This page was not yet optimized for use on mobile devices.

Marvell LS2 HSM Family

Certificate details

Certificate ID	#5502
Status	active
Validation dates	25.08.2026
Sunset date	24-08-2031
Standard	FIPS 140-3
Security level	3
Type	Hardware
Embodiment	MultiChipEmbed
Caveat	When installed, initialized and configured as specified in Section 11.1 of the Security Policy. When operated in approved mode
Exceptions	Operational environment: N/A Non-invasive security: N/A Mitigation of other attacks: N/A
Description	The LS2 HSM module is a multi-chip PCIe adapter with firmware. It consists of multiple firmware components, including an operating system, applications exposing services and interfaces related to secure key management, crypto operations, and policy management of the module.
Vendor	Marvell Semiconductor, Inc. http://www.marvell.com/products/security-solutions.html
Lab	Teron Labs
Algorithms	AES-CBCA7544 AES-CCMA7544 AES-CMACA7544 AES-CTRA7544 AES-ECBA7544 AES-GCMA7544 AES-GMACA7544 AES-KWA1948 AES-KWPA1948 Counter DRBGA1948 ECDSA KeyGen (FIPS186-4)A1948 ECDSA KeyGen (FIPS186-5)A7545 ECDSA KeyVer (FIPS186-4)A1948 ECDSA SigGen (FIPS186-4)A1948 ECDSA SigGen (FIPS186-5)A7544 ECDSA SigVer (FIPS186-4)A1948 ECDSA SigVer (FIPS186-5)A7544 Hash DRBGA7544 HMAC-SHA-1A7544 HMAC-SHA2-224A7544 HMAC-SHA2-256A7544 HMAC-SHA2-384A7544 HMAC-SHA2-512A7544 HMAC-SHA3-224A7544 HMAC-SHA3-256A7544 HMAC-SHA3-384A7544 HMAC-SHA3-512A7544 KAS-ECC Sp800-56Ar3A1948 KAS-ECC-SSC Sp800-56Ar3A7544 KAS-IFC-SSCA1948 KDA HKDF Sp800-56Cr1A1948 KDA OneStep Sp800-56Cr1A1948 KDA TwoStep Sp800-56Cr1A1948 KDF ANS 9.63A1948 KDF SP800-108A7544 KTS-IFCA7545 RSA Decryption Primitive Sp800-56Br2A7544 RSA Decryption PrimitiveA1948 RSA KeyGen (FIPS186-5)A7545 RSA SigGen (FIPS186-5)A1948 RSA Signature PrimitiveA7544 RSA SigVer (FIPS186-4)A1946 RSA SigVer (FIPS186-5)A7545 SHA-1A7544 SHA2-224A7544 SHA2-256A7544 SHA2-384A7544 SHA2-512A7544 SHA3-224A7544 SHA3-256A7544 SHA3-384A7544 SHA3-512A7544 TDES-CBCA7544 TDES-ECBA7544 TDES-KWA1948 TLS v1.2 KDF RFC7627A7544
References	This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.

Certificate

Webpage

Security policy

Security policy PDF TXT

Extracted keywords

Symmetric Algorithms

AES, AES-256, AES256, AES-, CAST, DES, Triple-DES, TDEA, TDES, HMAC, CMAC

Asymmetric Algorithms

RSA 1024, RSA 2048, RSA-2048, ECDH, ECDSA, ECC, Diffie-Hellman, DH, DSA

Post-quantum Algorithms

ML-DSA, ML_DSA

Hash functions

SHA-1, SHA1, SHA256, SHA2, SHA-2, SHA3-512, SHA3-224, SHA3-256, SHA3-384, SHA-3, PBKDF

Schemes

MAC, KEM, Key Agreement

Protocols

SSL, TLS, TLS 1.2, TLS v1.2

Randomness

DRBG, RNG, RBG

Libraries

OpenSSL

Elliptic Curves

P-224, P-256, P-384, P-521, P-192, B-233, B-283, B-571, K-233, K-283, K-409, K-571, K-163, B-163, secp256k1, brainpoolP224r1, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1, brainpoolP160r1, FRP256v1, Curve25519

Block cipher modes

ECB, CBC, CTR, GCM, CCM

TLS cipher suites

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Trusted Execution Environments

PSP

Security level

Level 3

Side-channel analysis

physical tampering

Creation date	D:20260824100254-04'00'
Modification date	D:20260824100254-04'00'
Pages	149
Creator	Microsoft® Word for Microsoft 365
Producer	Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

No references are available for this certificate.

Processing updates

06.10.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__update__': {'Level 3': 5}}}}, 'symmetric_crypto': {'__update__': {'DES': {'__update__': {'3DES': {'__update__': {'Triple-DES': 11}}}}}}, 'randomness': {'__update__': {'PRNG': {'__update__': {'DRBG': 222}}}}, 'standard_id': {'__update__': {'FIPS': {'__update__': {'FIPS 186-4': 15}}}}} data.
05.10.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__update__': {'Level 3': 4}}}}, 'symmetric_crypto': {'__update__': {'DES': {'__update__': {'3DES': {'__update__': {'Triple-DES': 12}}}}}}, 'randomness': {'__update__': {'PRNG': {'__update__': {'DRBG': 224}}}}, 'standard_id': {'__update__': {'FIPS': {'__update__': {'FIPS 186-4': 14}}}}} data.
28.09.2026

The certificate data changed.
Certificate changed

The web extraction data was updated.

The certificate_pdf_url property was set to https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf.
24.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__update__': {'Level 3': 5}}}}, 'symmetric_crypto': {'__update__': {'DES': {'__update__': {'3DES': {'__update__': {'Triple-DES': 11}}}}}}, 'randomness': {'__update__': {'PRNG': {'__update__': {'DRBG': 222}}}}, 'standard_id': {'__update__': {'FIPS': {'__update__': {'FIPS 186-4': 15}}}}} data.

The is_br1_format property was set to True.

The br1_tables property was set to {'_type': 'sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables', 'security_levels': {'section': 1, 'subsection': 2, 'found': True, 'entries': [{'section': '1', 'title': 'General', 'level': '3'}, {'section': '2', 'title': 'Cryptographic module specification', 'level': '3'}, {'section': '3', 'title': 'Cryptographic module interfaces', 'level': '3'}, {'section': '4', 'title': 'Roles, services, and authentication', 'level': '3'}, {'section': '5', 'title': 'Software/Firmware security', 'level': '3'}, {'section': '6', 'title': 'Operational environment', 'level': 'N/A'}, {'section': '7', 'title': 'Physical security', 'level': '3'}, {'section': '8', 'title': 'Non-invasive security', 'level': 'N/A'}, {'section': '9', 'title': 'Sensitive security parameter management', 'level': '3'}, {'section': '10', 'title': 'Self-tests', 'level': '3'}, {'section': '11', 'title': 'Life-cycle assurance', 'level': '3'}, {'section': '12', 'title': 'Mitigation of other attacks', 'level': 'N/A'}, {'section': '', 'title': 'Overall Level', 'level': '3'}]}, 'tested_module_id_hw': {'section': 2, 'subsection': 2, 'found': True, 'entries': [{'modelPartNum': 'LS2-B0 / LS2-G- A050-XX-Y-B0', 'hwVersion': 'CN9310410-03 C - LS2-G-A050-XX-Y-B0', 'fwVersion': 'MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB', 'processors': 'Octeon_TX2', 'features': 'Offers 50% of full card capacity.'}, {'modelPartNum': 'LS2-B0 / LS2-G- A100-XX-Y-B0', 'hwVersion': 'CN9310410-03 C - LS2-G-A100-XX-Y-B0', 'fwVersion': 'MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB', 'processors': 'Octeon_TX2', 'features': 'Offers 75% of full card capacity.'}, {'modelPartNum': 'LS2-B0 / LS2-G- A300-XX-Y-B0', 'hwVersion': 'CN9310410-03 C - LS2-G-A300-XX-Y-B0', 'fwVersion': 'MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB', 'processors': 'Octeon_TX2', 'features': 'Offers full card capacity.'}]}, 'tested_module_id_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'tested_module_id_hw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'tested_op_env_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'vendor_affirmed_op_env_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'modes_of_operation': {'section': 2, 'subsection': 4, 'found': False, 'entries': []}, 'approved_algorithms': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'algorithm': 'AES-CBC', 'cavpCertName': 'A1948, A7544', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128, 192, 256', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-CCM', 'cavpCertName': 'A7544', 'properties': 'Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-8192 Increment 8', 'reference': 'SP 800-38C'}, {'algorithm': 'AES-CMAC', 'cavpCertName': 'A1948', 'properties': 'Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 32-128 Increment 8 Message Length - Message Length: 0-65536 Increment 8', 'reference': 'SP 800-38B'}, {'algorithm': 'AES-CMAC', 'cavpCertName': 'A7544', 'properties': 'Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 16-128 Increment 8, MAC Length: 32-128 Increment 8 Message Length - Message Length: 0-65536 Increment 8', 'reference': 'SP 800-38B'}, {'algorithm': 'AES-CTR', 'cavpCertName': 'A1948, A7544', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-ECB', 'cavpCertName': 'A1948, A7544', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128, 192, 256', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-GCM', 'cavpCertName': 'A1948', 'properties': 'Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 8-1024 Increment 8 Payload Length - Payload Length: 0-65536 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8', 'reference': 'SP 800-38D'}, {'algorithm': 'AES-GCM', 'cavpCertName': 'A7544', 'properties': 'Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 96-128 Increment 32 Payload Length - Payload Length: 0-65536 Increment 8', 'reference': 'SP 800-38D'}, {'algorithm': 'AES-GMAC', 'cavpCertName': 'A1948', 'properties': 'AAD Length - AAD Length: 0-65536 Increment 8 Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 8-1024 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8', 'reference': 'SP 800-38D'}, {'algorithm': 'AES-GMAC', 'cavpCertName': 'A7544', 'properties': 'Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 96-128 Increment 32 AAD Length - AAD Length: 0-65536 Increment 8', 'reference': 'SP 800-38D'}, {'algorithm': 'AES-KW', 'cavpCertName': 'A1948', 'properties': 'Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 64', 'reference': 'SP 800-38F'}, {'algorithm': 'AES-KWP', 'cavpCertName': 'A1948', 'properties': 'Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 8-4096 Increment 8', 'reference': 'SP 800-38F'}, {'algorithm': 'Counter DRBG', 'cavpCertName': 'A1948', 'properties': 'Prediction Resistance - No, Yes Mode - AES-256 Derivation Function Enabled - Yes', 'reference': 'SP 800-90A Rev. 1'}, {'algorithm': 'ECDSA KeyGen (FIPS186-4)', 'cavpCertName': 'A1948', 'properties': 'Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - Testing Candidates', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA KeyGen (FIPS186-5)', 'cavpCertName': 'A7545', 'properties': 'Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates', 'reference': 'FIPS 186-5'}, {'algorithm': 'ECDSA KeyVer (FIPS186-4)', 'cavpCertName': 'A1948', 'properties': 'Curve - P-192, P-224, P-256, P-384, P-521', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA SigGen (FIPS186-4)', 'cavpCertName': 'A1948', 'properties': 'Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - Yes', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA SigGen (FIPS186-5)', 'cavpCertName': 'A7544', 'properties': 'Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No, Yes', 'reference': 'FIPS 186-5'}, {'algorithm': 'ECDSA SigVer (FIPS186-4)', 'cavpCertName': 'A1948', 'properties': 'Curve - P-192, P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,', 'reference': 'FIPS 186-4'}, {'algorithm': '', 'cavpCertName': '', 'properties': 'SHA2-512', 'reference': ''}, {'algorithm': 'ECDSA SigVer (FIPS186-5)', 'cavpCertName': 'A7544', 'properties': 'Component - Yes Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512', 'reference': 'FIPS 186-5'}, {'algorithm': 'Hash DRBG', 'cavpCertName': 'A7544', 'properties': 'Prediction Resistance - Yes Supports Reseed - No Mode - SHA2-512 Entropy Input - Entropy Input: 2048 Nonce - Nonce: 2048 Personalization String Length - Personalization String Length: 0-2048 Increment 8 Additional Input - Additional Input: 0-2048 Increment 8', 'reference': 'SP 800-90A Rev. 1'}, {'algorithm': 'HMAC-SHA-1', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 160 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA-1', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 160 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-224', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 224 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-224', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 224 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-256', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 256 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-256', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 256 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-384', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 384 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-384', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 384 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-512', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 512 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2-512', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 512 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-224', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 112, 128, 160, 192, 224 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-224', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 112-224 Increment 8 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-256', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 128, 192, 256 Key Length - Key Length: 8-524288 Increment', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-256', 'cavpCertName': 'A7544', 'properties': '8 MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-384', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 192, 256, 320, 384 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-384', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 8-8192 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-512', 'cavpCertName': 'A1948', 'properties': 'MAC - MAC: 256, 320, 384, 448, 512 Key Length - Key Length: 8-524288 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA3-512', 'cavpCertName': 'A7544', 'properties': 'MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 8-8192', 'reference': 'FIPS 198-1'}, {'algorithm': 'KAS-ECC Sp800- 56Ar3', 'cavpCertName': 'A1948', 'properties': 'Increment 8 Domain Parameter Generation Methods - P-521 Function - Key Pair Generation, Partial Validation iutId - 123456ABCD Scheme - ephemeralUnified - KAS Role - Initiator, Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-512', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': '', 'cavpCertName': '', 'properties': 'Fixed Info Pattern - l||uPartyInfo||vPartyInfo Fixed Info Encoding - Concatenation Key Length - 512', 'reference': ''}, {'algorithm': 'KAS-ECC-SSC Sp800-56Ar3', 'cavpCertName': 'A1948', 'properties': 'Domain Parameter Generation Methods - B-233, B-283, B- 409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P-384, P-521 Scheme - staticUnified -', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'KAS-ECC-SSC Sp800-56Ar3', 'cavpCertName': 'A7544', 'properties': 'KAS Role - initiator, responder Domain Parameter Generation Methods - P-224, P-256, P- 384, P-521 Scheme - staticUnified - KAS Role - initiator, responder', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'KAS-IFC-SSC', 'cavpCertName': 'A1948', 'properties': 'Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg1-crt Scheme - KAS1 - KAS Role - initiator KAS2 - KAS Role - initiator, responder Fixed Public Exponent - 010001', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'KDA HKDF Sp800- 56Cr1', 'cavpCertName': 'A1948', 'properties': 'Fixed Info Pattern - uPartyInfo||vPartyInfo||l Fixed Info Encoding - concatenation Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224-4096 Increment 8 HMAC Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-', 'reference': 'SP 800-56C Rev. 2'}, {'algorithm': 'KDA OneStep Sp800-56Cr1', 'cavpCertName': 'A1948', 'properties': 'Auxiliary Function Methods - Auxiliary Function Name - SHA2-224 Fixed Info Pattern - label||uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224-1024 Increment 8', 'reference': 'SP 800-56C Rev. 2'}, {'algorithm': 'KDA TwoStep Sp800-56Cr1', 'cavpCertName': 'A1948', 'properties': 'MAC Salting Methods - random Supported Lengths - Supported Lengths: 1-4096 Fixed Info Encoding - concatenation Fixed Info Pattern - uPartyInfo||vPartyInfo||l KDF Mode - counter MAC Modes - CMAC-AES128, CMAC-AES192, CMAC- AES256, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Counter Lengths - 16, 24, 32, 8 Fixed Data Order - after fixed data, before fixed data The KDF supports an empty IV - No The KDF requires an empty IV - No Derived Key Length - 4096 Shared Secret Length - Shared Secret Length: 224-1024 Increment 8', 'reference': 'SP 800-56C Rev. 2'}, {'algorithm': 'KDF ANS 9.63 (CVL)', 'cavpCertName': 'A1948', 'properties': 'Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Field Size - 224, 521 Shared Info Length - Shared Info Length: 224, 528 Key Data Length - Key Data Length: 128, 4096', 'reference': 'SP 800-135 Rev. 1'}, {'algorithm': 'KDF SP800-108', 'cavpCertName': 'A1948', 'properties': 'KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES192, CMAC- AES256, CMAC-TDES, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512', 'reference': 'SP 800-108 Rev. 1'}, {'algorithm': '', 'cavpCertName': '', 'properties': 'Supported Lengths - Supported Lengths: 64-2048 Increment 8 Fixed Data Order - After Fixed Data, Before Fixed Data, In the Middle of Fixed Data Counter Length - 16, 24, 32, 8 Supports Empty IV - No Custom Key In Length - 0', 'reference': ''}, {'algorithm': 'KDF SP800-108', 'cavpCertName': 'A7544', 'properties': 'KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES192, CMAC- AES256, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Supported Lengths - Supported Lengths: 64-2048 Increment 8 Fixed Data Order - After Fixed Data, Before Fixed Data, In the Middle of Fixed Data Counter Length - 16, 24, 32, 8 Supports Empty IV - No Requires Empty IV - No', 'reference': 'SP 800-108 Rev. 1'}, {'algorithm': 'KTS-IFC', 'cavpCertName': 'A1948', 'properties': 'Function - partialVal IUT ID - 0123456789CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg2-crt Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA3-512 Supports Null Associated Data - Yes Associated Data Pattern - l||uPartyInfo||vPartyInfo Associated Data Encoding - concatenation', 'reference': 'SP 800-56B Rev. 2'}, {'algorithm': 'KTS-IFC', 'cavpCertName': 'A7545', 'properties': 'Key Length - 320 Function - partialVal IUT ID - 0123456789CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg2-crt Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA2-224, SHA2-256, SHA2-384, SHA2- 512 Supports Null Associated Data - Yes Associated Data Pattern - l||uPartyInfo||vPartyInfo Associated Data Encoding - concatenation Key Length - 320', 'reference': 'SP 800-56B Rev. 2'}, {'algorithm': 'RSA Decryption Primitive (CVL)', 'cavpCertName': 'A1948', 'properties': 'Modulus Length - 2048', 'reference': 'FIPS 186-4'}, {'algorithm': 'RSA Decryption Primitive Sp800- 56Br2 (CVL)', 'cavpCertName': 'A7544', 'properties': 'Modulo - 2048, 3072, 4096 Key Format - Chinese Remainder Theorem (CRT), Standard Public Exponent Mode - fixed, random', 'reference': 'SP 800-56B Rev. 2'}, {'algorithm': 'RSA KeyGen (FIPS186-5)', 'cavpCertName': 'A1948', 'properties': 'Fixed Public Exponent - 010001 Key Generation Mode - probable Modulo - 2048, 3072, 4096, 8192 p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed', 'reference': 'FIPS 186-5'}, {'algorithm': 'RSA KeyGen (FIPS186-5)', 'cavpCertName': 'A7545', 'properties': 'Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Info Generated By Server - No Private Key Format - crt Public Exponent Mode - fixed, random Fixed Public Exponent - 010001', 'reference': 'FIPS 186-5'}, {'algorithm': 'RSA SigGen (FIPS186-5)', 'cavpCertName': 'A1948', 'properties': 'Hash Pair - Hash Algorithm - SHA3-512 Salt Length - 64 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pss', 'reference': 'FIPS 186-5'}, {'algorithm': 'RSA Signature Primitive (CVL)', 'cavpCertName': 'A1948', 'properties': 'Private Key Format - standard Public Exponent Mode - fixed Fixed Public Exponent - 010001', 'reference': 'FIPS 186-4'}, {'algorithm': 'RSA Signature Primitive (CVL)', 'cavpCertName': 'A7544', 'properties': 'Modulo - 2048, 3072, 4096 Private Key Format - crt, standard Public Exponent Mode - fixed, random Fixed Public Exponent - 010001', 'reference': 'FIPS 186-4'}, {'algorithm': 'RSA SigVer (FIPS186-4)', 'cavpCertName': 'A1946', 'properties': 'Signature Type - PKCS 1.5 Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256 Public Exponent Mode - Fixed Fixed Public Exponent - 010001', 'reference': 'FIPS 186-4'}, {'algorithm': 'RSA SigVer (FIPS186-5)', 'cavpCertName': 'A1948', 'properties': 'Hash Pair - Hash Algorithm - SHA3-512 Salt Length - 64 Mask Function - mgf1 Modulo - 2048, 3072, 4096 Signature Type - pss Fixed Public Exponent - 010001 Public Exponent Mode - fixed', 'reference': 'FIPS 186-5'}, {'algorithm': 'RSA SigVer (FIPS186-5)', 'cavpCertName': 'A7545', 'properties': 'Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Public Exponent Mode - fixed, random Fixed Public Exponent - 010001', 'reference': 'FIPS 186-5'}, {'algorithm': 'SHA-1', 'cavpCertName': 'A1948', 'properties': 'Message Length - Message Length: 0-65536 Increment 8 Function - SHA1', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA-1', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-224', 'cavpCertName': 'A1948, A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-256', 'cavpCertName': 'A1946', 'properties': 'Message Length - Message Length: 8-65536 Increment 8 Function - SHA2', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-256', 'cavpCertName': 'A1948', 'properties': 'Message Length - Message Length: 0-65536 Increment 8 Function - SHA2', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-256', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-384', 'cavpCertName': 'A1948', 'properties': 'Message Length - Message Length: 0-65536 Increment 8 Function - SHA2', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-384', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-512', 'cavpCertName': 'A1948', 'properties': 'Message Length - Message Length: 0-65536 Increment 8 Function - SHA2', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-512', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA3-224', 'cavpCertName': 'A1948', 'properties': 'Supports Bit-Oriented Messages - No Supports Empty Message - Yes', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-224', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-256', 'cavpCertName': 'A1948', 'properties': 'Supports Bit-Oriented Messages - No Supports Empty Message - Yes', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-256', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-384', 'cavpCertName': 'A1948', 'properties': 'Supports Bit-Oriented Messages - No Supports Empty Message - Yes', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-384', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-512', 'cavpCertName': 'A1948', 'properties': 'Supports Bit-Oriented Messages - No Supports Empty Message - Yes', 'reference': 'FIPS 202'}, {'algorithm': 'SHA3-512', 'cavpCertName': 'A7544', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 202'}, {'algorithm': 'TDES-CBC', 'cavpCertName': 'A1948, A7544', 'properties': 'Direction - Decrypt, Encrypt Keying Option - 1', 'reference': 'SP 800-67 Rev. 2'}, {'algorithm': 'TDES-ECB', 'cavpCertName': 'A7544', 'properties': 'Direction - Decrypt, Encrypt Keying Option - 1', 'reference': 'SP 800-67 Rev. 2'}, {'algorithm': 'TDES-KW', 'cavpCertName': 'A1948', 'properties': 'Direction - Decrypt', 'reference': 'SP 800-38F'}, {'algorithm': 'TLS v1.2 KDF RFC7627 (CVL)', 'cavpCertName': 'A7544', 'properties': 'Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024', 'reference': 'SP 800-135 Rev. 1'}]}, 'vendor_affirmed_algos': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'name': 'CKG1', 'algoPropList': 'Key Type:Asymmetric and Symmetric', 'implName': 'N/A', 'reference': 'SP800-133rev2 Section 4 Example 1 and IG D.H'}, {'name': 'CKG2', 'algoPropList': 'Key Type:Symmetric', 'implName': 'N/A', 'reference': 'SP800-133rev2 Section 4 Example 2 and IG D.H'}]}, 'non_approved_allowed_algos': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'name': 'CPT-AES-CBC (unwrap)', 'algoPropList': 'AES:Legacy Key unwrap only CBC mode: Decrypt; 128, 192, and 256-bit', 'implName': 'LS2-CPT', 'reference': 'Key unwrapping. Per IG D.G'}, {'name': 'CPT-AES-ECB (unwrap)', 'algoPropList': 'AES:AES : Legacy Key unwrap only ECB mode: Decrypt; 128, 192, and 256-bit', 'implName': 'LS2-CPT', 'reference': 'Key unwrapping. Per IG D.G'}, {'name': 'EC Diffie-Hellman with non-NIST', 'algoPropList': 'Curve Types:Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128', 'implName': 'LS2-CPT', 'reference': 'Per IGs D.F and C.A.'}, {'name': 'recommended curves', 'algoPropList': 'bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits), Prime order curve, generated as per FIPS 186-5 Section 6', 'implName': '', 'reference': ''}, {'name': 'ECDSA with non- NIST recommended curves', 'algoPropList': 'Curve types:Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits), Prime order curve, generated as per FIPS 186-5 Section 6', 'implName': 'LS2-CPT', 'reference': 'Per IG C.A'}, {'name': 'SW-AES-CBC (unwrap)', 'algoPropList': 'AES:Legacy Key unwrap only CBC mode: Decrypt; 128, 192, and 256-bit', 'implName': 'LS2-SW-Crypto', 'reference': 'Key unwrapping. Per IG D.G'}, {'name': 'SW-AES-ECB (unwrap)', 'algoPropList': 'AES:Legacy Key unwrap only ECB mode: Decrypt; 128, 192, and 256-bit', 'implName': 'LS2-SW-Crypto', 'reference': 'Key unwrapping. Per IG D.G'}]}, 'non_approved_allowed_NSC': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'name': 'SHA1', 'caveat': 'No security claimed per IG 2.4.A, Scenario 1. Use of a non- approved cryptographic algorithm to "obfuscate" a CSP', 'use': 'Used for Key fingerprint/KCV computation'}, {'name': 'Triple-DES SP 800-38B', 'caveat': 'No security claimed per IG 2.4.A, Scenario 1. Use of a non- approved cryptographic algorithm to "obfuscate" a CSP', 'use': 'Used for Key fingerprint/KCV computation'}, {'name': 'PBKDF', 'caveat': 'No security claimed per IG 2.4.A, Scenario 2. Use of an algorithm for a purpose that is not security relevant or is redundant.', 'use': 'Used for hashing of authentication passwords'}]}, 'non_approved_not_allowed': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'name': 'AES (non- compliant)', 'use': 'Key wrap (TR31/TR34/AES-CBC/AES-GCM, wrap/unwrap), Decimal Table/Data/PIN Encryption/Decryption. FF1/FF3-1 Data Encryption/Decryption * In Non-Approved mode, AES GCM supports the IV length from 1 byte to 16 bytes'}, {'name': 'DES MAC (non- compliant)', 'use': 'MAC generation and Verification'}, {'name': 'Double-DES (non- compliant)', 'use': 'Derive unique key per transaction (DUKPT), EMV key derivation. Derive PIN from Offset. Derive Offset from PIN. PIN Verification. PVV generation and Verification. CVV generation and verification. Export Symmetric key/Export Asymmetric key pair using TR31 wrapping. Import/Export using TR34. Import Decimal Table. EMV script. EMV ARQC/ARPC. Data/PIN encryption/decryption'}, {'name': 'EC-AES', 'use': 'EC-AES wrap/unwrap (EC BYOK)'}, {'name': 'ECDH KDF', 'use': 'Key derivation using ECDH followed by HMAC/CMAC counter KDF'}, {'name': 'ECDSA (non- compliant)', 'use': 'Key generation, Sign, Verify P192, Secp192k1, brainpoolP160r1, brainpool192r1, K-163 and B-163 (SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512)'}, {'name': 'KAS-ECC (non- compliant)', 'use': 'EC Key generation and ECDH Curve25519 (128 bits), Curve448 (224 bits)'}, {'name': 'ML-DSA ECDSA Sign (non- compliant)', 'use': 'Signature generation function which generates a concateneated signature of ML_DSA and ECDSA'}, {'name': 'ML-DSA ECDSA Verify (non- compliant)', 'use': 'Signature verification function which verifies a concateneated signature of ML_DSA and ECDSA'}, {'name': 'RSA (non- compliant)', 'use': 'TR34 Import TR34 Export PIN block decryption BYOK Encrypt/Decrypt Asymmetric key encapsulation and un-encapsulation using PKCS#1-v1.5 padding with modulus size bits 2048-, 3072- and 4096-bits Key generation, Sign, Verify (1024-bit)'}, {'name': 'PBE', 'use': 'Key generation'}, {'name': 'Shamir Key Share (non-compliant)', 'use': 'Key share'}, {'name': 'SW-Counter-DRBG (Allowed Per IG 2.4.A) (non- compliant)', 'use': 'Random number generation for user, keys, internal IVs, and salt'}, {'name': 'Triple-DES (non- compliant)', 'use': 'Derive unique key per transaction (DUKPT) EMV key derivation. Derive PIN from Offset Derive Offset from PIN Verification PVV generation and verification CVV generation and verification Export Symmetric key/Export Asymmetric key pair using TR31 wrapping Import/Export using TR34 Import Decimal Table EMV script. EMV ARQC/ARPC Data/PIN encryption/decryption'}]}, 'ports_interfaces': {'section': 3, 'subsection': 1, 'found': True, 'entries': [{'physicalPort': 'USB (FTDI USB to Multi-Channe)', 'logicalInterface': 'Status Output', 'data': 'Log messages of MCU UART,SMBus, Diagnostics'}, {'physicalPort': 'PCIe', 'logicalInterface': 'Data Input Data Output Control Input Status Output', 'data': 'Primary interface to communicate with the module. Provides APIs for the software on the host to communicate with the module'}, {'physicalPort': 'PCIeSMBus', 'logicalInterface': 'Status Output', 'data': 'Log message of Diagnostics and System management'}, {'physicalPort': 'LED', 'logicalInterface': 'Status Output', 'data': 'Operation status'}, {'physicalPort': 'Tamper PIN', 'logicalInterface': 'Control Input', 'data': 'No data; only a signal from high to low'}, {'physicalPort': 'Zeroize push button', 'logicalInterface': 'Control Input', 'data': 'No data; only a signal'}, {'physicalPort': 'Power connector', 'logicalInterface': '', 'data': 'No data; external power connector'}, {'physicalPort': 'Battery interfaces', 'logicalInterface': '', 'data': 'No data; external power connector'}]}, 'authentication_methods': {'section': 4, 'subsection': 1, 'found': True, 'entries': [{'name': 'Username and password', 'description': 'The password is a minimum of 8 characters (case-sensitive, alpha- numeric).', 'mechanism': 'SW-AES- KWP-Unwrap (KTS)', 'strength': 'The password is a minimum of 8 characters (case- sensitive, alpha- numeric. As such, there are (26*2+10)^8 = 62^8 possible minimum-length passwords,and the false acceptance rate is 1 in 62^8', 'perMinute': 'A maximum of 20 password attempts are possible before a user is permanently locked out. Therefore, the probability of false authentication over any time frame is 20 /62^8 (The number of allowed login attempts prior to lockout is configured during module initialization but cannot exceed 20.)'}, {'name': 'Digital signature', 'description': 'Authentication is performed using SHA2- 256 based RSA 2048-bit PKCS#1-v1.5 signatures(provides 112 bits of strength). Corresponding public key is associated with the identity.', 'mechanism': 'SW-RSA- SigVer (FIPS186-5)', 'strength': 'The probability that a random attempt will succeed or a false acceptance will occur is approximately 1/(2^112).', 'perMinute': 'For each failed signature verification, the module will block for 2 seconds. Therefore, the probability that a random attempt will succeed in a one-minute period is approximately 30/(2^112)'}]}, 'roles': {'section': 4, 'subsection': 2, 'found': True, 'entries': [{'name': 'MCO', 'type': 'Identity', 'operatorType': 'Crypto Officer', 'authMethodList': 'Username and password'}, {'name': 'MCO (2FA)', 'type': 'Multi-Factor Identity', 'operatorType': 'Crypto Officer', 'authMethodList': 'Username and password Digital signature'}, {'name': 'Pre-CO', 'type': 'Identity', 'operatorType': 'Crypto Officer', 'authMethodList': 'Username and password'}, {'name': 'PCO', 'type': 'Identity', 'operatorType': 'Crypto Officer', 'authMethodList': 'Username and password'}, {'name': 'PCO (2FA)', 'type': 'Multi-Factor Identity', 'operatorType': 'Crypto Officer', 'authMethodList': 'Username and password Digital signature'}, {'name': 'PCU', 'type': 'Identity', 'operatorType': 'Crypto User', 'authMethodList': 'Username and password'}, {'name': 'PCU (2FA)', 'type': 'Multi-Factor Identity', 'operatorType': 'Crypto User', 'authMethodList': 'Username and password Digital signature'}, {'name': 'AU', 'type': 'Identity', 'operatorType': 'Audit User', 'authMethodList': 'Username and password'}]}, 'approved_services': {'section': 4, 'subsection': 3, 'found': True, 'entries': [{'name': 'GP_PARTITION_MGMT', 'description': 'Provides services to manage user and master partitions', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW- KeyGen CPT- KeyGen SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG SW- KDA- HKDF- Sp800- 56Cr1 SW- RSA- KeyGen (FIPS186 -5) SW- RSA- SigGen', 'rolesSspAccess': 'MCO - HSM Master Encryption Key (HXMEKY): G,E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - HSM Vendor Firmware Update Validation Key Public RSA (HVFUVKYPUBRSA ): E - HSM Owner Attestation Key Public (HOOATKYPUB): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z,G - FIPS Partition HSM Manufacturer Master'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '(FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 256 ENT (P) (SP 800- 90B)', 'rolesSspAccess': 'Authentication Key Private RSA (FPHMMAKYPRVR SA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E - Partition Authentication Certificate (PXPACT): Z,G - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - Partition Data Encryption Key (PXDEKY): G,Z - Partition Master Encryption Key (PXMEKY): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '(PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition Masking Key (PXMSKY): Z - Partition User Login Password Data (PULPDA): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z PCO - HSM Master Encryption Key (HXMEKY): E - Partition Master Encryption Key (PXMEKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Pre-CO - Partition Master Encryption Key (PXMEKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST):'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Firmware Update Validation Key Public ECC (HVFUVKYPUBECC'}, {'name': 'GP_PARTITION_SSP_M GMT', 'description': 'Provides services to manage user and master partition SSPs', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'KAS- KDA- HKDF (SP800- 56Ar3) SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-KAS- ECC (KAS) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST SW-AES- GMAC SW-AES-', 'rolesSspAccess': 'MCO - HSM Owner Attestation Key Public (HOOATKYPUB): W - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyGen (FIPS186 -4) SW- ECDSA- KeyVer (FIPS186 -4) SW- ECDSA- SigGen (FIPS186 -4) SW- ECDSA- SigVer (FIPS186 -4) CPT- HMAC- SHA-1 SW- HMAC- SHA-1 CPT- HMAC- SHA2- 224 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256 CPT- HMAC- SHA2- 384 SW-', 'rolesSspAccess': 'General Purpose HMAC Session Key (PUGPMSK): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition Authentication Certificate (PXPACT): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - HSM Owner Recovery Key (HOREKY): W - HSM Manufacturer Endorsement Certificate ECC (HMEDCTECC): E - HSM Manufacturer Endorsement Key Private ECC (HMEDKYPRVECC): E PCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User General Purpose'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW-KAS- ECC- Sp800- 56Ar3 SW- KDA- HKDF- Sp800- 56Cr1 SW-KDF- ANS- 9.63 SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 256', 'rolesSspAccess': '(PUGPMSK): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition Authentication Certificate (PXPACT): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E'}, {'name': 'GP_PARTITION_TIME_ MGMT', 'description': 'Provides services to manage user time', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': '', 'rolesSspAccess': 'MCO Unauthenticated'}, {'name': 'GP_LICENSE_MGMT', 'description': 'Provides services to manage license of the software running on the HSM', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW- RSA- SigVer (FIPS186 -5) SW- RSA- SigGen (FIPS186 -5) SW- SHA2- 256', 'rolesSspAccess': 'MCO - HSM Vendor License Key Public RSA (HVLICKYPUBRSA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E'}, {'name': 'GP_QUORUM_CONTR OL', 'description': 'Provides quorum control (MofN) services', 'indicator': 'Success with fips_stat', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'ENT (P) (SP 800- 90B) SW-', 'rolesSspAccess': 'Pre-CO PCO - Partition DRBG CTR V State'}, {'name': '', 'description': '', 'indicator': 'e = 2 or 3', 'inputs': '', 'outputs': '', 'secFunImpl': 'Counter- DRBG SW- RSA- SigVer (FIPS186 -5)', 'rolesSspAccess': '(PXDRBGCTVST): G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG CTR Key State (PXDRBGCTKST): G,E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E PCU - Partition DRBG CTR V State (PXDRBGCTVST): G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG CTR Key State (PXDRBGCTKST): G,E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E'}, {'name': 'GP_USER_MGMT', 'description': 'Provides services to manage user accounts and', 'indicator': 'Success with fips_stat', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'ENT (P) (SP 800- 90B) KAS-', 'rolesSspAccess': 'PCU - Partition Password Encryption Key (PXPEKY): E'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': 'roles within the HSM.', 'indicator': 'e = 2 or 3', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns KDA- ONESTE P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- KWP- Unwrap (KTS) CPT- Hash- DRBG SW-KDF- SP800- 108 SW- PBKDF SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5)', 'rolesSspAccess': '- Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition User TLS E2E Client Authentication Certificate (PUTLSE2ECACT): E - Partition User Login Password Data (PULPDA): W,E,Z - Partition Master Encryption Key (PXMEKY): E MCO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E,G - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): W,E,Z - Partition Authentication Certificate (PXPACT): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'E - Partition User Password Encryption Key Ephemeral Key Public (PUPEEKPUB): Z,E,W - Partition Password Encryption Key Shared Secret (PXPESZ): Z,G,E PCO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E,W - Partition Password Encryption Key (PXPEKY): E,G - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): Z,E,W - Partition Authentication Certificate (PXPACT): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition User Password Encryption Key Ephemeral Key Public (PUPEEKPUB): Z,E,W'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '- Partition Password Encryption Key Shared Secret (PXPESZ): Z,G,E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z AU - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): E,Z,W Pre-CO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): E,Z,W Unauthenticated - FIPS Partition HSM Owner Authentication'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'Certificate RSA (FPHOOAUCTRSA): E - Partition Owner Authentication Certificate (POOAUCT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E - Partition Data Encryption Key (PXDEKY): E'}, {'name': 'GP_BACKUP_RESTOR E', 'description': 'Provides Backup/Restore services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW- KeyGen ENT (P) (SP 800- 90B) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-AES- CBC- UNWRA P SW-AES- CBC- WRAP SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter-', 'rolesSspAccess': 'MCO - Partition Backup Ephemeral Key (PXKBEK): G,E,W,R - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : R,W - Partition Password Encryption Key (PXPEKY): R,W - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): R,W - Partition User General Purpose Symmetric Key (PUGPSKY): R,W - Partition User General Purpose HMAC Key (PUGPMKY): R,W - Partition User General Purpose Key Public'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'DRBG CPT- Hash- DRBG CPT- HMAC- SHA2- 256 SW-KDF- SP800- 108 SW- SHA2- 256', 'rolesSspAccess': '(PUGPKYPUB): R,W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E - HSM Owner Recovery Key (HOREKY): E - Partition Data Encryption Key (PXDEKY): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): R - Partition Authentication Certificate (PXPACT): R - Partition Masking Key (PXMSKY): R,W - Partition User Login Password Data (PULPDA): R,W PCO - Partition Backup Ephemeral Key (PXKBEK): G,E,R,W - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : R,W'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': '- Partition Password Encryption Key (PXPEKY): R,W - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): R,W - Partition User General Purpose Symmetric Key (PUGPSKY): R,W - Partition User General Purpose HMAC Key (PUGPMKY): R,W - Partition User General Purpose Key Public (PUGPKYPUB): R,W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E - HSM Owner Recovery Key (HOREKY): E - Partition Data Encryption Key (PXDEKY): E - Partition User Login Password Data (PULPDA): R,W'}, {'name': 'GP_KBK_MGMT', 'description': 'Provides service to manage Key Backup Key (KBK)', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-AES- CBC- UNWRA P SW-AES- CBC- WRAP SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW-KDF- SP800- 108', 'rolesSspAccess': 'MCO - HSM Owner Trust Anchor Certificate (HOOTACT): G,E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): G,E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - HSM Owner Recovery Key (HOREKY): E PCO - Partition Key Backup Key (PXKBKY): W,R,E - Partition Cert Auth Ephemeral Key (PXCAEK): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): W,R,E - Partition Data Encryption Key'}, {'name': 'GP_AUDIT_LOG_MGMT', 'description': 'Provides audit log services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'CPT- SHA2- 256 CPT- RSA- Signature -Primitive', 'rolesSspAccess': 'PCO - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E AU - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E MCO'}, {'name': 'GP_INFO_DIAGNOSTIC', 'description': 'Provides info and diagnostic services including Get Status, Get Version and Run Self-tests.', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-AES- GCM- Enc', 'rolesSspAccess': 'MCO - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E PCO - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E PCU'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns SW-AES- GCM- Dec SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) LEGACY -SW- TDES- KW (KTS) LEGACY -CPT- AES- CBC- UNWRA P LEGACY -CPT- AES- ECB- UNWRA P CPT- AES- CCM- ENC CPT- AES- CCM- DEC CPT- AES- CMAC CPT- AES- ECB- ENC CPT- AES- ECB- DEC CPT- AES- GCM- ENC CPT- AES- GCM- DEC SW-AES- KWP- Wrap', 'rolesSspAccess': '- FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E AU - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E Unauthenticated - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyVer (FIPS186 -4) CPT- ECDSA- SigGen (FIPS186 -4) SW- ECDSA- SigGen (FIPS186 -4) CPT- ECDSA- SigVer (FIPS186 -5) SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG CPT- HMAC- SHA-1 SW- HMAC- SHA-1 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256', 'rolesSspAccess': ''}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns CPT- HMAC- SHA2- 384 SW- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW- HMAC- SHA3- 224 CPT- HMAC- SHA3- 224 CPT- HMAC- SHA3- 256 CPT- HMAC- SHA3- 384 CPT- HMAC- SHA3- 512 SW- HMAC- SHA3- 256 SW- HMAC- SHA3- 384 SW- HMAC- SHA3- 512 SW-KAS- ECC- Sp800- 56Ar3 CPT- KAS- ECC- SSC- Sp800- 56Ar3', 'rolesSspAccess': ''}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'SW-KAS- ECC- SSC- Sp800- 56Ar3 SW-KAS- IFC-SSC CPT- KDF- SP800- 108 SW-KDF- SP800- 108 CPT- KDF-TLS SW- PBKDF CPT- RSA- Decryptio n- Primitive SW- RSA- Decryptio n- Primitive SW- RSA- SigGen (FIPS186 -5) CPT- RSA- Signature -Primitive SW- RSA- Signature -Primitive SW- RSA- SigVer (FIPS186 -5) CPT- SHA-1 SW- SHA-1 CPT- SHA2- 256 SW- SHA2- 256 CPT- SHA2-', 'rolesSspAccess': ''}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns 512 SW- SHA2- 512 SW- SHAKE- 128 SW- SHAKE- 256 CPT- TDES- CBC SW- SHA3- 224 SW- SHA3- 256 SW- SHA3- 384 SW- SHA3- 512', 'rolesSspAccess': ''}, {'name': 'GP_E2E', 'description': 'Provides e2e services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW- ECDSA- KeyGen (FIPS186 -4) FW- ECDSA- KeyGen (FIPS186 -5) SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG CPT- KAS- ECC- SSC- Sp800- 56Ar3 CPT- RSA-', 'rolesSspAccess': 'Unauthenticated - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): E - Partition TLS E2E Pre Master Secret (PXTLSE2EPMS): Z,G,E - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY): G,E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'Signature -Primitive SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 512 ENT (P) (SP 800- 90B) KAS-TLS (Sp800- 56Ar3)', 'rolesSspAccess': '(PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Ephemeral Key Private EC (PXTLSE2EEKPRV ECC): G - Partition TLS E2E Ephemeral Key Public EC (PXTLSE2EEKPUB ECC): G,R - Partition Owner Authentication Certificate (POOAUCT): R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition User TLS E2E Client Authentication Certificate (PUTLSE2ECACT): E,W - Partition User TLS E2E Ephemeral Key Public EC (PUTLSE2EEKPUB ECC): E,W'}, {'name': 'GP_SESSION_MGMT', 'description': 'Provides services to manage sessions and tokens', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW- RSA- SigVer (FIPS186 -5) CPT- Hash- DRBG SW- PBKDF SW-AES- KWP- Unwrap (KTS) ENT (P) (SP 800- 90B)', 'rolesSspAccess': 'Unauthenticated - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'E - Partition Password Encryption Key (PXPEKY): E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition User Login Password Data (PULPDA): E MCO - Partition Backup Ephemeral Key (PXKBEK): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E PCO - Partition Backup Ephemeral Key (PXKBEK): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST):'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): Z - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY): Z PCU - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): Z - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY):'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'AU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E'}, {'name': 'GP_KEY_MGMT', 'description': 'Provides services to manage keys', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW- KeyGen ENT (P) (SP 800- 90B) KAS- ANS- 9.63 (Sp800- 56Ar3) KAS- KDA- HKDF (SP800- 56Ar3) KAS- KDA- ONESTE P (SP800- 56Ar3) KAS- KDA- TWOSTE P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) SW-AES- GCM- Wrap SW-AES-', 'rolesSspAccess': 'MCO - HSM Owner Trust Anchor Certificate (HOOTACT): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - HSM Owner Recovery Key (HOREKY): E PCO - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Data Encryption Key (PXDEKY): E'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns GCM- Unwrap SW-KAS- ECC (KAS) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-KTS- IFC- Encap (KTS) SW-KTS- IFC- Decap (KTS) LEGACY -SW- TDES- KW (KTS) FW-KTS- IFC- Encap (KTS) FW-KTS- IFC- Decap (KTS) LEGACY -SW- AES- CBC- UNWRA P LEGACY -SW- AES- ECB- UNWRA P LEGACY -CPT- AES- CBC- UNWRA P LEGACY -CPT- AES- ECB- UNWRA P', 'rolesSspAccess': '- Partition User General Purpose Key Public (PUGPKYPUB): Z,R,E,W - Partition User General Purpose Session Key Public (PUGPSKYPUB): R,E,W - Partition Master Encryption Key (PXMEKY): E - Partition Key Loading Key (PXKLKY): G - Partition Key Loading Key Ephemeral Key Private (PXKLKEKPRV): Z,G,E - Partition Key Loading Key Ephemeral Key Public (PXKLKEKPUB): Z,G,E,R - Partition User Key Loading Key Ephemeral Key Public (PUKLKEKPUB): Z,E,W - Partition Key Loading Key Shared Secret (PXKLSZ): Z,G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- CMAC SW-AES- GMAC SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyGen (FIPS186 -4) FW- ECDSA- KeyGen (FIPS186 -5) SW- ECDSA- KeyVer (FIPS186 -4) CPT- Hash- DRBG CPT- HMAC- SHA-1 SW- HMAC- SHA-1 CPT- HMAC-', 'rolesSspAccess': 'E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,E - Partition User General Purpose Symmetric Key (PUGPSKY): Z,E - Partition User General Purpose HMAC Key (PUGPMKY): Z,E PCU - Partition User General Purpose Key Public (PUGPKYPUB): Z,W,G,E,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z,W,G,E,R - Partition Master Encryption Key (PXMEKY): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,W,G,E,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z,W,G,E,R - Partition User General Purpose Symmetric Key (PUGPSKY): Z,W,G,E,R - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z,W,G,E,R - Partition User General Purpose HMAC Key (PUGPMKY): Z,W,G,E,R - Partition User General Purpose'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns SHA2- 224 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256 CPT- HMAC- SHA2- 384 SW- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW-KAS- ECC- SSC- Sp800- 56Ar3 SW- KDA- HKDF- Sp800- 56Cr1 SW- KDA- OneStep- Sp800- 56Cr1 SW- KDA- TwoStep- Sp800- 56Cr1 SW-KDF- ANS- 9.63 SW-KDF- SP800- 108 SW- RSA-', 'rolesSspAccess': 'HMAC Session Key (PUGPMSK): Z,W,G,E,R - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Key Loading Key (PXKLKY): E - Partition Wrap Unwrap Shared Secret (PXWUSZ): Z,E Pre-CO - Partition Key Loading Key (PXKLKY): G,W - Partition Key Loading Key Ephemeral Key Private (PXKLKEKPRV): Z,G,E - Partition Key Loading Key Ephemeral Key Public (PXKLKEKPUB): Z,G,E - Partition User Key Loading Key Ephemeral Key Public (PUKLKEKPUB): Z,E,W - Partition Key Loading Key Shared Secret (PXKLSZ): Z,G,E - FIPS Octeon HSM'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns KeyGen (FIPS186 -5) FW-RSA- KeyGen (FIPS186 -5) FW-RSA- SigVer (FIPS186 -5) UB-RSA- SigVer (FIPS186 -4) SW- RSA- SigVer (FIPS186 -5) SW- SHA-1 SW- SHA2- 256 SW- SHA2- 384 SW- SHA2- 512', 'rolesSspAccess': 'DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,E - Partition User General Purpose Symmetric Key (PUGPSKY): Z,E - Partition User General Purpose HMAC Key (PUGPMKY): Z,E - Partition User General Purpose Key Public (PUGPKYPUB): Z,E,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): R - Partition Wrap Ephemeral Key Private (PXWEKPRV): G,E,Z - Partition Wrap Ephemeral Key Public (PXWEKPUB): G,R,Z - Partition User Wrap'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'Unwrap Ephemeral Key Public (PUWUEKPUB): G,R,Z - Partition Wrap Unwrap Encryption Ephemeral Key (PXWUEEK): G,E,Z - Partition Wrap Unwrap Intermediate Ephemeral Key (PXWUIEK): G,W,E,Z Unauthenticated - Partition User General Purpose Key Public (PUGPKYPUB): R - Partition User General Purpose Session Key Public (PUGPSKYPUB): R'}, {'name': 'GP_POLICY_MGMT', 'description': 'Provides services to HSM/Partition policies', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': '', 'rolesSspAccess': 'MCO PCO Pre-CO PCU AU Unauthenticated'}, {'name': 'GP_CRYPTO_FASTPAT H', 'description': 'Provides crypto/fastpathser vices', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'LEGACY -CPT- TDES- ECB CPT- RSA- Decryptio n- Primitive CPT- Hash- DRBG CPT- SHA2- 512 SW-AES- CMAC CPT- SHA3- 512 CPT- AES- CBC- ENC CPT- AES- CBC- DEC CPT-', 'rolesSspAccess': 'PCU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E,G - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition User'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns SHA-1 CPT- SHAKE- 128 CPT- SHAKE- 256 CPT- SHA2- 256 CPT- AES- GMAC CPT- AES- CCM- ENC CPT- AES- CCM- DEC CPT- SHA3- 256 CPT- AES- ECB- ENC CPT- AES- ECB- DEC CPT- HMAC- SHA2- 256 CPT- RSA- Signature -Primitive CPT- SHA2- 224 CPT- SHA2- 384 CPT- AES- GCM- ENC CPT- AES- GCM- DEC CPT- SHA3- 224 CPT-', 'rolesSspAccess': 'General Purpose Session Key Public (PUGPSKYPUB): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User General Purpose HMAC Session Key (PUGPMSK): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E PCO - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Pre-CO - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Unauthenticated - Partition TLS E2E'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'AES- CTR- ENC CPT- AES- CTR- DEC CPT- ECDSA- SigGen (FIPS186 -4) CPT- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 CPT- SHA3- 384 SW-KAS- ECC (KAS) ENT (P) (SP 800- 90B) CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST SW-KDF- ANS- 9.63 SW-AES- GMAC', 'rolesSspAccess': 'Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E'}, {'name': 'GP_ZEROIZATION', 'description': 'Provides zeroization services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS)', 'rolesSspAccess': 'MCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': '(PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key (HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '- Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z - HSM Manufacturer Endorsement Key Private ECC (HMEDKYPRVECC): Z - HSM Owner Recovery Key (HOREKY): Z - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): Z - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): Z - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): Z - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): Z - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): Z - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): Z - HSM Manufacturer Endorsement Certificate ECC (HMEDCTECC): Z - HSM Manufacturer'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'Hardware Unique 2 Key (HMHU2KY): E,Z - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): Z - HSM Owner Trust Anchor Certificate (HOOTACT): Z - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): Z PCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - HSM Master Encryption Key (HXMEKY): E PCU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '- Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z Pre-CO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': '(HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z Unauthenticated - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '(PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key (HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': '- Partition Owner Authentication Certificate (POOAUCT): Z - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z'}, {'name': 'GP_CERT_AUTH', 'description': 'Provides cert auth services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'CPT- KeyGen SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG SW-KAS- IFC-SSC SW-KDF- SP800- 108 SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) ENT (P) (SP 800- 90B)', 'rolesSspAccess': 'PCO - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '(POOTACT): W,E,R - Partition Owner Authentication Certificate (POOAUCT): W,E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): Z,W,R PCU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R AU - FIPS Octeon HSM DRBG Entropy'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '- HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R Unauthenticated - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): W,E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): W,E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': 'Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R MCO - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): R - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - FIPS Partition HSM Owner Authentication Certificate RSA'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns', 'rolesSspAccess': '(FPHOOAUCTRSA): W,R - HSM Owner Trust Anchor Certificate (HOOTACT): W,E,R Pre-CO - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): R - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): R - HSM Owner Trust Anchor Certificate (HOOTACT): R - Partition Owner Authentication Certificate (POOAUCT): W,R - Partition Owner Trust Anchor Certificate (POOTACT): W,R - Partition Authentication Certificate (PXPACT): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): W,R'}, {'name': 'GP_CLONING', 'description': 'Provides cloning services', 'indicator': 'Success with fips_stat e = 2 or 3', 'inputs': 'Opco de Inputs', 'outputs': 'Opcod e Output s', 'secFunImpl': 'CPT- KeyGen KAS- KDA- ONESTE', 'rolesSspAccess': 'PCO - Partition Password Encryption Key (PXPEKY): W,R - Partition Key'}, {'name': 'Name', 'description': 'Description', 'indicator': 'Indicat or', 'inputs': 'Input s', 'outputs': 'Outpu ts', 'secFunImpl': 'Securit y Functio', 'rolesSspAccess': 'SSP Access'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'ns P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- CMAC SW- ECDSA- KeyGen (FIPS186 -4) SW- ECDSA- KeyVer (FIPS186 -4) CPT- Hash- DRBG SW- HMAC- SHA2- 512 SW- KDA- HKDF- Sp800- 56Cr1 SW-KDF- SP800- 108 SW- PBKDF SW- RSA- KeyGen (FIPS186 -5) SW-', 'rolesSspAccess': 'Loading Key (PXKLKY): W,R - Partition Masking Key (PXMSKY): W,E,R,G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E - Partition Cloning Ephemeral Key Private (PXCLEKPRV): Z,G,E - Partition Cloning Ephemeral Key Public (PXCLEKPUB): Z,G,R - Partition Cloning Shared Secret (PXCLSZ): Z,G,E - Partition Cloning Encryption Ephemeral Key (PXCLEEK): Z,G,E - Partition Cloning MAC Ephemeral Key (PXCLMEK): Z,G,E - Partition User Cloning Ephemeral Key Public (PUCLEKPUB): Z,E,W PCU - Partition User General Purpose Asymmetric Key'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': 'SHA-1 SW- SHA2- 256 ENT (P) (SP 800- 90B)', 'rolesSspAccess': 'Private (PUGPAKYPRV): W,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): W,R - Partition User General Purpose Symmetric Key (PUGPSKY): W,R - Partition User General Purpose Symmetric Session Key (PUGPSSK): W,R - Partition User General Purpose HMAC Key (PUGPMKY): W,R - Partition User General Purpose HMAC Session Key (PUGPMSK): W,R - Partition User General Purpose Key Public (PUGPKYPUB): W,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): W,R - Partition Masking Key (PXMSKY): E - Partition Master Encryption Key (PXMEKY): E AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): W,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): W,R - Partition User General Purpose Symmetric Key (PUGPSKY): W,R - Partition User'}, {'name': '', 'description': '', 'indicator': '', 'inputs': '', 'outputs': '', 'secFunImpl': '', 'rolesSspAccess': 'General Purpose Symmetric Session Key (PUGPSSK): W,R - Partition User General Purpose HMAC Key (PUGPMKY): W,R - Partition User General Purpose HMAC Session Key (PUGPMSK): W,R - Partition User General Purpose Key Public (PUGPKYPUB): W,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): W,R - Partition Masking Key (PXMSKY): E - Partition Password Encryption Key (PXPEKY): W,R - Partition Key Loading Key (PXKLKY): W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E'}]}, 'non_approved_services': {'section': 4, 'subsection': 4, 'found': True, 'entries': [{'name': 'CN_GENERATE_PB E_KEY', 'description': 'Generate PBE DES3 key with the given password, salt, and iteration count. Make sure that HSM is initialized with fips_state=0.The fips_state parameter can be found in the hsm_configfile.', 'alg_accessed': 'SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant) PBE', 'role': 'PCU'}, {'name': 'LSPAY_GENERATE _ASYMM_KEY', 'description': 'Generates RSA KEY Pair (mod_len>= 2048-bit). Generates EC KEY PAIR (Curves: Nist P256, 224, 384, 521, Brain pool (Curves: P160, P192, P224, P256, P320, P384, P512), x25519/448 and Secp256K1 and FRP256v1)', 'alg_accessed': 'RSA (non- comp liant) ECD SA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_GENERATE _SYMM_KEY', 'description': 'Generates symmetric key AES, TDEA keys used for LSPay operations', 'alg_accessed': 'SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_EXPORT_P UBLIC_KEY', 'description': 'Exports public key for BYOK.', 'alg_accessed': '', 'role': 'PCU'}, {'name': 'LSPAY_IMPORT_K PK', 'description': 'Imports OAEP wrapped or ECDH_AES_PAD wrapped symmetric key.', 'alg_accessed': 'EC- AES ECD H KDF RSA (non- comp', 'role': 'PCU'}, {'name': 'LSPAY_IMPORT_T R34_KEY', 'description': 'Import symmetric keys using TR- 34 unwrap.', 'alg_accessed': 'RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_EXPORT_K EY', 'description': 'Exports symmetric key wrapped with TR31,AES_CBC/ AES_CBC_PAD.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_EXPORT_T R34_KEY', 'description': 'Exports symmetric keys wrapped with TR34 mechanism', 'alg_accessed': 'RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_TRANSLAT E_KEY', 'description': 'Translates wrapped key from one KPK to another KPK.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_IMPORT_C ERTIFICATE', 'description': "Imports peer's certificate to read public key required in TR34. Import X901 certificate into HSM.", 'alg_accessed': '', 'role': 'PCU'}, {'name': 'LSPAY_IMPORT_D ECIMAL_TABLE', 'description': 'Imports encrypted decimal table to be used in PIN APIs to decimalize native PIN.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_GENERATE _CSR', 'description': 'Create CSR with given key pair.', 'alg_accessed': 'RSA (non- comp liant) ECD SA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_DERIVE_KE Y', 'description': 'Derives DUKPT working key from the BDK.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp', 'role': 'PCU'}, {'name': 'LSPAY_ENCRYPT', 'description': 'Encrypts input data or PIN.', 'alg_accessed': 'AES (non- comp', 'role': 'PCU'}, {'name': '', 'description': '', 'alg_accessed': 'liant) Triple -DES (non- comp liant)', 'role': ''}, {'name': 'LSPAY_DECRYPT', 'description': 'Decrypts input data or PIN.', 'alg_accessed': 'AES (non- comp liant) Doub le- DES (non- comp liant) Triple -DES (non- comp', 'role': 'PCU'}, {'name': 'LSPAY_DECRYPT_ THEN_ENCRYPT', 'description': 'Decrypts the input cipher text with one key and encrypts with another key.', 'alg_accessed': 'liant) AES (non- comp liant) Doub le- DES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_MAC_GEN', 'description': 'Computes MAC on input data. Algorithm used: DES/Triple-DES', 'alg_accessed': 'DES MAC (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_MAC_VERI FY', 'description': 'Verifies MAC with calculated AMC on input data.', 'alg_accessed': 'DES MAC (non- comp liant) Triple -DES (non-', 'role': 'PCU'}, {'name': 'LSPAY_MAC_TRAN SLATE', 'description': 'Translates MAC by using new key on input data.', 'alg_accessed': 'DES MAC', 'role': 'PCU'}, {'name': '', 'description': '', 'alg_accessed': '(non- comp liant) Triple -DES (non- comp liant)', 'role': ''}, {'name': 'LSPAY_FPE_ENCR YPT', 'description': 'Performs FPE FF1/FF3-1 encrypt operation on input data.', 'alg_accessed': 'AES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_FPE_DECR YPT', 'description': 'Performs FPE FF1/FF3-1 decrypt operation on input data.', 'alg_accessed': 'AES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_SIGN', 'description': 'Performs sign and verify on input data.', 'alg_accessed': 'ECD SA (non- comp liant) RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_SIGN_VERI FY', 'description': 'Verifies sign on input data.', 'alg_accessed': 'ECD SA (non- comp liant) RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_PINBLK_TR ANSLATE', 'description': 'Decrypts the input PIN using decryption key, translates to given PIN format and encrypts with another key.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant) RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_DERIVE_PI N_FROM_OFFSET', 'description': 'Derive PIN from given offset. Encrypts validation data with DES EDE. Derives native PIN, then offset will be added to derive IBM PIN. PIN will be encoded in given ISO format. Encrypt encoded PIN with PIN encryption key.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_DERIVE_O FFSET_FROM_PIN', 'description': 'Generates IBM offset from given PIN. Decrypt and decode received PIN. Generate native from given validation data. Subtract decoded PIN from native PIN t to get PIN offset.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_VERIFY_PI N', 'description': 'Verifies given PIN .Decrypt and decode received PIN. Generate native from given validation data. Add offset to native PIN. Compare resultant PIN with received PIN.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_PVV_GEN', 'description': 'Perform PVV generation on PIN and PAN data.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp', 'role': 'PCU'}, {'name': 'LSPAY_PVV_VERIF Y', 'description': 'Verifies given PVV.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_EMV_GENV ERIFY', 'description': 'Perform EMV crypto operations. Generate ARPC. Generate or Verify ARQC.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_EMV_SECU RE_MSG_GEN', 'description': 'Generates MAC over secure message.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_CVV_GEN', 'description': 'Generates CVV, CVV2,iCVVon given card details.', 'alg_accessed': 'AES (non- comp liant)', 'role': 'PCU'}, {'name': '', 'description': '', 'alg_accessed': 'Triple -DES (non- comp liant)', 'role': ''}, {'name': 'LSPAY_CVV_VERIF Y', 'description': 'Verifies CVV with given card details', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_KEY_SHAR E_CREATE', 'description': 'Creates components of Key', 'alg_accessed': 'Sha mir Key Shar e (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_KEY_SHAR E_EXPORT_COMP ONENT', 'description': 'Exports created components in encrypted format', 'alg_accessed': 'AES (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_KEY_SHAR E_COMBINE_INIT', 'description': 'Starts combine keyinit.', 'alg_accessed': '', 'role': 'PCU'}, {'name': 'LSPAY_KEY_SHAR E_COMBINE_KEY', 'description': 'Combines all components of the key.', 'alg_accessed': 'Sha mir Key Shar e (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_KEY_SHAR E_ZEROIZE', 'description': 'Erases all components of the key.', 'alg_accessed': '', 'role': 'PCU'}, {'name': 'LSPAY_MFK_GENE RATE', 'description': 'Generates MFK key.', 'alg_accessed': 'SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)', 'role': 'PCO'}, {'name': 'LSPAY_MFK_GET_I NFO', 'description': 'Returns MFK information for partition.', 'alg_accessed': '', 'role': 'PCO'}, {'name': 'LSPAY_MFK_SET_ PRIMARY', 'description': 'Sets MFK as primary.', 'alg_accessed': '', 'role': 'PCO'}, {'name': 'LSPAY_MFK_DELE TE', 'description': 'Deletes MFK.', 'alg_accessed': '', 'role': 'PCO'}, {'name': 'LSPAY_FUNCTION ALITY_GET', 'description': 'Gets status of enabled/disabled LSPay services', 'alg_accessed': '', 'role': 'PCO'}, {'name': 'LSPAY_FUNCTION ALITY_SET', 'description': 'Enable/Disable services', 'alg_accessed': '', 'role': 'PCO'}, {'name': 'LSPAY_EXPORT_K PK', 'description': 'Export a Key Block Protection Key (KBPK)', 'alg_accessed': 'EC- AES ECD H KDF RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_IMPORT_P UBLIC_KEY', 'description': 'Import an RSA public key', 'alg_accessed': 'RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'LSPAY_VALIDATE_ PUBLIC_KEY', 'description': 'Validates the RSA public key', 'alg_accessed': 'RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_GENERATE_KE Y_PAIR (non- compliant)', 'description': 'Generates asymmetric keys (RSA/ ECC). Updates the public and private key handles in the output on return. Caveats in Non Approved apart from approved mode: RSA 1024 bits allowed along with all odd public exponent i.e. even lesser than 65537.NID_X9_62_prime192v1/NID_sect163k1/NID_ED25519/NID_se ct163r2/NID_secp192k1/NID_brainpoolP160r1/NID_brainpoolP192r1/NI D_X25519/NID_X448', 'alg_accessed': 'ECD SA (non- comp liant) KAS- ECC (non- comp liant) RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_GENERATE_KE Y (non-compliant)', 'description': 'Generates a symmetric key of given key type and length. Caveats in Non-Approved apart from approved mode:DES token key is allowed.', 'alg_accessed': 'SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_CREATE_OBJE CT (non-compliant)', 'description': 'Imports a public key into HSM. Caveats in Non Approved apart from approved mode:RSA-1024 bits allowed, NID_ED25519/NID_secp192k1/NID_brainpoolP160r1/NID_brainpoolP1 92r1/NID_X25519/NID_X448', 'alg_accessed': '', 'role': 'PCU'}, {'name': 'CN_UNWRAP_KEY (non-compliant)', 'description': 'Unwraps a key with an AES/Triple-DES/RSA private key existing on HSM or KLK. Takes the output wrapped data of wrapKey2 command. Caveats in Non Approved apart from approved mode:RSA-1024 bit, RSAPKCS1V1.5 Unwrap,NID_X9_62_prime192v1/', 'alg_accessed': 'EC- AES ECD H KDF', 'role': 'PCU'}, {'name': '', 'description': 'NID_sect163k1/NID_ED25519/NID_sect163r2/NID_secp192k1/NID_bra inpoolP160r1/NID_brainpoolP192r1/NID_X25519/NID_X448,Triple-DES', 'alg_accessed': 'RSA (non- comp liant) Triple -DES (non- comp liant)', 'role': ''}, {'name': 'CN_WRAP_KEY (non-compliant)', 'description': 'Wraps sensitive (private and symmetric) keys from the HSM to the host. Caveats in Non Approved apart from approved mode: AES-ECB mode, AES-CBC mode, AES-CBC-PAD mode, Triple-DES ECB mode, Triple- DES CBC mode, Triple-DES NIST Wrap mode, RSA-PKCS1V1.5 Wrap', 'alg_accessed': 'AES (non- comp liant) RSA (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_EXTRACT_MAS KED_OBJECT (non- compliant)', 'description': 'Extracts a masked object; i.e., retrieves an object by wrapping it with a masking key shared by the process of cloning.', 'alg_accessed': 'AES (non- comp liant)', 'role': 'PCU,P CO,AU'}, {'name': 'CN_STORE_FW_SI GNING_KEY (non- compliant)', 'description': 'Configure an RSA or EC public key into HSM as AO attestation key. These keys can be of modulus 1024, 2048, 3072, and 4096 or a supported 256 bits, 384 bits or 521 bits EC curve. Caveats in Non Approved is 192-bit curves supported', 'alg_accessed': 'ECD SA (non- comp liant) RSA (non- comp liant)', 'role': 'MCO'}, {'name': 'MAJOR_OP_ME_P KCS_LARGE (non- compliant)/MAJOR_ OP_ME_PKCS (non- compliant)', 'description': 'PKCS#1v1.5 encrypt and decrypt', 'alg_accessed': 'RSA (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_STORE_VEND OR_PRE_SHARED_ KEY (CN_STORE_KBK_ SHARE) (non- compliant)', 'description': 'Stores fixed keys (KBK) for backup. Including PKCS#1v1.5', 'alg_accessed': 'AES (non- comp liant) RSA (non- comp liant)', 'role': 'MCO'}, {'name': 'CN_INSERT_MASK ED_OBJECT (non- compliant)', 'description': 'Inserts a masked object into an HSM that is extracted from another HSM.', 'alg_accessed': 'AES (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU,P CO,AU'}, {'name': 'CN_ENCRYPT_SES SION (non- compliant)', 'description': 'Enables encrypted communication channel. Caveat is Non Approved mode allow the additional Cipher suite E2E_RSA_AES128_GCM_SHA256', 'alg_accessed': 'EC- AES ECD H KDF RSA (non- comp liant)', 'role': 'Unaut hentic ated'}, {'name': 'CN_ENCRYPT_SES SION_V2 (non- compliant)', 'description': 'Enables encrypted communication channel. Caveat is Non Approved mode allow the additional nonapproved cipher suites', 'alg_accessed': 'EC- AES ECD H KDF RSA (non- comp', 'role': 'Unaut hentic ated'}, {'name': 'CN_DERIVE_KEY (non-compliant)', 'description': 'Derives a key using a supported KDF mechanism with the params given by the user.', 'alg_accessed': 'liant) AES (non- comp liant) EC- AES ECD H KDF RSA (non- comp liant) Triple -DES (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_PQC_CRYPTO _HYBRID_SIG_GEN (non-compliant)', 'description': 'Generates a signature using ML-DSA and ECDSA sign algorithm.', 'alg_accessed': 'ML- DSA ECD SA Sign (non- comp liant)', 'role': 'PCU'}, {'name': 'CN_PQC_CRYPTO _HYBRID_SIG_VER IFY (non-compliant)', 'description': 'Verifies a signature using ML-DSA and ECDSA sign algorithm.', 'alg_accessed': 'ML- DSA ECD SA Verify (non- comp liant)', 'role': 'PCU'}]}, 'mechanisms_actions': {'section': 7, 'subsection': 1, 'found': True, 'entries': [{'mechanism': 'Epoxy Coating', 'inspectFreq': '12 Months', 'inspectGuidance': 'Examine surface of module for scratched or damaged epoxy, especially if circuitry shows.'}, {'mechanism': 'Battery life', 'inspectFreq': '6 Months', 'inspectGuidance': 'If the HSM has not been powered on in the last six months, then power it on for at least an hour.'}]}, 'storage_areas': {'section': 9, 'subsection': 1, 'found': True, 'entries': [{'name': 'DDR4', 'description': 'Ephemeral RAM', 'persistance': 'Dynamic'}, {'name': 'NOR', 'description': 'read/write memory', 'persistance': 'Static'}, {'name': 'MCU', 'description': 'read/write memory', 'persistance': 'Static'}, {'name': 'eMMC', 'description': 'read/write memory', 'persistance': 'Static'}, {'name': 'FUSE', 'description': 'OTP memory', 'persistance': 'Static'}]}, 'ssp_io_methods': {'section': 9, 'subsection': 2, 'found': True, 'entries': [{'name': 'Password-Input- Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KWP- Unwrap (KTS)'}, {'name': 'Key-Transport- Output-Method', 'source': 'NOR', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-KTS-IFC- Encap (KTS)'}, {'name': 'Key-Transport-Input- Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-KTS-IFC- Decap (KTS)'}, {'name': 'AES-Wrap-Output- Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KW-Wrap (KTS)'}, {'name': 'AES-Wrap-Pad- Output-Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KWP- Wrap (KTS)'}, {'name': 'AES-GCM-Wrap- Output-Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-GCM- Wrap'}, {'name': 'AES-Unwrap-Input- Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KW- Unwrap (KTS)'}, {'name': 'AES-Unwrap-Pad- Input-Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KWP- Unwrap (KTS)'}, {'name': 'AES-GCM-Unwrap- Input-Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-GCM- Unwrap'}, {'name': 'Public-Key-Plain- Output-Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Plaintext', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': ''}, {'name': 'Public-Key-Plain- Input-Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Plaintext', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': ''}, {'name': 'Shared-Secret-Plain- Output-Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-KTS-IFC- Encap (KTS)'}, {'name': 'Shared-Secret-Plain- Input-Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-KTS-IFC- Decap (KTS)'}, {'name': 'Restore-Key-Input- Method', 'source': 'Entered', 'dest': 'eMMC', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KWP- Unwrap (KTS)'}, {'name': 'Backup-Key-Output- Method', 'source': 'eMMC', 'dest': 'External', 'format': 'Encrypted', 'distribution': 'Automated', 'entry': 'Electronic', 'sfiAlgo': 'SW-AES-KWP- Wrap (KTS)'}]}, 'ssp_zeroization_methods': {'section': 9, 'subsection': 3, 'found': True, 'entries': [{'method': 'D', 'description': 'Manually zeroized (via GP_KEY_MGMT - CN_DESTROY_OBJECT service)', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_DESTROY_OBJECT'}, {'method': 'E', 'description': 'Zeroized right after use (Memory is wiped with zeros, immediately after use)', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'immediately after use'}, {'method': 'MFZ', 'description': "Zeroize all Partition's SSPs, including the HSM adapter owner programmed ones (Brings HSM to factory state. Factory reset via GP_ZEROIZATION - CN_ZEROIZE service with factory-reset as argument with MCO credentials)", 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_ZEROIZE'}, {'method': 'MZ', 'description': "Zeroize all Partition's SSPs, except vendor programmed ones (HSM zeroize via GP_ZEROIZATION - CN_ZEROIZE service with MCO credentials)", 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_ZEROIZE'}, {'method': 'PD', 'description': 'Zeroize all SSPs in the Partition and then delete the User Partition (via GP_PARTITION_MGMT - CN_DELETE_PARTITION service )', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_DELETE_PARTITION'}, {'method': 'PFZ', 'description': 'Zeroize all SSPs in the Partition (Factory reset via GP_ZEROIZATION - CN_ZEROIZE service with factory-reset as argument with PCO credentials)', 'rationale': 'wipes all SSPs withzeros in 1 second', 'operatorId': 'CN_ZEROIZE'}, {'method': 'PZ', 'description': 'Zeroize all User SSPs in the Partition Regular p (User Partition Regular zeroize via GP_ZEROIZATION - CN_ZEROIZE service with PCO credentials)', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_ZEROIZE'}, {'method': 'S', 'description': 'Zeroized on session close (Session Close via GP_SESSION_MGMT - CN_CLOSE_SESSION, CN_APP_FINALIZE and CN_CLOSE_PARTITION_SESSIONS)', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_CLOSE_SESSION'}, {'method': 'VZ', 'description': 'Vendor zeroize (Zeroizes all SSPs including vendor programmed configuration and CSPs. Makes the module unusable; the module must be sent back to the vendor for re-programming.) via GP_ZEROIZATION - CN_VENDOR_ZEROIZE service', 'rationale': 'wipes all SSPs with zeros in 1 second', 'operatorId': 'CN_VENDOR_ZEROIZE'}]}, 'self_tests': {'section': 10, 'subsection': 1, 'found': True, 'entries': [{'algorithmOrTest': 'CRC32 firmware integrity', 'testProps': 'CRC32', 'testMethod': 'KAT', 'type': 'SW/FW Integrity', 'indicator': 'successful boot', 'details': 'checksum'}, {'algorithmOrTest': 'Firmware Integrity Test', 'testProps': 'RSA-2048 SigVer', 'testMethod': 'KAT', 'type': 'SW/FW Integrity', 'indicator': 'successful boot', 'details': 'firmware signature verify'}, {'algorithmOrTest': 'Temperature monitor test', 'testProps': 'Temperature monitor', 'testMethod': 'CF', 'type': 'Critical Function', 'indicator': 'successful boot', 'details': 'Temperature monitor'}, {'algorithmOrTest': 'Voltage monitor test', 'testProps': 'Voltage monitor', 'testMethod': 'CF', 'type': 'Critical Function', 'indicator': 'successful boot', 'details': 'Voltage monitor'}]}, 'cond_self_tests': {'section': 10, 'subsection': 2, 'found': False, 'entries': []}, 'error_states': {'section': 10, 'subsection': 4, 'found': True, 'entries': [{'name': 'FIPS self-test failure', 'description': 'Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.', 'conditions': 'FIPS self-test failure', 'recoveryMethod': 'Reboot', 'indicator': 'Red LED ON'}, {'name': 'Hardware RBG failure', 'description': 'Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.', 'conditions': 'Hardware RBG failure', 'recoveryMethod': 'Reboot', 'indicator': 'Blue LED ON'}, {'name': 'Pairwise consistency test failure', 'description': 'Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.', 'conditions': 'Any pairwise consistency test failure', 'recoveryMethod': 'Reboot', 'indicator': 'Blue LED ON'}]}}.
23.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The following values were inserted: {'is_br1_format': False, 'br1_deviations': 0, 'br1_tables': None}.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__update__': {'Level 3': 4}}}}, 'symmetric_crypto': {'__update__': {'DES': {'__update__': {'3DES': {'__update__': {'Triple-DES': 12}}}}}}, 'randomness': {'__update__': {'PRNG': {'__update__': {'DRBG': 224}}}}, 'standard_id': {'__update__': {'FIPS': {'__update__': {'FIPS 186-4': 14}}}}} data.
21.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The following values were inserted: {'module_algorithms': {'_type': 'Set', 'elements': ['RSA Decryption Primitive Sp800-56Br2A7544', 'RSA Signature PrimitiveA7544', 'AES-CCMA7544', 'RSA SigVer (FIPS186-4)A1946', 'SHA3-224A7544', 'HMAC-SHA3-224A7544', 'KDF SP800-108A7544', 'HMAC-SHA2-512A7544', 'ECDSA SigGen (FIPS186-5)A7544', 'AES-CBCA7544', 'RSA SigVer (FIPS186-5)A7545', 'TLS v1.2 KDF RFC7627A7544', 'ECDSA SigVer (FIPS186-5)A7544', 'HMAC-SHA3-256A7544', 'ECDSA KeyGen (FIPS186-4)A1948', 'KAS-ECC-SSC Sp800-56Ar3A7544', 'ECDSA SigGen (FIPS186-4)A1948', 'HMAC-SHA2-224A7544', 'SHA3-512A7544', 'KAS-IFC-SSCA1948', 'KDA HKDF Sp800-56Cr1A1948', 'KDF ANS 9.63A1948', 'AES-ECBA7544', 'Counter DRBGA1948', 'HMAC-SHA2-256A7544', 'Hash DRBGA7544', 'AES-GMACA7544', 'AES-KWA1948', 'AES-CTRA7544', 'HMAC-SHA2-384A7544', 'ECDSA SigVer (FIPS186-4)A1948', 'AES-CMACA7544', 'TDES-CBCA7544', 'TDES-KWA1948', 'SHA3-384A7544', 'SHA2-384A7544', 'HMAC-SHA-1A7544', 'SHA2-512A7544', 'HMAC-SHA3-512A7544', 'SHA2-256A7544', 'AES-KWPA1948', 'RSA KeyGen (FIPS186-5)A7545', 'KDA OneStep Sp800-56Cr1A1948', 'ECDSA KeyGen (FIPS186-5)A7545', 'KAS-ECC Sp800-56Ar3A1948', 'ECDSA KeyVer (FIPS186-4)A1948', 'SHA3-256A7544', 'SHA-1A7544', 'AES-GCMA7544', 'KDA TwoStep Sp800-56Cr1A1948', 'SHA2-224A7544', 'HMAC-SHA3-384A7544', 'TDES-ECBA7544', 'KTS-IFCA7545', 'RSA SigGen (FIPS186-5)A1948', 'RSA Decryption PrimitiveA1948']}, 'policy_algorithms': {'_type': 'Set', 'elements': ['#A7545', '#A1946', '#A1948', '#A7544']}}.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__delete__': ['Level 1']}}}, 'fips_certlike': {'__update__': {'Certlike': {'__update__': {'HMAC- SHA-1': 10, 'SHA-1': 26, 'SHA2- 512': 17}}}}, 'symmetric_crypto': {'__update__': {'AES_competition': {'__update__': {'AES': {'__update__': {'AES-': 134}}, 'CAST': {'__update__': {'CAST': 60}}}}, 'constructions': {'__update__': {'MAC': {'__update__': {'HMAC': 64, 'CMAC': 12}}}}}}, 'hash_function': {'__update__': {'SHA': {'__update__': {'SHA1': {'__update__': {'SHA-1': 26}}}}}}, 'tee_name': {'__delete__': ['IBM']}, 'standard_id': {'__update__': {'FIPS': {'__update__': {'FIPS 186-4': 15, 'FIPS 186-5': 15, 'FIPS18': 33}}}}} data.

The computed heuristics were updated.

The algorithms property was updated, with the {'_type': 'Set', 'elements': ['#A7545', '#A1946', '#A1948', '#A7544']} values added.

The state was updated.

The policy property was updated, with the {'txt_hash': 'ed70c7ebde88e0410e6adb5710224a88da978c8079cd0b7d84b1be7c7e23ce83', 'json_hash': 'fa9d98247b8ebe292d2e012874315c38da17f4d608c02e4acaa9a751ead2e0e1'} data.
31.08.2026

The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5502,
  "dgst": "536b9ac36d9adc0b",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CTRA7544",
        "RSA Decryption Primitive Sp800-56Br2A7544",
        "RSA SigGen (FIPS186-5)A1948",
        "RSA SigVer (FIPS186-4)A1946",
        "HMAC-SHA2-224A7544",
        "AES-CMACA7544",
        "HMAC-SHA3-384A7544",
        "ECDSA SigVer (FIPS186-5)A7544",
        "AES-GCMA7544",
        "AES-GMACA7544",
        "SHA-1A7544",
        "SHA2-224A7544",
        "KDF ANS 9.63A1948",
        "Counter DRBGA1948",
        "SHA2-512A7544",
        "ECDSA SigVer (FIPS186-4)A1948",
        "KAS-ECC-SSC Sp800-56Ar3A7544",
        "AES-KWA1948",
        "KDA HKDF Sp800-56Cr1A1948",
        "ECDSA SigGen (FIPS186-4)A1948",
        "KDA TwoStep Sp800-56Cr1A1948",
        "AES-KWPA1948",
        "KAS-ECC Sp800-56Ar3A1948",
        "RSA KeyGen (FIPS186-5)A7545",
        "KTS-IFCA7545",
        "Hash DRBGA7544",
        "TDES-ECBA7544",
        "HMAC-SHA2-512A7544",
        "AES-CCMA7544",
        "SHA3-224A7544",
        "HMAC-SHA3-256A7544",
        "#A1946",
        "#A7545",
        "AES-ECBA7544",
        "ECDSA KeyGen (FIPS186-5)A7545",
        "ECDSA SigGen (FIPS186-5)A7544",
        "HMAC-SHA2-384A7544",
        "KDA OneStep Sp800-56Cr1A1948",
        "HMAC-SHA2-256A7544",
        "TDES-CBCA7544",
        "#A1948",
        "SHA3-512A7544",
        "#A7544",
        "HMAC-SHA3-512A7544",
        "KDF SP800-108A7544",
        "TLS v1.2 KDF RFC7627A7544",
        "KAS-IFC-SSCA1948",
        "SHA3-384A7544",
        "RSA Decryption PrimitiveA1948",
        "RSA Signature PrimitiveA7544",
        "TDES-KWA1948",
        "ECDSA KeyVer (FIPS186-4)A1948",
        "AES-CBCA7544",
        "SHA2-384A7544",
        "SHA3-256A7544",
        "RSA SigVer (FIPS186-5)A7545",
        "HMAC-SHA3-224A7544",
        "HMAC-SHA-1A7544",
        "SHA2-256A7544",
        "ECDSA KeyGen (FIPS186-4)A1948"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A1948, A7544",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CCM",
            "cavpCertName": "A7544",
            "properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-8192 Increment 8",
            "reference": "SP 800-38C"
          },
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A1948",
            "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 32-128 Increment 8 Message Length - Message Length: 0-65536 Increment 8",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A7544",
            "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 16-128 Increment 8, MAC Length: 32-128 Increment 8 Message Length - Message Length: 0-65536 Increment 8",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "A1948, A7544",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A1948, A7544",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A1948",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 8-1024 Increment 8 Payload Length - Payload Length: 0-65536 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7544",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 96-128 Increment 32 Payload Length - Payload Length: 0-65536 Increment 8",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A1948",
            "properties": "AAD Length - AAD Length: 0-65536 Increment 8 Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 8-1024 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A7544",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 128, 32, 64, 96 IV Length - IV Length: 96-128 Increment 32 AAD Length - AAD Length: 0-65536 Increment 8",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A1948",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "AES-KWP",
            "cavpCertName": "A1948",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 8-4096 Increment 8",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A1948",
            "properties": "Prediction Resistance - No, Yes Mode - AES-256 Derivation Function Enabled - Yes",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-4)",
            "cavpCertName": "A1948",
            "properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7545",
            "properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186-4)",
            "cavpCertName": "A1948",
            "properties": "Curve - P-192, P-224, P-256, P-384, P-521",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-4)",
            "cavpCertName": "A1948",
            "properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - Yes",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A7544",
            "properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No, Yes",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-4)",
            "cavpCertName": "A1948",
            "properties": "Curve - P-192, P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "SHA2-512",
            "reference": ""
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A7544",
            "properties": "Component - Yes Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "Hash DRBG",
            "cavpCertName": "A7544",
            "properties": "Prediction Resistance - Yes Supports Reseed - No Mode - SHA2-512 Entropy Input - Entropy Input: 2048 Nonce - Nonce: 2048 Personalization String Length - Personalization String Length: 0-2048 Increment 8 Additional Input - Additional Input: 0-2048 Increment 8",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 160 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 160 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-224",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 224 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-224",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 224 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 512 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 512 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-224",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 112, 128, 160, 192, 224 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-224",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 112-224 Increment 8 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-256",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 128, 192, 256 Key Length - Key Length: 8-524288 Increment",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-256",
            "cavpCertName": "A7544",
            "properties": "8 MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-384",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 192, 256, 320, 384 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-384",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 8-8192 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-512",
            "cavpCertName": "A1948",
            "properties": "MAC - MAC: 256, 320, 384, 448, 512 Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA3-512",
            "cavpCertName": "A7544",
            "properties": "MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 8-8192",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC Sp800- 56Ar3",
            "cavpCertName": "A1948",
            "properties": "Increment 8 Domain Parameter Generation Methods - P-521 Function - Key Pair Generation, Partial Validation iutId - 123456ABCD Scheme - ephemeralUnified - KAS Role - Initiator, Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-512",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Fixed Info Pattern - l||uPartyInfo||vPartyInfo Fixed Info Encoding - Concatenation Key Length - 512",
            "reference": ""
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A1948",
            "properties": "Domain Parameter Generation Methods - B-233, B-283, B- 409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P-384, P-521 Scheme - staticUnified -",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A7544",
            "properties": "KAS Role - initiator, responder Domain Parameter Generation Methods - P-224, P-256, P- 384, P-521 Scheme - staticUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-IFC-SSC",
            "cavpCertName": "A1948",
            "properties": "Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg1-crt Scheme - KAS1 - KAS Role - initiator KAS2 - KAS Role - initiator, responder Fixed Public Exponent - 010001",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDA HKDF Sp800- 56Cr1",
            "cavpCertName": "A1948",
            "properties": "Fixed Info Pattern - uPartyInfo||vPartyInfo||l Fixed Info Encoding - concatenation Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224-4096 Increment 8 HMAC Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-",
            "reference": "SP 800-56C Rev. 2"
          },
          {
            "algorithm": "KDA OneStep Sp800-56Cr1",
            "cavpCertName": "A1948",
            "properties": "Auxiliary Function Methods - Auxiliary Function Name - SHA2-224 Fixed Info Pattern - label||uPartyInfo||vPartyInfo Fixed Info Encoding - concatenation Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224-1024 Increment 8",
            "reference": "SP 800-56C Rev. 2"
          },
          {
            "algorithm": "KDA TwoStep Sp800-56Cr1",
            "cavpCertName": "A1948",
            "properties": "MAC Salting Methods - random Supported Lengths - Supported Lengths: 1-4096 Fixed Info Encoding - concatenation Fixed Info Pattern - uPartyInfo||vPartyInfo||l KDF Mode - counter MAC Modes - CMAC-AES128, CMAC-AES192, CMAC- AES256, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Counter Lengths - 16, 24, 32, 8 Fixed Data Order - after fixed data, before fixed data The KDF supports an empty IV - No The KDF requires an empty IV - No Derived Key Length - 4096 Shared Secret Length - Shared Secret Length: 224-1024 Increment 8",
            "reference": "SP 800-56C Rev. 2"
          },
          {
            "algorithm": "KDF ANS 9.63 (CVL)",
            "cavpCertName": "A1948",
            "properties": "Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Field Size - 224, 521 Shared Info Length - Shared Info Length: 224, 528 Key Data Length - Key Data Length: 128, 4096",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A1948",
            "properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES192, CMAC- AES256, CMAC-TDES, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Supported Lengths - Supported Lengths: 64-2048 Increment 8 Fixed Data Order - After Fixed Data, Before Fixed Data, In the Middle of Fixed Data Counter Length - 16, 24, 32, 8 Supports Empty IV - No Custom Key In Length - 0",
            "reference": ""
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A7544",
            "properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES192, CMAC- AES256, HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Supported Lengths - Supported Lengths: 64-2048 Increment 8 Fixed Data Order - After Fixed Data, Before Fixed Data, In the Middle of Fixed Data Counter Length - 16, 24, 32, 8 Supports Empty IV - No Requires Empty IV - No",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "KTS-IFC",
            "cavpCertName": "A1948",
            "properties": "Function - partialVal IUT ID - 0123456789CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg2-crt Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA3-512 Supports Null Associated Data - Yes Associated Data Pattern - l||uPartyInfo||vPartyInfo Associated Data Encoding - concatenation",
            "reference": "SP 800-56B Rev. 2"
          },
          {
            "algorithm": "KTS-IFC",
            "cavpCertName": "A7545",
            "properties": "Key Length - 320 Function - partialVal IUT ID - 0123456789CAFECAFE Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg2-crt Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA2-224, SHA2-256, SHA2-384, SHA2- 512 Supports Null Associated Data - Yes Associated Data Pattern - l||uPartyInfo||vPartyInfo Associated Data Encoding - concatenation Key Length - 320",
            "reference": "SP 800-56B Rev. 2"
          },
          {
            "algorithm": "RSA Decryption Primitive (CVL)",
            "cavpCertName": "A1948",
            "properties": "Modulus Length - 2048",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA Decryption Primitive Sp800- 56Br2 (CVL)",
            "cavpCertName": "A7544",
            "properties": "Modulo - 2048, 3072, 4096 Key Format - Chinese Remainder Theorem (CRT), Standard Public Exponent Mode - fixed, random",
            "reference": "SP 800-56B Rev. 2"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-5)",
            "cavpCertName": "A1948",
            "properties": "Fixed Public Exponent - 010001 Key Generation Mode - probable Modulo - 2048, 3072, 4096, 8192 p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7545",
            "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Info Generated By Server - No Private Key Format - crt Public Exponent Mode - fixed, random Fixed Public Exponent - 010001",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186-5)",
            "cavpCertName": "A1948",
            "properties": "Hash Pair - Hash Algorithm - SHA3-512 Salt Length - 64 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pss",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA Signature Primitive (CVL)",
            "cavpCertName": "A1948",
            "properties": "Private Key Format - standard Public Exponent Mode - fixed Fixed Public Exponent - 010001",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA Signature Primitive (CVL)",
            "cavpCertName": "A7544",
            "properties": "Modulo - 2048, 3072, 4096 Private Key Format - crt, standard Public Exponent Mode - fixed, random Fixed Public Exponent - 010001",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A1946",
            "properties": "Signature Type - PKCS 1.5 Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256 Public Exponent Mode - Fixed Fixed Public Exponent - 010001",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A1948",
            "properties": "Hash Pair - Hash Algorithm - SHA3-512 Salt Length - 64 Mask Function - mgf1 Modulo - 2048, 3072, 4096 Signature Type - pss Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A7545",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Public Exponent Mode - fixed, random Fixed Public Exponent - 010001",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A1948",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Function - SHA1",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-224",
            "cavpCertName": "A1948, A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A1946",
            "properties": "Message Length - Message Length: 8-65536 Increment 8 Function - SHA2",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A1948",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Function - SHA2",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A1948",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Function - SHA2",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A1948",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Function - SHA2",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA3-224",
            "cavpCertName": "A1948",
            "properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-224",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-256",
            "cavpCertName": "A1948",
            "properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-256",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-384",
            "cavpCertName": "A1948",
            "properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-384",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-512",
            "cavpCertName": "A1948",
            "properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "SHA3-512",
            "cavpCertName": "A7544",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "TDES-CBC",
            "cavpCertName": "A1948, A7544",
            "properties": "Direction - Decrypt, Encrypt Keying Option - 1",
            "reference": "SP 800-67 Rev. 2"
          },
          {
            "algorithm": "TDES-ECB",
            "cavpCertName": "A7544",
            "properties": "Direction - Decrypt, Encrypt Keying Option - 1",
            "reference": "SP 800-67 Rev. 2"
          },
          {
            "algorithm": "TDES-KW",
            "cavpCertName": "A1948",
            "properties": "Direction - Decrypt",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
            "cavpCertName": "A7544",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
            "reference": "SP 800-135 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Provides services to manage user and master partitions",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_PARTITION_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - HSM Master Encryption Key (HXMEKY): G,E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - HSM Vendor Firmware Update Validation Key Public RSA (HVFUVKYPUBRSA ): E - HSM Owner Attestation Key Public (HOOATKYPUB): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z,G - FIPS Partition HSM Manufacturer Master",
            "secFunImpl": "SW- KeyGen CPT- KeyGen SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG SW- KDA- HKDF- Sp800- 56Cr1 SW- RSA- KeyGen (FIPS186 -5) SW- RSA- SigGen"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Authentication Key Private RSA (FPHMMAKYPRVR SA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E - Partition Authentication Certificate (PXPACT): Z,G - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - Partition Data Encryption Key (PXDEKY): G,Z - Partition Master Encryption Key (PXMEKY): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key",
            "secFunImpl": "(FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 256 ENT (P) (SP 800- 90B)"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition Masking Key (PXMSKY): Z - Partition User Login Password Data (PULPDA): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z PCO - HSM Master Encryption Key (HXMEKY): E - Partition Master Encryption Key (PXMEKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Pre-CO - Partition Master Encryption Key (PXMEKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST):",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Firmware Update Validation Key Public ECC (HVFUVKYPUBECC",
            "secFunImpl": ""
          },
          {
            "description": "Provides services to manage user and master partition SSPs",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_PARTITION_SSP_M GMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - HSM Owner Attestation Key Public (HOOATKYPUB): W - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User",
            "secFunImpl": "KAS- KDA- HKDF (SP800- 56Ar3) SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-KAS- ECC (KAS) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST SW-AES- GMAC SW-AES-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "General Purpose HMAC Session Key (PUGPMSK): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition Authentication Certificate (PXPACT): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - HSM Owner Recovery Key (HOREKY): W - HSM Manufacturer Endorsement Certificate ECC (HMEDCTECC): E - HSM Manufacturer Endorsement Key Private ECC (HMEDKYPRVECC): E PCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User General Purpose",
            "secFunImpl": "ns KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyGen (FIPS186 -4) SW- ECDSA- KeyVer (FIPS186 -4) SW- ECDSA- SigGen (FIPS186 -4) SW- ECDSA- SigVer (FIPS186 -4) CPT- HMAC- SHA-1 SW- HMAC- SHA-1 CPT- HMAC- SHA2- 224 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256 CPT- HMAC- SHA2- 384 SW-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PUGPMSK): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition Authentication Certificate (PXPACT): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E",
            "secFunImpl": "ns SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW-KAS- ECC- Sp800- 56Ar3 SW- KDA- HKDF- Sp800- 56Cr1 SW-KDF- ANS- 9.63 SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 256"
          },
          {
            "description": "Provides services to manage user time",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_PARTITION_TIME_ MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO Unauthenticated",
            "secFunImpl": ""
          },
          {
            "description": "Provides services to manage license of the software running on the HSM",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_LICENSE_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - HSM Vendor License Key Public RSA (HVLICKYPUBRSA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E",
            "secFunImpl": "SW- RSA- SigVer (FIPS186 -5) SW- RSA- SigGen (FIPS186 -5) SW- SHA2- 256"
          },
          {
            "description": "Provides quorum control (MofN) services",
            "indicator": "Success with fips_stat",
            "inputs": "Opco de Inputs",
            "name": "GP_QUORUM_CONTR OL",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "Pre-CO PCO - Partition DRBG CTR V State",
            "secFunImpl": "ENT (P) (SP 800- 90B) SW-"
          },
          {
            "description": "",
            "indicator": "e = 2 or 3",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PXDRBGCTVST): G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG CTR Key State (PXDRBGCTKST): G,E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E PCU - Partition DRBG CTR V State (PXDRBGCTVST): G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG CTR Key State (PXDRBGCTKST): G,E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E",
            "secFunImpl": "Counter- DRBG SW- RSA- SigVer (FIPS186 -5)"
          },
          {
            "description": "Provides services to manage user accounts and",
            "indicator": "Success with fips_stat",
            "inputs": "Opco de Inputs",
            "name": "GP_USER_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "PCU - Partition Password Encryption Key (PXPEKY): E",
            "secFunImpl": "ENT (P) (SP 800- 90B) KAS-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "roles within the HSM.",
            "indicator": "e = 2 or 3",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition User TLS E2E Client Authentication Certificate (PUTLSE2ECACT): E - Partition User Login Password Data (PULPDA): W,E,Z - Partition Master Encryption Key (PXMEKY): E MCO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E,G - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): W,E,Z - Partition Authentication Certificate (PXPACT): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):",
            "secFunImpl": "ns KDA- ONESTE P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- KWP- Unwrap (KTS) CPT- Hash- DRBG SW-KDF- SP800- 108 SW- PBKDF SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5)"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "E - Partition User Password Encryption Key Ephemeral Key Public (PUPEEKPUB): Z,E,W - Partition Password Encryption Key Shared Secret (PXPESZ): Z,G,E PCO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E,W - Partition Password Encryption Key (PXPEKY): E,G - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): Z,E,W - Partition Authentication Certificate (PXPACT): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition User Password Encryption Key Ephemeral Key Public (PUPEEKPUB): Z,E,W",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition Password Encryption Key Shared Secret (PXPESZ): Z,G,E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z AU - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): E,Z,W Pre-CO - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition Password Encryption Key (PXPEKY): E - Partition Master Encryption Key (PXMEKY): E - Partition User Login Password Data (PULPDA): E,Z,W Unauthenticated - FIPS Partition HSM Owner Authentication",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Certificate RSA (FPHOOAUCTRSA): E - Partition Owner Authentication Certificate (POOAUCT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E - Partition Data Encryption Key (PXDEKY): E",
            "secFunImpl": ""
          },
          {
            "description": "Provides Backup/Restore services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_BACKUP_RESTOR E",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - Partition Backup Ephemeral Key (PXKBEK): G,E,W,R - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : R,W - Partition Password Encryption Key (PXPEKY): R,W - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): R,W - Partition User General Purpose Symmetric Key (PUGPSKY): R,W - Partition User General Purpose HMAC Key (PUGPMKY): R,W - Partition User General Purpose Key Public",
            "secFunImpl": "SW- KeyGen ENT (P) (SP 800- 90B) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-AES- CBC- UNWRA P SW-AES- CBC- WRAP SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter-"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PUGPKYPUB): R,W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E - HSM Owner Recovery Key (HOREKY): E - Partition Data Encryption Key (PXDEKY): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): R - Partition Authentication Certificate (PXPACT): R - Partition Masking Key (PXMSKY): R,W - Partition User Login Password Data (PULPDA): R,W PCO - Partition Backup Ephemeral Key (PXKBEK): G,E,R,W - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : R,W",
            "secFunImpl": "DRBG CPT- Hash- DRBG CPT- HMAC- SHA2- 256 SW-KDF- SP800- 108 SW- SHA2- 256"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition Password Encryption Key (PXPEKY): R,W - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): R,W - Partition User General Purpose Symmetric Key (PUGPSKY): R,W - Partition User General Purpose HMAC Key (PUGPMKY): R,W - Partition User General Purpose Key Public (PUGPKYPUB): R,W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E - HSM Owner Recovery Key (HOREKY): E - Partition Data Encryption Key (PXDEKY): E - Partition User Login Password Data (PULPDA): R,W",
            "secFunImpl": ""
          },
          {
            "description": "Provides service to manage Key Backup Key (KBK)",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_KBK_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - HSM Owner Trust Anchor Certificate (HOOTACT): G,E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): G,E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - HSM Owner Recovery Key (HOREKY): E PCO - Partition Key Backup Key (PXKBKY): W,R,E - Partition Cert Auth Ephemeral Key (PXCAEK): E - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): W,R,E - Partition Data Encryption Key",
            "secFunImpl": "SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-AES- CBC- UNWRA P SW-AES- CBC- WRAP SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW-KDF- SP800- 108"
          },
          {
            "description": "Provides audit log services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_AUDIT_LOG_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "PCO - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E AU - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E MCO",
            "secFunImpl": "CPT- SHA2- 256 CPT- RSA- Signature -Primitive"
          },
          {
            "description": "Provides info and diagnostic services including Get Status, Get Version and Run Self-tests.",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_INFO_DIAGNOSTIC",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E PCO - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E PCU",
            "secFunImpl": "SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW-AES- GCM- Enc"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E AU - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E Unauthenticated - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): E",
            "secFunImpl": "ns SW-AES- GCM- Dec SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) LEGACY -SW- TDES- KW (KTS) LEGACY -CPT- AES- CBC- UNWRA P LEGACY -CPT- AES- ECB- UNWRA P CPT- AES- CCM- ENC CPT- AES- CCM- DEC CPT- AES- CMAC CPT- AES- ECB- ENC CPT- AES- ECB- DEC CPT- AES- GCM- ENC CPT- AES- GCM- DEC SW-AES- KWP- Wrap"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "ns (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyVer (FIPS186 -4) CPT- ECDSA- SigGen (FIPS186 -4) SW- ECDSA- SigGen (FIPS186 -4) CPT- ECDSA- SigVer (FIPS186 -5) SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG CPT- HMAC- SHA-1 SW- HMAC- SHA-1 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "ns CPT- HMAC- SHA2- 384 SW- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW- HMAC- SHA3- 224 CPT- HMAC- SHA3- 224 CPT- HMAC- SHA3- 256 CPT- HMAC- SHA3- 384 CPT- HMAC- SHA3- 512 SW- HMAC- SHA3- 256 SW- HMAC- SHA3- 384 SW- HMAC- SHA3- 512 SW-KAS- ECC- Sp800- 56Ar3 CPT- KAS- ECC- SSC- Sp800- 56Ar3"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "SW-KAS- ECC- SSC- Sp800- 56Ar3 SW-KAS- IFC-SSC CPT- KDF- SP800- 108 SW-KDF- SP800- 108 CPT- KDF-TLS SW- PBKDF CPT- RSA- Decryptio n- Primitive SW- RSA- Decryptio n- Primitive SW- RSA- SigGen (FIPS186 -5) CPT- RSA- Signature -Primitive SW- RSA- Signature -Primitive SW- RSA- SigVer (FIPS186 -5) CPT- SHA-1 SW- SHA-1 CPT- SHA2- 256 SW- SHA2- 256 CPT- SHA2-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "ns 512 SW- SHA2- 512 SW- SHAKE- 128 SW- SHAKE- 256 CPT- TDES- CBC SW- SHA3- 224 SW- SHA3- 256 SW- SHA3- 384 SW- SHA3- 512"
          },
          {
            "description": "Provides e2e services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_E2E",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "Unauthenticated - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): E - Partition TLS E2E Pre Master Secret (PXTLSE2EPMS): Z,G,E - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY): G,E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State",
            "secFunImpl": "SW-AES- GCM- Wrap SW-AES- GCM- Unwrap SW- ECDSA- KeyGen (FIPS186 -4) FW- ECDSA- KeyGen (FIPS186 -5) SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG CPT- KAS- ECC- SSC- Sp800- 56Ar3 CPT- RSA-"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Ephemeral Key Private EC (PXTLSE2EEKPRV ECC): G - Partition TLS E2E Ephemeral Key Public EC (PXTLSE2EEKPUB ECC): G,R - Partition Owner Authentication Certificate (POOAUCT): R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition User TLS E2E Client Authentication Certificate (PUTLSE2ECACT): E,W - Partition User TLS E2E Ephemeral Key Public EC (PUTLSE2EEKPUB ECC): E,W",
            "secFunImpl": "Signature -Primitive SW- RSA- SigVer (FIPS186 -5) SW- SHA2- 512 ENT (P) (SP 800- 90B) KAS-TLS (Sp800- 56Ar3)"
          },
          {
            "description": "Provides services to manage sessions and tokens",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_SESSION_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "Unauthenticated - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):",
            "secFunImpl": "SW- RSA- SigVer (FIPS186 -5) CPT- Hash- DRBG SW- PBKDF SW-AES- KWP- Unwrap (KTS) ENT (P) (SP 800- 90B)"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "E - Partition Password Encryption Key (PXPEKY): E - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : E - Partition User Login Password Data (PULPDA): E MCO - Partition Backup Ephemeral Key (PXKBEK): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E PCO - Partition Backup Ephemeral Key (PXKBEK): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST):",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): Z - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY): Z PCU - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): Z - Partition TLS E2E Master Secret Key (PXTLSE2EMSKY):",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "AU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E",
            "secFunImpl": ""
          },
          {
            "description": "Provides services to manage keys",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_KEY_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - HSM Owner Trust Anchor Certificate (HOOTACT): E - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): E - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): E - HSM Manufacturer Hardware Unique 2 Key (HMHU2KY): E - HSM Owner Recovery Key (HOREKY): E PCO - Partition Owner Trust Anchor Certificate (POOTACT): E - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Data Encryption Key (PXDEKY): E",
            "secFunImpl": "SW- KeyGen ENT (P) (SP 800- 90B) KAS- ANS- 9.63 (Sp800- 56Ar3) KAS- KDA- HKDF (SP800- 56Ar3) KAS- KDA- ONESTE P (SP800- 56Ar3) KAS- KDA- TWOSTE P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) SW-AES- GCM- Wrap SW-AES-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition User General Purpose Key Public (PUGPKYPUB): Z,R,E,W - Partition User General Purpose Session Key Public (PUGPSKYPUB): R,E,W - Partition Master Encryption Key (PXMEKY): E - Partition Key Loading Key (PXKLKY): G - Partition Key Loading Key Ephemeral Key Private (PXKLKEKPRV): Z,G,E - Partition Key Loading Key Ephemeral Key Public (PXKLKEKPUB): Z,G,E,R - Partition User Key Loading Key Ephemeral Key Public (PUKLKEKPUB): Z,E,W - Partition Key Loading Key Shared Secret (PXKLSZ): Z,G,E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST):",
            "secFunImpl": "ns GCM- Unwrap SW-KAS- ECC (KAS) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) SW-KTS- IFC- Encap (KTS) SW-KTS- IFC- Decap (KTS) LEGACY -SW- TDES- KW (KTS) FW-KTS- IFC- Encap (KTS) FW-KTS- IFC- Decap (KTS) LEGACY -SW- AES- CBC- UNWRA P LEGACY -SW- AES- ECB- UNWRA P LEGACY -CPT- AES- CBC- UNWRA P LEGACY -CPT- AES- ECB- UNWRA P"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,E - Partition User General Purpose Symmetric Key (PUGPSKY): Z,E - Partition User General Purpose HMAC Key (PUGPMKY): Z,E PCU - Partition User General Purpose Key Public (PUGPKYPUB): Z,W,G,E,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z,W,G,E,R - Partition Master Encryption Key (PXMEKY): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,W,G,E,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z,W,G,E,R - Partition User General Purpose Symmetric Key (PUGPSKY): Z,W,G,E,R - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z,W,G,E,R - Partition User General Purpose HMAC Key (PUGPMKY): Z,W,G,E,R - Partition User General Purpose",
            "secFunImpl": "ns CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- CMAC SW-AES- GMAC SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS) SW- Counter- DRBG SW- ECDSA- KeyGen (FIPS186 -4) FW- ECDSA- KeyGen (FIPS186 -5) SW- ECDSA- KeyVer (FIPS186 -4) CPT- Hash- DRBG CPT- HMAC- SHA-1 SW- HMAC- SHA-1 CPT- HMAC-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "HMAC Session Key (PUGPMSK): Z,W,G,E,R - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Key Loading Key (PXKLKY): E - Partition Wrap Unwrap Shared Secret (PXWUSZ): Z,E Pre-CO - Partition Key Loading Key (PXKLKY): G,W - Partition Key Loading Key Ephemeral Key Private (PXKLKEKPRV): Z,G,E - Partition Key Loading Key Ephemeral Key Public (PXKLKEKPUB): Z,G,E - Partition User Key Loading Key Ephemeral Key Public (PUKLKEKPUB): Z,E,W - Partition Key Loading Key Shared Secret (PXKLSZ): Z,G,E - FIPS Octeon HSM",
            "secFunImpl": "ns SHA2- 224 SW- HMAC- SHA2- 224 CPT- HMAC- SHA2- 256 SW- HMAC- SHA2- 256 CPT- HMAC- SHA2- 384 SW- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 SW- HMAC- SHA2- 512 SW-KAS- ECC- SSC- Sp800- 56Ar3 SW- KDA- HKDF- Sp800- 56Cr1 SW- KDA- OneStep- Sp800- 56Cr1 SW- KDA- TwoStep- Sp800- 56Cr1 SW-KDF- ANS- 9.63 SW-KDF- SP800- 108 SW- RSA-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z,E - Partition User General Purpose Symmetric Key (PUGPSKY): Z,E - Partition User General Purpose HMAC Key (PUGPMKY): Z,E - Partition User General Purpose Key Public (PUGPKYPUB): Z,E,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): R - Partition Wrap Ephemeral Key Private (PXWEKPRV): G,E,Z - Partition Wrap Ephemeral Key Public (PXWEKPUB): G,R,Z - Partition User Wrap",
            "secFunImpl": "ns KeyGen (FIPS186 -5) FW-RSA- KeyGen (FIPS186 -5) FW-RSA- SigVer (FIPS186 -5) UB-RSA- SigVer (FIPS186 -4) SW- RSA- SigVer (FIPS186 -5) SW- SHA-1 SW- SHA2- 256 SW- SHA2- 384 SW- SHA2- 512"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Unwrap Ephemeral Key Public (PUWUEKPUB): G,R,Z - Partition Wrap Unwrap Encryption Ephemeral Key (PXWUEEK): G,E,Z - Partition Wrap Unwrap Intermediate Ephemeral Key (PXWUIEK): G,W,E,Z Unauthenticated - Partition User General Purpose Key Public (PUGPKYPUB): R - Partition User General Purpose Session Key Public (PUGPSKYPUB): R",
            "secFunImpl": ""
          },
          {
            "description": "Provides services to HSM/Partition policies",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_POLICY_MGMT",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO PCO Pre-CO PCU AU Unauthenticated",
            "secFunImpl": ""
          },
          {
            "description": "Provides crypto/fastpathser vices",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_CRYPTO_FASTPAT H",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "PCU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E,G - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): E - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): E - Partition User General Purpose Key Public (PUGPKYPUB): E - Partition User",
            "secFunImpl": "LEGACY -CPT- TDES- ECB CPT- RSA- Decryptio n- Primitive CPT- Hash- DRBG CPT- SHA2- 512 SW-AES- CMAC CPT- SHA3- 512 CPT- AES- CBC- ENC CPT- AES- CBC- DEC CPT-"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "General Purpose Session Key Public (PUGPSKYPUB): E - Partition User General Purpose HMAC Key (PUGPMKY): E - Partition User General Purpose HMAC Session Key (PUGPMSK): E - Partition User General Purpose Symmetric Key (PUGPSKY): E - Partition User General Purpose Symmetric Session Key (PUGPSSK): E - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E PCO - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Pre-CO - Partition TLS E2E Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E Unauthenticated - Partition TLS E2E",
            "secFunImpl": "ns SHA-1 CPT- SHAKE- 128 CPT- SHAKE- 256 CPT- SHA2- 256 CPT- AES- GMAC CPT- AES- CCM- ENC CPT- AES- CCM- DEC CPT- SHA3- 256 CPT- AES- ECB- ENC CPT- AES- ECB- DEC CPT- HMAC- SHA2- 256 CPT- RSA- Signature -Primitive CPT- SHA2- 224 CPT- SHA2- 384 CPT- AES- GCM- ENC CPT- AES- GCM- DEC CPT- SHA3- 224 CPT-"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Symmetric Key (PXTLSE2EKY): E - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E",
            "secFunImpl": "AES- CTR- ENC CPT- AES- CTR- DEC CPT- ECDSA- SigGen (FIPS186 -4) CPT- HMAC- SHA2- 384 CPT- HMAC- SHA2- 512 CPT- SHA3- 384 SW-KAS- ECC (KAS) ENT (P) (SP 800- 90B) CPT- ECDH- NON- NIST CPT- ECDSA- SigGen- NON- NIST SW-KDF- ANS- 9.63 SW-AES- GMAC"
          },
          {
            "description": "Provides zeroization services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_ZEROIZATION",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "MCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key",
            "secFunImpl": "SW-AES- KWP- Wrap (KTS) SW-AES- KWP- Unwrap (KTS)"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key (HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z - HSM Manufacturer Endorsement Key Private ECC (HMEDKYPRVECC): Z - HSM Owner Recovery Key (HOREKY): Z - FIPS Partition HSM Manufacturer Master Authentication Key Private RSA (FPHMMAKYPRVR SA): Z - FIPS Partition HSM Manufacturer Master Authentication Key Private ECC (FPHMMAKYPRVE CC): Z - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): Z - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): Z - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): Z - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): Z - HSM Manufacturer Endorsement Certificate ECC (HMEDCTECC): Z - HSM Manufacturer",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Hardware Unique 2 Key (HMHU2KY): E,Z - FIPS Partition HSM Vendor Key Backup Key (FPHVKBKY): Z - HSM Owner Trust Anchor Certificate (HOOTACT): Z - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): Z PCO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - HSM Master Encryption Key (HXMEKY): E PCU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - Partition Master Encryption Key (PXMEKY): Z",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z Pre-CO - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z - Partition Owner Authentication Certificate (POOAUCT): Z - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z Unauthenticated - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): Z - Partition User General Purpose Asymmetric Session Key Private",
            "secFunImpl": ""
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(PUGPASKPRV): Z - Partition User General Purpose Symmetric Key (PUGPSKY): Z - Partition User General Purpose Symmetric Session Key (PUGPSSK): Z - Partition User General Purpose HMAC Key (PUGPMKY): Z - Partition User General Purpose HMAC Session Key (PUGPMSK): Z - Partition User General Purpose Key Public (PUGPKYPUB): Z - Partition User General Purpose Session Key Public (PUGPSKYPUB): Z - HSM Master Encryption Key (HXMEKY): Z - Partition Key Loading Key (PXKLKY): Z - Partition Key Backup Key (PXKBKY): Z - Partition Master Encryption Key (PXMEKY): Z - Partition Data Encryption Key (PXDEKY): Z - Partition Authentication Key Private RSA (PXPAKYPRVRSA): Z - Partition Masking Key (PXMSKY): Z - Partition Authentication Certificate (PXPACT): Z - Partition Password Encryption Key (PXPEKY): Z - Partition Owner Trust Anchor Certificate (POOTACT): Z",
            "secFunImpl": "ns"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- Partition Owner Authentication Certificate (POOAUCT): Z - Partition User Two- Factor Authentication Key Public RSA (PU2FAKYPUBRSA) : Z - HSM Owner Attestation Key Public (HOOATKYPUB): Z - Partition User Login Password Data (PULPDA): Z",
            "secFunImpl": ""
          },
          {
            "description": "Provides cert auth services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_CERT_AUTH",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "PCO - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate",
            "secFunImpl": "CPT- KeyGen SW- ECDSA- SigVer (FIPS186 -4) CPT- Hash- DRBG SW-KAS- IFC-SSC SW-KDF- SP800- 108 SW- RSA- SigGen (FIPS186 -5) SW- RSA- SigVer (FIPS186 -5) ENT (P) (SP 800- 90B)"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(POOTACT): W,E,R - Partition Owner Authentication Certificate (POOAUCT): W,E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): Z,W,R PCU - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R AU - FIPS Octeon HSM DRBG Entropy",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R Unauthenticated - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): E - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): E,R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): E,R - Partition Authentication Certificate (PXPACT): E,R - HSM Owner Trust Anchor Certificate (HOOTACT): W,E,R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): W,E,R - Partition Owner Trust Anchor Certificate (POOTACT): E,R - Partition Owner Authentication",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Certificate (POOAUCT): E,R - Partition Cert Auth Source Shared Secret (PXCASSZ): Z,G,E,R - Partition Authentication Key Private RSA (PXPAKYPRVRSA): E - Partition Cert Auth Target Shared Secret (PXCATSZ): G,Z,E,W - Partition Cert Auth Ephemeral Key (PXCAEK): G - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): R MCO - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): R - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - FIPS Partition HSM Owner Authentication Certificate RSA",
            "secFunImpl": "ns"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(FPHOOAUCTRSA): W,R - HSM Owner Trust Anchor Certificate (HOOTACT): W,E,R Pre-CO - HSM Vendor Authentication Root Certificate RSA (HVARCTRSA): R - HSM Vendor Authentication Root Certificate ECC (HVARCTEC): R - FIPS Partition HSM Manufacturer Master Authentication Certificate RSA (FPHMMACTRSA): R - FIPS Partition HSM Manufacturer Master Authentication Certificate ECC (FPHMMACTECC): R - FIPS Partition HSM Owner Authentication Certificate RSA (FPHOOAUCTRSA): R - HSM Owner Trust Anchor Certificate (HOOTACT): R - Partition Owner Authentication Certificate (POOAUCT): W,R - Partition Owner Trust Anchor Certificate (POOTACT): W,R - Partition Authentication Certificate (PXPACT): R - Partition Owner Client Authentication Trust Anchor Certificate (POCAUTACT): W,R",
            "secFunImpl": "ns"
          },
          {
            "description": "Provides cloning services",
            "indicator": "Success with fips_stat e = 2 or 3",
            "inputs": "Opco de Inputs",
            "name": "GP_CLONING",
            "outputs": "Opcod e Output s",
            "rolesSspAccess": "PCO - Partition Password Encryption Key (PXPEKY): W,R - Partition Key",
            "secFunImpl": "CPT- KeyGen KAS- KDA- ONESTE"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Input s",
            "name": "Name",
            "outputs": "Outpu ts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Securit y Functio"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Loading Key (PXKLKY): W,R - Partition Masking Key (PXMSKY): W,E,R,G - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E - Partition Cloning Ephemeral Key Private (PXCLEKPRV): Z,G,E - Partition Cloning Ephemeral Key Public (PXCLEKPUB): Z,G,R - Partition Cloning Shared Secret (PXCLSZ): Z,G,E - Partition Cloning Encryption Ephemeral Key (PXCLEEK): Z,G,E - Partition Cloning MAC Ephemeral Key (PXCLMEK): Z,G,E - Partition User Cloning Ephemeral Key Public (PUCLEKPUB): Z,E,W PCU - Partition User General Purpose Asymmetric Key",
            "secFunImpl": "ns P (SP800- 56Ar3) KAS-IFC- OneStep (SP800- 56Br2) SW-AES- KW- Wrap (KTS) SW-AES- KW- Unwrap (KTS) CPT- AES- CBC- ENC CPT- AES- CBC- DEC SW-AES- CMAC SW- ECDSA- KeyGen (FIPS186 -4) SW- ECDSA- KeyVer (FIPS186 -4) CPT- Hash- DRBG SW- HMAC- SHA2- 512 SW- KDA- HKDF- Sp800- 56Cr1 SW-KDF- SP800- 108 SW- PBKDF SW- RSA- KeyGen (FIPS186 -5) SW-"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Private (PUGPAKYPRV): W,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): W,R - Partition User General Purpose Symmetric Key (PUGPSKY): W,R - Partition User General Purpose Symmetric Session Key (PUGPSSK): W,R - Partition User General Purpose HMAC Key (PUGPMKY): W,R - Partition User General Purpose HMAC Session Key (PUGPMSK): W,R - Partition User General Purpose Key Public (PUGPKYPUB): W,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): W,R - Partition Masking Key (PXMSKY): E - Partition Master Encryption Key (PXMEKY): E AU - Partition User General Purpose Asymmetric Key Private (PUGPAKYPRV): W,R - Partition User General Purpose Asymmetric Session Key Private (PUGPASKPRV): W,R - Partition User General Purpose Symmetric Key (PUGPSKY): W,R - Partition User",
            "secFunImpl": "SHA-1 SW- SHA2- 256 ENT (P) (SP 800- 90B)"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "General Purpose Symmetric Session Key (PUGPSSK): W,R - Partition User General Purpose HMAC Key (PUGPMKY): W,R - Partition User General Purpose HMAC Session Key (PUGPMSK): W,R - Partition User General Purpose Key Public (PUGPKYPUB): W,R - Partition User General Purpose Session Key Public (PUGPSKYPUB): W,R - Partition Masking Key (PXMSKY): E - Partition Password Encryption Key (PXPEKY): W,R - Partition Key Loading Key (PXKLKY): W - FIPS Octeon HSM DRBG Entropy Source (FOHXDRBGENST): G,E,Z - FIPS Octeon HSM DRBG Seed (FOHXDRBGSD): G,E,Z - FIPS Octeon HSM DRBG Nonce (FOHXDRBGNON): G,E,Z - Partition DRBG Hash C State (PXDRBGHACST): E - Partition DRBG Hash V State (PXDRBGHAVST): E - Partition Master Encryption Key (PXMEKY): E",
            "secFunImpl": ""
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The password is a minimum of 8 characters (case-sensitive, alpha- numeric).",
            "mechanism": "SW-AES- KWP-Unwrap (KTS)",
            "name": "Username and password",
            "perMinute": "A maximum of 20 password attempts are possible before a user is permanently locked out. Therefore, the probability of false authentication over any time frame is 20 /62^8 (The number of allowed login attempts prior to lockout is configured during module initialization but cannot exceed 20.)",
            "strength": "The password is a minimum of 8 characters (case- sensitive, alpha- numeric. As such, there are (26*2+10)^8 = 62^8 possible minimum-length passwords,and the false acceptance rate is 1 in 62^8"
          },
          {
            "description": "Authentication is performed using SHA2- 256 based RSA 2048-bit PKCS#1-v1.5 signatures(provides 112 bits of strength). Corresponding public key is associated with the identity.",
            "mechanism": "SW-RSA- SigVer (FIPS186-5)",
            "name": "Digital signature",
            "perMinute": "For each failed signature verification, the module will block for 2 seconds. Therefore, the probability that a random attempt will succeed in a one-minute period is approximately 30/(2^112)",
            "strength": "The probability that a random attempt will succeed or a false acceptance will occur is approximately 1/(2^112)."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [],
        "found": false,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "FIPS self-test failure",
            "description": "Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.",
            "indicator": "Red LED ON",
            "name": "FIPS self-test failure",
            "recoveryMethod": "Reboot"
          },
          {
            "conditions": "Hardware RBG failure",
            "description": "Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.",
            "indicator": "Blue LED ON",
            "name": "Hardware RBG failure",
            "recoveryMethod": "Reboot"
          },
          {
            "conditions": "Any pairwise consistency test failure",
            "description": "Module is no longer operational. The data output is inhibited. Only Unauthenticated status output is available.",
            "indicator": "Blue LED ON",
            "name": "Pairwise consistency test failure",
            "recoveryMethod": "Reboot"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "12 Months",
            "inspectGuidance": "Examine surface of module for scratched or damaged epoxy, especially if circuitry shows.",
            "mechanism": "Epoxy Coating"
          },
          {
            "inspectFreq": "6 Months",
            "inspectGuidance": "If the HSM has not been powered on in the last six months, then power it on for at least an hour.",
            "mechanism": "Battery life"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [
          {
            "caveat": "No security claimed per IG 2.4.A, Scenario 1. Use of a non- approved cryptographic algorithm to \"obfuscate\" a CSP",
            "name": "SHA1",
            "use": "Used for Key fingerprint/KCV computation"
          },
          {
            "caveat": "No security claimed per IG 2.4.A, Scenario 1. Use of a non- approved cryptographic algorithm to \"obfuscate\" a CSP",
            "name": "Triple-DES SP 800-38B",
            "use": "Used for Key fingerprint/KCV computation"
          },
          {
            "caveat": "No security claimed per IG 2.4.A, Scenario 2. Use of an algorithm for a purpose that is not security relevant or is redundant.",
            "name": "PBKDF",
            "use": "Used for hashing of authentication passwords"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [
          {
            "algoPropList": "AES:Legacy Key unwrap only CBC mode: Decrypt; 128, 192, and 256-bit",
            "implName": "LS2-CPT",
            "name": "CPT-AES-CBC (unwrap)",
            "reference": "Key unwrapping. Per IG D.G"
          },
          {
            "algoPropList": "AES:AES : Legacy Key unwrap only ECB mode: Decrypt; 128, 192, and 256-bit",
            "implName": "LS2-CPT",
            "name": "CPT-AES-ECB (unwrap)",
            "reference": "Key unwrapping. Per IG D.G"
          },
          {
            "algoPropList": "Curve Types:Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128",
            "implName": "LS2-CPT",
            "name": "EC Diffie-Hellman with non-NIST",
            "reference": "Per IGs D.F and C.A."
          },
          {
            "algoPropList": "bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits), Prime order curve, generated as per FIPS 186-5 Section 6",
            "implName": "",
            "name": "recommended curves",
            "reference": ""
          },
          {
            "algoPropList": "Curve types:Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits), Prime order curve, generated as per FIPS 186-5 Section 6",
            "implName": "LS2-CPT",
            "name": "ECDSA with non- NIST recommended curves",
            "reference": "Per IG C.A"
          },
          {
            "algoPropList": "AES:Legacy Key unwrap only CBC mode: Decrypt; 128, 192, and 256-bit",
            "implName": "LS2-SW-Crypto",
            "name": "SW-AES-CBC (unwrap)",
            "reference": "Key unwrapping. Per IG D.G"
          },
          {
            "algoPropList": "AES:Legacy Key unwrap only ECB mode: Decrypt; 128, 192, and 256-bit",
            "implName": "LS2-SW-Crypto",
            "name": "SW-AES-ECB (unwrap)",
            "reference": "Key unwrapping. Per IG D.G"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [
          {
            "name": "AES (non- compliant)",
            "use": "Key wrap (TR31/TR34/AES-CBC/AES-GCM, wrap/unwrap), Decimal Table/Data/PIN Encryption/Decryption. FF1/FF3-1 Data Encryption/Decryption * In Non-Approved mode, AES GCM supports the IV length from 1 byte to 16 bytes"
          },
          {
            "name": "DES MAC (non- compliant)",
            "use": "MAC generation and Verification"
          },
          {
            "name": "Double-DES (non- compliant)",
            "use": "Derive unique key per transaction (DUKPT), EMV key derivation. Derive PIN from Offset. Derive Offset from PIN. PIN Verification. PVV generation and Verification. CVV generation and verification. Export Symmetric key/Export Asymmetric key pair using TR31 wrapping. Import/Export using TR34. Import Decimal Table. EMV script. EMV ARQC/ARPC. Data/PIN encryption/decryption"
          },
          {
            "name": "EC-AES",
            "use": "EC-AES wrap/unwrap (EC BYOK)"
          },
          {
            "name": "ECDH KDF",
            "use": "Key derivation using ECDH followed by HMAC/CMAC counter KDF"
          },
          {
            "name": "ECDSA (non- compliant)",
            "use": "Key generation, Sign, Verify P192, Secp192k1, brainpoolP160r1, brainpool192r1, K-163 and B-163 (SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512)"
          },
          {
            "name": "KAS-ECC (non- compliant)",
            "use": "EC Key generation and ECDH Curve25519 (128 bits), Curve448 (224 bits)"
          },
          {
            "name": "ML-DSA ECDSA Sign (non- compliant)",
            "use": "Signature generation function which generates a concateneated signature of ML_DSA and ECDSA"
          },
          {
            "name": "ML-DSA ECDSA Verify (non- compliant)",
            "use": "Signature verification function which verifies a concateneated signature of ML_DSA and ECDSA"
          },
          {
            "name": "RSA (non- compliant)",
            "use": "TR34 Import TR34 Export PIN block decryption BYOK Encrypt/Decrypt Asymmetric key encapsulation and un-encapsulation using PKCS#1-v1.5 padding with modulus size bits 2048-, 3072- and 4096-bits Key generation, Sign, Verify (1024-bit)"
          },
          {
            "name": "PBE",
            "use": "Key generation"
          },
          {
            "name": "Shamir Key Share (non-compliant)",
            "use": "Key share"
          },
          {
            "name": "SW-Counter-DRBG (Allowed Per IG 2.4.A) (non- compliant)",
            "use": "Random number generation for user, keys, internal IVs, and salt"
          },
          {
            "name": "Triple-DES (non- compliant)",
            "use": "Derive unique key per transaction (DUKPT) EMV key derivation. Derive PIN from Offset Derive Offset from PIN Verification PVV generation and verification CVV generation and verification Export Symmetric key/Export Asymmetric key pair using TR31 wrapping Import/Export using TR34 Import Decimal Table EMV script. EMV ARQC/ARPC Data/PIN encryption/decryption"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [
          {
            "alg_accessed": "SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant) PBE",
            "description": "Generate PBE DES3 key with the given password, salt, and iteration count. Make sure that HSM is initialized with fips_state=0.The fips_state parameter can be found in the hsm_configfile.",
            "name": "CN_GENERATE_PB E_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant) ECD SA (non- comp liant)",
            "description": "Generates RSA KEY Pair (mod_len\u003e= 2048-bit). Generates EC KEY PAIR (Curves: Nist P256, 224, 384, 521, Brain pool (Curves: P160, P192, P224, P256, P320, P384, P512), x25519/448 and Secp256K1 and FRP256v1)",
            "name": "LSPAY_GENERATE _ASYMM_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)",
            "description": "Generates symmetric key AES, TDEA keys used for LSPay operations",
            "name": "LSPAY_GENERATE _SYMM_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "",
            "description": "Exports public key for BYOK.",
            "name": "LSPAY_EXPORT_P UBLIC_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "EC- AES ECD H KDF RSA (non- comp",
            "description": "Imports OAEP wrapped or ECDH_AES_PAD wrapped symmetric key.",
            "name": "LSPAY_IMPORT_K PK",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant)",
            "description": "Import symmetric keys using TR- 34 unwrap.",
            "name": "LSPAY_IMPORT_T R34_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Exports symmetric key wrapped with TR31,AES_CBC/ AES_CBC_PAD.",
            "name": "LSPAY_EXPORT_K EY",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant)",
            "description": "Exports symmetric keys wrapped with TR34 mechanism",
            "name": "LSPAY_EXPORT_T R34_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Translates wrapped key from one KPK to another KPK.",
            "name": "LSPAY_TRANSLAT E_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "",
            "description": "Imports peer\u0027s certificate to read public key required in TR34. Import X901 certificate into HSM.",
            "name": "LSPAY_IMPORT_C ERTIFICATE",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Imports encrypted decimal table to be used in PIN APIs to decimalize native PIN.",
            "name": "LSPAY_IMPORT_D ECIMAL_TABLE",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant) ECD SA (non- comp liant)",
            "description": "Create CSR with given key pair.",
            "name": "LSPAY_GENERATE _CSR",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp",
            "description": "Derives DUKPT working key from the BDK.",
            "name": "LSPAY_DERIVE_KE Y",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp",
            "description": "Encrypts input data or PIN.",
            "name": "LSPAY_ENCRYPT",
            "role": "PCU"
          },
          {
            "alg_accessed": "liant) Triple -DES (non- comp liant)",
            "description": "",
            "name": "",
            "role": ""
          },
          {
            "alg_accessed": "AES (non- comp liant) Doub le- DES (non- comp liant) Triple -DES (non- comp",
            "description": "Decrypts input data or PIN.",
            "name": "LSPAY_DECRYPT",
            "role": "PCU"
          },
          {
            "alg_accessed": "liant) AES (non- comp liant) Doub le- DES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Decrypts the input cipher text with one key and encrypts with another key.",
            "name": "LSPAY_DECRYPT_ THEN_ENCRYPT",
            "role": "PCU"
          },
          {
            "alg_accessed": "DES MAC (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Computes MAC on input data. Algorithm used: DES/Triple-DES",
            "name": "LSPAY_MAC_GEN",
            "role": "PCU"
          },
          {
            "alg_accessed": "DES MAC (non- comp liant) Triple -DES (non-",
            "description": "Verifies MAC with calculated AMC on input data.",
            "name": "LSPAY_MAC_VERI FY",
            "role": "PCU"
          },
          {
            "alg_accessed": "DES MAC",
            "description": "Translates MAC by using new key on input data.",
            "name": "LSPAY_MAC_TRAN SLATE",
            "role": "PCU"
          },
          {
            "alg_accessed": "(non- comp liant) Triple -DES (non- comp liant)",
            "description": "",
            "name": "",
            "role": ""
          },
          {
            "alg_accessed": "AES (non- comp liant)",
            "description": "Performs FPE FF1/FF3-1 encrypt operation on input data.",
            "name": "LSPAY_FPE_ENCR YPT",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant)",
            "description": "Performs FPE FF1/FF3-1 decrypt operation on input data.",
            "name": "LSPAY_FPE_DECR YPT",
            "role": "PCU"
          },
          {
            "alg_accessed": "ECD SA (non- comp liant) RSA (non- comp liant)",
            "description": "Performs sign and verify on input data.",
            "name": "LSPAY_SIGN",
            "role": "PCU"
          },
          {
            "alg_accessed": "ECD SA (non- comp liant) RSA (non- comp liant)",
            "description": "Verifies sign on input data.",
            "name": "LSPAY_SIGN_VERI FY",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant) RSA (non- comp liant)",
            "description": "Decrypts the input PIN using decryption key, translates to given PIN format and encrypts with another key.",
            "name": "LSPAY_PINBLK_TR ANSLATE",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Derive PIN from given offset. Encrypts validation data with DES EDE. Derives native PIN, then offset will be added to derive IBM PIN. PIN will be encoded in given ISO format. Encrypt encoded PIN with PIN encryption key.",
            "name": "LSPAY_DERIVE_PI N_FROM_OFFSET",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Generates IBM offset from given PIN. Decrypt and decode received PIN. Generate native from given validation data. Subtract decoded PIN from native PIN t to get PIN offset.",
            "name": "LSPAY_DERIVE_O FFSET_FROM_PIN",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Verifies given PIN .Decrypt and decode received PIN. Generate native from given validation data. Add offset to native PIN. Compare resultant PIN with received PIN.",
            "name": "LSPAY_VERIFY_PI N",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp",
            "description": "Perform PVV generation on PIN and PAN data.",
            "name": "LSPAY_PVV_GEN",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Verifies given PVV.",
            "name": "LSPAY_PVV_VERIF Y",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Perform EMV crypto operations. Generate ARPC. Generate or Verify ARQC.",
            "name": "LSPAY_EMV_GENV ERIFY",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Generates MAC over secure message.",
            "name": "LSPAY_EMV_SECU RE_MSG_GEN",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant)",
            "description": "Generates CVV, CVV2,iCVVon given card details.",
            "name": "LSPAY_CVV_GEN",
            "role": "PCU"
          },
          {
            "alg_accessed": "Triple -DES (non- comp liant)",
            "description": "",
            "name": "",
            "role": ""
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Verifies CVV with given card details",
            "name": "LSPAY_CVV_VERIF Y",
            "role": "PCU"
          },
          {
            "alg_accessed": "Sha mir Key Shar e (non- comp liant)",
            "description": "Creates components of Key",
            "name": "LSPAY_KEY_SHAR E_CREATE",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant)",
            "description": "Exports created components in encrypted format",
            "name": "LSPAY_KEY_SHAR E_EXPORT_COMP ONENT",
            "role": "PCU"
          },
          {
            "alg_accessed": "",
            "description": "Starts combine keyinit.",
            "name": "LSPAY_KEY_SHAR E_COMBINE_INIT",
            "role": "PCU"
          },
          {
            "alg_accessed": "Sha mir Key Shar e (non- comp liant)",
            "description": "Combines all components of the key.",
            "name": "LSPAY_KEY_SHAR E_COMBINE_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "",
            "description": "Erases all components of the key.",
            "name": "LSPAY_KEY_SHAR E_ZEROIZE",
            "role": "PCU"
          },
          {
            "alg_accessed": "SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)",
            "description": "Generates MFK key.",
            "name": "LSPAY_MFK_GENE RATE",
            "role": "PCO"
          },
          {
            "alg_accessed": "",
            "description": "Returns MFK information for partition.",
            "name": "LSPAY_MFK_GET_I NFO",
            "role": "PCO"
          },
          {
            "alg_accessed": "",
            "description": "Sets MFK as primary.",
            "name": "LSPAY_MFK_SET_ PRIMARY",
            "role": "PCO"
          },
          {
            "alg_accessed": "",
            "description": "Deletes MFK.",
            "name": "LSPAY_MFK_DELE TE",
            "role": "PCO"
          },
          {
            "alg_accessed": "",
            "description": "Gets status of enabled/disabled LSPay services",
            "name": "LSPAY_FUNCTION ALITY_GET",
            "role": "PCO"
          },
          {
            "alg_accessed": "",
            "description": "Enable/Disable services",
            "name": "LSPAY_FUNCTION ALITY_SET",
            "role": "PCO"
          },
          {
            "alg_accessed": "EC- AES ECD H KDF RSA (non- comp liant)",
            "description": "Export a Key Block Protection Key (KBPK)",
            "name": "LSPAY_EXPORT_K PK",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant)",
            "description": "Import an RSA public key",
            "name": "LSPAY_IMPORT_P UBLIC_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant)",
            "description": "Validates the RSA public key",
            "name": "LSPAY_VALIDATE_ PUBLIC_KEY",
            "role": "PCU"
          },
          {
            "alg_accessed": "ECD SA (non- comp liant) KAS- ECC (non- comp liant) RSA (non- comp liant)",
            "description": "Generates asymmetric keys (RSA/ ECC). Updates the public and private key handles in the output on return. Caveats in Non Approved apart from approved mode: RSA 1024 bits allowed along with all odd public exponent i.e. even lesser than 65537.NID_X9_62_prime192v1/NID_sect163k1/NID_ED25519/NID_se ct163r2/NID_secp192k1/NID_brainpoolP160r1/NID_brainpoolP192r1/NI D_X25519/NID_X448",
            "name": "CN_GENERATE_KE Y_PAIR (non- compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "SW- Coun ter- DRB G (Allo wed Per IG 2.4.A ) (non- comp liant)",
            "description": "Generates a symmetric key of given key type and length. Caveats in Non-Approved apart from approved mode:DES token key is allowed.",
            "name": "CN_GENERATE_KE Y (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "",
            "description": "Imports a public key into HSM. Caveats in Non Approved apart from approved mode:RSA-1024 bits allowed, NID_ED25519/NID_secp192k1/NID_brainpoolP160r1/NID_brainpoolP1 92r1/NID_X25519/NID_X448",
            "name": "CN_CREATE_OBJE CT (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "EC- AES ECD H KDF",
            "description": "Unwraps a key with an AES/Triple-DES/RSA private key existing on HSM or KLK. Takes the output wrapped data of wrapKey2 command. Caveats in Non Approved apart from approved mode:RSA-1024 bit, RSAPKCS1V1.5 Unwrap,NID_X9_62_prime192v1/",
            "name": "CN_UNWRAP_KEY (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "RSA (non- comp liant) Triple -DES (non- comp liant)",
            "description": "NID_sect163k1/NID_ED25519/NID_sect163r2/NID_secp192k1/NID_bra inpoolP160r1/NID_brainpoolP192r1/NID_X25519/NID_X448,Triple-DES",
            "name": "",
            "role": ""
          },
          {
            "alg_accessed": "AES (non- comp liant) RSA (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Wraps sensitive (private and symmetric) keys from the HSM to the host. Caveats in Non Approved apart from approved mode: AES-ECB mode, AES-CBC mode, AES-CBC-PAD mode, Triple-DES ECB mode, Triple- DES CBC mode, Triple-DES NIST Wrap mode, RSA-PKCS1V1.5 Wrap",
            "name": "CN_WRAP_KEY (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant)",
            "description": "Extracts a masked object; i.e., retrieves an object by wrapping it with a masking key shared by the process of cloning.",
            "name": "CN_EXTRACT_MAS KED_OBJECT (non- compliant)",
            "role": "PCU,P CO,AU"
          },
          {
            "alg_accessed": "ECD SA (non- comp liant) RSA (non- comp liant)",
            "description": "Configure an RSA or EC public key into HSM as AO attestation key. These keys can be of modulus 1024, 2048, 3072, and 4096 or a supported 256 bits, 384 bits or 521 bits EC curve. Caveats in Non Approved is 192-bit curves supported",
            "name": "CN_STORE_FW_SI GNING_KEY (non- compliant)",
            "role": "MCO"
          },
          {
            "alg_accessed": "RSA (non- comp liant)",
            "description": "PKCS#1v1.5 encrypt and decrypt",
            "name": "MAJOR_OP_ME_P KCS_LARGE (non- compliant)/MAJOR_ OP_ME_PKCS (non- compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "AES (non- comp liant) RSA (non- comp liant)",
            "description": "Stores fixed keys (KBK) for backup. Including PKCS#1v1.5",
            "name": "CN_STORE_VEND OR_PRE_SHARED_ KEY (CN_STORE_KBK_ SHARE) (non- compliant)",
            "role": "MCO"
          },
          {
            "alg_accessed": "AES (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Inserts a masked object into an HSM that is extracted from another HSM.",
            "name": "CN_INSERT_MASK ED_OBJECT (non- compliant)",
            "role": "PCU,P CO,AU"
          },
          {
            "alg_accessed": "EC- AES ECD H KDF RSA (non- comp liant)",
            "description": "Enables encrypted communication channel. Caveat is Non Approved mode allow the additional Cipher suite E2E_RSA_AES128_GCM_SHA256",
            "name": "CN_ENCRYPT_SES SION (non- compliant)",
            "role": "Unaut hentic ated"
          },
          {
            "alg_accessed": "EC- AES ECD H KDF RSA (non- comp",
            "description": "Enables encrypted communication channel. Caveat is Non Approved mode allow the additional nonapproved cipher suites",
            "name": "CN_ENCRYPT_SES SION_V2 (non- compliant)",
            "role": "Unaut hentic ated"
          },
          {
            "alg_accessed": "liant) AES (non- comp liant) EC- AES ECD H KDF RSA (non- comp liant) Triple -DES (non- comp liant)",
            "description": "Derives a key using a supported KDF mechanism with the params given by the user.",
            "name": "CN_DERIVE_KEY (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "ML- DSA ECD SA Sign (non- comp liant)",
            "description": "Generates a signature using ML-DSA and ECDSA sign algorithm.",
            "name": "CN_PQC_CRYPTO _HYBRID_SIG_GEN (non-compliant)",
            "role": "PCU"
          },
          {
            "alg_accessed": "ML- DSA ECD SA Verify (non- comp liant)",
            "description": "Verifies a signature using ML-DSA and ECDSA sign algorithm.",
            "name": "CN_PQC_CRYPTO _HYBRID_SIG_VER IFY (non-compliant)",
            "role": "PCU"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Log messages of MCU UART,SMBus, Diagnostics",
            "logicalInterface": "Status Output",
            "physicalPort": "USB (FTDI USB to Multi-Channe)"
          },
          {
            "data": "Primary interface to communicate with the module. Provides APIs for the software on the host to communicate with the module",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "PCIe"
          },
          {
            "data": "Log message of Diagnostics and System management",
            "logicalInterface": "Status Output",
            "physicalPort": "PCIeSMBus"
          },
          {
            "data": "Operation status",
            "logicalInterface": "Status Output",
            "physicalPort": "LED"
          },
          {
            "data": "No data; only a signal from high to low",
            "logicalInterface": "Control Input",
            "physicalPort": "Tamper PIN"
          },
          {
            "data": "No data; only a signal",
            "logicalInterface": "Control Input",
            "physicalPort": "Zeroize push button"
          },
          {
            "data": "No data; external power connector",
            "logicalInterface": "",
            "physicalPort": "Power connector"
          },
          {
            "data": "No data; external power connector",
            "logicalInterface": "",
            "physicalPort": "Battery interfaces"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Username and password",
            "name": "MCO",
            "operatorType": "Crypto Officer",
            "type": "Identity"
          },
          {
            "authMethodList": "Username and password Digital signature",
            "name": "MCO (2FA)",
            "operatorType": "Crypto Officer",
            "type": "Multi-Factor Identity"
          },
          {
            "authMethodList": "Username and password",
            "name": "Pre-CO",
            "operatorType": "Crypto Officer",
            "type": "Identity"
          },
          {
            "authMethodList": "Username and password",
            "name": "PCO",
            "operatorType": "Crypto Officer",
            "type": "Identity"
          },
          {
            "authMethodList": "Username and password Digital signature",
            "name": "PCO (2FA)",
            "operatorType": "Crypto Officer",
            "type": "Multi-Factor Identity"
          },
          {
            "authMethodList": "Username and password",
            "name": "PCU",
            "operatorType": "Crypto User",
            "type": "Identity"
          },
          {
            "authMethodList": "Username and password Digital signature",
            "name": "PCU (2FA)",
            "operatorType": "Crypto User",
            "type": "Multi-Factor Identity"
          },
          {
            "authMethodList": "Username and password",
            "name": "AU",
            "operatorType": "Audit User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "3",
            "section": "1",
            "title": "General"
          },
          {
            "level": "3",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "3",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "3",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "3",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "3",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "3",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "3",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "CRC32 firmware integrity",
            "details": "checksum",
            "indicator": "successful boot",
            "testMethod": "KAT",
            "testProps": "CRC32",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Firmware Integrity Test",
            "details": "firmware signature verify",
            "indicator": "successful boot",
            "testMethod": "KAT",
            "testProps": "RSA-2048 SigVer",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Temperature monitor test",
            "details": "Temperature monitor",
            "indicator": "successful boot",
            "testMethod": "CF",
            "testProps": "Temperature monitor",
            "type": "Critical Function"
          },
          {
            "algorithmOrTest": "Voltage monitor test",
            "details": "Voltage monitor",
            "indicator": "successful boot",
            "testMethod": "CF",
            "testProps": "Voltage monitor",
            "type": "Critical Function"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Password-Input- Method",
            "sfiAlgo": "SW-AES-KWP- Unwrap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Key-Transport- Output-Method",
            "sfiAlgo": "SW-KTS-IFC- Encap (KTS)",
            "source": "NOR"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Key-Transport-Input- Method",
            "sfiAlgo": "SW-KTS-IFC- Decap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-Wrap-Output- Method",
            "sfiAlgo": "SW-AES-KW-Wrap (KTS)",
            "source": "eMMC"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-Wrap-Pad- Output-Method",
            "sfiAlgo": "SW-AES-KWP- Wrap (KTS)",
            "source": "eMMC"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-GCM-Wrap- Output-Method",
            "sfiAlgo": "SW-AES-GCM- Wrap",
            "source": "eMMC"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-Unwrap-Input- Method",
            "sfiAlgo": "SW-AES-KW- Unwrap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-Unwrap-Pad- Input-Method",
            "sfiAlgo": "SW-AES-KWP- Unwrap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES-GCM-Unwrap- Input-Method",
            "sfiAlgo": "SW-AES-GCM- Unwrap",
            "source": "Entered"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public-Key-Plain- Output-Method",
            "sfiAlgo": "",
            "source": "eMMC"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public-Key-Plain- Input-Method",
            "sfiAlgo": "",
            "source": "Entered"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Shared-Secret-Plain- Output-Method",
            "sfiAlgo": "SW-KTS-IFC- Encap (KTS)",
            "source": "eMMC"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Shared-Secret-Plain- Input-Method",
            "sfiAlgo": "SW-KTS-IFC- Decap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Restore-Key-Input- Method",
            "sfiAlgo": "SW-AES-KWP- Unwrap (KTS)",
            "source": "Entered"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Backup-Key-Output- Method",
            "sfiAlgo": "SW-AES-KWP- Wrap (KTS)",
            "source": "eMMC"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Manually zeroized (via GP_KEY_MGMT - CN_DESTROY_OBJECT service)",
            "method": "D",
            "operatorId": "CN_DESTROY_OBJECT",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroized right after use (Memory is wiped with zeros, immediately after use)",
            "method": "E",
            "operatorId": "immediately after use",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroize all Partition\u0027s SSPs, including the HSM adapter owner programmed ones (Brings HSM to factory state. Factory reset via GP_ZEROIZATION - CN_ZEROIZE service with factory-reset as argument with MCO credentials)",
            "method": "MFZ",
            "operatorId": "CN_ZEROIZE",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroize all Partition\u0027s SSPs, except vendor programmed ones (HSM zeroize via GP_ZEROIZATION - CN_ZEROIZE service with MCO credentials)",
            "method": "MZ",
            "operatorId": "CN_ZEROIZE",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroize all SSPs in the Partition and then delete the User Partition (via GP_PARTITION_MGMT - CN_DELETE_PARTITION service )",
            "method": "PD",
            "operatorId": "CN_DELETE_PARTITION",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroize all SSPs in the Partition (Factory reset via GP_ZEROIZATION - CN_ZEROIZE service with factory-reset as argument with PCO credentials)",
            "method": "PFZ",
            "operatorId": "CN_ZEROIZE",
            "rationale": "wipes all SSPs withzeros in 1 second"
          },
          {
            "description": "Zeroize all User SSPs in the Partition Regular p (User Partition Regular zeroize via GP_ZEROIZATION - CN_ZEROIZE service with PCO credentials)",
            "method": "PZ",
            "operatorId": "CN_ZEROIZE",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Zeroized on session close (Session Close via GP_SESSION_MGMT - CN_CLOSE_SESSION, CN_APP_FINALIZE and CN_CLOSE_PARTITION_SESSIONS)",
            "method": "S",
            "operatorId": "CN_CLOSE_SESSION",
            "rationale": "wipes all SSPs with zeros in 1 second"
          },
          {
            "description": "Vendor zeroize (Zeroizes all SSPs including vendor programmed configuration and CSPs. Makes the module unusable; the module must be sent back to the vendor for re-programming.) via GP_ZEROIZATION - CN_VENDOR_ZEROIZE service",
            "method": "VZ",
            "operatorId": "CN_VENDOR_ZEROIZE",
            "rationale": "wipes all SSPs with zeros in 1 second"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Ephemeral RAM",
            "name": "DDR4",
            "persistance": "Dynamic"
          },
          {
            "description": "read/write memory",
            "name": "NOR",
            "persistance": "Static"
          },
          {
            "description": "read/write memory",
            "name": "MCU",
            "persistance": "Static"
          },
          {
            "description": "read/write memory",
            "name": "eMMC",
            "persistance": "Static"
          },
          {
            "description": "OTP memory",
            "name": "FUSE",
            "persistance": "Static"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "Offers 50% of full card capacity.",
            "fwVersion": "MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB",
            "hwVersion": "CN9310410-03 C - LS2-G-A050-XX-Y-B0",
            "modelPartNum": "LS2-B0 / LS2-G- A050-XX-Y-B0",
            "processors": "Octeon_TX2"
          },
          {
            "features": "Offers 75% of full card capacity.",
            "fwVersion": "MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB",
            "hwVersion": "CN9310410-03 C - LS2-G-A100-XX-Y-B0",
            "modelPartNum": "LS2-B0 / LS2-G- A100-XX-Y-B0",
            "processors": "Octeon_TX2"
          },
          {
            "features": "Offers full card capacity.",
            "fwVersion": "MARVELL-LS2-FW-10.23-0602, MARVELL-LS2-UBOOT-10.02- 1200-SB",
            "hwVersion": "CN9310410-03 C - LS2-G-A300-XX-Y-B0",
            "modelPartNum": "LS2-B0 / LS2-G- A300-XX-Y-B0",
            "processors": "Octeon_TX2"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Asymmetric and Symmetric",
            "implName": "N/A",
            "name": "CKG1",
            "reference": "SP800-133rev2 Section 4 Example 1 and IG D.H"
          },
          {
            "algoPropList": "Key Type:Symmetric",
            "implName": "N/A",
            "name": "CKG2",
            "reference": "SP800-133rev2 Section 4 Example 2 and IG D.H"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 85
          },
          "ECDH": {
            "ECDH": 7
          },
          "ECDSA": {
            "ECDSA": 32
          }
        },
        "FF": {
          "DH": {
            "DH": 6,
            "Diffie-Hellman": 3
          },
          "DSA": {
            "DSA": 2
          }
        },
        "RSA": {
          "RSA 1024": 1,
          "RSA 2048": 3,
          "RSA-2048": 1
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 10
        },
        "CCM": {
          "CCM": 2
        },
        "CTR": {
          "CTR": 15
        },
        "ECB": {
          "ECB": 10
        },
        "GCM": {
          "GCM": 9
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "OpenSSL": {
          "OpenSSL": 1
        }
      },
      "crypto_protocol": {
        "TLS": {
          "SSL": {
            "SSL": 1
          },
          "TLS": {
            "TLS": 53,
            "TLS 1.2": 5,
            "TLS v1.2": 5
          }
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 7
        },
        "KEM": {
          "KEM": 1
        },
        "MAC": {
          "MAC": 66
        }
      },
      "device_model": {},
      "ecc_curve": {
        "ANSSI": {
          "FRP256v1": 1
        },
        "Brainpool": {
          "brainpoolP160r1": 1,
          "brainpoolP224r1": 4,
          "brainpoolP256r1": 4,
          "brainpoolP320r1": 4,
          "brainpoolP384r1": 4,
          "brainpoolP512r1": 4
        },
        "Curve": {
          "Curve25519": 1
        },
        "NIST": {
          "B-163": 1,
          "B-233": 1,
          "B-283": 1,
          "B-571": 1,
          "K-163": 1,
          "K-233": 1,
          "K-283": 1,
          "K-409": 1,
          "K-571": 1,
          "P-192": 4,
          "P-224": 18,
          "P-256": 18,
          "P-384": 16,
          "P-521": 20,
          "secp256k1": 1
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#2": 2
        }
      },
      "fips_certlike": {
        "Certlike": {
          "# A7544": 2,
          "- PKCS 1": 1,
          "AES 256": 2,
          "AES-256": 3,
          "AES256": 3,
          "Certificate RSA": 32,
          "DES3": 1,
          "HMAC SHA256": 1,
          "HMAC- SHA-1": 10,
          "HMAC-SHA-1": 16,
          "PKCS 1": 1,
          "RSA 1024": 1,
          "RSA 2048": 3,
          "SHA-1": 26,
          "SHA-2": 1,
          "SHA-3": 2,
          "SHA1": 2,
          "SHA2": 4,
          "SHA2- 224": 7,
          "SHA2- 256": 23,
          "SHA2- 384": 13,
          "SHA2- 512": 17,
          "SHA2-224": 15,
          "SHA2-256": 21,
          "SHA2-384": 15,
          "SHA2-512": 17,
          "SHA256": 1,
          "SHA3- 224": 4,
          "SHA3- 256": 4,
          "SHA3- 384": 4,
          "SHA3- 512": 4,
          "SHA3-224": 6,
          "SHA3-256": 6,
          "SHA3-384": 6,
          "SHA3-512": 9
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 3": 5
        }
      },
      "hash_function": {
        "PBKDF": {
          "PBKDF": 13
        },
        "SHA": {
          "SHA1": {
            "SHA-1": 26,
            "SHA1": 2
          },
          "SHA2": {
            "SHA-2": 1,
            "SHA2": 4,
            "SHA256": 1
          },
          "SHA3": {
            "SHA-3": 2,
            "SHA3-224": 6,
            "SHA3-256": 6,
            "SHA3-384": 6,
            "SHA3-512": 9
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {
        "FIPS": {
          "ML-DSA": 5,
          "ML_DSA": 2
        }
      },
      "randomness": {
        "PRNG": {
          "DRBG": 222
        },
        "RNG": {
          "RBG": 7,
          "RNG": 1
        }
      },
      "side_channel_analysis": {
        "FI": {
          "physical tampering": 1
        }
      },
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 8,
          "FIPS 180-4": 10,
          "FIPS 186-4": 15,
          "FIPS 186-5": 15,
          "FIPS 198-1": 18,
          "FIPS 202": 8,
          "FIPS PUB 140-3": 1,
          "FIPS PUB 202": 1,
          "FIPS140-3": 1,
          "FIPS18": 33,
          "FIPS186": 42,
          "FIPS186-4": 18,
          "FIPS186-5": 31
        },
        "ISO": {
          "ISO/IEC 19790": 2,
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "NIST SP 800-131A": 2,
          "NIST SP 800-186": 2,
          "SP 800-108": 2,
          "SP 800-131A": 1,
          "SP 800-132": 2,
          "SP 800-135": 2,
          "SP 800-38A": 7,
          "SP 800-38B": 7,
          "SP 800-38C": 3,
          "SP 800-38D": 9,
          "SP 800-38F": 10,
          "SP 800-56A": 4,
          "SP 800-56B": 3,
          "SP 800-56C": 3,
          "SP 800-63B": 1,
          "SP 800-67": 2,
          "SP 800-90A": 3,
          "SP 800-90B": 1
        },
        "PKCS": {
          "PKCS 1": 1
        },
        "RFC": {
          "RFC 5288": 1,
          "RFC 7627": 1,
          "RFC7627": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 52,
            "AES-": 134,
            "AES-256": 3,
            "AES256": 3
          },
          "CAST": {
            "CAST": 60
          }
        },
        "DES": {
          "3DES": {
            "TDEA": 4,
            "TDES": 4,
            "Triple-DES": 11
          },
          "DES": {
            "DES": 9
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 12,
            "HMAC": 64
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 27
        }
      },
      "tls_cipher_suite": {
        "TLS": {
          "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 3,
          "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 3
        }
      },
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CTRA7544",
        "RSA Decryption Primitive Sp800-56Br2A7544",
        "RSA SigGen (FIPS186-5)A1948",
        "RSA SigVer (FIPS186-4)A1946",
        "HMAC-SHA2-224A7544",
        "AES-CMACA7544",
        "HMAC-SHA3-384A7544",
        "ECDSA SigVer (FIPS186-5)A7544",
        "AES-GCMA7544",
        "AES-GMACA7544",
        "SHA-1A7544",
        "SHA2-224A7544",
        "KDF ANS 9.63A1948",
        "Counter DRBGA1948",
        "SHA2-512A7544",
        "ECDSA SigVer (FIPS186-4)A1948",
        "KAS-ECC-SSC Sp800-56Ar3A7544",
        "AES-KWA1948",
        "KDA HKDF Sp800-56Cr1A1948",
        "ECDSA SigGen (FIPS186-4)A1948",
        "KDA TwoStep Sp800-56Cr1A1948",
        "AES-KWPA1948",
        "KAS-ECC Sp800-56Ar3A1948",
        "RSA KeyGen (FIPS186-5)A7545",
        "KTS-IFCA7545",
        "Hash DRBGA7544",
        "TDES-ECBA7544",
        "HMAC-SHA2-512A7544",
        "AES-CCMA7544",
        "SHA3-224A7544",
        "HMAC-SHA3-256A7544",
        "AES-ECBA7544",
        "ECDSA KeyGen (FIPS186-5)A7545",
        "ECDSA SigGen (FIPS186-5)A7544",
        "HMAC-SHA2-384A7544",
        "KDA OneStep Sp800-56Cr1A1948",
        "HMAC-SHA2-256A7544",
        "TDES-CBCA7544",
        "SHA3-512A7544",
        "HMAC-SHA3-512A7544",
        "KDF SP800-108A7544",
        "TLS v1.2 KDF RFC7627A7544",
        "KAS-IFC-SSCA1948",
        "SHA3-384A7544",
        "RSA Decryption PrimitiveA1948",
        "RSA Signature PrimitiveA7544",
        "TDES-KWA1948",
        "ECDSA KeyVer (FIPS186-4)A1948",
        "AES-CBCA7544",
        "SHA2-384A7544",
        "SHA3-256A7544",
        "RSA SigVer (FIPS186-5)A7545",
        "HMAC-SHA3-224A7544",
        "HMAC-SHA-1A7544",
        "SHA2-256A7544",
        "ECDSA KeyGen (FIPS186-4)A1948"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A1946",
        "#A1948",
        "#A7545",
        "#A7544"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260824100254-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260824100254-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 1731807,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": []
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 149
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "fa9d98247b8ebe292d2e012874315c38da17f4d608c02e4acaa9a751ead2e0e1",
      "source_hash": "9074506728be7fbdc3cfec615a02375c7675e2932150c7056681dd4cc7385666",
      "txt_hash": "ed70c7ebde88e0410e6adb5710224a88da978c8079cd0b7d84b1be7c7e23ce83"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. When operated in approved mode",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
    "date_sunset": "2031-08-24",
    "description": "The LS2 HSM module is a multi-chip PCIe adapter with firmware. It consists of multiple firmware components, including an operating system, applications exposing services and interfaces related to secure key management, crypto operations, and policy management of the module.",
    "embodiment": "MultiChipEmbed",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 3,
    "mentioned_certs": {},
    "module_name": "Marvell LS2 HSM Family",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-08-25",
        "lab": "Teron Labs",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Marvell Semiconductor, Inc.",
    "vendor_url": "http://www.marvell.com/products/security-solutions.html"
  }
}

Sections

Marvell LS2 HSM Family

Certificate details

Security policy

Extracted keywords

Symmetric Algorithms

Asymmetric Algorithms

Post-quantum Algorithms

Hash functions

Schemes

Protocols

Randomness

Libraries

Elliptic Curves

Block cipher modes

TLS cipher suites

Trusted Execution Environments

Security level

Side-channel analysis

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Certificate changed

Certificate changed

Certificate changed

Certificate changed

Certificate changed

Certificate changed

New certificate

Raw data

Sections

Marvell LS2 HSM Family

Certificate details

Security policy

Extracted keywords

Cryptography

Symmetric Algorithms

Asymmetric Algorithms

Post-quantum Algorithms

Hash functions

Schemes

Protocols

Randomness

Libraries

Elliptic Curves

Block cipher modes

TLS cipher suites

Device

Trusted Execution Environments

Security

Security level

Side-channel analysis

Other

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Raw data

Toggle raw data