Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 1 of 45
Apple Inc.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1]
FIPS 140-3 Non-Proprietary Security Policy
Prepared for:
Apple Inc.
One Apple Park Way
Cupertino, CA 95014
Prepared by:
atsec information security corporation
4516 Seton Center Parkway, Suite 250
Austin, TX 78759
atsec.com
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 2 of 45
Table of Contents
Trademarks ................................................................................................................................ 5
1 General.................................................................................................................................... 6
1.1 Overview........................................................................................................................... 6
1.2 Security Levels................................................................................................................... 6
1.3 Additional Information....................................................................................................... 6
2 Cryptographic Module Specification........................................................................................ 7
2.1 Description........................................................................................................................ 7
2.2 Tested and Vendor Affirmed Module Version and Identification........................................ 8
2.3 Excluded Components......................................................................................................12
2.4 Modes of Operation.........................................................................................................12
2.5 Algorithms .......................................................................................................................13
2.6 Security Function Implementations ..................................................................................17
2.7 Algorithm Specific Information.........................................................................................20
2.8 RBG and Entropy..............................................................................................................21
2.9 Key Generation.................................................................................................................22
2.10 Key Establishment ..........................................................................................................22
2.11 Industry Protocols ..........................................................................................................23
3 Cryptographic Module Interfaces ...........................................................................................24
3.1 Ports and Interfaces..........................................................................................................24
4 Roles, Services, and Authentication.........................................................................................25
4.1 Authentication Methods...................................................................................................25
4.2 Roles................................................................................................................................25
4.3 Approved Services............................................................................................................25
4.4 Non-Approved Services....................................................................................................28
4.5 External Software/Firmware Loaded................................................................................29
5 Software/Firmware Security....................................................................................................30
5.1 Integrity Techniques.........................................................................................................30
5.2 Initiate on Demand ..........................................................................................................30
6 Operational Environment........................................................................................................31
6.1 Operational Environment Type and Requirements............................................................31
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 3 of 45
7 Physical Security.....................................................................................................................32
8 Non-Invasive Security ............................................................................................................33
8.1 Mitigation Techniques......................................................................................................33
9 Sensitive Security Parameters Management............................................................................34
9.1 Storage Areas...................................................................................................................34
9.2 SSP Input-Output Methods ..............................................................................................34
9.3 SSP Zeroization Methods .................................................................................................34
9.4 SSPs .................................................................................................................................35
9.5 Transitions.......................................................................................................................37
10 Self-Tests..............................................................................................................................38
10.1 Pre-Operational Self-Tests..............................................................................................38
10.2 Conditional Self-Tests.....................................................................................................38
10.3 Periodic Self-Test Information ........................................................................................40
10.4 Error States.....................................................................................................................41
10.5 Operator Initiation of Self-Tests......................................................................................42
11 Life-Cycle Assurance.............................................................................................................43
11.1 Installation, Initialization, and Startup Procedures...........................................................43
11.2 Administrator Guidance..................................................................................................43
11.3 Non-Administrator Guidance .........................................................................................43
11.4 Design and Rules............................................................................................................43
11.5 End of Life......................................................................................................................44
12 Mitigation of Other Attacks ..................................................................................................45
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 4 of 45
List of Tables
Table 1: Security Levels............................................................................................................. 6
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets).... 8
Table 3: Tested Operational Environments - Software, Firmware, Hybrid .................................11
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid ..................12
Table 5: Modes List and Description .........................................................................................13
Table 6: Approved Algorithms...................................................................................................16
Table 7: Vendor-Affirmed Algorithms ........................................................................................16
Table 8: Non-Approved, Not Allowed Algorithms.......................................................................17
Table 9: Security Function Implementations..............................................................................20
Table 10: Entropy Certificates...................................................................................................21
Table 11: Entropy Sources........................................................................................................22
Table 12: Ports and Interfaces ..................................................................................................24
Table 13: Roles.........................................................................................................................25
Table 14: Approved Services ....................................................................................................28
Table 15: Non-Approved Services.............................................................................................29
Table 16: Storage Areas ...........................................................................................................34
Table 17: SSP Input-Output Methods........................................................................................34
Table 18: SSP Zeroization Methods..........................................................................................35
Table 19: SSP Table 1..............................................................................................................36
Table 20: SSP Table 2..............................................................................................................37
Table 21: Pre-Operational Self-Tests........................................................................................38
Table 22: Conditional Self-Tests ...............................................................................................40
Table 23: Pre-Operational Periodic Information.........................................................................40
Table 24: Conditional Periodic Information................................................................................41
Table 25: Error States...............................................................................................................42
List of Figures
Figure 1: Block Diagram.............................................................................................................. 8
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 5 of 45
Trademarks
Apple’s trademarks applicable to this document are listed in
https://www.apple.com/legal/intellectual-property/trademark/appletmlist.html.
Other company, product, and service names may be trademarks or service marks of others.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 6 of 45
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy for Apple corecrypto Module
18.3 [Apple silicon, Kernel, Software, SL1] cryptographic module. It contains the security rules
under which the module must operate and describes how this module meets the requirements
as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for
a Security Level 1 module.
This document provides all tables and diagrams (when applicable) required by NIST SP 800-
140Br1.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 1
12 Mitigation of other attacks N/A
Overall Level 1
Table 1: Security Levels
1.3 Additional Information
In preparing the Security Policy document, the laboratory formatted the vendor-supplied
documentation for consolidation without altering the technical statements therein contained.
The further refining of the Security Policy document was conducted iteratively throughout the
conformance testing. The vendor reviewed the intermediate and final Security Policy and
approved all of its content.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 7 of 45
2 Cryptographic Module Specification
2.1 Description
Purpose and Use: The Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1]
cryptographic module (hereafter referred to as “the module”) provides implementations of low-
level cryptographic primitives to the Device OS’s (iOS, iPadOS, watchOS, tvOS, visionOS, macOS)
kernels Security Framework and Common Crypto. The module provides services intended to
protect data in transit and at rest.
The module is optimized for library use within the Device OS kernel space and does not contain
any terminating assertions or exceptions. It is implemented as a Device OS dynamically loadable
library. The library is loaded into the Device OS kernel and its cryptographic functions are made
available to Device OS kernel services only.
Any internal error detected by the module is returned to the caller with an appropriate return
code. The calling Device OS kernel service must examine the return code and act accordingly.
The module communicates any error status synchronously through the use of its documented
return codes, thus indicating the module’s status. Caller-induced or internal errors do not reveal
any sensitive material to callers.
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Cryptographic Boundary: The module cryptographic boundary is delineated by the dotted green
rectangle in the Figure 1 where the Kernel Extension (KEXT) is a bundle that performs low-level
tasks. KEXTs run in kernel space, which gives them elevated privileges and the ability to perform
tasks that user-space apps can’t.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 8 of 45
Tested Operational Environment’s Physical Perimeter (TOEPP): The physical perimeter is
represented by the most exterior black line in the block diagram Figure 1. The module executes
within the kernel space of the computing platforms and operating systems listed in the Tested
Operational Environments Table section 2.2.
Figure 1: Block Diagram
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File
Name
Software/ Firmware
Version
Features Integrity Test
xnu-11215.82.4 18.3 N/A HMAC-SHA256
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Tested Operational Environments - Software, Firmware, Hybrid:
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 9 of 45
Operating
System
Hardware Platform Processors PAA/PAI Hypervisor
or Host OS
Version(s)
iPadOS 18 iPad (9th generation) Apple A Series
A13 Bionic
Yes NA 18.3
iPadOS 18 iPad (9th generation) Apple A Series
A13 Bionic
No NA 18.3
iPadOS 18 iPad Air (4th
generation)
Apple A Series
A14 Bionic
Yes NA 18.3
iPadOS 18 iPad Air (4th
generation)
Apple A Series
A14 Bionic
No NA 18.3
iPadOS 18 iPad mini (6th
generation)
Apple A Series
A15 Bionic
Yes NA 18.3
iPadOS 18 iPad mini (6th
generation)
Apple A Series
A15 Bionic
No NA 18.3
iPadOS 18 iPad mini (7th
generation)
Apple A Series
A17 Pro
Yes NA 18.3
iPadOS 18 iPad mini (7th
generation)
Apple A Series
A17 Pro
No NA 18.3
iPadOS 18 iPad Air (4th
generation)
Apple M Series
M1
Yes NA 18.3
iPadOS 18 iPad Air (4th
generation)
Apple M Series
M1
No NA 18.3
iPadOS 18 iPad Pro 12.9-inch
(6th generation)
Apple M Series
M2
Yes NA 18.3
iPadOS 18 iPad Pro 12.9-inch
(6th generation)
Apple M Series
M2
No NA 18.3
iPadOS 18 iPad Pro 11-inch M4 Apple M Series
M4
Yes NA 18.3
iPadOS 18 iPad Pro 11-inch M4 Apple M Series
M4
No NA 18.3
iOS 18 iPhone 11 Pro Max Apple A Series
A13 Bionic
Yes NA 18.3
iOS 18 iPhone 11 Pro Max Apple A Series
A13 Bionic
No NA 18.3
iOS 18 iPhone 12 Apple A Series
A14 Bionic
Yes NA 18.3
iOS 18 iPhone 12 Apple A Series
A14 Bionic
No NA 18.3
iOS 18 iPhone 13 Pro Max Apple A Series
A15 Bionic
Yes NA 18.3
iOS 18 iPhone 13 Pro Max Apple A Series
A15 Bionic
No NA 18.3
iOS 18 iPhone 15 Plus Apple A Series
A16 Bionic
Yes NA 18.3
iOS 18 iPhone 15 Plus Apple A Series
A16 Bionic
No NA 18.3
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 10 of 45
Operating
System
Hardware Platform Processors PAA/PAI Hypervisor
or Host OS
Version(s)
iOS 18 iPhone 15 Pro Max Apple A Series
A17 Pro
Yes NA 18.3
iOS 18 iPhone 15 Pro Max Apple A Series
A17 Pro
No NA 18.3
iOS 18 iPhone 16 Apple A Series
A18
Yes NA 18.3
iOS 18 iPhone 16 Apple A Series
A18
No NA 18.3
iOS 18 iPhone 16 Pro Apple A Series
A18 Pro
Yes NA 18.3
iOS 18 iPhone 16 Pro Apple A Series
A18 Pro
No NA 18.3
watchOS
11
Apple Watch Series
S9
Apple S Series
S9
Yes NA 18.3
watchOS
11
Apple Watch Series
S9
Apple S Series
S9
No NA 18.3
watchOS
11
Apple Watch Series
S10
Apple S Series
S10
Yes NA 18.3
watchOS
11
Apple Watch Series
S10
Apple S Series
S10
No NA 18.3
tvOS 18 Apple TV 4K (3rd
generation)
Apple A Series
A15 Bionic
Yes NA 18.3
tvOS 18 Apple TV 4K (3rd
generation)
Apple A Series
A15 Bionic
No NA 18.3
macOS 15 MacBook Pro (13-
inch, 2020)
Apple M Series
M1
Yes NA 18.3
macOS 15 MacBook Pro (13-
inch, 2020)
Apple M Series
M1
No NA 18.3
macOS 15 MacBook Pro (16-
inch, M1 Pro, 2021)
Apple M Series
M1 Pro
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M1 Pro, 2021)
Apple M Series
M1 Pro
No NA 18.3
macOS 15 MacBook Pro (16-
inch, M1 Max, 2021)
Apple M Series
M1 Max
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M1 Max, 2021)
Apple M Series
M1 Max
No NA 18.3
macOS 15 Mac Studio Apple M Series
M1 Ultra
Yes NA 18.3
macOS 15 Mac Studio Apple M Series
M1 Ultra
No NA 18.3
macOS 15 MacBook Pro (13-
inch, M2, 2020)
Apple M Series
M2
Yes NA 18.3
macOS 15 MacBook Pro (13-
inch, M2, 2020)
Apple M Series
M2
No NA 18.3
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 11 of 45
Operating
System
Hardware Platform Processors PAA/PAI Hypervisor
or Host OS
Version(s)
macOS 15 MacBook Pro (16-
inch, M2 Pro, 2023)
Apple M Series
M2 Pro
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M2 Pro, 2023)
Apple M Series
M2 Pro
No NA 18.3
macOS 15 MacBook Pro (16-
inch, M2 Max, 2023)
Apple M Series
M2 Max
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M2 Max, 2023)
Apple M Series
M2 Max
No NA 18.3
macOS 15 Mac Studio (2023) Apple M Series
M2 Ultra
Yes NA 18.3
macOS 15 Mac Studio (2023) Apple M Series
M2 Ultra
No NA 18.3
macOS 15 MacBook Air (13-inch,
2024)
Apple M Series
M3
Yes NA 18.3
macOS 15 MacBook Air (13-inch,
2024)
Apple M Series
M3
No NA 18.3
macOS 15 MacBook Pro (14-
inch, M3 Pro, Nov
2023)
Apple M Series
M3 Pro
Yes NA 18.3
macOS 15 MacBook Pro (14-
inch, M3 Pro, Nov
2023)
Apple M Series
M3 Pro
No NA 18.3
macOS 15 MacBook Pro (14-
inch, M3 Max, Nov
2023)
Apple M Series
M3 Max
Yes NA 18.3
macOS 15 MacBook Pro (14-
inch, M3 Max, Nov
2023)
Apple M Series
M3 Max
No NA 18.3
macOS 15 Mac Mini (2024) Apple M Series
M4
Yes NA 18.3
macOS 15 Mac Mini (2024) Apple M Series
M4
No NA 18.3
macOS 15 MacBook Pro (16-
inch, M4 Pro, 2024)
Apple M Series
M4 Pro
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M4 Pro, 2024)
Apple M Series
M4 Pro
No NA 18.3
macOS 15 MacBook Pro (16-
inch, M4 Max, 2024)
Apple M Series
M4 Max
Yes NA 18.3
macOS 15 MacBook Pro (16-
inch, M4 Max, 2024)
Apple M Series
M4 Max
No NA 18.3
visionOS 2 Apple Vision Pro Apple M Series
M2
Yes NA 18.3
visionOS 2 Apple Vision Pro Apple M Series
M2
No NA 18.3
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 12 of 45
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
Operating
System
Hardware Platform
iPadOS 18 iPad 7th gen with Apple A Series A10
iPadOS 18 iPad Air 3rd gen with Apple A Series A12 Bionic
iPadOS 18 iPad Mini 5th gen with Apple A Series A12 Bionic
iPadOS 18 iPad 8th gen with Apple A Series A12 Bionic
iPadOS 18 iPad Pro 12.9 in 3rd gen with Apple A Series A12X Bionic
iPadOS 18 iPad Pro 11 in 1st gen with Apple A Series A12X Bionic
iPadOS 18 iPad Pro 12.9 in 4th gen with Apple A Series A12Z Bionic
iPadOS 18 iPad Pro 11 in 2nd gen with Apple A Series A12Z Bionic
iPadOS 18 iPad 11th gen with Apple A Series A16 Bionic
iPadOS 18 iPad Air M3 with Apple M Series M3
iOS 18 iPhone XR with Apple A Series A12 Bionic
iOS 18 iPhone XS with Apple A Series A12 Bionic
iOS 18 iPhone XS Max with Apple A Series A12 Bionic
iOS 18 iPhone 16e with Apple A Series A18
tvOS 18 Apple TV 4K with Apple A Series A12 Bionic
macOS 15 Apple Security Chip T2 with Apple T Series T2
macOS 15 Mac Studio 2025 with Apple M Series M3 Ultra
watchOS 11 Apple Watch Series S6 with Apple S Series S6
watchOS 11 Apple Watch Series S7 with Apple S Series S7
watchOS 11 Apple Watch Series S8 with Apple S Series S8
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid
CMVP makes no statement as to the correct operation of the module or the security strengths
of the generated keys when so ported if the specific operational environment is not listed on the
validation certificate.
2.3 Excluded Components
None for this module.
2.4 Modes of Operation
Modes List and Description:
Mode
Name
Description Type Status Indicator
Approved
mode
Approved mode of operation
is entered when the module
utilizes the services that use
Approved return a '0' from
fips_allowed_mode() for block
cipher functions and fips_allowed()
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 13 of 45
Mode
Name
Description Type Status Indicator
the security functions listed in
the Approved Algorithms
Table and the Vendor
Affirmed Algorithms Table.
for all other services to indicate the
executed cryptographic algorithm
was approved
Non-
Approved
mode
Non-Approved mode of
operation is entered when
the module utilizes non-
approved security functions
in the Table Non-Approved
Algorithms Not Allowed in the
Approved Mode of
Operation.
Non-
Approved
return any non-zero value from
fips_allowed_mode() for block
cipher functions and fips_allowed()
for all other services to indicate the
executed cryptographic algorithm
was non- approved
Table 5: Modes List and Description
2.4.1 Mode Change Instructions and Status
The Module has an Approved and non-Approved mode of operation. The Approved mode of
Operation is assumed automatically without any specific configuration. After the device starts up
and the module has passed all pre-operational self-tests any calls to the Approved security
functions listed in the Approved Services Table will cause the module to implicitly assume the
Approved mode of operation and any calls to the non-Approved security functions listed in the
Non-Approved Services Table will cause the module to implicitly assume the non-Approved
mode of operation. The module transitions back to the approved mode of operation only when
an approved service is requested.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP
Cert
Properties Reference
AES-CBC A6403 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CCM A6406 Key Length - 128, 192, 256 SP 800-38C
AES-CFB128 A6403 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB8 A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 14 of 45
Algorithm CAVP
Cert
Properties Reference
AES-CTR A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CTR A6406 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A6403 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A6406 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A6406 Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 192, 256
SP 800-38D
AES-KW A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-OFB A6403 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-OFB A6404 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-XTS
Testing Revision
2.0
A6403 Direction - Decrypt, Encrypt
Key Length - 128, 256
SP 800-38E
Counter DRBG A6404 Prediction Resistance - No
Mode - AES-128, AES-256
Derivation Function Enabled - Yes
SP 800-90A
Rev. 1
Counter DRBG A6406 Prediction Resistance - No
Mode - AES-128, AES-256
Derivation Function Enabled - Yes
SP 800-90A
Rev. 1
ECDSA KeyGen
(FIPS186-5)
A6407 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyVer
(FIPS186-5)
A6407 Curve - P-224, P-256, P-384, P-521 FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A6407 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256,
SHA2-384, SHA2-512
Component - No
FIPS 186-5
ECDSA SigVer
(FIPS186-4)
A6407 Component - No
Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA-1, SHA2-224, SHA2-
256, SHA2-384, SHA2-512, SHA3-224, SHA3-
256, SHA3-384, SHA3-512
FIPS 186-4
ECDSA SigVer
(FIPS186-5)
A6407 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256,
SHA2-384, SHA2-512
FIPS 186-5
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 15 of 45
Algorithm CAVP
Cert
Properties Reference
HMAC-SHA-1 A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
224
A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
256
A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
256
A6408 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
384
A6405 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
384
A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
384
A6408 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512
A6405 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512
A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512
A6408 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512/256
A6405 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512/256
A6407 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
HMAC-SHA2-
512/256
A6408 Key Length - Key Length: 8-262144 Increment
8
FIPS 198-1
RSA SigGen
(FIPS186-5)
A6407 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5, pss
FIPS 186-5
RSA SigVer
(FIPS186-4)
A6407 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024, 2048, 3072, 4096
FIPS 186-4
RSA SigVer
(FIPS186-5)
A6407 Modulo - 2048, 3072, 4096
Signature Type - pss
FIPS 186-5
SHA-1 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-224 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-256 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-256 A6408 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-384 A6405 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-384 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 16 of 45
Algorithm CAVP
Cert
Properties Reference
SHA2-384 A6408 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512 A6405 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512 A6408 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512/256 A6405 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512/256 A6407 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
SHA2-512/256 A6408 Message Length - Message Length: 0-32768
Increment 8
FIPS 180-4
Table 6: Approved Algorithms
Vendor-Affirmed Algorithms:
Name Properties Implementation Reference
CKG Key Type:Asymmetric N/A SP800-133rev2 section 4 example 1
Table 7: Vendor-Affirmed Algorithms
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
Name Use and Function
ANSI X9.63 KDF Hash based Key Derivation Function
Blowfish Encryption / Decryption
CAST5 Encryption / Decryption
DES Encryption / Decryption
ECDSA PKG: Curve P-192; PKV: Curve P-192; Signature
Generation: Curve P-192; Signature Verification: Curve P-
192
ECDSA KeyGen Key Pair Generation for compact point representation of
points
EdDSA Key Generation, Signature Generation, Signature
Verification with Ed25519
Integrated Encryption Scheme
on elliptic curves (ECIES)
Encryption / Decryption
MD2 Message Digest
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 17 of 45
Name Use and Function
MD4 Message Digest
OMAC (One-Key CBC MAC) MAC generation /verification
RC2 Encryption / Decryption
RC4 Encryption / Decryption
RIPEMD Message Digest
RSA SigGen PKCS#1 v1.5 and PSS; Signature Generation using key
sizes less than 2048-bits
RSA SigVer Signature Verification using key sizes less than1024
RSA Key Wrapping OAEP, PKCS#1 v1.5 and -PSS schemes
Triple-DES [SP 800-67r2] Encryption / Decryption
MD5 Message Digest
RFC 6637 Key Derivation Key Derivation Function
HKDF [SP800-56Crev2] Key Derivation Function
Table 8: Non-Approved, Not Allowed Algorithms
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Symmetric
Encryption and
Decryption
BC-UnAuth
BC-Auth
Symmetric
Encryption and
Decryption
AES-CBC:Key
Length: 128, 192,
256
AES-CCM:Key
Length: 128, 192,
256
AES-
CFB128:Key
Length: 128, 192,
256
AES-CFB8:Key
Length: 128, 192,
256
AES-CTR:Key
Length: 128, 192,
256
AES-ECB:Key
Length: 128, 192,
256
AES-GCM:Key
Length: 128, 192,
256
AES-OFB:Key
Length: 128, 192,
256
AES-XTS
Testing Revision
AES-CBC:
(A6403, A6404)
AES-CCM:
(A6406)
AES-CFB128:
(A6403, A6404)
AES-CFB8:
(A6404)
AES-CTR:
(A6404, A6406)
AES-ECB:
(A6403, A6404,
A6406)
AES-GCM:
(A6406)
AES-OFB:
(A6403, A6404)
AES-XTS
Testing Revision
2.0: (A6403)
AES-KW:
(A6404)
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 18 of 45
Name Type Description Properties Algorithms
2.0:Key Length:
128, 256
AES-KW:Key
Length: 128, 192,
256
Random
Number
Generation
DRBG Random
Number
Generation
Counter
DRBG:AES-128,
AES-256;
Derivation
Function
Enabled; No
Prediction
Resistance; Key
size: 128, 256
bits
Counter DRBG:
(A6404, A6406)
Asymmetric Key
Pair Generation
AsymKeyPair-
KeyGen
CKG
ECDSA Key
Pair Generation
FIPS 186-5 key
generation
method:Appendix
A.2.2 Rejection
Sampling (e.g.,
Testing
Candidates)
Supported
Curves: P-224,
P-256, P-384, P-
521
ECDSA KeyGen
(FIPS186-5):
(A6407)
CKG: ()
Key Type:
Asymmetric
Asymmetric Key
Validation
AsymKeyPair-
KeyVer
Asymmetric Key
Validation
Supported
Curves:P-224, P-
256, P-384, P-
521
ECDSA KeyVer
(FIPS186-5):
(A6407)
Digital Signature
Generation
DigSig-SigGen Digital Signature ECDSA SigGen
(FIPS186-5):P-
224, P-256, P-
384, P-521
RSA SigGen
(FIPS186-
5):Signature
Generation
(PKCS#1 v1.5)
and (PKCS
PSS); Modulus:
2048, 3072, 4096
ECDSA SigGen
(FIPS186-5):
(A6407)
RSA SigGen
(FIPS186-5):
(A6407)
Digital Signature
Verification
DigSig-SigVer Digital Signature
Verification
ECDSA SigVer
(FIPS186-5):P-
224, P-256, P-
384, P-521
RSA SigVer
ECDSA SigVer
(FIPS186-5):
(A6407)
RSA SigVer
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 19 of 45
Name Type Description Properties Algorithms
(FIPS186-
5):Signature
Verification
(PKCS#1 v1.5)
and (PKCS
PSS); Modulus:
1024 (legacy),
2048, 3072, 4096
(FIPS186-5):
(A6407)
Digital Signature
Verification
(Legacy)
DigSig-SigVer Digital Signature
Verification
using SHA-1
IG:C.M
Message
Digest:SHA-1
ECDSA SigVer
(FIPS186-4):
(A6407)
RSA SigVer
(FIPS186-4):
(A6407)
SHA-1: (A6407)
Keyed Hash MAC Keyed Hash HMAC-SHA-
1:Key Size: 128 -
262144 bits; Key
Strength: 128
bits
HMAC-SHA2-
224:Key Size:
224 - 262144
bits; Key
Strength: 224
bits
HMAC-SHA2-
256:Key Size:
256 - 262144
bits; Key
Strength: 256
bits
HMAC-SHA2-
384:Key Size:
384 - 262144
bits; Key
Strength: 384
bits
HMAC-SHA2-
512:Key Size:
512 - 262144
bits; Key
Strength: 512
bits
HMAC-SHA2-
512/256:Key
Size: 512 -
HMAC-SHA-1:
(A6407)
HMAC-SHA2-
224: (A6407)
HMAC-SHA2-
256: (A6407,
A6408)
HMAC-SHA2-
384: (A6405,
A6407, A6408)
HMAC-SHA2-
512: (A6405,
A6407, A6408)
HMAC-SHA2-
512/256:
(A6405, A6407,
A6408)
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 20 of 45
Name Type Description Properties Algorithms
262144 bits; Key
Strength: 256
bits
Message Digest SHA Message Digest SHA-1:N/A
SHA2-224:N/A
SHA2-256:N/A
SHA2-384:N/A
SHA2-512:N/A
SHA2-
512/256:N/A
SHA-1: (A6407)
SHA2-224:
(A6407)
SHA2-256:
(A6407, A6408)
SHA2-384:
(A6405, A6407,
A6408)
SHA2-512:
(A6405, A6407,
A6408)
SHA2-512/256:
(A6405, A6407,
A6408)
Table 9: Security Function Implementations
2.7 Algorithm Specific Information
AES-GCM
AES-GCM IV is constructed in compliance with IG C.H scenario 1 (IPsec-v3).
The GCM IV generation follows RFC 4106 and shall only be used for the IPsec protocol version 3.
When the IV in RFC 4106 exhausts the maximum number of possible values for a given security
association, either party to the security association that encounters this condition triggers a
rekeying with IKEv2 to establish a new encryption key for the security association. The module
uses RFC 7296 compliant IKEv2 to establish the shared secret SKEYSEED from which the AES-
GCM encryption keys are derived.
In compliance with IG C.H section 3, if the module’s power is lost and then restored, the key
used for the AES GCM encryption/decryption shall be re-distributed. This condition is not
enforced by the module.
AES-XTS
AES-XTS mode is only approved for hardware storage applications. The length of the AES-XTS
data unit does not exceed 220
blocks. It is the responsibility of the Operator to ensure Key_1 and
Key_2 are generated independently according to the rules for component symmetric keys from
NIST SP 800-133rev2, Section 6.3. In compliance with IG C.I, before using the keys in the XTS-
Algorithm, the module includes an explicit check to verify that Key_1 ≠ Key_2.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 21 of 45
RSA
In compliance with IG C.F, all the RSA modulus sizes used by the cryptographic module have
been CAVP the certificates are listed in the Approved Algorithms Table of this security policy.
There are no untested RSA modulus sizes used by the cryptographic module.
KTS
The module does not establish SSPs using an approved key transport scheme (KTS). However,
it does offer approved authenticated algorithms that can be used by an external
operator/application as part of an approved KTS.
SHA-1
SHA-1 is only approved when used in approved mode for message digest and signature
verification. Digital signature generation using SHA-1 is non-approved and not allowed in
approved services. The SHA-1 algorithm, as implemented by the module, will be non-approved
for all purposes except signature verification, starting January 1, 2031.
Legacy Algorithms
Algorithms designated as “Legacy” can only be used on data that was generated prior to the
Legacy Date specified in FIPS 140-3 IG C.M. SHA-1 used in the context of ECDSA SigVer and RSA
SigVer, is allowed for Legacy use only.
2.8 RBG and Entropy
Cert
Number
Vendor
Name
E113 apple
Table 10: Entropy Certificates
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
Apple
corecrypto
physical
entropy
source
Physical Apple A Series A13 Bionic,
Apple A Series A14 Bionic,
Apple A Series A15 Bionic,
Apple A Series A16 Bionic,
Apple A Series A17 Pro,
Apple A Series A18, Apple A
Series A18 Pro, Apple S
Series S9, Apple S Series
S10, Apple M Series M1,
Apple M Series M1 Pro, Apple
M Series M1 Max, Apple M
256 bit Full
Entropy
SHA-256
[ACVP cert.
#C1223]
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 22 of 45
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
Series M1 Ultra, Apple M
Series M2, Apple M Series
M2 Pro, Apple M Series M2
Max, Apple M Series M2
Ultra, Apple M Series M3,
Apple M Series M3 Pro, Apple
M Series M3 Max, Apple M
Series M4, Apple M Series
M4 Pro, Apple M Series M4
Max
Table 11: Entropy Sources
Entropy source: The module makes use of a physical entropy source listed in the above table,
which is located within the physical perimeter of the module (TOEPP) but outside the
cryptographic boundary of the module. The entropy source runs on all processors listed in the
above table, which accounts for and operates on all tested Operating Environments listed in the
section 2.2 above. The output of the entropy source provides full entropy to seed and reseed
SP800-90Arev1 DRBG during initialization and reseeding respectively.
DRBG: The NIST SP 800-90ARev1 approved deterministic random bit generator (DRBG) used for
random number generation is a CTR_DRBG using AES-256 with derivation function enabled and
without prediction resistance.
The module performs DRBG health tests according to SP800-90ARev1 section 11.3.
2.9 Key Generation
See vendor affirmed algorithms (CKG) in section 2.5. The module implements ECDSA Key
Generation in compliance with SP800-133rev2 section 4 example 1 and IG D.H.
The module does not implement symmetric key generation.
2.10 Key Establishment
The module does not establish SSPs using an approved key transport scheme (KTS). However, it
does offer approved authenticated algorithms that can be used by an external operator
application as part of an approved KTS.
The module does not implement key agreement.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 23 of 45
2.11 Industry Protocols
No parts of the IPSec, other than those mentioned above, have been tested by the CAVP and
CMVP.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 24 of 45
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Data Input Data inputs are provided in the variables passed in the C language
Kernel Interfaces (KPIs) and callable service invocations, generally
through caller-supplied buffers
N/A Data Output Data outputs are provided in the variables passed in the KPI and
callable service invocations, generally through caller-supplied
buffers
N/A Control
Input
Control inputs which control the mode of the module are provided
through dedicated parameters.
N/A Status
Output
Status output is provided in return codes and through messages.
Documentation for each KPI lists possible return codes. A complete
list of all return codes returned by the C language KPIs within the
module is provided in the header files and the KPI documentation.
Messages are also documented in the KPI documentation.
Table 12: Ports and Interfaces
The module does not implement a Control Output Logical Interface.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 25 of 45
4 Roles, Services, and Authentication
4.1 Authentication Methods
N/A for this module.
FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the
module does not support an authentication mechanism for Crypto Officer. The Crypto Officer
role is authorized to access all services provided by the module (see Table - Approved Services
and Table - Non-Approved Services).
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Role Crypto Officer None
Table 13: Roles
4.3 Approved Services
The abbreviations of the access rights to SSPs have the following interpretation:
G = Generate: The module generates or derives the SSP.
R = Read: The SSP is read from the module (e.g., the SSP is output).
W = Write: The SSP is updated, imported, or written to the module.
E = Execute: The module uses the SSP in performing a cryptographic operation.
Z = Zeroise: The module zeroises the SSP.
N/A = The service does not access any SSP during its operation
Name Description Indicator Inputs Outputs Security
Functions
SSP
Access
AES
Encryption
Execute
AES-mode
encrypt
operation
0 plaintext
data and
key
ciphertext
data
Symmetric
Encryption
and
Decryption
Crypto
Officer
- AES
key: W,E
AES
Decryption
Execute
AES-mode
decrypt
operation
0 ciphertext
data and
key
plaintext
data
Symmetric
Encryption
and
Decryption
Crypto
Officer
- AES
key: W,E
Message
Digest
Generation
Generate a
digest for
the
0 message digest Message
Digest
Crypto
Officer
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 26 of 45
Name Description Indicator Inputs Outputs Security
Functions
SSP
Access
requested
algorithm
Message
Authentication
Code
Generation
Generate a
MAC tag
using the
requested
SHA
algorithm
0 message,
MAC key,
MAC
algorithm
MAC Keyed
Hash
Crypto
Officer
- HMAC
key: W,E
RSA signature
generation
Sign a
message
with a
specified
RSA private
key.
0 private
key,
message,
hash
function;
computed
signature
Digital
Signature
Generation
Crypto
Officer
- RSA
key pair:
W,E
RSA signature
verification
Verify the
signature of
a message
with a
specified
RSA public
key.
0 public
key,
digital
signature,
message,
hash
function
pass/fail
result of
digital
signature
verification
Digital
Signature
Verification
Digital
Signature
Verification
(Legacy)
Crypto
Officer
- RSA
key pair:
W,E
ECDSA
signature
generation
Sign a
message
with a
specified
ECDSA
private key
0 private
key,
message,
hash
function
computed
signature
Digital
Signature
Generation
Crypto
Officer
- ECDSA
key pair:
W,E
ECDSA
signature
verification
Verify the
signature of
a message
with a
specified
ECDSA
public key
0 public
key,
digital
signature,
message,
hash
function
pass/fail
result of
digital
signature
verification
Digital
Signature
Verification
Digital
Signature
Verification
(Legacy)
Crypto
Officer
- ECDSA
key pair:
W,E
Random
Number
Generation
Generate
random
number
0 length of
generated
number
random
bit-string
Random
Number
Generation
Crypto
Officer
- Entropy
input
string:
W,E,Z
- DRBG
seed,
internal
state V
value,
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 27 of 45
Name Description Indicator Inputs Outputs Security
Functions
SSP
Access
and key:
G,W,E
Asymmetric
Key Pair
Validation
Validate
ECDSA key
pair
0 ECDSA
key pair
Pass/Fail Random
Number
Generation
Asymmetric
Key
Validation
Crypto
Officer
- ECDSA
key pair:
W,E
Self-test execute
CASTs
0 power pass/fail
results
Symmetric
Encryption
and
Decryption
Random
Number
Generation
Digital
Signature
Generation
Digital
Signature
Verification
Keyed
Hash
Message
Digest
Crypto
Officer
Show Status Return the
module
status
N/A N/A Status
output
None Crypto
Officer
Show
version/module
info
Return
Module
Base Name
and Module
Version
Number
N/A N/A Module
information
None Crypto
Officer
Zeroization SSPs are
zeroised
when the
system is
powered
down, when
all resources
of symmetric
crypto
function
context, all
resources of
0 N/A N/A None Crypto
Officer
- AES
key: Z
- AES
key-
wrapping
key: Z
- HMAC
key: Z
- ECDSA
key pair:
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 28 of 45
Name Description Indicator Inputs Outputs Security
Functions
SSP
Access
hash
context, all
resources of
asymmetric
crypto
function
context are
released.
Z
- RSA
key pair:
Z
- Entropy
input
string: Z
- DRBG
seed,
internal
state V
value,
and key:
Z
ECDSA Key
Pair
Generation
Generate a
key pair for
a requested
ECC curve
0 curve size key pair Random
Number
Generation
Asymmetric
Key Pair
Generation
Crypto
Officer
- ECDSA
key pair:
G,R
- DRBG
seed,
internal
state V
value,
and key:
W,E
Table 14: Approved Services
4.4 Non-Approved Services
Name Description Algorithms Role
Triple-DES encryption /
decryption
Execute Triple-DES mode
encrypt or decrypt
operation.
Triple-DES [SP 800-
67r2]
CO
RSA Key Encapsulation The CAST does not perform
the full KTS, only the raw
RSA encrypt/decrypt.
RSA Key Wrapping CO
RSA Signature Generation Sign a message with a non-
approved RSA private key
size
RSA SigGen CO
RSA Signature Verification Verify the signature of a
message with a non-
approved RSA public key
size
RSA SigVer CO
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 29 of 45
Name Description Algorithms Role
ECDSA key-pair generation,
ECDSA PKV, ECDSA signature
generation, ECDSA signature
verification
For curve P-192 ECDSA CO
ECDSA Key Pair Generation for
compact point representation of
points
For compact point
representation of points
ECDSA KeyGen CO
EdDSA Key Generation,
Signature Generation, Signature
Verification
Ed25519 EdDSA CO
ECIES Elliptic Curve encrypt/
decrypt
Integrated
Encryption Scheme
on elliptic curves
(ECIES)
CO
ANSI X9.63 Key Derivation SHA-1 hash-based ANSI X9.63 KDF CO
SP800-56Crev2 Key Derivation
(HKDF)
SHA-256 hash-based HKDF [SP800-
56Crev2]
CO
OMAC Message Authentication
Code Generation
One-Key CBC-MAC using
128-bit key
OMAC (One-Key
CBC MAC)
CO
OMAC Message Authentication
Code Verification
One-Key CBC-MAC using
128-bit key
OMAC (One-Key
CBC MAC)
CO
Message digest generation Message digest generation
using non-approved
algorithms
MD2
MD4
RIPEMD
MD5
CO
Symmetric encryption /
decryption
Symmetric encryption /
decryption using non-
approved algorithms
Blowfish
CAST5
DES
RC2
RC4
CO
RFC 6637 KDF SHA-256, SHA-512, AES-
128, AES-256
RFC 6637 Key
Derivation
CO
Table 15: Non-Approved Services
4.5 External Software/Firmware Loaded
The module does not support the loading of external software/firmware.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 30 of 45
5 Software/Firmware Security
5.1 Integrity Techniques
A software integrity test is performed on the runtime image of the module. The HMAC-SHA256
implemented in the module is used as the approved algorithm for the integrity test with the
HMAC key embedded in the module. If the test fails, the module enters an error state where no
cryptographic services are provided, and data output is prohibited i.e. the module is not
operational.
5.2 Initiate on Demand
The module’s integrity test can be performed on demand by power-cycling the computing
platform. Integrity test on demand is performed as part of the Pre-Operational Self-Tests,
automatically executed at power-on.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 31 of 45
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Modifiable
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 32 of 45
7 Physical Security
The FIPS 140-3 physical security requirements do not apply to the Apple corecrypto Module
18.3 [Apple silicon, Kernel, Software, SL1] since it is a software module.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 33 of 45
8 Non-Invasive Security
8.1 Mitigation Techniques
Per IG 12.A, until the requirements of NIST SP 800-140F are defined, non-invasive mechanisms
fall under ISO/IEC 19790:2012 Section 7.12 Mitigation of other attacks.
The requirements of this area are not applicable to the module.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 34 of 45
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description Persistence
Type
RAM Temporary storage for SSPs used by the module as part of service
execution. The module does not perform persistent storage of SSPs
Dynamic
Table 16: Storage Areas
9.2 SSP Input-Output Methods
Name From To Format
Type
Distributio
n Type
Entry
Type
SFI or
Algorith
m
KPI input
parameter
s
Operator
calling
application
(TOEPP)
Cryptographi
c module
Plaintex
t
Manual Electroni
c
KPI output
parameter
s
Cryptographi
c module
Operator
calling
application
(TOEPP)
Plaintex
t
Manual Electroni
c
Table 17: SSP Input-Output Methods
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator
Initiation
Wipe and Free
memory block
allocated
Zeroizes the SSPs
contained within the
cipher handle.
Memory occupied by SSPs is
overwritten with zeroes and then it
is released, which renders the
SSP values irretrievable. The
completion of the zeroization
routine indicates that the
zeroization procedure succeeded.
By calling the
cipher related
zeroization
API
Module Reset De-allocates the
volatile memory used
to store SSPs
Volatile memory used by the
module is overwritten within
nanoseconds when power is
removed.
By unloading
and reloading
the module
Intermediate
value
zeroization
Intermediate keygen
values are zeroized
before the module
Intermediate keygen values are
zeroized before the module returns
from the key generation function.
N/A
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 35 of 45
Zeroization
Method
Description Rationale Operator
Initiation
returns from the key
generation function.
Table 18: SSP Zeroization Methods
Data output interfaces are inhibited while zeroisation is performed.
9.4 SSPs
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
AES key AES key 128 to
256 bits -
128 to
256 bits
Symmetric
- CSP
Symmetric
Encryption
and
Decryption
AES key-
wrapping
key
AES KW 128 to
256 bits -
128 to
256 bits
symmetric -
CSP
Symmetric
Encryption
and
Decryption
HMAC
key
HMAC key 128 -
262144
bits - 112
to 256
MAC - CSP Keyed
Hash
ECDSA
key pair
ECDSA key
pair
(including
intermediate
keygen
values)
P-224, P-
256, P-
384, P-
521 - 112
to 256
bits
Asymmetric
- CSP
Asymmetric
Key Pair
Generation
Digital
Signature
Generation
Digital
Signature
Verification
Digital
Signature
Verification
(Legacy)
RSA key
pair
RSA key
pair
(including
intermediate
keygen
values)
2048 -
4096 -
112 to
150 bits
Asymmetric
- CSP
Digital
Signature
Generation
Digital
Signature
Verification
Digital
Signature
Verification
(Legacy)
Entropy
input
string
Entropy
input string
512 bits -
256 bits
Entropy
input string
- CSP
Random
Number
Generation
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 36 of 45
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
DRBG
seed,
internal
state V
value,
and key
DRBG input
parameters
384 bits -
256 bits
DRBG -
CSP
Random
Number
Generation
Random
Number
Generation
Table 19: SSP Table 1
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
AES key KPI input
parameters
RAM:Plaintext From
service
invocation
to service
completion
Wipe and
Free memory
block
allocated
Module
Reset
AES key-
wrapping
key
KPI input
parameters
RAM:Plaintext From
service
invocation
to service
completion
Wipe and
Free memory
block
allocated
Module
Reset
HMAC
key
KPI input
parameters
RAM:Plaintext From
service
invocation
to service
completion
Wipe and
Free memory
block
allocated
Module
Reset
ECDSA
key pair
KPI input
parameters
KPI output
parameters
RAM:Plaintext From
service
invocation
to service
completion
Wipe and
Free memory
block
allocated
Module
Reset
Intermediate
value
zeroization
DRBG seed, internal
state V value, and
key:Used With
RSA key
pair
KPI input
parameters
RAM:Plaintext From
service
invocation
to service
completion
Wipe and
Free memory
block
allocated
Module
Reset
Intermediate
DRBG seed, internal
state V value, and
key (IG D.L
compliant):Derived
From
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 37 of 45
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
value
zeroization
Entropy
input
string
RAM:Plaintext Storage
duration
during the
usage of
the CSP
Module
Reset
DRBG seed, internal
state V value, and
key:Used With
DRBG
seed,
internal
state V
value,
and key
Storage
duration
during the
usage of
the CSP
Module
Reset
Entropy input
string:Used With
Table 20: SSP Table 2
9.5 Transitions
SHA-1 is disallowed for digital signature generation. When used for digital signature verification,
SHA-1 is allowed for legacy use. The use of SHA-1 is deprecated through December 31, 2030,
for applying protection in non-digital signature applications and disallowed thereafter. The use of
SHA-1 is acceptable for processing already-protected information through December 31, 2030,
and allowed for legacy use thereafter.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 38 of 45
10 Self-Tests
While the module is executing the self-tests, services are not available, and input and output are
inhibited.
10.1 Pre-Operational Self-Tests
The module performs a pre-operational software integrity automatically when the module is
loaded into memory (i.e., at power on) before the module transitions to the operational state. A
software integrity test is performed on the runtime image of the module with HMAC-SHA256
used to perform the approved integrity technique. Prior to using HMAC-SHA-256, a Conditional
Cryptographic Algorithm Self-Tests (CAST) is performed.
Algorithm
or Test
Test
Properties
Test Method Test
Type
Indicator Details
HMAC-
SHA2-256
(A6407)
112-bit key Message
Authentication
SW/FW
Integrity
Module
successful
execution
The HMAC-SHA2-256
value calculated at
runtime is compared
with the HMAC-SHA2-
256 value stored in the
module, computed at
compilation time.
Table 21: Pre-Operational Self-Tests
10.2 Conditional Self-Tests
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CBC
Encrypt
128-bit key,
encrypt
KAT CAST Module
becomes
operational
Symmetric
encryption
Test runs at
power-on
before the
integrity test
AES-ECB
Decrypt
128-bit key,
decrypt
KAT CAST Module
becomes
operational
Symmetric
decryption
Test runs at
power-on
before the
integrity test
AES-KW
Encrypt
128-bit key,
encrypt
KAT CAST Module
becomes
operational
Symmetric
wrapping
Test runs at
power-on
before the
integrity test
AES-KW
Decrypt
128-bit key,
decrypt
KAT CAST Module
becomes
operational
Symmetric
unwrap
Test runs at
power-on
before the
integrity test
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 39 of 45
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM
Encrypt
128-bit key,
encrypt
KAT CAST Module
becomes
operational
Symmetric
encryption
Test runs at
power-on
before the
integrity test
AES-GCM
Decrypt
128-bit key,
decrypt
KAT CAST Module
becomes
operational
Symmetric
decryption
Test runs at
power-on
before the
integrity test
Counter
DRBG
128-bit key KAT CAST Module
becomes
operational
“SP 800-90Ar1
(instantiate,
reseed,
generate) health
test per section
11.3
Test runs at
power-on
before the
integrity test
HMAC-
SHA2-256
SHA2-256 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-
SHA-1
SHA-1 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-
SHA2-512
SHA2-512 KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-
SHA2-
512/256
SHA2-
512/256
KAT CAST Module
becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
RSA
SigGen
(FIPS186-
5)
PKCS#1
v1.5 with
2048 bit key
and SHA2-
256
KAT CAST Module
becomes
operational
Digital signature
generation
Test runs at
power-on
before the
integrity test
RSA
SigVer
(FIPS186-
5)
PKCS#1
v1.5 with
2048 bit key
and SHA2-
256
KAT CAST Module
becomes
operational
Digital signature
verification
Test runs at
power-on
before the
integrity test
ECDSA
KeyGen
(FIPS186-
5)
PCT with
SHA2-256
PCT PCT Successful
key pair
generation
Signature
generation &
verification
Key pair
generation
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 40 of 45
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
ECDSA
SigGen
(FIPS186-
5)
P-224 with
SHA-224
KAT CAST Module
becomes
operational
Digital signature
generation
Test runs at
power-on
before the
integrity test
ECDSA
SigVer
(FIPS186-
5)
P-224 with
SHA-224
KAT CAST Module
becomes
operational
Digital signature
verification
Test runs at
power-on
before the
integrity test
Table 22: Conditional Self-Tests
10.3 Periodic Self-Test Information
Algorithm or
Test
Test Method Test Type Period Periodic
Method
HMAC-SHA2-
256 (A6407)
Message
Authentication
SW/FW Integrity Whenever
module is
powered on
Upon every
power on
Table 23: Pre-Operational Periodic Information
Algorithm or
Test
Test Method Test Type Period Periodic
Method
AES-CBC
Encrypt
KAT CAST On Demand Manually
AES-ECB
Decrypt
KAT CAST On Demand Manually
AES-KW
Encrypt
KAT CAST On Demand Manually
AES-KW
Decrypt
KAT CAST On Demand Manually
AES-GCM
Encrypt
KAT CAST On Demand Manually
AES-GCM
Decrypt
KAT CAST On Demand Manually
Counter DRBG KAT CAST On Demand Manually
HMAC-SHA2-
256
KAT CAST On Demand Manually
HMAC-SHA-1 KAT CAST On Demand Manually
HMAC-SHA2-
512
KAT CAST On Demand Manually
HMAC-SHA2-
512/256
KAT CAST On Demand Manually
RSA SigGen
(FIPS186-5)
KAT CAST On Demand Manually
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 41 of 45
Algorithm or
Test
Test Method Test Type Period Periodic
Method
RSA SigVer
(FIPS186-5)
KAT CAST On Demand Manually
ECDSA KeyGen
(FIPS186-5)
PCT PCT On Demand Manually
ECDSA SigGen
(FIPS186-5)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-5)
KAT CAST On Demand Manually
Table 24: Conditional Periodic Information
10.4 Error States
Nam
e
Description Condition
s
Recovery
Method
Indicator
Error
State
1) The
HMAC-SHA-
256 value
computed
over the
module did
not match the
pre-
computed
value or 2)
The
computed
value in the
invoked
Conditional
CAST did not
match the
known value
or 3) The
signature
failed to
generate/verif
y successfully
in the
Conditional
PCT. No
cryptographic
services are
provided, and
1) Pre-
operationa
l Software
Integrity
Test
failure or
2)
Conditiona
l CAST
failure 3)
Conditiona
l PCT
failure
Power
cycle the
device
which
results in
the module
being
reloaded
into
memory
and
reperformin
g the pre-
operational
software
integrity
test and the
Conditional
CASTs.
1) Error message "FAILED:
fipspost_post_integrity" send to caller or
2) Error message "FAILED:<event>" sent
to caller (<event> refers to any of the
cryptographic functions listed Table -
Conditional Self-Tests 3) Error code
"CCEC_GENERATE_KEY_CONSISTEN
CY" returned for ECDSA
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 42 of 45
Nam
e
Description Condition
s
Recovery
Method
Indicator
data output is
prohibited
Table 25: Error States
10.5 Operator Initiation of Self-Tests
The module permits operators to initiate the pre-operational or conditional self-tests on
demand for periodic testing of the module by rebooting the system (i.e., power-cycling).
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 43 of 45
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
Startup Procedures: The module is built into Device OS defined in section 2 and delivered/
installed with the respective Device OS. There is no standalone delivery of the module as a
software library.
Installation Process and Authentication Mechanisms: The vendor’s internal development process
guarantees that the correct version of module goes with its intended Device OS version. For
additional assurance, the module is digitally signed by vendor, and it is verified during the
integration into Host Device OS.
This digital signature-based integrity protection during the delivery/integration process is not to
be confused with the HMAC-256 based integrity check performed by the module itself as part of
its pre-operational self- tests.
11.2 Administrator Guidance
The Approved mode of operation is configured in the system by default and can only be
transitioned into the non-Approved mode by calling one of the non-Approved services listed in
Table - Non-Approved Services. If the device starts up successfully, then the module has passed
all self-tests and is operating in the Approved mode.
Apple Platform Certifications guide and Apple Platform Security guide are provided by Apple
which offers IT System Administrators with the necessary technical information to ensure FIPS
140-3 Compliance of the deployed systems. This guide walks the reader through the system’s
assertion of cryptographic module integrity and the steps necessary if module integrity requires
remediation.
The administrator should request the “Show module and version info” service from the module
and confirm that it outputs “Apple corecrypto Module 18.3 [Apple ARM, Kernel, Software, SL1]”
to identify the module and its version. The term Apple ARM identifies Apple Silicon chips.
11.3 Non-Administrator Guidance
No non-administrator guidance.
11.4 Design and Rules
The Crypto Officer shall consider the following requirements and restrictions when using the
module.
• AES-GCM see section 2.7.
• AES-XTS see section 2.7.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 44 of 45
11.5 End of Life
The module secure sanitization is accomplished by first powering the module down, which will
zeroize all SSPs within volatile memory. Following the power-down, an uninstall by way of
system wipe or system update will zeroize the xnu-11215.82.4 binary file listed in Table 2.
Apple corecrypto Module 18.3 [Apple silicon, Kernel, Software, SL1] FIPS 140-3 Non-Proprietary Security Policy
© 2025 Apple Inc., All rights reserved.
This document may be reproduced and distributed only in its original entirely without revision.
Page 45 of 45
12 Mitigation of Other Attacks
The module does not claim mitigation of other attacks.