Micron® MTC22-P4 Controller Sub Chip Security Subsystem

Certificate details

Certificate ID	#5559
Status	active
Validation dates	20.10.2026
Sunset date	19-10-2031
Standard	FIPS 140-3
Security level	2
Type	Hardware
Embodiment	SingleChip
Caveat	No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions	Operational environment: N/A Non-invasive security: N/A Mitigation of other attacks: N/A
Description	Micron® MTC22-P4 Controller Sub Chip Security Subsystem provides cryptographic functionality to SSD controller.
Vendor	Micron Technology, Inc. http://www.micron.com
Lab	Lightship Security, Inc.
Algorithms	AES-CTRC1278 AES-ECBC1278 AES-KWA5550 AES-XTS Testing Revision 2.0A5545 Conditioning Component Block Cipher Derivation Function SP800-90BA2272 Counter DRBGC1278 ECDSA KeyGen (FIPS186-5)A5551 ECDSA KeyVer (FIPS186-5)A5551 ECDSA SigGen (FIPS186-5)A5551 ECDSA SigVer (FIPS186-5)A5551 HMAC-SHA2-384A5548 HMAC-SHA2-512/256A5548 HMAC-SHA2-512A5548 KDF SP800-108A5546 KTS-IFCA5549 PBKDFA5552 RSA SigVer (FIPS186-5)A5547 SHA2-384A5544 SHA2-512/256A5544 SHA2-512A5544
References	This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Webpage
Security policy

Security policy PDF TXT
Extracted keywords

Symmetric Algorithms

AES-128, AES-256, AES, CAST, HMAC
Asymmetric Algorithms

RSA 3072, RSA-PSS, ECDSA
Hash functions

SHA-384, PBKDF
Schemes

MAC, Key Agreement
Randomness

DRBG, RNG, RBG
Elliptic Curves

P-384
Block cipher modes

GCM, XTS
Trusted Execution Environments

PSP
Security level

Level 2, Level 0
Side-channel analysis

Fault induction
Standards

FIPS 140-3, FIPS PUB 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS140-3, SP 800-38A, SP 800-38F, SP 800-38E, SP 800-90B, SP 800-90A, SP 800-108, SP 800-56B, SP 800-132, ISO/IEC 19790, ISO/IEC 24759
Cross-references

Outgoing
384 - historical - IBM® Crypto for C (ICC)
Creation date	D:20261006070809-04'00'
Modification date	D:20261006070809-04'00'
Pages	58
Creator	Microsoft® Word for Microsoft 365
Producer	Microsoft® Word for Microsoft 365
Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.
No automatically derived data are available in this section.
Cross-references

Processing updates

26.10.2026

The certificate was first processed.
Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5559,
  "dgst": "30c6570a99d5554c",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A5549",
        "#A5546",
        "HMAC-SHA2-512/256A5548",
        "HMAC-SHA2-384A5548",
        "ECDSA KeyVer (FIPS186-5)A5551",
        "#A5543",
        "#A2272",
        "AES-ECBC1278",
        "ECDSA SigGen (FIPS186-5)A5551",
        "SHA2-512/256A5544",
        "SHA2-384A5544",
        "#A5547",
        "#A5548",
        "#A5550",
        "#A5552",
        "#A5551",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2272",
        "AES-XTS Testing Revision 2.0A5545",
        "PBKDFA5552",
        "#A5545",
        "HMAC-SHA2-512A5548",
        "#C1278",
        "RSA SigVer (FIPS186-5)A5547",
        "AES-KWA5550",
        "Counter DRBGC1278",
        "KTS-IFCA5549",
        "ECDSA KeyGen (FIPS186-5)A5551",
        "#A5544",
        "SHA2-512A5544",
        "AES-CTRC1278",
        "ECDSA SigVer (FIPS186-5)A5551",
        "KDF SP800-108A5546"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "384"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "384"
        ]
      }
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": [
        "384"
      ]
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 2,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CTR, AES-ECB",
            "cavpCertName": "C1278",
            "properties": "Direction - Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A5543, A5545",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A5550",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 256 Payload Length - Payload Length: 256- 4096 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "AES-XTS Testing Revision 2.0",
            "cavpCertName": "A5543, A5545",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256 Payload Length - Payload Length: 4096-32896 Increment 128 Tweak Mode - Number Data Unit Length Matches Payload Length - Yes",
            "reference": "SP 800-38E"
          },
          {
            "algorithm": "Conditioning Component Block Cipher Derivation Function SP800-90B",
            "cavpCertName": "A2272",
            "properties": "Key Length - 128 Payload Length - Payload Length: 512",
            "reference": "SP 800-90B"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "C1278",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0- 256, Additional Input: 0-384 Entropy Input - Entropy Input: 256, Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0-256, Personalization String Length: 0-384 Returned Bits - 512",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A5551",
            "properties": "Curve - P-384 Secret Generation Mode - extra bits",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186-5)",
            "cavpCertName": "A5551",
            "properties": "Curve - P-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A5551",
            "properties": "Curve - P-384 Hash Algorithm - SHA2-384 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A5551",
            "properties": "Component - No Curve - P-384 Hash Algorithm - SHA2-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A5548",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 384",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A5548",
            "properties": "MAC - MAC: 512 Key Length - Key Length: 512",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512/256",
            "cavpCertName": "A5548",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 256",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A5546",
            "properties": "KDF Mode - Counter MAC Mode - HMAC-SHA2-384, HMAC- SHA2-512/256 Supported Lengths - Supported Lengths: 384 Fixed Data Order - Before Fixed Data Counter Length - 8 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "KTS-IFC",
            "cavpCertName": "A5549",
            "properties": "Function - partialVal IUT ID - 6500 Modulo - 3072, 4096 Key Generation Methods - rsakpg1- basic Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - initiator Key Transport Method - Hash Algorithms - SHA2-384 Supports Null Associated Data - Yes Associated Data Pattern - uPartyInfo||vPartyInfo Associated Data Encoding - concatenation Key Length - 256",
            "reference": "SP 800-56B Rev. 2"
          },
          {
            "algorithm": "PBKDF",
            "cavpCertName": "A5552",
            "properties": "Iteration Count - Iteration Count: 100- 1000 Increment 1 HMAC Algorithm - SHA2-512/256 Password Length - Password Length: 8- 32 Increment 1 Salt Length - Salt Length: 128-3952 Increment 8 Key Data Length - Key Data Length: 256",
            "reference": "SP 800-132"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A5547",
            "properties": "Hash Pair - Hash Algorithm - SHA2-384 Modulo - 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A5544",
            "properties": "Message Length - Message Length: 384, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A5544",
            "properties": "Message Length - Message Length: 512, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512/256",
            "cavpCertName": "A5544",
            "properties": "Message Length - Message Length: 256, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Run KAT tests on all cryptograph ic algorithms and firmware integrity test",
            "indicator": "CCS",
            "inputs": "Power",
            "name": "Module Self-Test",
            "outputs": "Pass/Fail status",
            "rolesSspAccess": "Controller",
            "secFunImpl": "KTS1 KTS2 RNG ENT SHS HMAC DPE DPD KDF PBKDF RSAVer ECDSASi gVer ECDSASi gGen ECDSA- KeyGen CKG CKG - Combined"
          },
          {
            "description": "Get information about the operational state of the drive This includes Module identifier, hardware and firmware",
            "indicator": "CCS",
            "inputs": "Comma nd",
            "name": "Get Status",
            "outputs": "Comman d response with module status informati on",
            "rolesSspAccess": "Controller",
            "secFunImpl": "None"
          },
          {
            "description": "revision values.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Unwrap TCG SSP using PBKDF derived key",
            "indicator": "CCS",
            "inputs": "Passwor d",
            "name": "TCG Authenticat e",
            "outputs": "Pass/Fail Status",
            "rolesSspAccess": "Controller - Password: E - SumRdsKey: W - RdsKey: W - PasswordWrapKey: G,E,Z - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": "KTS1 KDF PBKDF CKG"
          },
          {
            "description": "Remove status of all past authenticati on and their privileges",
            "indicator": "CCS",
            "inputs": "End Session",
            "name": "Clear TCG Authenticati ons",
            "outputs": "Pass/Fail Status",
            "rolesSspAccess": "Controller",
            "secFunImpl": "None"
          },
          {
            "description": "Generate a key, wrap key and associate key with an entity",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "NVMe Allocate and associate Key",
            "outputs": "Pass/Fail Status",
            "rolesSspAccess": "Controller - SumRdsKey: G,E,R - RdsKey: G,E,R - DRBG-State: E - WrapKey: E - NamespaceDEK: G,R - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": "KTS1 RNG CKG"
          },
          {
            "description": "Zeroize key and disassociat e key from an entity",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "NVMe Deallocate and disassociat e Key",
            "outputs": "Pass/Fail Status",
            "rolesSspAccess": "Controller - WrapKey: E - NamespaceDEK: Z - AuthenticatedUseH macKey: E",
            "secFunImpl": "KTS1 DPE"
          },
          {
            "description": "Erase user data in a namespace by changing the",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "NVMe Update Key",
            "outputs": "Pass/Fail Status",
            "rolesSspAccess": "Controller - SumRdsKey: W,E - RdsKey: E - DRBG-State: E - WrapKey: E - NamespaceDEK:",
            "secFunImpl": "KTS1 RNG CKG"
          },
          {
            "description": "encryption key",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "G,R,Z - LockingObjectDEK: G,R,Z - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": ""
          },
          {
            "description": "Generate an HMAC over the prescribed content",
            "indicator": "CCS",
            "inputs": "Content",
            "name": "Public HMAC Generation",
            "outputs": "Mac of content",
            "rolesSspAccess": "Controller - RootPublicMacKey: E - PspHmacKey: E",
            "secFunImpl": "HMAC"
          },
          {
            "description": "Load DEK into DPE for indicated range",
            "indicator": "CCS",
            "inputs": "Range and Keyinfo",
            "name": "Load Range and Key",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - SumRdsKey: W,E - RdsKey: E - TweakKey: W - WrapKey: E - NamespaceDEK: W - LockingObjectDEK: W - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": "KTS1"
          },
          {
            "description": "Save, restore security operational context",
            "indicator": "CCS",
            "inputs": "Content pointer",
            "name": "AWOR",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - SumRdsKey: W,R - RdsKey: W,R - TweakKey: W,R - PspHmacKey: W,R - RootHmacKey: E - RootKeyWrapKey: G,E - RootPublicMacKey: E - EphemeralSumRdsk WrapKey: W,R",
            "secFunImpl": "KTS1 HMAC KDF CKG CKG - Combined"
          },
          {
            "description": "Generate a key, wrap key and associate",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "TCG Allocate and associate Key",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - SumRdsKey: G,E,R - RdsKey: G,E,R - DRBG-State: E",
            "secFunImpl": "KTS1 RNG CKG"
          },
          {
            "description": "key with an entity",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- WrapKey: E - LockingObjectDEK: G,R - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": ""
          },
          {
            "description": "Zeroize key and disassociat e key from an entity",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "TCG Deallocate and disassociat e Key",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - WrapKey: E - LockingObjectDEK: Z,R - AuthenticatedUseH macKey: E",
            "secFunImpl": "KTS1"
          },
          {
            "description": "Erase user data in a namespace by changing the encryption key",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "TCG Update Key",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - SumRdsKey: W,E - RdsKey: E - DRBG-State: E - WrapKey: E - LockingObjectDEK: G,R,Z - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": "KTS1 RNG CKG"
          },
          {
            "description": "Set PIN which is used in generating a key to wrap a TCG credential",
            "indicator": "CCS",
            "inputs": "Passwor d and passwor d length",
            "name": "TCG Set PIN",
            "outputs": "Status indicator",
            "rolesSspAccess": "Controller - SumRdsKey: W,G - RdsKey: W,G - DRBG-State: E - WrapKey: E - Password: W,E,Z - PasswordWrapKey: G,E,Z - AuthenticatedUseH macKey: E - EphemeralSumRdsk WrapKey: E",
            "secFunImpl": "KTS1 RNG HMAC KDF PBKDF CKG"
          },
          {
            "description": "Revert to FOB, Revert to FOB with TCG Activated",
            "indicator": "CCS",
            "inputs": "Access control list",
            "name": "TCG Revert, Activate, Reactivate",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - SumRdsKey: Z - RdsKey: Z - WrapKey: E - DRBG-State: E - NamespaceDEK: G,Z - RootHmacKey: E - LockingObjectDEK: G,Z - AuthenticatedUseH macKey: E",
            "secFunImpl": "KTS1 RNG HMAC CKG"
          },
          {
            "description": "Restore Persistent CSP",
            "indicator": "CCS",
            "inputs": "CSP List",
            "name": "CSP Load",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - RootHmacKey: E - RootKeyWrapKey: E - WrapKey: W - DRBG-State: E - TweakKey: W - PspHmacKey: W",
            "secFunImpl": "KTS1 HMAC"
          },
          {
            "description": "Generate a new KeyDerivati onKey",
            "indicator": "CCS",
            "inputs": "Value",
            "name": "Generate KeyDerivati onKey",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - RootHmacKey: G,E - RootKeyWrapKey: G,E - RootPublicMacKey: G - WrapKey: G,E - KeyDerivationKey: G,E - Entropy Input and Seed: E - DRBG-State: G,E - TweakKey: G - PspHmacKey: G - AuthenticatedUseH macKey: G,E - EphemeralSumRdsk WrapKey: G,E",
            "secFunImpl": "KDF CKG"
          },
          {
            "description": "Device cryptograph ic identity",
            "indicator": "CCS",
            "inputs": "Index",
            "name": "Attestation",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - KDeviceIDPrivate: G,E,Z",
            "secFunImpl": "KTS1 RNG SHS"
          },
          {
            "description": "and attestation",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- KDeviceIDPublic: G - KAliasPrivate: G,E - KAliasPublic: G - KDeviceIDWrapKey: G,E,Z - DRBG-State: E - UDS: G,E,Z",
            "secFunImpl": "ECDSASi gVer ECDSASi gGen ECDSA- KeyGen CKG - Combined"
          },
          {
            "description": "Encryption / Decryption of user data to / from a user data range",
            "indicator": "CCS",
            "inputs": "Data packet",
            "name": "User Write/Read",
            "outputs": "Data Packet",
            "rolesSspAccess": "Controller - NamespaceDEK: E - LockingObjectDEK: E - TweakKey: E",
            "secFunImpl": "DPE DPD"
          },
          {
            "description": "KTS-RSA wrap an internally generated random",
            "indicator": "CCS",
            "inputs": "None",
            "name": "SUP Generate",
            "outputs": "Encrypte d password context Status",
            "rolesSspAccess": "Controller - KDeviceWrappingP ub: E - PasswordWrapKey: G,E,Z - SUP Seed: G,R - DRBG-State: E",
            "secFunImpl": "KTS1 KTS2 RNG KDF PBKDF CKG"
          },
          {
            "description": "Unwrap SUP blob using KBKDF derived key",
            "indicator": "CCS",
            "inputs": "Passwor d",
            "name": "SUP Authenticat e",
            "outputs": "Authentic ation result",
            "rolesSspAccess": "Controller - PasswordWrapKey: G,E - Password: W,E",
            "secFunImpl": "KTS1 KDF PBKDF"
          },
          {
            "description": "Returns a 256-bit random number",
            "indicator": "CCS",
            "inputs": "Size",
            "name": "Random",
            "outputs": "DRBG output",
            "rolesSspAccess": "Controller - DRBG-State: E",
            "secFunImpl": "RNG"
          },
          {
            "description": "Destroys all keys. Must be performed under the direct control of the operator",
            "indicator": "CCS",
            "inputs": "None",
            "name": "Zeroize",
            "outputs": "None",
            "rolesSspAccess": "Controller - AuthenticatedUseH macKey: Z - DRBG-State: Z - EphemeralSumRdsk WrapKey: Z - Entropy Input and Seed: Z - KeyDerivationKey: Z -",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "LockingObjectDEK: Z - NamespaceDEK: Z - Password: Z - PasswordWrapKey: Z - PspHmacKey: Z - RdsKey: Z - RootHmacKey: Z - RootKeyWrapKey: Z - SumRdsKey: Z - SUP Seed: Z - TweakKey: Z - WrapKey: Z - KFWModuleVerify: Z - KFWControllerVerify : Z - KAuthPub: Z - KVSAuthPub: Z - KDeviceWrappingP ub: Z - KManifestPub: Z - KFWCBootloaderVe rify: Z - UDS: Z - KDeviceIDWrapKey: Z - KDeviceIDPrivate: Z - KAliasPrivate: Z - KDeviceIDPublic: Z - KAliasPublic: Z - RootPublicMacKey: Z",
            "secFunImpl": ""
          },
          {
            "description": "Deprovision the device, zeroize all SSPs",
            "indicator": "CCS",
            "inputs": "None",
            "name": "Module Deprovision",
            "outputs": "None",
            "rolesSspAccess": "Controller - AuthenticatedUseH macKey: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Descriptio n",
            "indicator": "Indic ator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- DRBG-State: Z - EphemeralSumRdsk WrapKey: Z - Entropy Input and Seed: Z - LockingObjectDEK: Z - NamespaceDEK: Z - Password: Z - PasswordWrapKey: Z - PspHmacKey: Z - RdsKey: Z - RootHmacKey: Z - RootKeyWrapKey: Z - SumRdsKey: Z - SUP Seed: Z - TweakKey: Z - WrapKey: Z - KFWModuleVerify: Z - KFWControllerVerify : Z - KAuthPub: Z - KVSAuthPub: Z - KDeviceWrappingP ub: Z - KManifestPub: Z - KFWCBootloaderVe rify: Z - KDeviceIDWrapKey: Z - KDeviceIDPrivate: Z - KAliasPrivate: Z - KDeviceIDPublic: Z - KAliasPublic: Z -",
            "secFunImpl": "s"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "RootPublicMacKey: Z",
            "secFunImpl": ""
          },
          {
            "description": "Authenticati on for factory- restricted services",
            "indicator": "CCS",
            "inputs": "Authoriz ation signatur e",
            "name": "Factory Auth",
            "outputs": "Random Value",
            "rolesSspAccess": "Controller - KAuthPub: E - KVSAuthPub: E - DRBG-State: E",
            "secFunImpl": "RNG RSAVer"
          },
          {
            "description": "Verify firmware image signature",
            "indicator": "CCS",
            "inputs": "Firmwar e Image Location",
            "name": "Firmware Signature Check",
            "outputs": "Status",
            "rolesSspAccess": "Controller - KFWModuleVerify: E - KFWControllerVerify : E - KFWCBootloaderVe rify: E",
            "secFunImpl": "RSAVer"
          },
          {
            "description": "Verify and load trusted set of PKS",
            "indicator": "CCS",
            "inputs": "Manifest Location",
            "name": "Manifest Load",
            "outputs": "Status",
            "rolesSspAccess": "Controller - KManifestPub_ROM : E - KManifestPub: E - KDeviceWrappingP ub: R - KFWCBootloaderVe rify: R - KFWModuleVerify: R - KVSAuthPub: R - KAuthPub: R - KFWControllerVerify : R",
            "secFunImpl": "RSAVer"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The User role is authenticated to the msg in interface with cryptographic signature generation",
            "mechanism": "RSAVer",
            "name": "Controller authentication",
            "perMinute": "This verification has an associated retry limit of 5. This controls the number of unsuccessful attempts before authentication is blocked until a system restart occurs. This results in a probability of 5/2^128 that multiple attempts in a given minute of time is successful.",
            "strength": "RSA 3072/4096 has a key strength of 128/150 bits. The probability of a successful verification from a single random attempt is at least 1/2^128. This effectively eliminates the possibility of determining the private key through exhaustive methods."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-KW (A5550) - Encrypt",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 KW Encrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW (A5550) - Decrypt",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 KW Decrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Testing Revision 2.0 - Encryption",
            "condition": "At boot up",
            "details": "256-bit AES-XTS encryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "Comparison",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Testing Revision 2.0 - Decryption",
            "condition": "At boot up",
            "details": "256-bit AES-XTS decryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "Comparison",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Conditioning Component Block Cipher Derivation Function SP800- 90B (A2272)",
            "condition": "At boot up",
            "details": "SP800-90B Conditioning Component (AES-128)",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES 128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (C1278)",
            "condition": "At boot up",
            "details": "AES-256 CTR_DRBG KAT SP800-90A Health Tests. Instantiate, Reseed, Generate as a full test",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "Counter DRBG - AES 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A5551)",
            "condition": "When a new ECDSA key pair is generated",
            "details": "A pairwise consistency check is performed on ECDSA private/public key on",
            "indicator": "Success or Failure Code",
            "testMethod": "PCT",
            "testProps": "ECDSA P-384",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A5551)",
            "condition": "At boot up",
            "details": "P-384 Signature Generation KAT with SHA-384",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "ECDSA P-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A5551)",
            "condition": "At boot up",
            "details": "P-384 Signature Verification KAT with SHA-384",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "ECDSA P-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-384 (A5548)",
            "condition": "At boot up",
            "details": "HMAC SHA2-384 KAT performed prior to Firmware Integrity test",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "HMAC SHA2-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-512 (A5548)",
            "condition": "At boot up",
            "details": "HMAC SHA2-512 KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "HMAC SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SP800-108 (A5546)",
            "condition": "At boot up",
            "details": "Counter mode KBKDF KAT. Inclusive of HMAC-SHA2-384 KAT.",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA2-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "PBKDF (A5552)",
            "condition": "At boot up",
            "details": "Option 1a using HMAC SHA2-512/256",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "HMAC SHA2- 512/256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-5) (A5547)",
            "condition": "At boot up before Pre- Operational firmware integrity test.",
            "details": "3072 RSA PKCS#1_v1.5 Verification with SHA-384 KAT the Module only supports the public key operation for RSA Signature Verification and KTS-RSA Wrap",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "3072 RSA PKCS#1_v1.5 Verification with SHA-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "BootLoader Firmware Load test",
            "condition": "At boot up",
            "details": "A 3072/ 4096-bit RSA or ECDSA P384 Signature Verification is executed on the bootloader copied into the Module",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer (FIPS186-5) (A5547)",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "Runtime Firmware Load test",
            "condition": "At boot up",
            "details": "A 3072/ 4096-bit RSA or ECDSA P384 Signature Verification is executed on the SEE firmware copied into the Module",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer (FIPS186-5) (A5547)",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "XTS Duplicate Key",
            "condition": "Upon generation of XTS key",
            "details": "Duplicate Key Test",
            "indicator": "Success or Failure Code",
            "testMethod": "CT",
            "testProps": "",
            "type": "Critical Function"
          },
          {
            "algorithmOrTest": "Entropy 90B Start- up Repetition Count Test (RCT)",
            "condition": "At boot up",
            "details": "As specified in [90B] RCT startup health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Repetition Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Start- up Adaptive Proportion Test (APT)",
            "condition": "At boot up",
            "details": "As specified in [90B] APT startup health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Adaptive Proportion Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RCT)",
            "condition": "Continuous when entropy is requested",
            "details": "As specified in [90B] RCT continuous health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Repetition Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Adaptive Proportion Test (APT)",
            "condition": "Continuous when entropy is requested",
            "details": "As specified in [90B] APT continuous health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Adaptive Proportion Test",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Triggered by cryptographic KAT failure.",
            "description": "The ROM fails a KAT",
            "indicator": "A Cryptographic Self-test Failure status is indicated in response to any service request.",
            "name": "ES1",
            "recoveryMethod": "Reboot/Power cycle the module"
          },
          {
            "conditions": "Firmware load and integrity check fails when the firmware fails to verify",
            "description": "The Module fails the firmware load test or the Firmware Integrity test",
            "indicator": "The Module enters the ES2 error state and outputs a verification failure status in response to the firmware service.",
            "name": "ES2",
            "recoveryMethod": "Reboot/Power cycle the module"
          },
          {
            "conditions": "Triggered by cryptographic KAT failure.",
            "description": "The Module fails conditional KAT self-test. Non-operational state. No services beside status services are allowed",
            "indicator": "The Module enters the ES3 error state and will output a self-test failure status to any service request",
            "name": "ES3",
            "recoveryMethod": "Reboot/Power cycle the module"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "On initial receipt of the device and yearly afterwards",
            "inspectGuidance": "Inspect for evidence of prying or removal of the chip packaging. If tampering is suspected, then the device containing the IC should be removed from service and the site administrator should be contacted. See Example below.",
            "mechanism": "IC packaging"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "User Data",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "AESE (encryption engine)"
          },
          {
            "data": "User Data",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "AESD (encryption engine)"
          },
          {
            "data": "Service info input",
            "logicalInterface": "Control Input Status Output",
            "physicalPort": "Mbox (Mailbox)"
          },
          {
            "data": "Service info output",
            "logicalInterface": "Data Output",
            "physicalPort": "Controller output (response to Mbox)"
          },
          {
            "data": "None",
            "logicalInterface": "Control Input",
            "physicalPort": "Reset/Interrupt"
          },
          {
            "data": "Service info data (command/response)",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "BMG-128 (S-DMA Interface)"
          },
          {
            "data": "None",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          },
          {
            "data": "Firmware Images",
            "logicalInterface": "Data Input",
            "physicalPort": "LDPC Decoder"
          },
          {
            "data": "Status Data",
            "logicalInterface": "Status Output",
            "physicalPort": "UART"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Controller authentication",
            "name": "Controller",
            "operatorType": "CO",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "2",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "2",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Bootloader Firmware integrity test",
            "details": "Executed on the whole firmware stored in the Module",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer PKCS1_v1.5 or PSS (FIPS186-5) (A5547)",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Module run time firmware integrity test",
            "details": "Executed on the whole firmware stored in the Module",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer PKCS1_v1.5 or PSS (FIPS186-5) (A5547)",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Sub Chip security sub system RAM (S1)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Input in Plaintext(IO1)",
            "sfiAlgo": "",
            "source": "Outside the module boundary in ASIC Internal SRAM"
          },
          {
            "dest": "Sub Chip security sub system RAM (S1)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input using SP800-38F AES key Transport (IO2)",
            "sfiAlgo": "KTS1",
            "source": "Outside the module boundary in ASIC Internal SRAM"
          },
          {
            "dest": "Outside the module boundary in ASIC Internal SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output using SP800-38F Key Transport (IO3)",
            "sfiAlgo": "KTS1",
            "source": "Sub Chip security sub system RAM (S1)"
          },
          {
            "dest": "Outside the module boundary in ASIC Internal SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output encapsulated by RSA (IO4)",
            "sfiAlgo": "KTS2",
            "source": "Sub Chip security sub system RAM (S1)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroized by Module power cycle or hard reset.",
            "method": "Z1",
            "operatorId": "Implicit",
            "rationale": "When module is reset, all data stored in volatile module memory (RAM) will be lost"
          },
          {
            "description": "Zeroized by the zeroization service by overwriting with a fixed pattern of zeros.",
            "method": "Z2",
            "operatorId": "Explicit",
            "rationale": "Each SSP is overwritten with a fixed value of 1s or 0s"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Stored in volatile memory (RAM).",
            "name": "Sub Chip security sub system RAM (S1)",
            "persistance": "Dynamic"
          },
          {
            "description": "Stored in e-fuse in Plaintext",
            "name": "Sub Chip security sub system e-Fuse (S2)",
            "persistance": "Static"
          },
          {
            "description": "Stored in register in Plaintext",
            "name": "Sub Chip security sub system register (S3)",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "NVMe interface at the physical boundary",
            "fwVersion": "Function ROM v3.0 Boot ROM v1.0 Bootloader V2.0 Runtime SCCS v3.0",
            "hwVersion": "0x20201112",
            "modelPartNum": "Micron\u00ae MTC22-P4 Controller Sub Chip Security Subsystem",
            "processors": "Micron\u00ae MTC-22 P4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Asymmetric and Symmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "SP800-133rev2 Section 4 example 1 and IG D.H"
          },
          {
            "algoPropList": "Key Type:Symmetric Key Generation for AES-XTS usage",
            "implName": "N/A",
            "name": "CKG- Combined",
            "reference": "SP 800-133rev2 Section 6.3 example #1 and IG C.I"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECDSA": {
            "ECDSA": 25
          }
        },
        "RSA": {
          "RSA 3072": 1,
          "RSA-PSS": 2
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "GCM": {
          "GCM": 1
        },
        "XTS": {
          "XTS": 4
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 2
        },
        "MAC": {
          "MAC": 5
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-384": 18
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#1": 1,
          "#5550": 1,
          "Certificate 384": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES 128": 1,
          "AES 256": 2,
          "AES-128": 2,
          "AES-256": 10,
          "RSA 3072": 1,
          "SHA-384": 4,
          "SHA2-384": 7,
          "SHA2-512": 3
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 0": 2,
          "Level 2": 3
        }
      },
      "hash_function": {
        "PBKDF": {
          "PBKDF": 11
        },
        "SHA": {
          "SHA2": {
            "SHA-384": 4
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 17
        },
        "RNG": {
          "RBG": 2,
          "RNG": 15
        }
      },
      "side_channel_analysis": {
        "FI": {
          "Fault induction": 8
        }
      },
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 10,
          "FIPS 180-4": 3,
          "FIPS 186-5": 8,
          "FIPS 198-1": 3,
          "FIPS PUB 140-3": 2,
          "FIPS140-3": 1,
          "FIPS186-5": 22
        },
        "ISO": {
          "ISO/IEC 19790": 2,
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "SP 800-108": 1,
          "SP 800-132": 1,
          "SP 800-38A": 2,
          "SP 800-38E": 1,
          "SP 800-38F": 1,
          "SP 800-56B": 1,
          "SP 800-90A": 1,
          "SP 800-90B": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 14,
            "AES-128": 2,
            "AES-256": 10
          },
          "CAST": {
            "CAST": 34
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 26
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 10
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-512/256A5548",
        "HMAC-SHA2-384A5548",
        "ECDSA KeyVer (FIPS186-5)A5551",
        "AES-ECBC1278",
        "ECDSA SigGen (FIPS186-5)A5551",
        "SHA2-512/256A5544",
        "SHA2-384A5544",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2272",
        "AES-XTS Testing Revision 2.0A5545",
        "PBKDFA5552",
        "HMAC-SHA2-512A5548",
        "RSA SigVer (FIPS186-5)A5547",
        "AES-KWA5550",
        "Counter DRBGC1278",
        "KTS-IFCA5549",
        "ECDSA KeyGen (FIPS186-5)A5551",
        "SHA2-512A5544",
        "AES-CTRC1278",
        "ECDSA SigVer (FIPS186-5)A5551",
        "KDF SP800-108A5546"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A5549",
        "#A5546",
        "#A5545",
        "#C1278",
        "#A5547",
        "#A5548",
        "#A5550",
        "#A5552",
        "#A5544",
        "#A5543",
        "#A2272",
        "#A5551"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261006070809-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261006070809-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 890271,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": []
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 58
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "655b8c965655896ba27d83267573370fd17571eb2ec89e2de8080b758daf34a3",
      "source_hash": "c4544161f1c1ce0069e0eabe6b396468945aca0585ef50dc2af1aba57823d82b",
      "txt_hash": "6234bdbb814a200495137552b06d5e1644055768fce766412bf2a0bdb1d08822"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-19",
    "description": "Micron\u00ae MTC22-P4 Controller Sub Chip Security Subsystem provides cryptographic functionality to SSD controller.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Micron\u00ae MTC22-P4 Controller Sub Chip Security Subsystem",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-20",
        "lab": "Lightship Security, Inc.",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Micron Technology, Inc.",
    "vendor_url": "http://www.micron.com"
  }
}
Sections

Micron® MTC22-P4 Controller Sub Chip Security Subsystem

Certificate details

Security policy

Extracted keywords

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Schemes

Randomness

Elliptic Curves

Block cipher modes

Trusted Execution Environments

Security level

Side-channel analysis

Standards

Cross-references

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

New certificate

Raw data

Sections

Micron® MTC22-P4 Controller Sub Chip Security Subsystem

Certificate details

Security policy

Extracted keywords

Cryptography

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Schemes

Randomness

Elliptic Curves

Block cipher modes

Device

Trusted Execution Environments

Security

Security level

Side-channel analysis

Other

Standards

Cross-references

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Raw data

Toggle raw data
