Micron® MSA11-P5 Controller Sub Chip Security Subsystem

Certificate details

Certificate ID #5522
Status active
Validation dates 14.09.2026
Sunset date 13-09-2031
Standard FIPS 140-3
Security level 2
Type Hardware
Embodiment SingleChip
Caveat No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions
  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description Micron® MSA11-P5 Controller Sub Chip Security provides cryptographic functionality to SSD controllers.
Vendor Micron Technology, Inc. http://www.micron.com
Lab Lightship Security, Inc.
Algorithms
  • AES-CTRC1278
  • AES-ECBC1278
  • AES-GCMA6144
  • AES-KWA6149
  • AES-XTS Testing Revision 2.0A6146
  • Conditioning Component Block Cipher Derivation Function SP800-90BA2272
  • Counter DRBGC1278
  • ECDSA KeyGen (FIPS186-5)A6142
  • ECDSA KeyVer (FIPS186-5)A6142
  • ECDSA SigGen (FIPS186-5)A6142
  • ECDSA SigVer (FIPS186-5)A6142
  • HMAC-SHA2-384A6151
  • HMAC-SHA2-512/256A6151
  • KDF SP800-108A6148
  • KTS-IFCA6150
  • RSA SigVer (FIPS186-5)A6147
  • SHA2-384A6145
  • SHA2-512/256A6145
  • SHA2-512A6145
References

This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES-128, AES-256, AES, CAST, HMAC
Asymmetric Algorithms
RSA 3072, ECDSA
Hash functions
SHA384, SHA-384, SHA2
Schemes
MAC, Key Agreement
Randomness
DRBG, RNG, RBG
Elliptic Curves
P-384
Block cipher modes
GCM, XTS

Trusted Execution Environments
PSP

Security level
Level 2, Level 3, Level 0
Side-channel analysis
Fault induction

Author Hawes, David J. (Fed)
Creation date D:20260908160040-04'00'
Modification date D:20260908160040-04'00'
Pages 61
Creator Microsoft® Word for Microsoft 365
Producer Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

No references are available for this certificate.

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5522,
  "dgst": "34ff3bb3732ca543",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A6144",
        "#A6146",
        "KTS-IFCA6150",
        "#A6150",
        "#A6148",
        "#A6143",
        "ECDSA KeyGen (FIPS186-5)A6142",
        "AES-ECBC1278",
        "Counter DRBGC1278",
        "#C1278",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2272",
        "#A6147",
        "HMAC-SHA2-384A6151",
        "AES-KWA6149",
        "ECDSA SigGen (FIPS186-5)A6142",
        "#A6145",
        "KDF SP800-108A6148",
        "#A6142",
        "SHA2-384A6145",
        "#A2272",
        "AES-XTS Testing Revision 2.0A6146",
        "#A6151",
        "SHA2-512A6145",
        "SHA2-512/256A6145",
        "AES-GCMA6144",
        "RSA SigVer (FIPS186-5)A6147",
        "AES-CTRC1278",
        "HMAC-SHA2-512/256A6151",
        "ECDSA SigVer (FIPS186-5)A6142",
        "ECDSA KeyVer (FIPS186-5)A6142",
        "#A6149"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 1,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "C1278",
            "properties": "Direction - Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A6144",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A6146",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "C1278",
            "properties": "Direction - Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A6144",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 256-65536 Increment 128 AAD Length - AAD Length: 0",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A6149",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 256 Payload Length - Payload Length: 256-4096 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "AES-XTS Testing Revision 2.0",
            "cavpCertName": "A6144",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256 Payload Length - Payload Length: 4096-32896 Increment 128 Tweak Mode - Hex Data Unit Length Matches Payload Length - Yes",
            "reference": "SP 800-38E"
          },
          {
            "algorithm": "AES-XTS Testing Revision 2.0",
            "cavpCertName": "A6146",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256 Payload Length - Payload Length: 4096-32896 Increment 128 Tweak Mode - Number Data Unit Length Matches Payload Length - Yes",
            "reference": "SP 800-38E"
          },
          {
            "algorithm": "Conditioning Component Block Cipher Derivation Function SP800-90B",
            "cavpCertName": "A2272",
            "properties": "Key Length - 128 Payload Length - Payload Length: 512",
            "reference": "SP 800-90B"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "C1278",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0- 256, Additional Input: 0-384 Entropy Input - Entropy Input: 256, Entropy Input: 384",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0-256, Personalization String Length: 0-384 Returned Bits - 512",
            "reference": ""
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A6142",
            "properties": "Curve - P-384 Secret Generation Mode - extra bits",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186- 5)",
            "cavpCertName": "A6142",
            "properties": "Curve - P-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186- 5)",
            "cavpCertName": "A6142",
            "properties": "Curve - P-384 Hash Algorithm - SHA2-384 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186- 5)",
            "cavpCertName": "A6142",
            "properties": "Curve - P-384 Hash Algorithm - SHA2-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A6151",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 384",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512/256",
            "cavpCertName": "A6151",
            "properties": "MAC - MAC: 256 Key Length - Key Length:",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A6148",
            "properties": "256 KDF Mode - Counter MAC Mode - HMAC-SHA2-384, HMAC-SHA2-512/256 Supported Lengths - Supported Lengths: 256-384 Increment 128 Fixed Data Order - Before Fixed Data Counter Length - 8 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "KTS-IFC",
            "cavpCertName": "A6150",
            "properties": "IUT ID - 9550 Modulo - 3072, 4096 Key Generation Methods - rsakpg1- basic Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - initiator Key Transport Method - Hash Algorithms - SHA2-384 Supports Null Associated Data - Yes Associated Data Pattern - Associated Data Encoding - concatenation Key Length - 256",
            "reference": "SP 800-56B Rev. 2"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A6147",
            "properties": "Hash Pair - Hash Algorithm - SHA2-384 Modulo - 3072, 4096 Signature Type - pkcs1v1.5, pss",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": ""
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A6143",
            "properties": "Message Length - Message Length: 384, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A6145",
            "properties": "Message Length - Message Length: 384, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A6145",
            "properties": "Message Length - Message Length: 512, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512/256",
            "cavpCertName": "A6145",
            "properties": "Message Length - Message Length: 256, 8-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Run KAT tests on all cryptographic algorithms and firmware integrity test",
            "indicator": "CCS",
            "inputs": "Power",
            "name": "Module Self- Test",
            "outputs": "Pass/Fail status",
            "rolesSspAccess": "Controller - DRBG-EI and seed: E - DRBG-State: G Unauthenticated - DRBG-EI and seed: E - DRBG-State: G",
            "secFunImpl": "KTS1 KTS2 KTS3 GCME GCMD RNG ENT SHS HMAC DPE DPD AuxE AuxD KDF RSAVer ECDSASigVer ECDSASigGen CKG"
          },
          {
            "description": "Get information about the operational state of the drive This includes Module identifier, hardware and firmware revision values.",
            "indicator": "CCS",
            "inputs": "Command",
            "name": "Get Status",
            "outputs": "Command response with module status information",
            "rolesSspAccess": "Controller",
            "secFunImpl": "None"
          },
          {
            "description": "Update and enforce authorization credential",
            "indicator": "CCS",
            "inputs": "Password and wrapped credentials",
            "name": "KeyMgmt",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - AdminKey: G,R,W,E - AuthKDK: G,R,W,E - AuthKey: G,R,W,E - PrivateKey: G,R,W,E - RdsKey: R,W - TCGWrapKey: E",
            "secFunImpl": "KTS1 KDF CKG"
          },
          {
            "description": "Load DEK into DPE for indicated range",
            "indicator": "CCS",
            "inputs": "Range and Key Info",
            "name": "Load Range Attributes",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - AuthKey: E - PrivateKey: W,E - AdminKey: W,E - TCGWrapKey: E - RdsKey: W,E - DEK: W",
            "secFunImpl": "KTS1"
          },
          {
            "description": "Generate Symmetric Module protected Key",
            "indicator": "CCS",
            "inputs": "Key Type",
            "name": "UpdateDEK",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - AuthKey: E - AdminKey: W,E - PrivateKey: W,E - RdsKey: G,R,W,E - TCGWrapKey: E - DEK: G,R",
            "secFunImpl": "KTS1 RNG CKG"
          },
          {
            "description": "Export module protected CSPs",
            "indicator": "CCS",
            "inputs": "CSP List",
            "name": "CSP-Export",
            "outputs": "CSP List",
            "rolesSspAccess": "Controller - TCGWrapKey: R,E - TCGHMACKey: R - OpenHMACKey: R - AdminKey: R,W",
            "secFunImpl": "KTS1 RNG CKG KTS2"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- PrivateKey: R,W,E - RdsKey: R,W,E - DEK: R - AuthKDK: E - RootKeyWrapKey: R,E - RootMACKey: R,E - RootPublicMacKey: R - aworWrappingKey: E - KDeviceIDPrivate: R - KDKDK: R - fsaKey: G,R,E",
            "secFunImpl": ""
          },
          {
            "description": "Import module protected CSPs",
            "indicator": "CCS",
            "inputs": "CSP List",
            "name": "CSP-Import",
            "outputs": "CSP List",
            "rolesSspAccess": "Controller - RootMACKey: W,E - RootKeyWrapKey: W,E - RootPublicMacKey: W - TCGWrapKey: W - TCGHMACKey: W - OpenHMACKey: W - KDeviceIDPrivate: W - aworWrappingKey: E - RdsKey: W - KDeviceIDPublic: W - fsaKey: W,E - KDKDK: W",
            "secFunImpl": "KTS1 KTS2"
          },
          {
            "description": "Encryption / Decryption of user data to / from a user data range",
            "indicator": "CCS",
            "inputs": "Data packet",
            "name": "User Write/Read",
            "outputs": "Data Packet",
            "rolesSspAccess": "Controller - DEK: E",
            "secFunImpl": "DPE DPD"
          },
          {
            "description": "KTS-IFC wrap an internally generated random",
            "indicator": "CCS",
            "inputs": "None",
            "name": "SUP Generate",
            "outputs": "Encrypted password context Status",
            "rolesSspAccess": "Controller - AuthKDK: G,E - AuthKey: G,E - TCGWrapKey: E - KDeviceWrappingPub: E - SUP Seed: R",
            "secFunImpl": "KTS3 RNG KDF"
          },
          {
            "description": "Unwrap SUP blob using KBKDF derived key",
            "indicator": "CCS",
            "inputs": "Password",
            "name": "SUP Authenticate",
            "outputs": "Authentication result",
            "rolesSspAccess": "Controller - AuthKDK: E - AuthKey: E - TCGWrapKey: E",
            "secFunImpl": "KDF"
          },
          {
            "description": "Returns a 256-bit random number",
            "indicator": "CCS",
            "inputs": "Size",
            "name": "Random",
            "outputs": "DRBG output",
            "rolesSspAccess": "Controller - DRBG-State: G,E - DRBG-EI and seed: E",
            "secFunImpl": "RNG"
          },
          {
            "description": "Generate an HMAC over the prescribed content",
            "indicator": "CCS",
            "inputs": "Data location",
            "name": "HMAC",
            "outputs": "Calculated HMAC",
            "rolesSspAccess": "Controller - OpenHMACKey: E - TCGHMACKey: E - RootPublicMacKey: E - aworHMACKey: E",
            "secFunImpl": "HMAC"
          },
          {
            "description": "Device cryptographic identity and attestation",
            "indicator": "CCS",
            "inputs": "Index",
            "name": "Attestation",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - KDeviceIDPrivate: G,E - KDeviceIDPublic: G,R,E - KAliasPrivate: G,E - KAliasPublic: G,R,E - UDS: G,E,Z - DRBG-State: E",
            "secFunImpl": "RNG SHS ECDSASigVer ECDSASigGen ECDSA- KeyGen"
          },
          {
            "description": "Destroys all keys. Must be performed",
            "indicator": "CCS",
            "inputs": "None",
            "name": "Zeroize",
            "outputs": "None",
            "rolesSspAccess": "Controller - RootKDK: Z",
            "secFunImpl": "None"
          },
          {
            "description": "under the direct control of the operator",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- RootMACKey: Z - RootPublicMacKey: Z - DRBG-EI and seed: Z - DRBG-State: Z - TCGWrapKey: Z - TCGHMACKey: Z - OpenHMACKey: Z - Password: Z - AuthKDK: Z - AuthKey: Z - AdminKey: Z - PrivateKey: Z - RdsKey: Z - DEK: Z - SUP Seed: Z - CDI: Z - DeviceIDWrapKey: Z - KDeviceIDPrivate: Z - KAliasPrivate: Z - KDKDK: Z - KDataDecryption: Z - aworWrappingKey: Z - aworHMACKey: Z - KProduct: Z - KBootloader: Z - KFWModuleVerify: Z - KFWControllerVerify: Z - KAuthPub: Z - KDeviceWrappingPub:",
            "secFunImpl": ""
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Z - KManifestPub: Z - fsaKey: - RootKeyWrapKey: Z",
            "secFunImpl": ""
          },
          {
            "description": "Deprovision the device, zeroize all SSPs",
            "indicator": "CCS",
            "inputs": "None",
            "name": "Module Deprovision",
            "outputs": "None",
            "rolesSspAccess": "Controller - RootKDK: Z - RootMACKey: Z - TCGWrapKey: Z - TCGHMACKey: Z - OpenHMACKey: Z - CDI: Z - DeviceIDWrapKey: Z - KDeviceIDPrivate: Z - KAliasPrivate: Z - KDeviceIDPublic: Z - KAliasPublic: Z - KDKDK: Z - KDataDecryption: Z - aworWrappingKey: Z - aworHMACKey: Z - KProduct: Z - KBootloader: Z - KFWModuleVerify: Z - KFWControllerVerify: Z - KAuthPub: Z - KDeviceWrappingPub: Z - KManifestPub: Z - RootKeyWrapKey: Z - RootPublicMacKey:",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Z - UDS: Z",
            "secFunImpl": ""
          },
          {
            "description": "Authentication for factory-restricted services",
            "indicator": "CCS",
            "inputs": "Authorization signature",
            "name": "Factory Auth",
            "outputs": "Random Value",
            "rolesSspAccess": "Controller - KAuthPub: E",
            "secFunImpl": "RNG RSAVer"
          },
          {
            "description": "Verify firmware image signature",
            "indicator": "CCS",
            "inputs": "Firmware Image Location",
            "name": "Firmware Signature Check",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - KFWModuleVerify: E - KFWControllerVerify: E - KProduct: E - KBootloader: E",
            "secFunImpl": "RSAVer ECDSASigVer"
          },
          {
            "description": "Decrypt image",
            "indicator": "CCS",
            "inputs": "Firmware Image Location",
            "name": "Image Decrypt",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - KDKDK: E - KDataDecryption: E",
            "secFunImpl": "GCMD"
          },
          {
            "description": "Encrypt image",
            "indicator": "CCS",
            "inputs": "Firmware Image Location",
            "name": "Image Encrypt",
            "outputs": "Status Indicator",
            "rolesSspAccess": "Controller - KDKDK: E - KDataDecryption: E",
            "secFunImpl": "GCME"
          },
          {
            "description": "Verify and load trusted set of PKS",
            "indicator": "CCS",
            "inputs": "Manifest Location",
            "name": "Manifest Load",
            "outputs": "Status",
            "rolesSspAccess": "Controller - KManifestPub: E - KManifestPub_ROM: E",
            "secFunImpl": "RSAVer ECDSASigVer"
          },
          {
            "description": "Raw cryptographic algorithm service with no assurance of security",
            "indicator": "CCS",
            "inputs": "Cryptographic algorithm and parameter",
            "name": "RawCrypto",
            "outputs": "Status Indicator and result",
            "rolesSspAccess": "Controller",
            "secFunImpl": "None"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "This role is authenticated to the msg in interface with cryptographic signature generation",
            "mechanism": "RSA SigVer and ECDSA SigVer",
            "name": "Controller authentication",
            "perMinute": "The strength per minute is 5/2^128 for RSA and 5/2^192 for ECDSA. This controls the number of unsuccessful attempts before authentication is blocked until a system restart occurs.",
            "strength": "RSA 3072/4096 has a key strength of 128/150 bits. The probability of a successful verification from a single random attempt is at least 1/2^128. ECDSA P- 384 has a key strength of 192 bits. The probability of a successful verification from a single random attempt is at least 1/2^192. This effectively eliminates the possibility of determining the private key through exhaustive methods."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-GCM Encrypt",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 GCM Encrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Decrypt",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 GCM Decrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW Encryption",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 KW Encrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW Decryption",
            "condition": "At boot up",
            "details": "(Auxiliary) AES-256 KW Decrypt KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS DPE Encryption",
            "condition": "At boot up",
            "details": "DPE 256-bit AES-XTS encryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS DPE Decryption",
            "condition": "At boot up",
            "details": "DPE 256-bit AES-XTS decryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Aux Encryption",
            "condition": "At boot up",
            "details": "(Auxiliary) 256-bit AES-XTS encryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Aux Decryption",
            "condition": "At boot up",
            "details": "(Auxiliary) 256-bit AES-XTS decryption KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES-256 Decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Conditioning Component Block Cipher Derivation Function SP800- 90B (A2272)",
            "condition": "At boot up",
            "details": "SP800-90B Conditioning Component (AES-128)",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "AES 128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (C1278)",
            "condition": "At boot up",
            "details": "AES-256 CTR_DRBG KAT SP800-90A Health Tests. Instantiate, Reseed, Generate as a full test",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "Counter DRBG - AES 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A6142)",
            "condition": "When a new ECDSA key pair is generated",
            "details": "A pairwise consistency check is performed on ECDSA private/public key on generation",
            "indicator": "Success or Failure Code",
            "testMethod": "PCT",
            "testProps": "ECDSA P-384",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186-5)",
            "condition": "At boot up",
            "details": "P-384 Signature Generation KAT with SHA-384",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "ECDSA P-384 Signature Generation",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186-5)",
            "condition": "At boot up before Pre-Operational firmware integrity test.",
            "details": "P-384 Signature Verification KAT with SHA-384",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "ECDSA P-384 Signature Verification KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2 ROM",
            "condition": "At boot up",
            "details": "HMAC SHA2-384 KAT",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "HMAC SHA2-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SP800-108",
            "condition": "At boot up",
            "details": "Counter mode KBKDF KAT. Inclusive of HMAC-SHA2- 384 KAT.",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "with HMAC-SHA2- 384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-384 FW",
            "condition": "At boot up",
            "details": "SHA2-384 KAT for the Firmware SHA",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "SHA2-384 Performed during boot before the pre- operational integrity checks (ROM)",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2 ROM",
            "condition": "At boot up",
            "details": "SHA2-512 for the SHA engine",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-5) (A6147)",
            "condition": "At boot up before Pre-Operational firmware integrity test.",
            "details": "3072 RSA PKCS#1_v1.5 Verification with SHA-384 KAT the Module only supports the public key operation for RSA Signature Verification and KTS-RSA Wrap",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "3072 RSA PKCS#1_v1.5 Verification with SHA-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "BootLoader Firmware Load test",
            "condition": "At boot up",
            "details": "A 3072/ 4096-bit RSA or ECDSA P384 Signature Verification is executed on the bootloader copied into the Module. See 10.6 - Additional Information",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer (FIPS186-5) (A6147), ECDSA SigVer (FIPS186-5) (A6142)",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "Runtime Firmware Load test",
            "condition": "At boot up",
            "details": "A 3072/ 4096-bit RSA or ECDSA P384 Signature Verification is executed on the SEE firmware copied into the Module. See 10.6 - Additional Information",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer (FIPS186-5) (A6147), ECDSA SigVer (FIPS186-5) (A6142)",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "Entropy 90B Start- up Repetition Count Test (RCT)",
            "condition": "At boot up",
            "details": "As specified in [90B] RCT startup health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Repetition Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Start- up Adaptive Proportion Test (APT)",
            "condition": "At boot up",
            "details": "As specified in [90B] APT startup health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Adaptive Proportion Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RCT)",
            "condition": "Continuous when entropy is requested",
            "details": "As specified in [90B] RCT continuous health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Repetition Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Adaptive Proportion Test (APT)",
            "condition": "Continuous when entropy is requested",
            "details": "As specified in [90B] APT continuous health tests",
            "indicator": "Success or Failure Code",
            "testMethod": "Fault induction",
            "testProps": "Adaptive Proportion Test",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Triggered by cryptographic KAT failure.",
            "description": "The ROM fails a KAT",
            "indicator": "A Cryptographic Self-test Failure status is indicated in response to any service request.",
            "name": "ES1",
            "recoveryMethod": "Reboot/Power cycle the module"
          },
          {
            "conditions": "Firmware load and integrity check fails when the firmware fails to verify",
            "description": "The Module fails the firmware load test or the Firmware Integrity test",
            "indicator": "The Module enters the ES2 error state and outputs a verification failure status in response to the firmware service.",
            "name": "ES2",
            "recoveryMethod": "Reboot/Power cycle the module"
          },
          {
            "conditions": "Triggered by cryptographic self-test failure.",
            "description": "The Module fails conditional self- test. Non-operational state. No services beside status services are allowed",
            "indicator": "The Module enters the ES3 error state and will output a self-test failure status to any service request",
            "name": "ES3",
            "recoveryMethod": "Reboot/Power cycle the module"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "On initial receipt of the device and yearly afterwards",
            "inspectGuidance": "Inspect for evidence of prying or removal of the chip packaging. If tampering is suspected, then the device containing the IC should be removed from service and the site administrator should be contacted. See Example below.",
            "mechanism": "IC packaging"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Normal Mode of Operation. This is the only Approved mode of operation supported by the module",
            "name": "NMO",
            "statusIndicator": "fipsApprovedMode: 1",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "User Data",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "AESE (encryption engine)"
          },
          {
            "data": "User Data",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "AESD (decryption engine)"
          },
          {
            "data": "Module Service data",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "Data"
          },
          {
            "data": "Service info input/output",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "Mbox (Mailbox)"
          },
          {
            "data": "None",
            "logicalInterface": "Control Input",
            "physicalPort": "Service request notification interrupt"
          },
          {
            "data": "None",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          },
          {
            "data": "None",
            "logicalInterface": "Control Input",
            "physicalPort": "Reset"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Controller authentication",
            "name": "Controller Table 11: Roles",
            "operatorType": "CO",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "2",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "2",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Bootloader Firmware integrity test",
            "details": "Executed on the whole firmware stored in the Module - See 10.6 - Additional Information",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer PKCS1_v1.5 or PSS (FIPS186-5) (A6147) or ECDSA SigVer (FIPS186-5) (A6142)",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Module run time firmware integrity test",
            "details": "Executed on the whole firmware stored in the Module - See 10.6 - Additional Information",
            "indicator": "Success or Failure Code",
            "testMethod": "KAT",
            "testProps": "RSA SigVer PKCS1_v1.5 or PSS (FIPS186-5) (A6147) or ECDSA SigVer (FIPS186-5) (A6142)",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Sub Chip security sub system RAM (S1)",
            "distribution": "N/A",
            "entry": "N/A",
            "format": "Plaintext",
            "name": "Input in Plaintext(IO1)",
            "sfiAlgo": "",
            "source": "Outside the module boundary in ASIC Internal SRAM"
          },
          {
            "dest": "Sub Chip security sub system RAM (S1)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input using SP800-38F AES key Transport (IO2)",
            "sfiAlgo": "KTS1",
            "source": "Outside the module boundary in ASIC Internal SRAM"
          },
          {
            "dest": "Sub Chip security sub system RAM (S1)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input using SP800-38D AES key Transport (IO3)",
            "sfiAlgo": "KTS2",
            "source": "Outside the module boundary in ASIC Internal SRAM"
          },
          {
            "dest": "Outside the module boundary in ASIC Internal SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output using SP800-38F Key Transport (IO4)",
            "sfiAlgo": "KTS1",
            "source": "Sub Chip security sub system RAM (S1)"
          },
          {
            "dest": "Outside the module boundary in ASIC Internal SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output using SP800-38D AES key Transport (IO5)",
            "sfiAlgo": "KTS2",
            "source": "Sub Chip security sub system RAM (S1)"
          },
          {
            "dest": "Outside the module boundary in ASIC Internal SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output encapsulated by RSA (IO6)",
            "sfiAlgo": "KTS3",
            "source": "Sub Chip security sub system RAM (S1)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroized by Module power cycle or hard reset.",
            "method": "Z1",
            "operatorId": "Implicit",
            "rationale": "When module is reset, all data stored in volatile module memory (RAM) will be lost"
          },
          {
            "description": "Zeroized by the zeroization service by overwriting with a fixed pattern of zeros.",
            "method": "Z2",
            "operatorId": "Explicit",
            "rationale": "Each SSP is overwritten with a fixed value of 1s or 0s"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Stored in volatile memory (RAM).",
            "name": "Sub Chip security sub system RAM (S1)",
            "persistance": "Dynamic"
          },
          {
            "description": "Stored in e-fuse in Plaintext",
            "name": "Sub Chip security sub system e-Fuse (S2)",
            "persistance": "Static"
          },
          {
            "description": "Stored in register in Plaintext",
            "name": "Sub Chip security sub system register (S3)",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "NVMe interface at the physical boundary",
            "fwVersion": "Function ROM v4.0, Bootloader V4.0, Runtime SCCS v4.2, 4.3, 4.4, 5.0",
            "hwVersion": "0x0C87E5",
            "modelPartNum": "Micron\u00ae MSA11-P5 Controller Sub Chip Security Subsystem",
            "processors": "Micron\u00ae MSA11-P5"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric and Asymmetric",
            "implName": "N/A",
            "name": "CKG1",
            "reference": "SP800-133rev2 Section 4 example 1 and IG D.H"
          },
          {
            "algoPropList": "AES 256:Symmetric Key Generation",
            "implName": "N/A",
            "name": "CKG - XTS",
            "reference": "SP 800-133rev2 Section 6.3 and IG C.I"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECDSA": {
            "ECDSA": 39
          }
        },
        "RSA": {
          "RSA 3072": 1
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "GCM": {
          "GCM": 4
        },
        "XTS": {
          "XTS": 3
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 2
        },
        "MAC": {
          "MAC": 4
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-384": 20
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES 128": 1,
          "AES 256": 2,
          "AES-128": 2,
          "AES-256": 15,
          "HMAC-SHA2": 4,
          "RSA 3072": 1,
          "SHA-384": 4,
          "SHA2": 2,
          "SHA2-384": 14,
          "SHA2-512": 3,
          "SHA384": 1
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 0": 3,
          "Level 2": 4,
          "Level 3": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA2": {
            "SHA-384": 4,
            "SHA2": 2,
            "SHA384": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 10
        },
        "RNG": {
          "RBG": 2,
          "RNG": 10
        }
      },
      "side_channel_analysis": {
        "FI": {
          "Fault induction": 8
        }
      },
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 11,
          "FIPS 180-4": 4,
          "FIPS 186-5": 6,
          "FIPS 198-1": 2,
          "FIPS PUB 140-3": 2,
          "FIPS140-3": 2,
          "FIPS186-5": 21
        },
        "ISO": {
          "ISO/IEC 19790": 2,
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "SP 800-108": 1,
          "SP 800-38A": 4,
          "SP 800-38D": 2,
          "SP 800-38E": 2,
          "SP 800-38F": 2,
          "SP 800-56B": 1,
          "SP 800-90A": 1,
          "SP 800-90B": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 41,
            "AES-128": 2,
            "AES-256": 15
          },
          "CAST": {
            "CAST": 42
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 24
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 10
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "KTS-IFCA6150",
        "ECDSA KeyGen (FIPS186-5)A6142",
        "AES-ECBC1278",
        "Counter DRBGC1278",
        "Conditioning Component Block Cipher Derivation Function SP800-90BA2272",
        "HMAC-SHA2-384A6151",
        "AES-KWA6149",
        "ECDSA SigGen (FIPS186-5)A6142",
        "KDF SP800-108A6148",
        "SHA2-384A6145",
        "AES-XTS Testing Revision 2.0A6146",
        "SHA2-512A6145",
        "SHA2-512/256A6145",
        "AES-GCMA6144",
        "RSA SigVer (FIPS186-5)A6147",
        "AES-CTRC1278",
        "HMAC-SHA2-512/256A6151",
        "ECDSA SigVer (FIPS186-5)A6142",
        "ECDSA KeyVer (FIPS186-5)A6142"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A6144",
        "#A6146",
        "#A6145",
        "#A6150",
        "#A6148",
        "#A6143",
        "#A6142",
        "#A2272",
        "#A6151",
        "#C1278",
        "#A6149",
        "#A6147"
      ]
    },
    "policy_metadata": {
      "/Author": "Hawes, David J. (Fed)",
      "/CreationDate": "D:20260908160040-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260908160040-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 950930,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?product=11640"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 61
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "ef270f9dcb9aca9ef72aeb2ae55427ec8c9f8612c346c8744f15cba59d9aa1ac",
      "source_hash": "98c6d61c8f8bc403bb78584acf14abf76233012d0d8ecae6bfbf028ff7eec384",
      "txt_hash": "698be8e8639fbc7f83f36eda9359daa57be5ea00d1adb7db830690e6d1ee19f8"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": null,
    "date_sunset": "2031-09-13",
    "description": "Micron\u00ae MSA11-P5 Controller Sub Chip Security provides cryptographic functionality to SSD controllers.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Micron\u00ae MSA11-P5 Controller Sub Chip Security Subsystem",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-09-14",
        "lab": "Lightship Security, Inc.",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Micron Technology, Inc.",
    "vendor_url": "http://www.micron.com"
  }
}