-133r2
Section 4,
5.1, and 5.2)
112-256 - 112-
256 bits
Intermediat
e value -
CSP
Key pair
generatio
n
Key pair
generation
Password
or
passphras
e
Password
used to
derive
symmetric
keys
Minimum of 8
character - N/A
Password -
CSP
Password
Based Key
Derivation
Derived
key
Symmetric
key derived
from a key
derivation
key, shared
secret, or
password
112-4096 bits -
112-256 bits
Symmetric
key - CSP
Password
Based
Key
Derivation
Entropy
Input
Entropy input
used to seed
the DRBG
(IG D.L
compliant)
128-384 bits -
112-337 bits
Entropy
input - CSP
Random
number
generation
DRBG
internal
state (V
value, C
value)
Internal state
of the
Hash_DRBG
(IG D.L
compliant)
880, 1776 bits -
128, 256 bits
Internal
state - CSP
Random
number
generatio
n
Random
number
generation
DRBG
internal
state (V
value, Key)
Internal state
of the
CTR_DRBG
and
HMAC_DRB
G (IG D.L
compliant)
CTR_DRBG:
256, 320, 384
bits;
HMAC_DRBG:
320, 512, 1024
bits -
CTR_DRBG:
Internal
state - CSP
Random
number
generatio
n
Random
number
generation
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 50 of 83
Name Description Size - Strength Type -
Category
Generate
d By
Establishe
d By
Used By
128, 192, 256
bits;
HMAC_DRBG:
128, 256 bits
DRBG
seed
DRBG seed
derived from
entropy input
as defined in
SP 800-
90Ar1 (IG
D.L
compliant)
CTR_DRBG:
256, 320, 384
bits;
HMAC_DBRG:
440, 880
bits;Hash_DRB
G: 440, 880 bits
- CTR_DRBG:
128, 192, 256
bits;
HMAC_DRBG:
128, 256 bits;
Hash_DRBG:
128, 256 bits;
Seed -
CSP
Random
number
generatio
n
Random
number
generation
Table 19: SSP Table 1
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
AES keys API input
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
HMAC keys API input
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
RSA Private
Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
RSA Public
Key:Paired With
DRBG internal state
(V value,
Key):Generated from
Intermediate key
generation
value:Generated from
RSA Public
Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
RSA Private
Key:Paired With
DRBG internal state
(V value, C
value):Generated
from
Intermediate key
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 51 of 83
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
generation
value:Generated from
ECDSA
Private Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
ECDSA Public
Key:Paired With
DRBG internal state
(V value, C
value):Generated
from
Intermediate key
generation
value:Generated from
ECDSA
Public Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
ECDSA Private
Key:Paired With
DRBG internal state
(V value, C
value):Generated
from
Intermediate key
generation
value:Generated from
Intermediate
key
generation
value
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Automatic RSA Private
Key:Generates
RSA Public
Key:Generates
ECDSA Private
Key:Generates
ECDSA Public
Key:Generates
Password or
passphrase
API input
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
Derived
key:Derivation of
Derived key API output
parameters
(plaintext)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Wipe and
Free memory
block
allocated
Module
Reset
Password or
passphrase:Derived
From
Entropy Input RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Automatic DRBG
seed:Derivation of
DRBG
internal state
(V value, C
value)
RAM:Plaintext From service
invocation
until
Automatic DRBG
seed:Generated from
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 52 of 83
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
cipherhandle
is freed
DRBG
internal state
(V value,
Key)
RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Automatic DRBG
seed:Generated from
DRBG seed RAM:Plaintext From service
invocation
until
cipherhandle
is freed
Automatic Entropy Input:Derived
From
DRBG internal state
(V value, C
value):Generation of
DRBG internal state
(V value,
Key):Generation of
Table 20: SSP Table 2
The tables above summarizes the Sensitive Security Parameters (SSPs) that are used by the cryptographic
services implemented in the module.
9.5 Transitions
The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January
1, 2031.
FIPS 186-4, has been superseded by FIPS 186-5 on February 4, 2024. For the current module context,
FIPS 186-4 can still be used in the approved mode as the module was submitted before the transition date.
See IG C.K for details. The only exceptions to this are the RSA sigVer CAVP tests performed for 1024,
1536 moduli under FIPS 186-2 since those are only approved for legacy purposes and not testable under
FIPS 186-4 standard.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 53 of 83
10 Self-Tests
10.1 Pre-Operational Self-Tests
Algorithm
or Test
Test
Properties
Test Method Test
Type
Indicator Details
HMAC-
SHA2-256
(A3757)
256-bit key Message
authentication
SW/FW
Integrity
Module
becomes
operational
and services
are available
for use
Integrity test for
/usr/lib64/libgcrypt.so.20.4.0
HMAC-
SHA2-256
(A3759)
256-bit key Message
authentication
SW/FW
Integrity
Module
becomes
operational
and services
are available
for use
Integrity test for
/usr/lib64/libgcrypt.so.20.4.0
HMAC-
SHA2-256
(A3760)
256-bit key Message
authentication
SW/FW
Integrity
Module
becomes
operational
and services
are available
for use
Integrity test for
/usr/lib64/libgcrypt.so.20.4.0
HMAC-
SHA2-256
(A3761)
256-bit key Message
authentication
SW/FW
Integrity
Module
becomes
operational
and services
are available
for use
Integrity test for
/usr/lib64/libgcrypt.so.20.4.0
HMAC-
SHA2-256
(A3762)
256-bit key Message
authentication
SW/FW
Integrity
Module
becomes
operational
and services
are available
for use
Integrity test for
/usr/lib64/libgcrypt.so.20.4.0
Table 21: Pre-Operational Self-Tests
The module performs pre-operational self-tests automatically when the module is becoming available for
the consuming application. Pre-operational self-tests ensure that the module is not corrupted. While the
module is executing the pre-operational self-tests, services are not available, input and output are inhibited.
The module is not available for use by the calling application until the pre-operational self-tests are
completed successfully. After the pre-operational self-tests and the CASTs succeed, the module becomes
operational. If any of the pre-operational self-tests or any of the CASTs fail an error message is returned,
and the module transitions to the error state.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 54 of 83
10.2 Conditional Self-Tests
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB encrypt
(A3757)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB encrypt
(A3759)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB encrypt
(A3760)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB encrypt
(A3762)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB encrypt
(A4675)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB encrypt
(A4676)
128, 192,
256-bit keys,
encrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB decrypt
(A3757)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB decrypt
(A3759)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB decrypt
(A3760)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB decrypt
(A3762)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-ECB decrypt
(A4675)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 55 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB decrypt
(A4676)
128, 192,
256-bit keys,
decrypt
KAT CAST Module
becomes
operational
Symmetric
operation
Test runs at
power-on
before the
integrity test
AES-CMAC encrypt
(A3757)
128-bit key
MAC
generation,
encrypt
KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
AES-CMAC encrypt
(A3759)
128-bit key
MAC
generation,
encrypt
KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
AES-CMAC encrypt
(A3760)
128-bit key
MAC
generation,
encrypt
KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
AES-CMAC encrypt
(A3762)
128-bit key
MAC
generation,
encrypt
KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
Counter DRBG Full
Acceleration (A3757)
AES 128-bit
key with DF,
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Counter DRBG
AESNI AVX (A3759)
AES 128-bit
key with DF,
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Counter DRBG
SSSE3 (A3760)
AES 128-bit
key with DF,
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Counter DRBG No
Acceleration (A3762)
AES 128-bit
key with DF,
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHA2-
256 Full Acceleration
(A3757)
SHA2-256
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHA2-
256 AESNI AVX
(A3759)
SHA2-256
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 56 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
Hash DRBG SHA2-
256 SSSE3 (A3760)
SHA2-256
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHA2-
256 SHLD (A3761)
SHA2-256
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHA2-
256 No Acceleration
(A3762)
SHA2-256
with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHA-1
Full Acceleration
(A3757)
SHA-1
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG AESNI
AVX (A3759)
SHA-1
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SSSE3
(A3760)
SHA-1
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG SHLD
(A3761)
SHA-1
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Hash DRBG No
Acceleration (A3762)
SHA-1
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
HMAC DRBG Full
Acceleration (A3757)
HMAC-SHA2-
256 with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
HMAC DRBG AESNI
AVX (A3759)
HMAC-SHA2-
256 with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
HMAC DRBG
(A3760)
HMAC-SHA2-
256 with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 57 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC DRBG SHLD
(A3761)
HMAC-SHA2-
256 with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
HMAC DRBG No
Acceleration (A3762)
HMAC-SHA2-
256 with and
without PR
KAT CAST Module
becomes
operational
Compliant
with SP 800-
90Ar1
Test runs at
power-on
before the
integrity test
ECDSA SigGen
(FIPS186-4) Full
Acceleration (A3757)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
ECDSA SigGen
(FIPS186-4) AESNI
AVX (A3759)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
ECDSA SigGen
(FIPS186-4) SSSE3
(A3760)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
ECDSA SigGen
(FIPS186-4) SHLD
(A3761)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
ECDSA SigGen
(FIPS186-4) No
Acceleration (A3762)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) Full
Acceleration (A3757)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) AESNI
AVX (A3759)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) SSSE3
(A3760)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) SHLD
(A3761)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 58 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
ECDSA SigVer
(FIPS186-4) No
Acceleratio (A3762)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) (A3757)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) (A3759)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) (A3760)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) (A3761)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
ECDSA SigVer
(FIPS186-4) (A3762)
P-256 and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
HMAC-SHA-1
(A3757)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA-1
(A3758)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA-1
(A3759)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA-1
(A3760)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA-1
(A3761)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 59 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-SHA-1
(A3762)
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-224
(A3757)
SHA2-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-224
(A3759)
SHA2-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-224
(A3760)
SHA2-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-224
(A3761)
SHA2-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-224
(A3762)
SHA2-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-256
(A3757)
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-256
(A3759)
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-256
(A3760)
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-256
(A3761)
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-256
(A3762)
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 60 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-SHA2-384
(A3757)
SHA2-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-384
(A3759)
SHA2-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-384
(A3760)
SHA2-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-384
(A3761)
SHA2-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-384
(A3762)
SHA2-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-512
(A3757)
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-512
(A3759)
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-512
(A3760)
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-512
(A3761)
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA2-512
(A3762)
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-224
(A3757)
SHA3-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 61 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-SHA3-224
(A3761)
SHA3-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-224
(A3762)
SHA3-224 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-256
(A3757)
SHA3-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-256
(A3761)
SHA3-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-256
(A3762)
SHA3-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-384
(A3757)
SHA3-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-384
(A3761)
SHA3-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-384
(A3762)
SHA3-384 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-512
(A3757)
SHA3-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-512
(A3761)
SHA3-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-SHA3-512
(A3762)
SHA3-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 62 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
RSA SigGen
(FIPS186-4) (A3757)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
RSA SigGen
(FIPS186-4) (A3759)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
RSA SigGen
(FIPS186-4) (A3760)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
RSA SigGen
(FIPS186-4) (A3761)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
RSA SigGen
(FIPS186-4) (A3762)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
generation
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-4) (A3757)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-4) (A3759)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-4) (A3760)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-4) (A3761)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-4) (A3762)
PKCS#1 v1.5
with 2048-bit
key and
SHA2-256
KAT CAST Module
becomes
operational
Digital
signature
verification
Test runs at
power-on
before the
integrity test
SHA-1 (A3757) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 63 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA-1 (A3758) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA-1 (A3759) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA-1 (A3760) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA-1 (A3761) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA-1 (A3762) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-224 (A3757) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-224 (A3759) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-224 (A3760) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-224 (A3761) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-224 (A3762) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A3757) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 64 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-256 (A3759) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A3760) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A3761) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A3762) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A4675) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-256 (A4676) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-384 (A3757) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-384 (A3759) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-384 (A3760) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-384 (A3761) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-384 (A3762) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 65 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-512 (A3757) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A3759) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A3760) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A3761) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A3762) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A4675) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
SHA2-512 (A4676) Message
digest
KAT CAST Module
becomes
operational
Message
digest
Test runs at
power-on
before the
integrity test
PBKDF No
Acceleration (A3757)
SHA-1
password
length 24
characters,
master key
length of 200
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF AESNI AVX
(A3759)
SHA-1
password
length 24
characters,
master key
length of 200
bits, iteration
count of
4096, and
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 66 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
salt length of
288 bits
PBKDF SSSE3
(A3760)
SHA-1
password
length 24
characters,
master key
length of 200
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHLD
(A3761)
SHA-1
password
length 24
characters,
master key
length of 200
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHA-1 No
Acceleration (A3762)
SHA-1
password
length 24
characters,
master key
length of 200
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHA2-256
Full Acceleration
(A3757)
SHA2-256
password
length 24
characters,
master key
length of 320
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHA2-256
AESNI AVX (A3759)
SHA2-256
password
length 24
characters,
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 67 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
master key
length of 320
bits, iteration
count of
4096, and
salt length of
288 bits
PBKDF SHA2-256
SSSE3 (A3760)
SHA2-256
password
length 24
characters,
master key
length of 320
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHA2-256
SHLD (A3761)
SHA2-256
password
length 24
characters,
master key
length of 320
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
PBKDF SHA2-256
No
Acceleration(A3762)
SHA2-256
password
length 24
characters,
master key
length of 320
bits, iteration
count of
4096, and
salt length of
288 bits
KAT CAST Module
becomes
operational
Password-
based key
derivation
Test runs at
power-on
before the
integrity test
RSA KeyGen
(FIPS186-4) (A3757)
PKCS#1 v1.5
with SHA2-
256
PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
RSA KeyGen
(FIPS186-4) (A3759)
PKCS#1 v1.5
with SHA2-
256
PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 68 of 83
Algorithm or Test Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
RSA KeyGen
(FIPS186-4) (A3760)
PKCS#1 v1.5
with SHA2-
256
PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
RSA KeyGen
(FIPS186-4) (A3761)
PKCS#1 v1.5
with SHA2-
256
PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
RSA KeyGen
(FIPS186-4) (A3762)
PKCS#1 v1.5
with SHA2-
256
PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
ECDSA KeyGen
(FIPS186-4) (A3757)
SHA2-256 PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
ECDSA KeyGen
(FIPS186-4) (A3759)
SHA2-256 PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
ECDSA KeyGen
(FIPS186-4) (A3760)
SHA2-256 PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
ECDSA KeyGen
(FIPS186-4) (A3761)
SHA2-256 PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
ECDSA KeyGen
(FIPS186-4) (A3762)
SHA2-256 PCT PCT Key pair
generation
is
successful
Signature
generation
and
verification
Key pair
generation
Table 22: Conditional Self-Tests
10.3 Periodic Self-Test Information
Algorithm or
Test
Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A3757)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A3759)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A3760)
Message
authentication
SW/FW Integrity On demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 69 of 83
Algorithm or
Test
Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A3761)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A3762)
Message
authentication
SW/FW Integrity On demand Manually
Table 23: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
AES-ECB encrypt
(A3757)
KAT CAST On Demand Manually
AES-ECB encrypt
(A3759)
KAT CAST On Demand Manually
AES-ECB encrypt
(A3760)
KAT CAST On Demand Manually
AES-ECB encrypt
(A3762)
KAT CAST On Demand Manually
AES-ECB encrypt
(A4675)
KAT CAST On Demand Manually
AES-ECB encrypt
(A4676)
KAT CAST On Demand Manually
AES-ECB decrypt
(A3757)
KAT CAST On Demand Manually
AES-ECB decrypt
(A3759)
KAT CAST On Demand Manually
AES-ECB decrypt
(A3760)
KAT CAST On Demand Manually
AES-ECB decrypt
(A3762)
KAT CAST On Demand Manually
AES-ECB decrypt
(A4675)
KAT CAST On Demand Manually
AES-ECB decrypt
(A4676)
KAT CAST On Demand Manually
AES-CMAC encrypt
(A3757)
KAT CAST On Demand Manually
AES-CMAC encrypt
(A3759)
KAT CAST On Demand Manually
AES-CMAC encrypt
(A3760)
KAT CAST On Demand Manually
AES-CMAC encrypt
(A3762)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 70 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
Counter DRBG Full
Acceleration
(A3757)
KAT CAST On Demand Manually
Counter DRBG
AESNI AVX
(A3759)
KAT CAST On Demand Manually
Counter DRBG
SSSE3 (A3760)
KAT CAST On Demand Manually
Counter DRBG No
Acceleration
(A3762)
KAT CAST On Demand Manually
Hash DRBG SHA2-
256 Full
Acceleration
(A3757)
KAT CAST On Demand Manually
Hash DRBG SHA2-
256 AESNI AVX
(A3759)
KAT CAST On Demand Manually
Hash DRBG SHA2-
256 SSSE3 (A3760)
KAT CAST On Demand Manually
Hash DRBG SHA2-
256 SHLD (A3761)
KAT CAST On Demand Manually
Hash DRBG SHA2-
256 No Acceleration
(A3762)
KAT CAST On Demand Manually
Hash DRBG SHA-1
Full Acceleration
(A3757)
KAT CAST On Demand Manually
Hash DRBG AESNI
AVX (A3759)
KAT CAST On Demand Manually
Hash DRBG SSSE3
(A3760)
KAT CAST On Demand Manually
Hash DRBG SHLD
(A3761)
KAT CAST On Demand Manually
Hash DRBG No
Acceleration
(A3762)
KAT CAST On Demand Manually
HMAC DRBG Full
Acceleration
(A3757)
KAT CAST On Demand Manually
HMAC DRBG
AESNI AVX
(A3759)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 71 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC DRBG
(A3760)
KAT CAST On Demand Manually
HMAC DRBG SHLD
(A3761)
KAT CAST On Demand Manually
HMAC DRBG No
Acceleration
(A3762)
KAT CAST On Demand Manually
ECDSA SigGen
(FIPS186-4) Full
Acceleration
(A3757)
KAT CAST On Demand Manually
ECDSA SigGen
(FIPS186-4) AESNI
AVX (A3759)
KAT CAST On Demand Manually
ECDSA SigGen
(FIPS186-4) SSSE3
(A3760)
KAT CAST On Demand Manually
ECDSA SigGen
(FIPS186-4) SHLD
(A3761)
KAT CAST On Demand Manually
ECDSA SigGen
(FIPS186-4) No
Acceleration
(A3762)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4) Full
Acceleration
(A3757)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4) AESNI
AVX (A3759)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4) SSSE3
(A3760)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4) SHLD
(A3761)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4) No
Acceleratio (A3762)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4)
(A3757)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 72 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
ECDSA SigVer
(FIPS186-4)
(A3759)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4)
(A3760)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4)
(A3761)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-4)
(A3762)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3757)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3758)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3759)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3760)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3761)
KAT CAST On Demand Manually
HMAC-SHA-1
(A3762)
KAT CAST On Demand Manually
HMAC-SHA2-224
(A3757)
KAT CAST On Demand Manually
HMAC-SHA2-224
(A3759)
KAT CAST On Demand Manually
HMAC-SHA2-224
(A3760)
KAT CAST On Demand Manually
HMAC-SHA2-224
(A3761)
KAT CAST On Demand Manually
HMAC-SHA2-224
(A3762)
KAT CAST On Demand Manually
HMAC-SHA2-256
(A3757)
KAT CAST On Demand Manually
HMAC-SHA2-256
(A3759)
KAT CAST On Demand Manually
HMAC-SHA2-256
(A3760)
KAT CAST On Demand Manually
HMAC-SHA2-256
(A3761)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 73 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A3762)
KAT CAST On Demand Manually
HMAC-SHA2-384
(A3757)
KAT CAST On Demand Manually
HMAC-SHA2-384
(A3759)
KAT CAST On Demand Manually
HMAC-SHA2-384
(A3760)
KAT CAST On Demand Manually
HMAC-SHA2-384
(A3761)
KAT CAST On Demand Manually
HMAC-SHA2-384
(A3762)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3757)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3759)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3760)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3761)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3762)
KAT CAST On Demand Manually
HMAC-SHA3-224
(A3757)
KAT CAST On Demand Manually
HMAC-SHA3-224
(A3761)
KAT CAST On Demand Manually
HMAC-SHA3-224
(A3762)
KAT CAST On Demand Manually
HMAC-SHA3-256
(A3757)
KAT CAST On Demand Manually
HMAC-SHA3-256
(A3761)
KAT CAST On Demand Manually
HMAC-SHA3-256
(A3762)
KAT CAST On Demand Manually
HMAC-SHA3-384
(A3757)
KAT CAST On Demand Manually
HMAC-SHA3-384
(A3761)
KAT CAST On Demand Manually
HMAC-SHA3-384
(A3762)
KAT CAST On Demand Manually
HMAC-SHA3-512
(A3757)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 74 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA3-512
(A3761)
KAT CAST On Demand Manually
HMAC-SHA3-512
(A3762)
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-4)
(A3757)
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-4)
(A3759)
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-4)
(A3760)
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-4)
(A3761)
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-4)
(A3762)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-4)
(A3757)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-4)
(A3759)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-4)
(A3760)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-4)
(A3761)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-4)
(A3762)
KAT CAST On Demand Manually
SHA-1 (A3757) KAT CAST On Demand Manually
SHA-1 (A3758) KAT CAST On Demand Manually
SHA-1 (A3759) KAT CAST On Demand Manually
SHA-1 (A3760) KAT CAST On Demand Manually
SHA-1 (A3761) KAT CAST On Demand Manually
SHA-1 (A3762) KAT CAST On Demand Manually
SHA2-224 (A3757) KAT CAST On Demand Manually
SHA2-224 (A3759) KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 75 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
SHA2-224 (A3760) KAT CAST On Demand Manually
SHA2-224 (A3761) KAT CAST On Demand Manually
SHA2-224 (A3762) KAT CAST On Demand Manually
SHA2-256 (A3757) KAT CAST On Demand Manually
SHA2-256 (A3759) KAT CAST On Demand Manually
SHA2-256 (A3760) KAT CAST On Demand Manually
SHA2-256 (A3761) KAT CAST On Demand Manually
SHA2-256 (A3762) KAT CAST On Demand Manually
SHA2-256 (A4675) KAT CAST On Demand Manually
SHA2-256 (A4676) KAT CAST On Demand Manually
SHA2-384 (A3757) KAT CAST On Demand Manually
SHA2-384 (A3759) KAT CAST On Demand Manually
SHA2-384 (A3760) KAT CAST On Demand Manually
SHA2-384 (A3761) KAT CAST On Demand Manually
SHA2-384 (A3762) KAT CAST On Demand Manually
SHA2-512 (A3757) KAT CAST On Demand Manually
SHA2-512 (A3759) KAT CAST On Demand Manually
SHA2-512 (A3760) KAT CAST On Demand Manually
SHA2-512 (A3761) KAT CAST On Demand Manually
SHA2-512 (A3762) KAT CAST On Demand Manually
SHA2-512 (A4675) KAT CAST On Demand Manually
SHA2-512 (A4676) KAT CAST On Demand Manually
PBKDF No
Acceleration
(A3757)
KAT CAST On Demand Manually
PBKDF AESNI AVX
(A3759)
KAT CAST On Demand Manually
PBKDF SSSE3
(A3760)
KAT CAST On Demand Manually
PBKDF SHLD
(A3761)
KAT CAST On Demand Manually
PBKDF SHA-1 No
Acceleration
(A3762)
KAT CAST On Demand Manually
PBKDF SHA2-256
Full Acceleration
(A3757)
KAT CAST On Demand Manually
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 76 of 83
Algorithm or Test Test Method Test Type Period Periodic Method
PBKDF SHA2-256
AESNI AVX
(A3759)
KAT CAST On Demand Manually
PBKDF SHA2-256
SSSE3 (A3760)
KAT CAST On Demand Manually
PBKDF SHA2-256
SHLD (A3761)
KAT CAST On Demand Manually
PBKDF SHA2-256
No
Acceleration(A3762)
KAT CAST On Demand Manually
RSA KeyGen
(FIPS186-4)
(A3757)
PCT PCT On Demand Manually
RSA KeyGen
(FIPS186-4)
(A3759)
PCT PCT On Demand Manually
RSA KeyGen
(FIPS186-4)
(A3760)
PCT PCT On Demand Manually
RSA KeyGen
(FIPS186-4)
(A3761)
PCT PCT On Demand Manually
RSA KeyGen
(FIPS186-4)
(A3762)
PCT PCT On Demand Manually
ECDSA KeyGen
(FIPS186-4)
(A3757)
PCT PCT On Demand Manually
ECDSA KeyGen
(FIPS186-4)
(A3759)
PCT PCT On Demand Manually
ECDSA KeyGen
(FIPS186-4)
(A3760)
PCT PCT On Demand Manually
ECDSA KeyGen
(FIPS186-4)
(A3761)
PCT PCT On Demand Manually
ECDSA KeyGen
(FIPS186-4)
(A3762)
PCT PCT On Demand Manually
Table 24: Conditional Periodic Information
This information can be found in Section 5.2.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 77 of 83
10.4 Error States
Name Description Conditions Recovery Method Indicator
Error
State
The module will return an
error code to indicate the
error and will enter the
Error state. Any further
cryptographic operation is
inhibited.
Failure of pre-
operational tests or
conditional tests.
The error can be
recovered by a
restart (i.e.,
powering off and
powering on) of the
module.
An error
message
related to the
cause of the
failure.
Fatal
Error
state
The module will abort and
will not be available.
Random numbers are
requested in the error
state or cipher
operations are
requested on a
deallocated handle.
The error can be
recovered by a
restart (i.e.,
powering off and
powering on) of the
module.
The module is
aborted
Table 25: Error States
After the pre-operational self-tests and the CASTs succeed, the module becomes operational. If any of the
pre-operational self-tests or any of the CASTs fail an error message is returned, and the module transitions
to the error state.
When the module fails any pre-operational self-test or conditional test, the module will return an error code
to indicate the error and will enter the Error state. Any further cryptographic operation is inhibited. The
calling application can obtain the module state by calling the gcry_control(GCRYCTL_OPERATIONAL_P)
API function. The function returns FALSE if the module is in the Error state, TRUE if the module is in the
Operational state. In the Error state, all data output is inhibited, and no cryptographic operation is allowed.
The error can be recovered by a restart (i.e., powering off and powering on) of the module.
If random numbers are requested while the module is in Error state, or if cipher operations are requested
on a deallocated handle the module will transition to Fatal Error state, the module will abort and will not be
available.
10.5 Operator Initiation of Self-Tests
The software integrity tests and the CASTs can be invoked relying on the
gcry_control(GCRYCTL_SELFTEST) API function call or by powering-off and reloading the module. The
PCTs can be invoked on demand by requesting the Key Generation service.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 78 of 83
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
The Crypto Officer can install the RPM package of the Module (i.e. libgcrypt-1.10.0-10.el9_0.rpm or
libgcrypt-1.10.0-10.el9_2.rpm) using standard tools recommended for the installation of RPM packages on
a Red Hat Enterprise Linux system (for example, dnf, rpm, and the RHN remote management tool). The
integrity of the RPM package is automatically verified during the installation, and the Crypto Officer shall
not install the RPM package if there is any integrity error.
Before the RPM package of the module is installed, the RHEL 9 system must operate in FIPS-validated
configuration. This can be achieved by:
• Starting the installation in Approved mode. Add the fips=1 option to the kernel command line
during the system installation. During the software selection stage, do not install any third-party
software.
• Switching the system into Approved mode after the installation. Execute the fips-mode-setup --
enable command. Restart the system.
The Crypto Officer must verify the system operates in Approved mode by executing the fips-mode-setup --
check command, which should output “FIPS mode is enabled.”
After installation of the RPM package of the module, the operator needs to check the output of the
gcry_get_config() API, which should include the following name and version:
Red Hat Enterprise Linux 9 libgcrypt 1.10.0-8b6840b590cedd43
Once libgcrypt has been put into Approved mode, it is not possible to switch back to standard mode without
terminating the process first. If the logging verbosity level of libgcrypt has been set to at least 2, the state
transitions and the self-tests are logged.
11.2 Administrator Guidance
All the functions, ports and logical interfaces described in this document are available to the Crypto Officer.
The user must not call malloc/free to create/release space for keys, let libgcrypt manage space for keys,
which will ensure that the key memory is overwritten before it is released.
gcry_control(GCRYCTL_TERM_SECMEM) needs to be called before the process is terminated.
11.3 Non-Administrator Guidance
The module implements only the Crypto Officer. There are no requirements for non-administrator guidance.
11.4 End of Life
For secure sanitization of the cryptographic module, the module must first to be powered off, which will
zeroize all keys and CSPs in volatile memory. Then, for actual deprecation, the module shall be upgraded
to a newer version that is FIPS 140-3 validated.
The module does not possess persistent storage of SSPs, so further sanitization steps are not required.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 79 of 83
12 Mitigation of Other Attacks
12.1 Attack List
RSA timing attacks.
12.2 Mitigation Effectiveness
RSA is vulnerable to timing attacks. In a setup where attackers can measure the time of RSA decryption or
signature operations, blinding must be used to protect the RSA operation from that attack.
By default, the module uses the following blinding technique: instead of using the RSA decryption directly,
a blinded value y = x re mod n is decrypted and the unblinded value x' = y' r−1 mod n returned.
The blinding value r is a random value with the size of the modulus n.
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 80 of 83
A Glossary and Abbreviations
AES Advanced Encryption Standard
API Application Programming Interface
CAST Cryptographic Algorithm Self-Test
CAVP Cryptographic Algorithm Validation Program
CBC Cipher Block Chaining
CCM Counter with Cipher Block Chaining-Message Authentication Code
CFB Cipher Feedback
CKG Cryptographic Key Generation
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
CTR Counter Mode
DF Derivation Function
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECC Elliptic Curve Cryptography
ECDSA Elliptic Curve Digital Signature Algorithm
FIPS Federal Information Processing Standards Publication
GCM Galois Counter Mode
HMAC Hash Message Authentication Code
KAT Known Answer Test
KW AES Key Wrap
MAC Message Authentication Code
NIST National Institute of Science and Technology
OFB Output Feedback
PAA Processor Algorithm Acceleration
PAI Processor Algorithm Implementation
PBKDF2 Password-based Key Derivation Function v2
PCT Pair-wise Consistency Test
PKCS Public-Key Cryptography Standards
PR Prediction Resistance
PSS Probabilistic Signature Scheme
RNG Random Number Generator
RSA Rivest, Shamir, Adleman
SHA Secure Hash Algorithm
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 81 of 83
SHS Secure Hash Standard
SSP Sensitive Security Parameter
XOF Extendable Output Function
XTS XEX-based Tweaked-codebook mode with cipher text Stealing
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 82 of 83
B References
FIPS140-3
FIPS PUB 140-3 - Security Requirements for Cryptographic Modules
March 2019
https://doi.org/10.6028/NIST.FIPS.140-3
FIPS140-3_IG
Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module
Validation Program
March 2024
https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-
program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
FIPS140-3_MM
FIPS 140-3 Cryptographic Module Validation Program - Management Manual
May 2025
https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-
program/documents/fips%20140-3/FIPS-140-3-CMVP%20Management%20Manual.pdf
FIPS180-4 Secure Hash Standard (SHS)
August 2015
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
FIPS186-4 Digital Signature Standard (DSS)
July 2013
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
FIPS186-2 Digital Signature Standard (DSS)
January 2000
https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf
FIPS197 Advanced Encryption Standard
November 2001
https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
FIPS198-1 The Keyed Hash Message Authentication Code (HMAC)
July 2008
https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
FIPS202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
August 2015
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1
February 2003
https://www.ietf.org/rfc/rfc3447.txt
SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of
Operation Methods and Techniques
December 2001
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf
SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of
Operation: The CMAC Mode for Authentication
May 2005
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf
SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of
Operation: the CCM Mode for Authentication and Confidentiality
May 2004
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
SP800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of
Operation: The XTS AES Mode for Confidentiality on Storage Devices
January 2010
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38e.pdf
Red Hat Enterprise Linux 9 libgcrypt FIPS 140-3 Non-Proprietary Security Policy
© 2026 Red Hat, Inc./ atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 83 of 83
SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of
Operation: Methods for Key Wrapping
December 2012
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
SP800-90Arev1 NIST Special Publication 800-90A Revision 1 - Recommendation for Random Number
Generation Using Deterministic Random Bit Generators
June 2015
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
SP800-90B NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used
for Random Bit Generation
January 2018
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
SP800-132 NIST Special Publication 800-132 - Recommendation for Password-Based Key
Derivation - Part 1: Storage Applications
December 2010
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf
SP800-133rev2
NIST Special Publication 800-133 - Recommendation for Cryptographic
Key Generation
June 2020
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf
SP800-140Br1
NIST Special Publication 800-140B – Revision 1 - CMVP Security Policy
Requirements
November 2023
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Br1.pdf