This page was not yet optimized for use on mobile devices.
Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]
Certificate details
| Certificate ID | #5347 |
|---|---|
| Status | active |
| Validation dates | 19.06.2026 |
| Sunset date | 16-12-2029 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The Apple corecrypto Kernel Space Module for Intel is a software cryptographic module running on a multi-chip standalone hardware device and provides services intended to protect data in transit and at rest. |
| Vendor | Apple Inc. http://www.apple.com |
| Lab | Lightship Security, Inc. |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-256, AES, AES-, CAST5, CAST, RC4, RC2, DES, Triple-DES, TDES, Blowfish, HMACAsymmetric Algorithms
ECDSA, EdDSA, ECIES, ECCHash functions
SHA-1, SHA-256, MD4, MD5, RIPEMDSchemes
MAC, Key AgreementProtocols
IKEv2, IPsecRandomness
DRBG, RBGElliptic Curves
P-224, P-256, P-384, P-521, Curve P-192, P-192, Curve25519, Ed25519Block cipher modes
ECB, CBC, GCM, CCM, XTSJavaCard API constants
X25519Trusted Execution Environments
PSPSecurity level
Level 1Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5347,
"dgst": "38fbb36fa36cedd8",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"RSA KeyGen (FIPS186-4)A3624",
"#A3628",
"AES-CBCA3621",
"Counter DRBGA3627",
"ECDSA KeyVer (FIPS186-4)A3624",
"HMAC-SHA2-512A3628",
"HMAC-SHA2-224A3628",
"#A3618",
"SHA2-512A3628",
"AES-ECBA3627",
"#A3624",
"TDES-ECBA3625",
"AES-CTRA3627",
"SHA2-224A3628",
"RSA SigGen (FIPS186-4)A3624",
"SHA2-384A3628",
"#A3626",
"#A3623",
"SHA2-512/256A3624",
"HMAC-SHA2-384A3628",
"HMAC DRBGA3624",
"AES-KWA3621",
"AES-GCMA3627",
"ECDSA KeyGen (FIPS186-4)A3624",
"SHA2-256A3628",
"#A3619",
"ECDSA SigVer (FIPS186-4)A3624",
"#A3620",
"AES-CFB8A3621",
"#A3627",
"KDF SP800-108A3624",
"ECDSA SigGen (FIPS186-4)A3624",
"AES-CFB128A3621",
"AES-CCMA3627",
"#A3625",
"HMAC-SHA-1A3628",
"RSA SigVer (FIPS186-4)A3624",
"HMAC-SHA2-512/256A3624",
"#A3621",
"AES-OFBA3621",
"AES-XTS Testing Revision 2.0A3619",
"#A3622",
"SHA-1A3628",
"HMAC-SHA2-256A3628"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"13.0"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A3618",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3619",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3626",
"properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0, 256, 65536",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3627",
"properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56, 64, 72, 80, 88, 96,",
"reference": "SP 800-38C"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0, 256, 65536",
"reference": ""
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3626",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3627",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3618",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3619",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3626",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3627",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3626",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 8, 96, 1024 Payload Length - Payload Length: 128, 256, 120, 248 AAD Length - AAD Length: 128, 256, 120, 248",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3627",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 8, 96, 1024 Payload Length - Payload Length: 128, 256, 120, 248",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 128",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 128",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A3620",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A3621",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A3618",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 65536 Tweak Mode - Hex Data Unit Length Matches Payload Length - Yes",
"reference": "SP 800-38E"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A3619",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 65536 Tweak Mode - Hex Data Unit Length Matches Payload Length - Yes",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3620",
"properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256 Entropy Input - Entropy Input: 128, Entropy Input: 256 Nonce - Nonce: 128, Nonce: 64, 128 Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256 Returned Bits - 128",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3621",
"properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256 Entropy Input - Entropy Input: 128, Entropy Input: 256 Nonce - Nonce: 128, Nonce: 64, 128 Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256 Returned Bits - 128",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3626",
"properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256 Entropy Input - Entropy Input: 128, Entropy Input: 256 Nonce - Nonce: 128, Nonce: 64, 128 Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256 Returned Bits - 128",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3627",
"properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-128, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256 Entropy Input - Entropy Input: 128, Entropy Input: 256 Nonce - Nonce: 128, Nonce: 64, 128",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256 Returned Bits - 128",
"reference": ""
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Curve - P-224, P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Curve - P-224, P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Curve - P-224, P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A3622",
"properties": "Prediction Resistance - No Supports Reseed - No Mode - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Entropy Input - Entropy Input: 128, 160, Entropy Input: 192, 256, Entropy Input: 256 Nonce - Nonce: 128, 256, Nonce: 64, 160, Nonce: 96, 256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Personalization String Length - Personalization String Length: 0, 160, Personalization String Length: 0, 256 Additional Input - Additional Input: 0, 160, Additional Input: 0, 256 Returned Bits - 1024, 2048, 384, 448, 640",
"reference": ""
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A3623",
"properties": "Prediction Resistance - No Supports Reseed - No Mode - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Entropy Input - Entropy Input: 128, 160, Entropy Input: 192, 256, Entropy Input: 256 Nonce - Nonce: 128, 256, Nonce: 64, 160, Nonce: 96, 256 Personalization String Length - Personalization String Length: 0, 160, Personalization String Length: 0, 256 Additional Input - Additional Input: 0, 160, Additional Input: 0, 256 Returned Bits - 1024, 2048, 384, 448, 640",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A3624",
"properties": "Prediction Resistance - No Supports Reseed - No Mode - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Entropy Input - Entropy Input: 128, 160, Entropy Input: 192, 256, Entropy Input: 256 Nonce - Nonce: 128, 256, Nonce: 64, 160, Nonce: 96, 256 Personalization String Length - Personalization String Length: 0, 160, Personalization String Length: 0, 256 Additional Input - Additional Input: 0, 160, Additional Input: 0, 256 Returned Bits - 1024, 2048, 384, 448, 640",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 160 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 160 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 160 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3628",
"properties": "MAC - MAC: 160 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A3628",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3628",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3628",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3628",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/256",
"cavpCertName": "A3622",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/256",
"cavpCertName": "A3623",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/256",
"cavpCertName": "A3624",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-262144 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A3624",
"properties": "KDF Mode - Counter, Feedback MAC Mode - HMAC-SHA-1, HMAC-SHA2- 224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Supported Lengths - Supported Lengths: 8- 4096 Increment 8 Fixed Data Order - Before Fixed Data Counter Length - 32 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Random Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Random Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Random Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA2-224",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA2-224",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Hash Pair - Hash Algorithm - SHA2-224",
"reference": ""
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3622",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Random",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3623",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Random",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3624",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Random",
"reference": "FIPS 186-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3628",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A3628",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3628",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3628",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3628",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/256",
"cavpCertName": "A3622",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/256",
"cavpCertName": "A3623",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/256",
"cavpCertName": "A3624",
"properties": "Message Length - Message Length: 0-32768 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TDES-ECB",
"cavpCertName": "A3625",
"properties": "Direction - Decrypt, Encrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Encrypt plaintext data",
"indicator": "1",
"inputs": "AES Key; Plaintext data",
"name": "Symmetri c encryption",
"outputs": "Ciphertext data",
"rolesSspAccess": "Crypto Officer - AES key: W,E - AES GCM key: W,E - AES XTS key: W,E",
"secFunImpl": "AES Cipher AES Authenticat ed Cipher"
},
{
"description": "Decrypt ciphertext data",
"indicator": "1",
"inputs": "AES/TDE S Key; Ciphertext data",
"name": "Symmetri c decryption",
"outputs": "Plaintext data",
"rolesSspAccess": "Crypto Officer - AES key: W,E - AES GCM key: W,E - AES XTS key: W,E - TDES Key: W,E",
"secFunImpl": "AES Cipher TDES Decryption AES Authenticat ed Cipher"
},
{
"description": "Perform key wrapping",
"indicator": "1",
"inputs": "Key- encryption -key; Key to be wrapped",
"name": "Key wrapping",
"outputs": "Wrapped key",
"rolesSspAccess": "Crypto Officer - AES Key- Encryptin g Key: W,E",
"secFunImpl": "AES Authenticat ed Cipher"
},
{
"description": "Perform key unwrapping",
"indicator": "1",
"inputs": "Key- encryption -key; Wrapped key",
"name": "Key unwrappin g",
"outputs": "Unwrapped key",
"rolesSspAccess": "Crypto Officer - AES Key- Encryptin g Key: W,E",
"secFunImpl": "AES Authenticat ed Cipher"
},
{
"description": "Compute a message digest",
"indicator": "1",
"inputs": "Message",
"name": "Hashing",
"outputs": "Message digest",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Message Digest"
},
{
"description": "Compute a message authenticati on code",
"indicator": "1",
"inputs": "Message, MAC key, MAC algorithm",
"name": "MAC Generatio n",
"outputs": "Message Authentication Code",
"rolesSspAccess": "Crypto Officer - HMAC key: W,E",
"secFunImpl": "MAC (HMAC)"
},
{
"description": "Verify a message authenticati on code",
"indicator": "1",
"inputs": "MAC, message, HMAC key, MAC algorithm",
"name": "MAC Verificatio n",
"outputs": "Pass/fail result",
"rolesSspAccess": "Crypto Officer - HMAC key: W,E",
"secFunImpl": "MAC (HMAC)"
},
{
"description": "Derive keys",
"indicator": "1",
"inputs": "KBKDF Key Derivation Key",
"name": "Derive key via KBKDF",
"outputs": "Derived key",
"rolesSspAccess": "Crypto Officer - KBKDF Key derivatio n key: W,E - KBKDF Derived key: G,R",
"secFunImpl": "Key Derivation"
},
{
"description": "Generate a public/privat e key pair",
"indicator": "1",
"inputs": "Random numbers, domain parameter s",
"name": "ECDSA key pair generatio n",
"outputs": "Public/private key pair",
"rolesSspAccess": "Crypto Officer - ECDSA public key: G,R - ECDSA private key: G,R",
"secFunImpl": "ECC Key Generation"
},
{
"description": "Generate a digital signature",
"indicator": "1",
"inputs": "Private key, message,",
"name": "ECDSA signature generatio n",
"outputs": "Digital signature",
"rolesSspAccess": "Crypto Officer - ECDSA",
"secFunImpl": "ECDSA Digital Signature"
},
{
"description": "",
"indicator": "",
"inputs": "hash function",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: E",
"secFunImpl": ""
},
{
"description": "Verify a digital signature",
"indicator": "1",
"inputs": "Public key",
"name": "ECDSA signature verificatio n",
"outputs": "True or False",
"rolesSspAccess": "Crypto Officer - ECDSA public key: W,E",
"secFunImpl": "ECDSA Digital Signature"
},
{
"description": "Generate a public/privat e key pair",
"indicator": "1",
"inputs": "Random numbers, domain parameter s",
"name": "RSA key pair generatio n",
"outputs": "Public/private key pair",
"rolesSspAccess": "Crypto Officer - RSA public key: G,R - RSA private key: G,R",
"secFunImpl": "RSA Key Generation"
},
{
"description": "Generate a digital signature",
"indicator": "1",
"inputs": "Private key, message, hash function",
"name": "RSA signature generatio n",
"outputs": "Digital signature",
"rolesSspAccess": "Crypto Officer - RSA private key: E",
"secFunImpl": "RSA Digital Signature"
},
{
"description": "Verify a digital signature",
"indicator": "1",
"inputs": "Public key",
"name": "RSA signature verificatio n",
"outputs": "True or False",
"rolesSspAccess": "Crypto Officer - RSA public key: W,E",
"secFunImpl": "RSA Digital Signature"
},
{
"description": "Generate a random number",
"indicator": "1",
"inputs": "Entropy, seed, V and key values",
"name": "Random number generatio n",
"outputs": "Random bit- string",
"rolesSspAccess": "Crypto Officer - Entropy Input String: W,E - DRBG Seed, Internal State V, and Key (IG D.L): G,E",
"secFunImpl": "Random Bit Generation"
},
{
"description": "Zeroise all SSPs",
"indicator": "1",
"inputs": "Length of context to zeroize and address of context to be zeroized",
"name": "Zeroisatio n",
"outputs": "Released memory space",
"rolesSspAccess": "Crypto Officer - AES key: Z - AES Key- Encryptin g Key: Z - AES GCM",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "key: Z - AES XTS key: Z - HMAC key: Z - ECDSA public key: Z - ECDSA private key: Z - RSA public key: Z - RSA private key: Z - Entropy Input String: Z - DRBG Seed, Internal State V, and Key (IG D.L): Z - KBKDF Key derivatio n key: Z - KBKDF Derived key: Z - TDES Key: Z",
"secFunImpl": "Functions"
},
{
"description": "Perform pre- operational and algorithm self-test",
"indicator": "1",
"inputs": "Instantiatio n",
"name": "On- Demand Self-test",
"outputs": "Status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "AES Cipher TDES Decryption AES Authenticat ed Cipher Random Bit Generation ECC Key Generation RSA Key Generation"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "ECDSA Digital Signature RSA Digital Signature Message Digest MAC (HMAC) Key Derivation"
},
{
"description": "Return module status",
"indicator": "N/A",
"inputs": "KPI invocation",
"name": "Show Status",
"outputs": "Operational/err or status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Return module name and versioning information",
"indicator": "N/A",
"inputs": "KPI invocation",
"name": "Show Module and Version Informatio n",
"outputs": "Module base name; Module version",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3628)",
"condition": "Test runs at power- on before the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-CBC (A3618)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-CBC (A3619)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-CBC (A3620)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-CBC (A3621)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES- CCM (A3626)",
"condition": "Test runs at power- on after the integrity test",
"details": "Authenticated Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES- CCM (A3627)",
"condition": "Test runs at power- on after the integrity test",
"details": "Authenticated Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3618)",
"condition": "Test runs at power- on after the",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "integrity test",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES-ECB (A3619)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3620)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3621)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3626)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3627)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES- GCM (A3626)",
"condition": "Test runs at power- on after the integrity test",
"details": "Authenticated Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES- GCM (A3627)",
"condition": "Test runs at power- on after the integrity test",
"details": "Authenticated Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-XTS Testing Revision",
"condition": "Test runs at power- on after",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "2.0 (A3618)",
"condition": "the integrity test",
"details": "",
"indicator": "operation al",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A3619)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Encryption/Decryptio n",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, encrypt/decry pt",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-KW (A3620)",
"condition": "Test runs at power- on after the integrity test",
"details": "Key Wrapping/Unwrappi ng",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, wrap/unwrap",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-KW (A3621)",
"condition": "Test runs at power- on after the integrity test",
"details": "Key Wrapping/Unwrappi ng",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "128-bit key, wrap/unwrap",
"type": "CAS T"
},
{
"algorithmOrTest": "Counter DRBG (A3620)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "Counter DRBG (A3621)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "Counter DRBG (A3626)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "Counter DRBG (A3627)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC DRBG (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC DRBG (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC DRBG (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Compliant with SP 800-90Ar1",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "As specified in NIST SP 800-90Ar1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3628)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3622)",
"condition": "Test runs at power- on after the",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "integrity test",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3628)",
"condition": "Test runs at power- on after the integrity test",
"details": "Message Authentication",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186 -4) (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186 -4) (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186 -4) (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186 -4) (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Verification",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186",
"condition": "Test runs at power- on after",
"details": "Digital Signature Verification",
"indicator": "Module becomes",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "-4) (A3623)",
"condition": "the integrity test",
"details": "",
"indicator": "operation al",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "RSA SigVer (FIPS186 -4) (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Verification",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "2048-bit modulus with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186 -4) (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186 -4) (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186 -4) (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Generation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186 -4) (A3622)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Verification",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186 -4) (A3623)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Verification",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186 -4) (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Digital Signature Verification",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA-256",
"type": "CAS T"
},
{
"algorithmOrTest": "KDF SP800- 108 (A3624)",
"condition": "Test runs at power- on after the integrity test",
"details": "Key Derivation",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "Counter and Feedback modes",
"type": "CAS T"
},
{
"algorithmOrTest": "TDES- ECB (A3625)",
"condition": "Test runs at power- on after the integrity test",
"details": "Symmetric Decryption",
"indicator": "Module becomes operation al",
"testMethod": "KAT",
"testProps": "168-bit key, decrypt",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186 -4) (A3622)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186 -4) (A3623)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186 -4) (A3624)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186 -4) (A3622)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186 -4) (A3623)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186 -4) (A3624)",
"condition": "Key pair generation",
"details": "Key Generation",
"indicator": "Successfu l key pair generatio n",
"testMethod": "PCT",
"testProps": "PCT",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "1) Preoperatio nal Software Integrity Test failure 2) Conditional CAST failure 3) Conditional PCT failure",
"description": "1) The HMAC- SHA2-256 value computed over the module did not match the precompute d value or 2) The computed value in the invoked Conditional CAST did not match the known value or 3) The signature failed to generate/ver ify successfully in the Conditional PCT. No",
"indicator": "1) Error message \"FAILED: fipspost_post_integrity\" send to caller or 2) Error message \"FAILED:\u003cevent\u003e\" sent to caller (\u003cevent\u003e refers to any of the cryptographic functions listed Table - Conditional Self-Tests, 3) Error code \"CCEC_GENERATE_KEY_CONSISTE NCY\" returned for ECDSA Error code and Error code \"CCRSA_GENERATE_KEY_CONSIST ENCY\" returned for RSA Error code\"",
"name": "Error State",
"recoveryMethod": "Power cycle the device which results in the module being reloaded into memory and reperformin g the preoperatio nal software integrity test and the Conditional CASTs"
},
{
"conditions": "",
"description": "cryptographi c services are provided, and data output is prohibited",
"indicator": "",
"name": "",
"recoveryMethod": ""
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Approved mode of operation is entered when the module utilizes the services that use the security functions listed in the Approved Algorithms Table and the Vendor Affirmed Algorithms Table.",
"name": "Approved mode",
"statusIndicator": "Return a \u00271\u0027 from fips_allowed_mode() for block cipher functions and fips_allowed() for all other services to indicate the executed cryptographic algorithm was approved.",
"type": "Approved"
},
{
"description": "Non-Approved mode of operation is entered when the module utilizes non-approved security functions in the Non- Approved Algorithms Not Allowed in the Approved Mode of Operation Table.",
"name": "Non- Approved mode",
"statusIndicator": "Return a \u00270\u0027 from fips_allowed_mode() for block cipher functions and fips_allowed() for all other services to indicate the executed cryptographic algorithm was non-approved.",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "RSA Key Generation",
"use": "ANSI X9.31 Key Pair Generation Key Size \u003c 2048"
},
{
"name": "RSA Digital Signature",
"use": "PKCS#1 v1.5 and PSS; Signature Generation Key Size \u003c 2048; Signature Verification Key Size \u003c 1024"
},
{
"name": "RSA Key Wrapping",
"use": "OAEP, PKCS#1 v1.5 and PSS schemes"
},
{
"name": "X25519",
"use": "Key Agreement; Key Generation"
},
{
"name": "Ed25519",
"use": "Key Generation; Signature Generation; Signature Verification"
},
{
"name": "ANSI X9.63 KDF",
"use": "Hash based Key Derivation Function"
},
{
"name": "RFC6637",
"use": "Key Derivation Function"
},
{
"name": "HKDF [SP 800-56C]",
"use": "Key Derivation Function"
},
{
"name": "DES",
"use": "Encryption/Decryption; Key Size: 56-bits"
},
{
"name": "CAST5",
"use": "Encryption/Decryption; Key Sizes: 40 to 128-bits in 8-bit increments"
},
{
"name": "RC4",
"use": "Encryption/Decryption; Key Sizes: 8 to 4096-bits"
},
{
"name": "RC2",
"use": "Encryption/Decryption; Key Sizes 8 to 1024-bits"
},
{
"name": "MD2",
"use": "Message Digest; Digest size 128-bit"
},
{
"name": "MD4",
"use": "Message Digest; Digest size 128-bit"
},
{
"name": "MD5",
"use": "Message Digest; Digest size 128-bit"
},
{
"name": "RIPEMD",
"use": "Message Digest; Digest size 160-bits"
},
{
"name": "ECDSA",
"use": "Key-pair generation: Curve P-192; Public key validation: Curve P- 192; Signature Generation: Curve P-192; Signature Verification: Curve P-192; Key Pair Generation for compact point representation of points"
},
{
"name": "Integrated Encryption Scheme on elliptic curves (ECIES)",
"use": "Encryption/Decryption"
},
{
"name": "Blowfish",
"use": "Encryption/Decryption"
},
{
"name": "OMAC (One-Key CBC MAC)",
"use": "MAC generation"
},
{
"name": "Triple-DES [SP 800- 67r2]",
"use": "CBC Encryption/Decryption and ECB encryption; Note: The module does not enforce the limit of 2^16 encryptions with the same Triple- DES key, as required by FIPS 140-3 IG C.G."
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "RSA Key Wrapping",
"description": "Perform key wrapping",
"name": "Key Encapsulation",
"role": "CO"
},
{
"alg_accessed": "RSA Key Wrapping",
"description": "Perform key unwrapping",
"name": "Key Decapsulation",
"role": "CO"
},
{
"alg_accessed": "X25519 Ed25519",
"description": "Generate a public/private key pair; Curve: Ed25519 and Curve25519",
"name": "EdDSA/X25519 key pair generation",
"role": "CO"
},
{
"alg_accessed": "Ed25519",
"description": "Generate a digital signature; Curve: Ed25519",
"name": "EdDSA signature generation",
"role": "CO"
},
{
"alg_accessed": "Ed25519",
"description": "Verify a digital signature; Curve: Ed25519",
"name": "EdDSA signature verification",
"role": "CO"
},
{
"alg_accessed": "X25519",
"description": "Perform key agreement",
"name": "X25519 key agreement",
"role": "CO"
},
{
"alg_accessed": "ECDSA",
"description": "Generate a public/private key pair; Curve: P-192",
"name": "ECDSA key pair generation",
"role": "CO"
},
{
"alg_accessed": "ECDSA",
"description": "Generate a digital signature; Curve: P-192",
"name": "ECDSA signature generation",
"role": "CO"
},
{
"alg_accessed": "ECDSA",
"description": "Verify a digital signature; Curve: P-192",
"name": "ECDSA Signature verification",
"role": "CO"
},
{
"alg_accessed": "RSA Key Generation",
"description": "Generate a public/private key pair; Key size \u003c 2048",
"name": "RSA key pair generation",
"role": "CO"
},
{
"alg_accessed": "RSA Digital Signature",
"description": "Generate a digital signature; Key size \u003c 2048",
"name": "RSA signature generation",
"role": "CO"
},
{
"alg_accessed": "RSA Digital Signature",
"description": "Verify a digital signature; Key size \u003c 1024",
"name": "RSA Signature verification",
"role": "CO"
},
{
"alg_accessed": "ANSI X9.63 KDF",
"description": "Hash-based key derivation; Per: ANSI X9.63",
"name": "ANSI X9.63 KDF Key Derivation",
"role": "CO"
},
{
"alg_accessed": "HKDF [SP 800-56C]",
"description": "Hash-based key derivation; Per: SP 800-56C HKDF",
"name": "SP 800-56C HKDF Key Derivation",
"role": "CO"
},
{
"alg_accessed": "RFC6637",
"description": "Hash-based key derivation; Per: RFC6637",
"name": "RFC6637 Key Derivation",
"role": "CO"
},
{
"alg_accessed": "OMAC (One-Key CBC MAC)",
"description": "Compute a message authentication code",
"name": "Generate MAC",
"role": "CO"
},
{
"alg_accessed": "MD2 MD4 MD5 RIPEMD",
"description": "Compute a message digest",
"name": "Hashing",
"role": "CO"
},
{
"alg_accessed": "DES CAST5 RC4 RC2 Integrated Encryption Scheme on elliptic curves (ECIES) Blowfish Triple-DES [SP 800-67r2]",
"description": "Perform symmetric data encryption",
"name": "Symmetric encryption",
"role": "CO"
},
{
"alg_accessed": "DES CAST5 RC4 RC2 Integrated Encryption Scheme on elliptic curves (ECIES) Blowfish Triple-DES [SP 800-67r2]",
"description": "Perform symmetric data decryption",
"name": "Symmetric decryption",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data inputs are provided in the variables passed in the KPI and callable service invocations, generally through caller-supplied buffers.",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "Data inputs are provided in the variables passed in the KPI and callable service invocations, generally through caller-supplied buffers.",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "Control inputs which control the mode of the module are provided through dedicated parameters, namely the kernel module plist whose information is supplied to the module by the kernel module loader.",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "Status output is provided in return codes and through messages. Documentation for each KPI lists possible return codes. A complete list of all return codes returned by the C language KPIs within the module is provided in the header files and the KPI documentation. Messages are also documented in the KPI documentation.",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC- SHA2-256 (A3628)",
"details": "The HMAC-SHA2- 256 value calculated at runtime is compared with the HMAC-SHA2-256 value stored in the module, computed at compilation time",
"indicator": "Module successful execution",
"testMethod": "Message Authentication over the complete module file image",
"testProps": "112-bit key",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "KPI input parameters",
"sfiAlgo": "",
"source": "Operator calling application (TOEPP)"
},
{
"dest": "Operator calling application (TOEPP)",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "KPI output parameters",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroizes the SSPs contained within the cipher handle.",
"method": "Wipe and Free memory block allocated",
"operatorId": "By calling the cipher related zeroization API.",
"rationale": "Memory occupied by SSPs is overwritten with zeroes and then it is released, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded."
},
{
"description": "De-allocates the volatile memory used to store SSPs.",
"method": "Module Reset",
"operatorId": "By unloading and reloading the module.",
"rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed."
},
{
"description": "Intermediate keygen values are zeroized before the module returns from the key generation function.",
"method": "Intermediate value zeroization",
"operatorId": "N/A",
"rationale": "Intermediate keygen values are zeroized before the module returns from the key generation function."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "The module stores ephemeral SSPs in RAM provided by the operational environment. They are received for use or generated by the module only at the command of the calling application. The operating system protects all SSPs through memory separation and protection mechanisms. No process other than the module itself can access the SSPs in its process\u0027 memory.",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "MacBook Air 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i5 (Amber Lake 8210Y)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Air 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i5 (Amber Lake 8210Y)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Air 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i7 (Ice Lake 1060NG7)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Air 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i7 (Ice Lake 1060NG7)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i7 (Coffee Lake 8700B)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i7 (Coffee Lake 8700B)",
"version": "v13.0"
},
{
"hardwarePlatform": "iMac 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i7 (Comet Lake 10700K)",
"version": "v13.0"
},
{
"hardwarePlatform": "iMac 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i7 (Comet Lake 10700K)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i9 (Coffee Lake 9880H)",
"version": "v13.0"
},
{
"hardwarePlatform": "MacBook Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i9 (Coffee Lake 9880H)",
"version": "v13.0"
},
{
"hardwarePlatform": "iMac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Xeon W (SkyLake W-2140B)",
"version": "v13.0"
},
{
"hardwarePlatform": "iMac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Xeon W (SkyLake W-2140B)",
"version": "v13.0"
},
{
"hardwarePlatform": "Mac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Xeon W (Cascade Lake W-3223)",
"version": "v13.0"
},
{
"hardwarePlatform": "Mac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Xeon W (Cascade Lake W-3223)",
"version": "v13.0"
},
{
"hardwarePlatform": "Mac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "Yes",
"processors": "Intel i5 (Coffee Lake 8257U)",
"version": "v13.0"
},
{
"hardwarePlatform": "Mac Pro 2022",
"hypervisorHostOs": "N/A",
"operatingSystem": "macOS Ventura v13",
"paa_pai": "No",
"processors": "Intel i5 (Coffee Lake 8257U)",
"version": "v13.0"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "NIST SP800-133r2 Section 4: Using the Output of a Random Generator, Example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "MacBook Pro - i5 (Ice Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Pro - i5 (Coffee Lake), 2021, 2020, 2019, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Pro - i7 (Amber Lake), 2021, 2019, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Pro - i7 (Coffee Lake), 2021, 2020, 2019, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Pro - i7 (Ice Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Pro - i9 (Coffee Lake), 2021, 2019, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Air - i5 (Ice Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Air - i7 (Ice Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Air - i5 (Amber Lake), 2021, 2019, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "MacBook Air - i7 (Amber Lake), 2021, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "Mac mini - i5 (Coffee Lake), 2021, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "Mac mini - i7 (Coffee Lake), 2021, 2018",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i5 (Comet Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i7 (Comet Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i9 (Comet Lake), 2021, 2020",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i5 (Coffee Lake), 2021, 2019",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i7 (Coffee Lake), 2021, 2019",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i9 (Coffee Lake), 2021, 2019",
"operatingSystem": "macOS Ventura v13"
},
{
"hardwarePlatform": "iMac - i9 (Comet Lake), 2022",
"operatingSystem": "macOS Ventura v13"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 5
},
"ECDSA": {
"ECDSA": 70
},
"ECIES": {
"ECIES": 3
},
"EdDSA": {
"EdDSA": 2
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 3
},
"CCM": {
"CCM": 2
},
"ECB": {
"ECB": 2
},
"GCM": {
"GCM": 10
},
"XTS": {
"XTS": 6
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKEv2": 2
},
"IPsec": {
"IPsec": 2
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 1
},
"MAC": {
"MAC": 41
}
},
"device_model": {},
"ecc_curve": {
"Curve": {
"Curve25519": 1
},
"Edwards": {
"Ed25519": 5
},
"NIST": {
"Curve P-192": 3,
"P-192": 9,
"P-224": 28,
"P-256": 40,
"P-384": 28,
"P-521": 28
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 6,
"AES key 128": 1,
"AES-128": 4,
"AES-256": 5,
"HMAC- SHA-1": 4,
"HMAC-SHA-1": 20,
"PKCS 1": 6,
"PKCS#1": 4,
"SHA-1": 21,
"SHA-256": 12,
"SHA2- 256": 7,
"SHA2- 384": 3,
"SHA2- 512": 4,
"SHA2-224": 16,
"SHA2-256": 18,
"SHA2-384": 10,
"SHA2-512": 17
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"MD": {
"MD4": {
"MD4": 2
},
"MD5": {
"MD5": 2
}
},
"RIPEMD": {
"RIPEMD": 2
},
"SHA": {
"SHA1": {
"SHA-1": 21
},
"SHA2": {
"SHA-256": 12
}
}
},
"ic_data_group": {},
"javacard_api_const": {
"curves": {
"X25519": 4
}
},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 35
},
"RNG": {
"RBG": 3
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 62,
"FIPS 180-4": 23,
"FIPS 186-4": 21,
"FIPS 198-1": 23,
"FIPS PUB 140-3": 1,
"FIPS186": 18,
"FIPS186-4": 47
},
"ISO": {
"ISO/IEC 19790:2012": 1
},
"NIST": {
"NIST SP 800-140F": 1,
"SP 800-108": 1,
"SP 800-38A": 20,
"SP 800-38C": 2,
"SP 800-38D": 2,
"SP 800-38E": 2,
"SP 800-38F": 2,
"SP 800-56C": 4,
"SP 800-67": 1,
"SP 800-90A": 7
},
"PKCS": {
"PKCS 1": 6,
"PKCS#1": 2
},
"RFC": {
"RFC 4106": 2,
"RFC 7296": 1,
"RFC6637": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 40,
"AES-": 4,
"AES-128": 4,
"AES-256": 5
},
"CAST": {
"CAST": 53,
"CAST5": 3
},
"RC": {
"RC2": 1,
"RC4": 3
}
},
"DES": {
"3DES": {
"TDES": 10,
"Triple-DES": 3
},
"DES": {
"DES": 4
}
},
"constructions": {
"MAC": {
"HMAC": 23
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 2
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"RSA KeyGen (FIPS186-4)A3624",
"AES-CBCA3621",
"Counter DRBGA3627",
"ECDSA KeyVer (FIPS186-4)A3624",
"HMAC-SHA2-512A3628",
"HMAC-SHA2-224A3628",
"SHA2-512A3628",
"AES-ECBA3627",
"TDES-ECBA3625",
"AES-CTRA3627",
"SHA2-224A3628",
"RSA SigGen (FIPS186-4)A3624",
"SHA2-384A3628",
"SHA2-512/256A3624",
"HMAC-SHA2-384A3628",
"HMAC DRBGA3624",
"AES-KWA3621",
"AES-GCMA3627",
"ECDSA KeyGen (FIPS186-4)A3624",
"SHA2-256A3628",
"ECDSA SigVer (FIPS186-4)A3624",
"AES-CFB8A3621",
"KDF SP800-108A3624",
"ECDSA SigGen (FIPS186-4)A3624",
"AES-CFB128A3621",
"AES-CCMA3627",
"HMAC-SHA-1A3628",
"RSA SigVer (FIPS186-4)A3624",
"HMAC-SHA2-512/256A3624",
"AES-OFBA3621",
"AES-XTS Testing Revision 2.0A3619",
"SHA-1A3628",
"HMAC-SHA2-256A3628"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3628",
"#A3625",
"#A3621",
"#A3619",
"#A3626",
"#A3618",
"#A3622",
"#A3620",
"#A3623",
"#A3627",
"#A3624"
]
},
"policy_metadata": {
"/Author": "Hawes, David J. (Fed)",
"/CreationDate": "D:20260616131153-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260616131153-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 922247,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"http://www.lightshipsec.com/"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 54
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "85e707035f30bad84ddfeba77d93a6cf40eeb07735c8e799955cd0a9de412694",
"source_hash": "a767cb39940829c7ba58fc1abc1571f9f7eb507a9fd1b4acfafc27b7c2f2497e",
"txt_hash": "c733263e29a6ebaf500b2eee2920bc522178e3d35b2003e73dd9de72b6657735"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
"date_sunset": "2029-12-16",
"description": "The Apple corecrypto Kernel Space Module for Intel is a software cryptographic module running on a multi-chip standalone hardware device and provides services intended to protect data in transit and at rest.",
"embodiment": "MultiChipStand",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-19",
"lab": "Lightship Security, Inc.",
"validation_type": "Initial"
}
],
"vendor": "Apple Inc.",
"vendor_url": "http://www.apple.com"
}
}