Oracle Linux 9 NSS Cryptographic Module

Known vulnerabilities detected

Our automated heuristics have identified vulnerabilities that may be associated with this certificate. See the CVEs section for details.

Certificate details

Certificate ID #4801
Status historical
Historical reason Replaced by certificate #5339
Validation dates 16.09.2024
Standard FIPS 140-3
Security level 1
Type Software
Embodiment Multi-Chip Stand Alone
Caveat Interim validation. When operated in approved mode. When installed, initialized and configured as specified in section 11 of the Security Policy.
Exceptions
  • Physical security: N/A
  • Non-invasive security: N/A
Description Network Security Services (NSS) is a set of open source C libraries designed to support cross-platform development of security-enabled applications. NSS implements major Internet security standards. NSS is available free of charge under a variety of open source compatible licenses. See http://www.mozilla.org/projects/security/pki/nss/.
Tested configurations
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER A1-2c with Ampere® Altra® Q80-30 with PAA
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER A1-2c with Ampere® Altra® Q80-30 without PAA
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER E4-2c with AMD EPYC 7J13 with PAA
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER E4-2c with AMD EPYC 7J13 without PAA
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER X9-2c with Intel® Xeon® Platinum 8358 with PAA
  • Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER X9-2c with Intel® Xeon® Platinum 8358 without PAA
Vendor Oracle Corporation http://www.oracle.com
Lab atsec information security corporation
Algorithms
  • AES-CBC-CS1A4765
  • AES-CBCA4769
  • AES-CMACA4762
  • AES-CTRA4769
  • AES-ECBA4769
  • AES-GCMA4769
  • AES-KWA4768
  • AES-KWPA4768
  • DSA SigVer (FIPS186-4)A4760
  • ECDSA KeyGen (FIPS186-4)A4760
  • ECDSA KeyVer (FIPS186-4)A4760
  • ECDSA SigGen (FIPS186-4)A4760
  • ECDSA SigVer (FIPS186-4)A4760
  • Hash DRBGA4760
  • HMAC-SHA2-224A4760
  • HMAC-SHA2-256A4760
  • HMAC-SHA2-384A4760
  • HMAC-SHA2-512A4760
  • KAS-ECC-SSC Sp800-56Ar3A4760
  • KAS-FFC-SSC Sp800-56Ar3A4760
  • KDA HKDF Sp800-56Cr1A4759
  • KDF IKEv2A4764
  • KDF SP800-108A4763
  • KDF TLSA4760
  • PBKDFA4760
  • RSA KeyGen (FIPS186-4)A4760
  • RSA SigGen (FIPS186-4)A4760
  • RSA SigVer (FIPS186-2)A4760
  • RSA SigVer (FIPS186-4)A4760
  • Safe Primes Key GenerationA4760
  • SHA2-224A4760
  • SHA2-256A4760
  • SHA2-384A4760
  • SHA2-512A4760
  • TLS v1.2 KDF RFC7627A4760
References

This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES, AES-, CAST, RC2, RC4, DES, Triple-DES, ChaCha20, Camellia, SEED, HMAC, HMAC-SHA-256, CMAC, CBC-MAC
Asymmetric Algorithms
ECDH, ECDSA, ECC, DH, Diffie-Hellman, DSA
Hash functions
SHA-1, SHA1, SHA-224, SHA-384, SHA-512, SHA-256, SHA-3, MD5, PBKDF2
Schemes
MAC, Key Exchange
Protocols
SSL, TLS, TLS v1.3, TLS 1.2, TLSv1.0, TLS 1.3, TLS v1.2, IKEv2, IKE, IKEv1
Randomness
DRBG, RNG
Libraries
NSS
Elliptic Curves
P-256, P-521, P-384, P-192
Block cipher modes
ECB, CBC, CTR, CFB, GCM, CCM

Trusted Execution Environments
PSP, SSC

Security level
Level 1
Side-channel analysis
Timing attacks, Timing attack, timing attacks

Creation date D:20240906033609Z00'00'
Modification date D:20240906033609Z00'00'
Pages 41
Producer macOS Version 14.6.1 (Build 23G93) Quartz PDFContext

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

CVE matches

ID Links Severity CVSS Score Published on
Base score
CVE-2022-21505
C N
MEDIUM 6.7 24.12.2024
CVE-2023-22024
C N
MEDIUM 5.5 20.09.2023
CVE-2025-4598
C N
MEDIUM 4.7 30.05.2025

Cross-references

No references are available for this certificate.

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 4801,
  "dgst": "2f9081896ab7d7bc",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "KDF IKEv2A4764",
        "#A4767",
        "KAS-ECC-SSC Sp800-56Ar3A4760",
        "KDF SP800-108A4763",
        "#A4760",
        "AES-ECBA4769",
        "AES-KWA4768",
        "SHA2-384A4760",
        "#A4768",
        "ECDSA KeyVer (FIPS186-4)A4760",
        "RSA SigGen (FIPS186-4)A4760",
        "#A4763",
        "AES-KWPA4768",
        "KDA HKDF Sp800-56Cr1A4759",
        "SHA2-256A4760",
        "RSA SigVer (FIPS186-2)A4760",
        "AES-CBC-CS1A4765",
        "#A4762",
        "AES-GCMA4769",
        "AES-CMACA4762",
        "SHA2-512A4760",
        "#A4761",
        "HMAC-SHA2-256A4760",
        "KAS-FFC-SSC Sp800-56Ar3A4760",
        "DSA SigVer (FIPS186-4)A4760",
        "HMAC-SHA2-384A4760",
        "ECDSA SigVer (FIPS186-4)A4760",
        "RSA KeyGen (FIPS186-4)A4760",
        "TLS v1.2 KDF RFC7627A4760",
        "PBKDFA4760",
        "#A4765",
        "ECDSA SigGen (FIPS186-4)A4760",
        "HMAC-SHA2-512A4760",
        "SHA2-224A4760",
        "ECDSA KeyGen (FIPS186-4)A4760",
        "#A4759",
        "#A4766",
        "HMAC-SHA2-224A4760",
        "RSA SigVer (FIPS186-4)A4760",
        "Hash DRBGA4760",
        "AES-CTRA4769",
        "AES-CBCA4769",
        "Safe Primes Key GenerationA4760",
        "#A4769",
        "#A4764",
        "KDF TLSA4760"
      ]
    },
    "cpe_matches": {
      "_type": "Set",
      "elements": [
        "cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:*"
      ]
    },
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "9"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": {
      "_type": "Set",
      "elements": [
        "CVE-2025-4598",
        "CVE-2023-22024",
        "CVE-2022-21505"
      ]
    },
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 4,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Compute a message digest",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "Message",
            "name": "Message Digest",
            "outputs": "Digest value",
            "rolesSspAccess": "N/A",
            "secFunImpl": "SHA2-224, SHA2-256, SHA2-384, SHA2-512"
          },
          {
            "description": "Encrypt a plaintext",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, plaintext",
            "name": "Encryption",
            "outputs": "Ciphertext",
            "rolesSspAccess": "AES Key: W, E",
            "secFunImpl": "AES-ECB, AES- CBC, AES-CBC- CS1, AES-CTR, AES-GCM (internal IV)"
          },
          {
            "description": "Decrypt a ciphertext",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, ciphertext",
            "name": "Decryption",
            "outputs": "Plaintext",
            "rolesSspAccess": "AES Key: W, E",
            "secFunImpl": "AES-ECB, AES- CBC, AES-CBC- CS1, AES-CTR, AES-GCM (external IV)"
          },
          {
            "description": "Wrap a key",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, Key To Be Wrapped",
            "name": "Key Wrapping",
            "outputs": "Wrapped key",
            "rolesSspAccess": "AES Key: W, E Wrapped Key: R Key To Be Wrapped: W, E",
            "secFunImpl": "AES-GCM, AES- KW, AES-KWP"
          },
          {
            "description": "Unwrap a key",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, Key To Be Unwrapped",
            "name": "Key Unwrapping",
            "outputs": "Unwrapped key",
            "rolesSspAccess": "AES Key: W, E Unwrapped Key: R Key To Be Unwrapped: W, E",
            "secFunImpl": "AES-GCM, AES- KW, AES-KWP"
          },
          {
            "description": "Compute a MAC tag",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, message",
            "name": "Message Authentication",
            "outputs": "MAC tag",
            "rolesSspAccess": "AES Key: W, E",
            "secFunImpl": "AES-CMAC"
          },
          {
            "description": "Compute a MAC tag",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "HMAC Key, message",
            "name": "Message Authentication",
            "outputs": "MAC tag",
            "rolesSspAccess": "HMAC Key: W, E",
            "secFunImpl": "HMAC-SHA- 224, HMAC- SHA-256, HMAC-SHA- 384, HMAC- SHA-512"
          },
          {
            "description": "Verify a MAC tag",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "AES Key, message, MAC tag HMAC Key,",
            "name": "Message Authentication Verification",
            "outputs": "Pass/fail",
            "rolesSspAccess": "AES Key: W, E",
            "secFunImpl": "AES-CMAC"
          },
          {
            "description": "Verify a MAC tag",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "message, MAC tag",
            "name": "Message Authentication Verification",
            "outputs": "Pass/fail",
            "rolesSspAccess": "HMAC Key: W, E",
            "secFunImpl": "HMAC-SHA- 224, HMAC- SHA-256, HMAC-SHA- 384, HMAC- SHA-512"
          },
          {
            "description": "Compute a",
            "indicator": "CKS_NSS_FI PS_OK",
            "inputs": "DH Private Key,",
            "name": "Shared Secret",
            "outputs": "Shared",
            "rolesSspAccess": "DH Private Key: W, E;",
            "secFunImpl": "KAS-FFC-SSC"
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "Roles",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "shared secret",
            "indicator": "",
            "inputs": "DH Public Key EC Private Key, EC Public Key",
            "name": "Computation",
            "outputs": "Secret",
            "rolesSspAccess": "",
            "secFunImpl": "KAS-ECC-SSC"
          },
          {
            "description": "Generate a digital signature",
            "indicator": "",
            "inputs": "Message, private key",
            "name": "Signature Generation",
            "outputs": "Signature",
            "rolesSspAccess": "",
            "secFunImpl": "RSA PKCS#1 v1.5 and PSS with SHA-224, SHA-256, SHA- 384, SHA-512, ECDSA with SHA-224, SHA- 256, SHA-384,"
          },
          {
            "description": "Verify a digital signature",
            "indicator": "",
            "inputs": "Message, public key, signature",
            "name": "Signature Verification",
            "outputs": "Pass/fail",
            "rolesSspAccess": "",
            "secFunImpl": "RSA PKCS#1 v1.5 and PSS with, SHA-224, SHA-256, SHA- 384, SHA-512, ECDSA with SHA-224, SHA- 256, SHA-384, SHA-512 DSA with SHA- 224, SHA-256, SHA-384, SHA-"
          },
          {
            "description": "Generate a key pair",
            "indicator": "",
            "inputs": "DH Group",
            "name": "Key Pair Generation",
            "outputs": "DH Private Key, DH Public Key",
            "rolesSspAccess": "",
            "secFunImpl": "512 Safe Primes"
          },
          {
            "description": "Generate a key pair",
            "indicator": "",
            "inputs": "Curve",
            "name": "Key Pair Generation",
            "outputs": "EC Private Key, EC Public Key",
            "rolesSspAccess": "",
            "secFunImpl": "ECDSA"
          },
          {
            "description": "Generate a key pair",
            "indicator": "",
            "inputs": "Modulus",
            "name": "Key Pair Generation",
            "outputs": "RSA Private Key, RSA Public Key",
            "rolesSspAccess": "",
            "secFunImpl": "RSA"
          },
          {
            "description": "Generate a secret key",
            "indicator": "",
            "inputs": "Key size",
            "name": "Secret Key Generation",
            "outputs": "Symmetric Key",
            "rolesSspAccess": "",
            "secFunImpl": "CKG (Symmetric Key Generation)"
          },
          {
            "description": "Derive a key",
            "indicator": "",
            "inputs": "Shared Secret",
            "name": "Key Derivation",
            "outputs": "Derived Key",
            "rolesSspAccess": "",
            "secFunImpl": "HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv2 KDF"
          },
          {
            "description": "Derive a key from a key",
            "indicator": "",
            "inputs": "Key-Derivation Key",
            "name": "Key-Based Key Derivation",
            "outputs": "Derived Key",
            "rolesSspAccess": "",
            "secFunImpl": "KBKDF"
          },
          {
            "description": "Derive a key from a",
            "indicator": "",
            "inputs": "Password",
            "name": "Password-Based Key Derivation",
            "outputs": "Derived Key",
            "rolesSspAccess": "",
            "secFunImpl": "PBKDF2"
          },
          {
            "description": "password Generate random bytes",
            "indicator": "CKR_OK",
            "inputs": "Output length",
            "name": "Random Number",
            "outputs": "Random bytes",
            "rolesSspAccess": "",
            "secFunImpl": "Hash_DRBG,"
          },
          {
            "description": "Return the",
            "indicator": "None",
            "inputs": "N/A",
            "name": "Generation Show Version",
            "outputs": "Module",
            "rolesSspAccess": "",
            "secFunImpl": "N/A"
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "Roles",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "module name and version information",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "name and version",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Return the module status",
            "indicator": "None",
            "inputs": "N/A",
            "name": "Show Status",
            "outputs": "Module status",
            "rolesSspAccess": "",
            "secFunImpl": "N/A"
          },
          {
            "description": "Perform the CASTs and integrity tests",
            "indicator": "None",
            "inputs": "N/A",
            "name": "Self-Test",
            "outputs": "Pass/fail",
            "rolesSspAccess": "",
            "secFunImpl": "SHA-224, SHA- 256, SHA-384, SHA-512 AES-GCM, AES- ECB, AES-CBC, AES-CMAC, HMAC, KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv2 KDF, PBKDF2, Hash_DRBG, KAS-FFC-SSC, KAS-ECC-SSC, RSA, ECDSA, DSA See Table 24 for specifics"
          },
          {
            "description": "Zeroize all SSPs",
            "indicator": "None",
            "inputs": "Any SSP",
            "name": "Zeroization",
            "outputs": "N/A",
            "rolesSspAccess": "",
            "secFunImpl": "N/A"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [],
        "found": false,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Software integrity test failure",
            "description": "An error occurred during the self-tests executed",
            "indicator": "Module will not load",
            "name": "Power-On Error",
            "recoveryMethod": "Restart of the module"
          },
          {
            "conditions": "CAST failure",
            "description": "on power-on",
            "indicator": "",
            "name": "",
            "recoveryMethod": ""
          },
          {
            "conditions": "PCT failure",
            "description": "An error occurred",
            "indicator": "",
            "name": "PCT Error",
            "recoveryMethod": ""
          },
          {
            "conditions": "",
            "description": "during a PCT",
            "indicator": "Module stops functioning (sftk_fatalError is set to",
            "name": "",
            "recoveryMethod": ""
          },
          {
            "conditions": "",
            "description": "",
            "indicator": "TRUE)",
            "name": "",
            "recoveryMethod": ""
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [],
        "found": false,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [
          {
            "name": "MD2, MD5, SHA-1",
            "use": "Message Digest"
          },
          {
            "name": "RC2, RC4, DES, Triple-DES, CDMF, Camellia, SEED, ChaCha20 (-Poly1305)",
            "use": "Encryption Decryption"
          },
          {
            "name": "AES GCM (external IV)",
            "use": "Encryption"
          },
          {
            "name": "CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96",
            "use": "Message Authentication"
          },
          {
            "name": "HMAC-SHA-1, HMAC (MD2, MD5; \u003c 112-bit keys)",
            "use": "Message Authentication"
          },
          {
            "name": "HMAC/SSLv3 MAC (constant-time implementation)",
            "use": "Message Authentication"
          },
          {
            "name": "RSA OAEP",
            "use": "Key Encapsulation/Decapsulation"
          },
          {
            "name": "SEED, ANS X9.63 KDF, SSL 3 PRF, 40v1 PRF",
            "use": "Key Derivation"
          },
          {
            "name": "KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv2 PRF (\u003c 112-bit keys)",
            "use": "Key Derivation"
          },
          {
            "name": "KBKDF (MD2, MD5)",
            "use": "Key Derivation"
          },
          {
            "name": "TLS 1.2 KDF (without extended master secret)",
            "use": "Key Derivation"
          },
          {
            "name": "IKEv1 KDF",
            "use": "Key Derivation"
          },
          {
            "name": "IKEv2 PRF (MD2, MD5)",
            "use": "Key Derivation"
          },
          {
            "name": "PKCS#5 PBE, PKCS#12 PBE",
            "use": "Password-Based Key Derivation"
          },
          {
            "name": "PBKDF2 (short password; short salt; insufficient iterations; \u003c 112-bit keys)",
            "use": "Password-Based Key Derivation"
          },
          {
            "name": "J-PAKE",
            "use": "Shared Secret Computation"
          },
          {
            "name": "KAS-FFC-SSC (FIPS 186-type groups)",
            "use": "Shared Secret Computation"
          },
          {
            "name": "KAS-ECC-SSC (P-192)",
            "use": "Shared Secret Computation"
          },
          {
            "name": "DSA",
            "use": "Parameter Generation Parameter Verification Key Pair Generation Signature Generation"
          },
          {
            "name": "RSA with SHA-1, RSA (primitive; PKCS#1 v1.5 or PSS with MD2, MD5)",
            "use": "Signature Generation"
          },
          {
            "name": "ECDSA (P-192)",
            "use": "Signature Verification"
          },
          {
            "name": "RSA",
            "use": "Asymmetric Encryption Asymmetric Decryption"
          },
          {
            "name": "DH (FIPS 186-type groups)",
            "use": "Key Pair Generation"
          },
          {
            "name": "RSA (\u003c 2048 bits)",
            "use": "Key Pair Generation"
          },
          {
            "name": "ECDSA (P-192)",
            "use": "Key Pair Generation"
          },
          {
            "name": "Symmetric key generation (\u003c 112 bits)",
            "use": "Secret Key Generation"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [],
        "found": false,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "N/A (Implicitly assumed)",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [],
        "found": false,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [],
        "found": false,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [],
        "found": false,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroizes the SSPs",
            "method": "Calling the zeroization API",
            "operatorId": "By calling the C_DestroyObject function",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
          },
          {
            "description": "Automatically zeroized by the module when no longer needed",
            "method": "Automatic",
            "operatorId": "N/A",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
          },
          {
            "description": "De-allocates the volatile memory used to store SSPs",
            "method": "Remove power from the module",
            "operatorId": "By removing power",
            "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs.",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 1
          },
          "ECDH": {
            "ECDH": 4
          },
          "ECDSA": {
            "ECDSA": 22
          }
        },
        "FF": {
          "DH": {
            "DH": 29,
            "Diffie-Hellman": 3
          },
          "DSA": {
            "DSA": 13
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 4
        },
        "CCM": {
          "CCM": 1
        },
        "CFB": {
          "CFB": 1
        },
        "CTR": {
          "CTR": 1
        },
        "ECB": {
          "ECB": 2
        },
        "GCM": {
          "GCM": 19
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "NSS": {
          "NSS": 48
        }
      },
      "crypto_protocol": {
        "IKE": {
          "IKE": 6,
          "IKEv1": 2,
          "IKEv2": 13
        },
        "TLS": {
          "SSL": {
            "SSL": 2
          },
          "TLS": {
            "TLS": 21,
            "TLS 1.2": 12,
            "TLS 1.3": 4,
            "TLS v1.2": 2,
            "TLS v1.3": 3,
            "TLSv1.0": 1
          }
        }
      },
      "crypto_scheme": {
        "KEX": {
          "Key Exchange": 1
        },
        "MAC": {
          "MAC": 12
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-192": 14,
          "P-256": 22,
          "P-384": 12,
          "P-521": 14
        }
      },
      "eval_facility": {
        "atsec": {
          "atsec": 3
        }
      },
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "DRBG 256": 1,
          "DSA 1": 1,
          "HMAC SHA- 1": 1,
          "HMAC SHA- 224": 1,
          "HMAC SHA-1": 1,
          "HMAC SHA-224": 1,
          "HMAC SHA-256": 2,
          "HMAC SHA-512": 1,
          "HMAC- SHA-256": 2,
          "HMAC- SHA-512": 2,
          "HMAC-SHA- 224": 4,
          "HMAC-SHA- 384": 4,
          "HMAC-SHA-1": 4,
          "HMAC-SHA-256": 8,
          "PKCS#1": 16,
          "PKCS#11": 2,
          "PKCS#12": 6,
          "PKCS#5": 6,
          "PKCS#7": 2,
          "RSA PKCS#1": 4,
          "SHA- 1": 1,
          "SHA- 224": 2,
          "SHA- 256": 5,
          "SHA- 384": 8,
          "SHA- 512": 2,
          "SHA-1": 12,
          "SHA-224": 17,
          "SHA-256": 32,
          "SHA-3": 1,
          "SHA-384": 16,
          "SHA-512": 22,
          "SHA-512 80": 1,
          "SHA1": 2,
          "SHA2-224": 2,
          "SHA2-256": 2,
          "SHA2-384": 2,
          "SHA2-512": 2
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 3
        }
      },
      "hash_function": {
        "MD": {
          "MD5": {
            "MD5": 12
          }
        },
        "PBKDF": {
          "PBKDF2": 15
        },
        "SHA": {
          "SHA1": {
            "SHA-1": 12,
            "SHA1": 2
          },
          "SHA2": {
            "SHA-224": 17,
            "SHA-256": 32,
            "SHA-384": 16,
            "SHA-512": 23
          },
          "SHA3": {
            "SHA-3": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 17
        },
        "RNG": {
          "RNG": 4
        }
      },
      "side_channel_analysis": {
        "SCA": {
          "Timing attack": 1,
          "Timing attacks": 1,
          "timing attacks": 1
        }
      },
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 15,
          "FIPS 1403": 1,
          "FIPS 180-4": 5,
          "FIPS 186-2": 1,
          "FIPS 186-4": 13,
          "FIPS 186-5": 2,
          "FIPS 197": 9,
          "FIPS 198-1": 2,
          "FIPS 202": 1,
          "FIPS PUB 140-3": 2
        },
        "ISO": {
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "SP 800-132": 8,
          "SP 800-140B": 1,
          "SP 800-38A": 6,
          "SP 800-38B": 2,
          "SP 800-38D": 4,
          "SP 800-38F": 5,
          "SP 800-90B": 1
        },
        "PKCS": {
          "PKCS#1": 10,
          "PKCS#11": 1,
          "PKCS#12": 3,
          "PKCS#5": 3,
          "PKCS#7": 1
        },
        "RFC": {
          "RFC 3526": 2,
          "RFC 5288": 2,
          "RFC 7627": 3,
          "RFC 7919": 2,
          "RFC 8446": 1,
          "RFC8446": 2
        },
        "X509": {
          "X.509": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 43,
            "AES-": 11
          },
          "CAST": {
            "CAST": 18
          },
          "RC": {
            "RC2": 3,
            "RC4": 3
          }
        },
        "DES": {
          "3DES": {
            "Triple-DES": 3
          },
          "DES": {
            "DES": 3
          }
        },
        "constructions": {
          "MAC": {
            "CBC-MAC": 2,
            "CMAC": 6,
            "HMAC": 22,
            "HMAC-SHA-256": 4
          }
        },
        "djb": {
          "ChaCha": {
            "ChaCha20": 3
          }
        },
        "miscellaneous": {
          "Camellia": {
            "Camellia": 3
          },
          "SEED": {
            "SEED": 5
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 4
        },
        "IBM": {
          "SSC": 3
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "KDF IKEv2A4764",
        "KAS-ECC-SSC Sp800-56Ar3A4760",
        "KDF SP800-108A4763",
        "AES-ECBA4769",
        "AES-KWA4768",
        "SHA2-384A4760",
        "ECDSA KeyVer (FIPS186-4)A4760",
        "RSA SigGen (FIPS186-4)A4760",
        "AES-KWPA4768",
        "KDA HKDF Sp800-56Cr1A4759",
        "SHA2-256A4760",
        "RSA SigVer (FIPS186-2)A4760",
        "AES-CBC-CS1A4765",
        "AES-GCMA4769",
        "AES-CMACA4762",
        "SHA2-512A4760",
        "HMAC-SHA2-256A4760",
        "KAS-FFC-SSC Sp800-56Ar3A4760",
        "DSA SigVer (FIPS186-4)A4760",
        "HMAC-SHA2-384A4760",
        "ECDSA SigVer (FIPS186-4)A4760",
        "RSA KeyGen (FIPS186-4)A4760",
        "TLS v1.2 KDF RFC7627A4760",
        "PBKDFA4760",
        "ECDSA SigGen (FIPS186-4)A4760",
        "HMAC-SHA2-512A4760",
        "SHA2-224A4760",
        "ECDSA KeyGen (FIPS186-4)A4760",
        "HMAC-SHA2-224A4760",
        "RSA SigVer (FIPS186-4)A4760",
        "Hash DRBGA4760",
        "AES-CTRA4769",
        "AES-CBCA4769",
        "Safe Primes Key GenerationA4760",
        "KDF TLSA4760"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A4763",
        "#A4761",
        "#A4767",
        "#A4759",
        "#A4766",
        "#A4762",
        "#A4760",
        "#A4769",
        "#A4764",
        "#A4768",
        "#A4765"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20240906033609Z00\u002700\u0027",
      "/ModDate": "D:20240906033609Z00\u002700\u0027",
      "/Producer": "macOS Version 14.6.1 (Build 23G93) Quartz PDFContext",
      "pdf_file_size_bytes": 1033052,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37371",
          "https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf",
          "https://www.ietf.org/rfc/rfc3447.txt",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37374",
          "https://www.ietf.org/rfc/rfc7919.txt",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37379",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf",
          "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37376",
          "https://www.ietf.org/rfc/rfc5288.txt",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37369",
          "http://www.oracle.com/",
          "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-add.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37377",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37375",
          "https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/details?validation=36772",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37370",
          "https://www.ietf.org/rfc/rfc3526.txt",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr1.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf",
          "http://www.atsec.com/",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37378",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
          "https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf",
          "https://docs.oracle.com/en/operating-systems/oracle-linux/9/fips/about_fips_1403.html#about-fips-140-3",
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/99",
          "https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf",
          "https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37372",
          "https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
          "https://www.ietf.org/rfc/rfc8446.txt",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf",
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=37373"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 41
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "a366d307d8e2ef6d8404f9c59808320c3bd03f327f3187906caa2df14af0d697",
      "source_hash": "4733618a4018be2c0e501f0a19f8035d5bb28bdb35fa4b95d1796ccba8ca7620",
      "txt_hash": "ed2285bb53e620aa2245a52221b2043fa0dc34a1c5d023cc40d482d20f40206d"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "Interim validation. When operated in approved mode. When installed, initialized and configured as specified in section 11 of the Security Policy.",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/September 2024_011024_0217.pdf",
    "date_sunset": null,
    "description": "Network Security Services (NSS) is a set of open source C libraries designed to support cross-platform development of security-enabled applications. NSS implements major Internet security standards. NSS is available free of charge under a variety of open source compatible licenses. See http://www.mozilla.org/projects/security/pki/nss/.",
    "embodiment": "Multi-Chip Stand Alone",
    "exceptions": [
      "Physical security: N/A",
      "Non-invasive security: N/A"
    ],
    "fw_versions": null,
    "historical_reason": "Replaced by certificate #5339",
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {},
    "module_name": "Oracle Linux 9 NSS Cryptographic Module",
    "module_type": "Software",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "historical",
    "sw_versions": "4.35.0-381552536e763d0c",
    "tested_conf": [
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER A1-2c with Ampere\u00ae Altra\u00ae Q80-30 with PAA",
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER A1-2c with Ampere\u00ae Altra\u00ae Q80-30 without PAA",
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER E4-2c with AMD EPYC 7J13 with PAA",
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER E4-2c with AMD EPYC 7J13 without PAA",
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER X9-2c with Intel\u00ae Xeon\u00ae Platinum 8358 with PAA",
      "Oracle Linux 9 on KVM on Oracle Linux 8 running on ORACLE SERVER X9-2c with Intel\u00ae Xeon\u00ae Platinum 8358 without PAA"
    ],
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2024-09-16",
        "lab": "atsec information security corporation",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Oracle Corporation",
    "vendor_url": "http://www.oracle.com"
  }
}