© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice.
OpenSSL Cryptographic Module
version 1.0
FIPS 140-2 Non-Proprietary Security Policy
Version 1.5
Last update: 2020-02-06
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 2 of 55
Prepared by:
atsec information security corporation
9130 Jollyville Road, Suite 260
Austin, TX 78759
www.atsec.com
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 3 of 55
Table of Contents
1. Cryptographic Module Specification....................................................................................................... 6
1.1. Module Overview ..................................................................................................................................6
1.2. Modes of Operation...............................................................................................................................9
2. Cryptographic Module Ports and Interfaces ......................................................................................... 10
3. Roles, Services and Authentication ...................................................................................................... 11
3.1. Roles ....................................................................................................................................................11
3.2. Services................................................................................................................................................11
3.3. Algorithms............................................................................................................................................13
3.3.1. Ubuntu 16.04 LTS 64-bit Little Endian Running on POWER System............................................14
3.3.2. Ubuntu 16.04 LTS 64-bit Running on Intel® Xeon®/Atom® Processor........................................18
3.3.3. Ubuntu 16.04 LTS 64-bit Running on z System ...........................................................................25
3.3.4. Non-Approved Algorithms ..........................................................................................................29
3.4. Operator Authentication .....................................................................................................................31
4. Physical Security .................................................................................................................................. 32
5. Operational Environment..................................................................................................................... 33
5.1. Applicability .........................................................................................................................................33
5.2. Policy....................................................................................................................................................33
6. Cryptographic Key Management.......................................................................................................... 34
6.1. Random Number Generation ..............................................................................................................34
6.2. Key Generation ....................................................................................................................................35
6.3. Key Agreement / Key Transport / Key Derivation................................................................................35
6.4. Key Entry / Output...............................................................................................................................36
6.5. Key / CSP Storage.................................................................................................................................36
6.6. Key / CSP Zeroization...........................................................................................................................36
7. Electromagnetic Interference/Electromagnetic Compatibility (EMI/EMC) ............................................ 37
8. Self-Tests ............................................................................................................................................. 38
8.1. Power-Up Tests....................................................................................................................................38
8.1.1. Integrity Tests..............................................................................................................................38
8.1.2. Cryptographic Algorithm Tests....................................................................................................38
8.2. On-Demand Self-Tests .........................................................................................................................39
8.3. Conditional Tests .................................................................................................................................39
9. Guidance.............................................................................................................................................. 41
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 4 of 55
9.1. Crypto Officer Guidance ......................................................................................................................41
9.1.1. Operating Environment Configurations ......................................................................................41
9.1.2. Module Installation .....................................................................................................................42
9.2. User Guidance......................................................................................................................................42
9.2.1. TLS...............................................................................................................................................42
9.2.2. AES GCM IV .................................................................................................................................43
9.2.3. AES XTS........................................................................................................................................43
9.2.4. Random Number Generator .......................................................................................................43
9.2.5. API Functions...............................................................................................................................43
9.2.6. Environment Variables................................................................................................................43
9.2.7. Handling FIPS Related Errors.......................................................................................................44
10. Mitigation of Other Attacks.................................................................................................................. 46
10.1. Blinding Against RSA Timing Attacks....................................................................................................46
10.2. Weak Triple-DES Keys Detection..........................................................................................................46
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 5 of 55
Copyrights and Trademarks
Ubuntu and Canonical are registered trademarks of Canonical Ltd.
Linux is a registered trademark of Linus Torvalds.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 6 of 55
1. Cryptographic Module Specification
This document is the non-proprietary FIPS 140-2 Security Policy for version 1.0 of the Ubuntu OpenSSL
Cryptographic Module. It contains the security rules under which the module must operate and describes how
this module meets the requirements as specified in FIPS PUB 140-2 (Federal Information Processing Standards
Publication 140-2) for a Security Level 1 software module.
The following sections describe the cryptographic module and how it conforms to the FIPS 140-2 specification
in each of the required areas.
1.1. Module Overview
The Ubuntu OpenSSL Cryptographic Module (hereafter referred to as “the module”) is a set of software
libraries implementing the Transport Layer Security (TLS) protocol v1.0, v1.1 and v1.2 and Datagram Transport
Layer Security (DTLS) protocol v.1.0 and v1.2, as well as general purpose cryptographic algorithms. The module
provides cryptographic services to applications running in the user space of the underlying Ubuntu operating
system through a C language Application Program Interface (API). The module utilizes processor instructions to
optimize and increase performance. The module can act as a TLS server or client, and interacts with other
entities via TLS/DTLS network protocols.
For the purpose of the FIPS 140-2 validation, the module is a software-only, multi-chip standalone
cryptographic module validated at overall security level 1. The table below shows the security level claimed for
each of the eleven sections that comprise the FIPS 140-2 standard:
FIPS 140-2 Section Security
Level
1 Cryptographic Module Specification 1
2 Cryptographic Module Ports and Interfaces 1
3 Roles, Services and Authentication 1
4 Finite State Model 1
5 Physical Security N/A
6 Operational Environment 1
7 Cryptographic Key Management 1
8 EMI/EMC 1
9 Self-Tests 1
10 Design Assurance 1
11 Mitigation of Other Attacks 1
Overall Level 1
Table 1 - Security Levels
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 7 of 55
The cryptographic logical boundary consists of all shared libraries and the integrity check files used for Integrity
Tests. The following table enumerates the files that comprise the module:
Component Description
libssl.so.1.0.0 Shared library for TLS/DTLS network protocols.
libcrypto.so.1.0.0 Shared library for cryptographic implementations.
.libssl.so.1.0.0.hmac Integrity check signature for libssl shared library.
.libcrypto.so.1.0.0.hmac Integrity check signature for libcrypto shared library.
Table 2 - Cryptographic Module Components
The software block diagram below shows the module, its interfaces with the operational environment and the
delimitation of its logical boundary, comprised of all the components within the BLUE box:
Figure 1 - Software Block Diagram
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 8 of 55
The module is aimed to run on a general purpose computer (GPC); the physical boundary of the module is the
tested platforms. Figure 2 shows the major components of a GPC:
Figure 2 - Cryptographic Module Physical Boundary
The module has been tested on the test platforms shown below:
Test Platform Processor Test Configuration
IBM Power System S822L
(PowerNV 8247-22L)
POWER8 Ubuntu 16.04 LTS 64-bit Little Endian
with/without Power ISA 2.07 (PAA)
IBM Power System S822LC
(PowerNV 8001-22C)
POWER8 Ubuntu 16.04 LTS 64-bit Little Endian
with/without Power ISA 2.07 (PAA)
IBM Power System S822LC
(PowerNV 8335-GTB)
POWER8 Ubuntu 16.04 LTS 64-bit Little Endian
with/without Power ISA 2.07 (PAA)
Supermicro SYS-5018R-WR Intel® Xeon® CPU E5-
2620v3
Ubuntu 16.04 LTS 64-bit with/without AES-
NI (PAA)
IBM z13 z13 Ubuntu 16.04 LTS 64-bit running on LPAR
with/without CPACF (PAI)
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 9 of 55
Supermicro A1SAi Intel®Atom™ C2750 Ubuntu 16.04 LTS 64-bit with/without AES-
NI (PAA)
Supermicro SMX11SPL-F Intel® Xeon® Silver 4216 Ubuntu 16.04 LTS 64-bit with/without AES-
NI (PAA)
Table 3 - Tested Platforms
Note: Per FIPS 140-2 IG G.5, the Cryptographic Module Validation Program (CMVP) makes no statement as to
the correct operation of the module or the security strengths of the generated keys when this module is ported
and executed in an operational environment not listed on the validation certificate.
1.2. Modes of Operation
The module supports two modes of operation:
• FIPS mode (the Approved mode of operation): only approved or allowed security functions with
sufficient security strength can be used.
• non-FIPS mode (the non-Approved mode of operation): only non-approved security functions can be
used.
The module enters FIPS mode after power-up tests succeed. Once the module is operational, the mode of
operation is implicitly assumed depending on the security function invoked and the security strength of the
cryptographic keys.
Critical security parameters used or stored in FIPS mode are not used in non-FIPS mode, and vice versa.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 10 of 55
2. Cryptographic Module Ports and Interfaces
As a software-only module, the module does not have physical ports. For the purpose of the FIPS 140-2
validation, the physical ports are interpreted to be the physical ports of the hardware platform on which it
runs.
The logical interfaces are the API through which applications request services, and the TLS protocol internal
state and messages sent and received from the TCP/IP protocol. The following table summarizes the four
logical interfaces:
FIPS Interface Physical Port Logical Interface
Data Input Ethernet ports API input parameters, kernel I/O – network
or files on file system, TLS protocol input
messages.
Data Output Ethernet ports API output parameters, kernel I/O – network
or files on file system, TLS protocol output
messages.
Control Input Keyboard, Serial port, Ethernet
port, Network
API function calls, API input parameters for
control, TLS protocol internal state.
Status Output Serial port, Ethernet port,
Network
API return codes, TLS protocol internal state.
Power Input PC Power Supply Port N/A
Table 4 - Ports and Interfaces
Note: The module is an implementation of the TLS protocol as defined in the RFC standards. The TLS protocol
provides confidentiality and data integrity between communicating applications. When an application calls into
the module’s API, the data passed will be securely passed to the peer.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 11 of 55
3. Roles, Services and Authentication
3.1. Roles
The module supports the following roles:
• User role: performs cryptographic services (in both FIPS mode and non-FIPS mode), TLS network
protocol, key zeroization, get status, and on-demand self-test.
• Crypto Officer role: performs module installation and initialization, and certificates management.
The User and Crypto Officer roles are implicitly assumed by the entity accessing the module services.
3.2. Services
The module provides services to users that assume one of the available roles. All services are shown in Table 5
and Table 6, and described in detail in the user documentation (i.e., man pages) referenced in section 9.1.
The table below shows the services available in FIPS mode. For each service, the associated cryptographic
algorithms, the roles to perform the service, and the cryptographic keys or Critical Security Parameters and
their access right are listed. If the services involve the use of the cryptographic algorithms, the corresponding
Cryptographic Algorithm Validation System (CAVS) certificate numbers of the cryptographic algorithms can be
found in Table 7, Table 8, Table 9 and Table 11 of this security policy. Notice that the algorithms mentioned in
the Network Protocol Services correspond to the same implementation of the algorithms described in the
Cryptographic Library Services.
Service Algorithms Role Access Keys/CSP
Cryptographic Library Services
Symmetric Encryption
and Decryption
AES User Read AES key
Triple-DES User Read Triple-DES key
RSA key generation RSA, DRBG User Create RSA public-private key
RSA digital signature
generation and
verification
RSA User Read RSA public-private key
DSA key generation DSA, DRBG User Create DSA public-private key
DSA domain parameter
generation
DSA User Read DSA domain parameters
DSA digital signature
generation and
verification
DSA User Read DSA public-private key
ECDSA key generation ECDSA, DRBG User Create ECDSA public-private key
ECDSA public key
validation
ECDSA User Read ECDSA public key
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 12 of 55
Service Algorithms Role Access Keys/CSP
ECDSA signature
generation and
verification
ECDSA User Read ECDSA public-private key
Random number
generation
DRBG User Read,
Update
Entropy input string, Internal
state
Message digest SHA-1, SHA-224,
SHA-256, SHA-384,
SHA-512
User n/a n/a
Message authentication
code (MAC)
HMAC User Read HMAC key
CMAC with AES User Read AES key
CMAC with Triple-DES User Read Triple-DES key
Key wrapping AES User Read AES key
Key encapsulation RSA User Read RSA public-private key
Diffie-Hellman Key
Agreement
KAS FFC User Create,
Read
Diffie-Hellman domain
parameters
EC Diffie-Hellman Key
Agreement
KAS ECC, ECC CDH
primitive
User Create,
Read
EC Diffie-Hellman public-
private keys
Network Protocols Services
Transport Layer Security
(TLS) network protocol
v1.0, v1.1 and v1.2
See Appendix A for the
complete list of
supported cipher suites.
User Read AES or Triple-DES key, RSA,
DSA or ECDSA public-private
key, HMAC Key, Shared
Secret, Diffie-Hellman domain
parameters or EC Diffie-
Hellman public-private keys
TLS extensions n/a User Read RSA, DSA or ECDSA public-
private key
Certificates management n/a Crypto
Officer
Read RSA, DSA or ECDSA public-
private key
Other FIPS-Related Services
Show status n/a User n/a None
Zeroization n/a User Zeroize All CSPs
Self-Tests AES, Triple-DES, SHS,
HMAC, DSA, RSA, ECDSA,
DRBG, Diffie-Hellman, EC
Diffie-Hellman, TLS KDF
User n/a None
Module installation n/a Crypto
Officer
n/a None
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 13 of 55
Service Algorithms Role Access Keys/CSP
Module initialization n/a Crypto
Officer
n/a None
Table 5 - Services in FIPS mode of operation
The table below lists the services only available in non-FIPS mode of operation.
Service Algorithms / Key sizes Role Access Keys/CSPs
Symmetric encryption and
decryption
2-key Triple-DES listed in
Table 12
User Read 2-key Triple-DES key
Authenticated Encryption cipher
for encryption and decryption
AES and SHA from multi-
buffer or stitch
implementation listed in
Table 12
User Read AES key, HMAC key
Asymmetric key generation using
keys disallowed by [SP800-131A]
RSA, DSA listed in Table 12 User Create RSA, DSA or ECDSA
public-private keys
Digital signature generation using
keys disallowed by [SP800-131A].
RSA, DSA listed in Table 12 User Read RSA or DSA public-
private keys
Key establishment using keys
disallowed by [SP800-131A].
Diffie-Hellman, RSA listed in
Table 12
User Read Diffie-Hellman domain
parameters or RSA
public-private keys
Message digest MD5 User n/a none
Message authentication code
(MAC) using keys disallowed by
[SP800-131A]
HMAC listed in Table 12,
CMAC with 2-key Triple-DES
User Read HMAC key, 2-key Triple-
DES key
X9.31 RSA Key Generation ANSI X9.31 RSA Key
Generation
User Create RSA public-private keys
Table 6 – Services in non-FIPS mode of operation
3.3. Algorithms
The algorithms implemented in the module are tested and validated by CAVP for the following operating
environment:
• Ubuntu 16.04 LTS 64-bit Little Endian running on POWER system
• Ubuntu 16.04 LTS 64-bit running on Intel® Xeon® processor
• Ubuntu 16.04 LTS 64-bit running on z system
The Ubuntu OpenSSL Cryptographic Module is compiled to use the support from the processor and assembly
code for AES, SHA and GHASH operations to enhance the performance of the module. Different
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 14 of 55
implementations can be invoked by setting the environment variable in the operational environment. Please
note that only one AES, SHA and/or GHASH implementation can be executed in runtime.
Notice that for the Transport Layer Security (TLS) protocol, no parts of this protocol, other than the key
derivation function (KDF), have been tested by the CAVP.
3.3.1. Ubuntu 16.04 LTS 64-bit Little Endian Running on POWER System
On the platform that runs POWER system, the module supports the use of Power ISA 2.07 and strict assembler
for AES, SHA and GHASH implementation, and the use of SSSE3 with Altivec for AES implementation. Each
implementation is determined by the environment variable OPENSSL_ppccap.
The following table shows the CAVS certificates and their associated information of the cryptographic
implementation in FIPS mode.
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict AES
assembler:
#4354
Using support
from POWER
ISA 2.07:
#4355
Using support
from SSSE3 with
Altivec:
#4356
AES [FIPS197],
[SP800-38A]
ECB, CBC, OFB,
CFB1, CFB8,
CFB128, CTR
128, 192, 256 Data Encryption and
Decryption
[SP800-38B] CMAC 128, 192, 256 MAC Generation and
Verification
[SP800-38C] CCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38E] XTS 128, 256 Data Encryption and
Decryption for Data
Storage
Strict AES
assembler:
#4354
AES [SP800-38F] KW 128, 192, 256 Key Wrapping and
Unwrapping
Strict SHA
assembler:
CVL #1054
Using support
from POWER
ISA 2.071
:
CVL #1057
ECC CDH
Primitive
[SP800-56A]
Section 5.7.1.2
n/a P-224, P-256,
P-384, P-521
K-233, K-283,
K-409, K-571
B-233, B-283,
B-409, B-571
EC Diffie-Hellman Key
Agreement
1 The module uses the support from Power ISA 2.07 for SHA-224, SHA-256, SHA-384 and SHA-512.
The SHA-1 is not supported.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 15 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict SHA
assembler:
CVL #1053
Using support
from POWER
ISA 2.071
:
CVL #1056
Partial EC
Diffie-
Hellman
[SP800-56A] ECC
Ephemeral
Unified scheme
P-224, P-256,
P-384, P-521
EC Diffie-Hellman Key
Agreement
Strict SHA
assembler:
CVL #1053
Using support
from POWER
ISA 2.071
:
CVL #1056
Partial Diffie-
Hellman
[SP800-56A] FCC
dhEphem
scheme
p=2048, q=224;
p=2048, q=256
Diffie-Hellman Key
Agreement
Strict SHA
assembler:
CVL #1055
Using support
from POWER
ISA 2.071
:
CVL #1058
TLS v1.0,
v1.1 and
v1.2 KDF
[SP800-
135rev1]
n/a n/a Key Derivation
Strict SHA
assembler:
#1156
Using support
from POWER
ISA 2.071
:
#1157
DSA [FIPS186-4] SHA-12
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
L=1024, N=1603
;
L=2048, N=224;
L=2048, N=256;
L=3072, N=256
Key Pair Generation,
Domain Parameter
Generation and
Verification, Digital
Signature Generation
and Verification
2 SHA-1 is only allowed and CAVS tested in DSA Domain Parameter Verification and DSA Signature
Verification for legacy use.
3 1024-bit key is only allowed and CAVS tested in DSA Domain Parameter Verification and DSA
Signature Verification for legacy use.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 16 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict SHA
assembler:
#1390
Using support
from POWER
ISA 2.071
:
#1391
DRBG [SP800-90A] Hash_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
n/a Deterministic Random
Bit Generation
HMAC_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
Strict AES
assembler:
#1390
CTR_DRBG:
AES-128,
AES-192,
AES-256
with/without
DF, without PR
Strict SHA
assembler:
#1031
Using support
from POWER
ISA 2.071
:
#1032
ECDSA [FIPS186-4] SHA-14
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
P-1925
, P-224,
P-256, P-384,
P-521,
K-1635
, K-233,
K-283, K-409,
K-571,
B-1635
, B-233,
B-283, B-409,
B-571
Key Pair Generation,
Public Key Verification,
Digital Signature
Generation and
Verification
4 SHA-1 is only allowed and CAVS tested in ECDSA Public Key Validation and ECDSA Signature
Verification for legacy use.
5 P-192, K-163 and B-163 curves are only allowed and CAVS tested in ECDSA Public Key Validation
and ECDSA Signature Verification for legacy use.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 17 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict SHA
assembler:
#2895
Using support
from POWER
ISA 2.071
:
#2896
HMAC [FIPS198-1] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
112 or greater Message
authentication code
Strict SHA
assembler:
#2351
Using support
from POWER
ISA 2.071
:
#2352
RSA [FIPS186-4] X9.31
SHA-16
,
SHA-256,
SHA-384,
SHA-512
10247
, 2048, 3072,
40968
Key Pair Generation,
Digital Signature
Generation and
Verification
PKCS#1v1.5
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
PSS
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
Strict SHA
assembler:
#3593
Using support
from POWER
ISA 2.071
:
#3594
SHS [FIPS180-4] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
n/a Message Digest
#2355 Triple-DES [SP800-67],
[SP800-38A]
ECB, CBC, CFB1,
CFB8, CFB64,
OFB
192 Data Encryption and
Decryption
6 SHA-1 is only allowed and CAVS tested in RSA Signature Verification for legacy use.
7 1024-bit key is only allowed and CAVS tested in RSA Signature Verification for legacy use.
8 4096-bit key is only CAVS tested for RSA Signature Generation.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 18 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
[SP800-67],
[SP800-38B]
CMAC 192 MAC Generation and
Verification
Table 7 – Cryptographic Algorithms for POWER system
3.3.2. Ubuntu 16.04 LTS 64-bit Running on Intel® Xeon®/Atom® Processor
On the platform that runs Intel Xeon or Intel Atom processor, the module supports the use of AES-NI, SSSE3
and strict assembler for AES implementation, the use of AVX2, SSSE3 and strict assembler for SHA
implementation, and the use of CLMUL instruction set and strict assembler for GHASH that is used for GCM
mode. Each implementation is determined by the environment variable OPENSSL_ia32cap.
The following table shows the CAVS certificates and their associated information of the cryptographic
implementation in FIPS mode.
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support from AES-NI
#4359
#C1499
#C1513
AES [FIPS197],
[SP800-38A]
ECB, CBC, OFB,
CFB1, CFB8,
CFB128, CTR
128, 192, 256 Data Encryption and
Decryption
[SP800-38B] CMAC 128, 192, 256 MAC Generation and
Verification
[SP800-38C] CCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38E] XTS 128, 256 Data Encryption and
Decryption for Data
Storage
Using support
from AES-NI and
CLMUL:
#4370
#C1500
#C1514
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 19 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support
from AES-NI and
strict GHASH
assembler:
#4371
#C1501
#C1516
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
Using strict AES assembler
#4360
#C1503
#C1520
AES [FIPS197],
[SP800-38A]
ECB, CBC, OFB,
CFB1, CFB8,
CFB128, CTR
128, 192, 256 Data Encryption and
Decryption
[SP800-38B] CMAC 128, 192, 256 MAC Generation and
Verification
[SP800-38C] CCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38E] XTS 128, 256 Data Encryption and
Decryption for Data
Storage
[SP800-38F] KW 128, 192, 256 Key Wrapping and
Unwrapping
Using strict
AES assembler
and support
from CLMUL:
#4372
#C1504
#C1519
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
Using strict
AES and GHASH
assembler:
#4373
#C1502
#C1518
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
Using support from SSSE3 for Bit Slice AES/Constant Time assembler
#4361
#C1509
#C1522
AES [FIPS197],
[SP800-38A]
ECB, CBC, OFB,
CFB1, CFB8,
CFB128, CTR
128, 192, 256 Data Encryption and
Decryption
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 20 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
[SP800-38B] CMAC 128, 192, 256 MAC Generation and
Verification
[SP800-38C] CCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38E] XTS 128, 256 Data Encryption and
Decryption for Data
Storage
Using support
from SSSE3 for
Bit Slice AES and
CLMUL:
#4374
#C1505
#C1521
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
Using support
from SSSE3 for
Bit Slice AES and
strict GHASH
assembler:
#4375
#C1510
#C1524
AES [SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
Other algorithms
Using support
from AVX2:
CVL #1065
#C1508
#C1523
Using support
from SSSE3:
CVL #1067
#C1511
#C1525
Strict SHA
assembler:
CVL #1069
#C1512
#C1526
ECC CDH
Primitive
[SP800-56A]
Section 5.7.1.2
n/a P-224, P-256,
P-384, P-521
K-233, K-283,
K-409, K-571
B-233, B-283,
B-409, B-571
EC Diffie-Hellman Key
Agreement
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 21 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support
from AVX2:
CVL #1065
#C1508
#C1523
Using support
from SSSE3:
CVL #1068
#C1511
#C1525
Strict SHA
assembler:
CVL #1069
#C1512
#C1526
Partial EC
Diffie-
Hellman
[SP800-56A] ECC
Ephemeral
Unified scheme
P-224, P-256,
P-384, P-521
EC Diffie-Hellman Key
Agreement
Using support
from AVX2:
CVL #1065
#C1508
#C1523
Using support
from SSSE3:
CVL #1067
#C1511
#C1525
Strict SHA
assembler:
CVL #1069
#C1512
#C1526
Partial Diffie-
Hellman
[SP800-56A] FCC
dhEphem
scheme
p=2048, q=224;
p=2048, q=256
Diffie-Hellman Key
Agreement
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 22 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support
from AVX2:
CVL #1066
#C1508
#C1523
Using support
from SSSE3:
CVL #1068
#C1511
#C1525
Strict SHA
assembler:
CVL #1070
#C1512
#C1526
TLS v1.0,
v1.1 and
v1.2 KDF
[SP800-
135rev1]
n/a n/a Key Derivation
Using support
from AVX2:
#1160
#C1508
#C1523
Using support
from SSSE3:
#1161
#C1511
#C1525
Strict SHA
assembler:
#1162
#C1512
#C1526
DSA [FIPS186-4] SHA-12
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
L=1024, N=1603
;
L=2048, N=224;
L=2048, N=256;
L=3072, N=256
Key Pair Generation,
Domain Parameter
Generation and
Verification, and
Digital Signature
Generation and
Verification
Using support
from AVX2:
#1395
#C1508
#C1523
Using support
DRBG [SP800-90A] Hash_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
n/a Deterministic Random
Bit Generation
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 23 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
from SSSE39
:
#1396
#C1511
#C1525
Strict SHA
assembler:
#1397
#C1512
#C1526
HMAC_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
Strict AES
assembler:
#1394
#C1503
#C1520
CTR_DRBG:
AES-128,
AES-192,
AES-256
with/without
DF, without PR
Using support
from AVX2:
#1035
#C1508
#C1523
Using support
from SSSE39
:
#1036
#C1511
#C1525
Strict SHA
assembler:
#1037
#C1512
#C1526
ECDSA [FIPS186-4] SHA-14
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
P-1925
, P-224,
P-256, P-384,
P-521,
K-1635
, K-233,
K-283, K-409,
K-571,
B-1635
, B-233,
B-283, B-409,
B-571
Key Pair Generation,
Public Key Verification,
Digital Signature
Generation and
Verification
9 The module only supports SHA-1, SHA-224 and SHA-256 when it uses the support of SSSE3.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 24 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support
from AVX2:
#2899
#C1508
#C1523
Using support
from SSSE39
:
#2900
#C1511
#C1525
Strict SHA
assembler:
#2901
#C1512
#C1526
HMAC [FIPS198-1] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
112 or greater Message
authentication code
Using support
from AVX2:
#2355
#C1508
#C1523
Using support
from SSSE39
:
#2356
#C1511
#C1525
Strict SHA
assembler:
#2357
#C1512
#C1526
RSA [FIPS186-4] X9.31
SHA-16
,
SHA-256,
SHA-384,
SHA-512
10247
, 2048, 3072,
40968
Key Pair Generation,
Digital Signature
Generation and
Verification
PKCS#1v1.5
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
PSS
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 25 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Using support
from AVX2:
#3597
#C1508
#C1523
Using support
from SSSE39
:
#3598
#C1511
#C1525
Strict SHA
assembler:
#3599
#C1512
#C1526
SHS [FIPS180-4] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
n/a Message Digest
#2357
#C1517
#C1527
Triple-DES [SP800-67],
[SP800-38A]
ECB, CBC, CFB1,
CFB8, CFB64,
OFB
192 Data Encryption and
Decryption
[SP800-67],
[SP800-38B]
CMAC 192 MAC Generation and
Verification
Table 8 – Cryptographic Algorithms for Intel® Xeon®/Atom® Processor10
3.3.3. Ubuntu 16.04 LTS 64-bit Running on z System
On the platform that runs z system, the module supports the use of CPACF or strict assembler for AES, SHA and
GHASH implementations. If the CPACF is available in the operational environment, the module uses the
support from the CPACF automatically; if CPACF is unavailable in the operational environment, the module uses
the strict assembler implemented in the module.
The following table shows the CAVS certificates and their associated information of the cryptographic
implementation in FIPS mode.
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
10 Not all algorithms and block chaining modes listed on the certificates are mentioned in this table
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 26 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict AES
assembler:
#4357
Using support
from CPACF:
#4358
AES [FIPS197],
[SP800-38A]
ECB, CBC, OFB,
CFB1, CFB8,
CFB128, CTR
128, 192, 256 Data Encryption and
Decryption
[SP800-38B] CMAC 128, 192, 256 MAC Generation and
Verification
[SP800-38C] CCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38D] GCM 128, 192, 256 Data Encryption and
Decryption
[SP800-38E] XTS 128, 256 Data Encryption and
Decryption for Data
Storage
[SP800-38F] KW 128, 192, 256 Key Wrapping and
Unwrapping
Strict SHA
assembler:
CVL #1060
Using support
from CPACF:
CVL #1063
ECC CDH
Primitive
[SP800-56A]
Section 5.7.1.2
n/a P-224, P-256,
P-384, P-521
K-233, K-283,
K-409, K-571
B-233, B-283,
B-409, B-571
EC Diffie-Hellman Key
Agreement
Strict SHA
assembler:
CVL #1059
Using support
from CPACF:
CVL #1063
Partial EC
Diffie-
Hellman
[SP800-56A] ECC
Ephemeral
Unified scheme
P-224, P-256,
P-384, P-521
EC Diffie-Hellman Key
Agreement
Strict SHA
assembler:
CVL #1059
Using support
from CPACF:
CVL #1062
Partial Diffie-
Hellman
[SP800-56A] FCC
dhEphem
scheme
p=2048, q=224;
p=2048, q=256
Diffie-Hellman Key
Agreement
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 27 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict SHA
assembler:
CVL #1061
Using support
from CPACF:
CVL #1064
TLS v1.0,
v1.1 and
v1.2 KDF
[SP800-
135rev1]
n/a n/a Key Derivation
Strict SHA
assembler:
#1158
Using support
from CPACF:
#1159
DSA [FIPS186-4] SHA-12
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
L=1024, N=1603
;
L=2048, N=224;
L=2048, N=256;
L=3072, N=256
Key Pair Generation,
Domain Parameter
Generation and
Verification, and
Digital Signature
Generation and
Verification
Strict SHA
assembler:
#1392
Using support
from CPACF:
#1393
DRBG [SP800-90A] Hash_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
n/a Deterministic Random
Bit Generation
HMAC_DRBG:
SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
without PR
Strict AES
assembler:
#1392
Using support
from CPACF:
#1393
CTR_DRBG:
AES-128,
AES-192,
AES-256
with/without
DF, without PR
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 28 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
Strict SHA
assembler:
#1033
Using support
from CPACF:
#1034
ECDSA [FIPS186-4] SHA-14
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
P-1925
, P-224,
P-256, P-384,
P-521,
K-1635
, K-233,
K-283, K-409,
K-571,
B-1635
, B-233,
B-283, B-409,
B-571
Key Pair Generation,
Public Key Verification,
Digital Signature
Generation and
Verification
Strict SHA
assembler:
#2897
Using support
from CPACF:
#2898
HMAC [FIPS198-1] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
112 or greater Message
authentication code
Strict SHA
assembler:
#2353
Using support
from CPACF:
#2354
RSA [FIPS186-4] X9.31
SHA-16
,
SHA-256,
SHA-384,
SHA-512
10247
, 2048, 3072,
40968
Key Pair Generation,
Digital Signature
Generation and
Verification
PKCS#1v1.5
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
PSS
SHA-16
,
SHA-224,
SHA-256,
SHA-384,
SHA-512
Strict SHA
assembler:
#3595
Using support
from CPACF:
#3596
SHS [FIPS180-4] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
n/a Message Digest
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 29 of 55
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
#2356 Triple-DES [SP800-67],
[SP800-38A]
ECB, CBC, CFB1,
CFB8, CFB64,
OFB
192 Data Encryption and
Decryption
[SP800-67],
[SP800-38B]
CMAC 192 MAC Generation and
Verification
Table 9 – Cryptographic Algorithms for z system
The CPACF provided by the IBM z system contains the completed AES and SHA implementations. The following
table shows the CAVS certificates and their associated information of the AES and SHA implementation tested
directly from the CPACF:
CAVP Cert Algorithm Standard Mode / Method Key Lengths,
Curves or Moduli
(in bits)
Use
#3958 AES [FIPS197],
[SP800-38A]
ECB, CBC, CTR 128, 192, 256 Data Encryption and
Decryption
#3196 SHS [FIPS180-4] SHA-1,
SHA-224,
SHA-256,
SHA-384,
SHA-512
n/a Message Digest
Table 10 – Cryptographic Algorithms from CPACF
3.3.4. Non-Approved Algorithms
The following table describes the non-Approved but allowed algorithms in FIPS mode:
Algorithm Caveat Use
RSA Key Encapsulation with Encryption
and Decryption Primitives and at least
2048 bits key size
Provides between 112 and 256
bits of encryption strength.
Key Establishment; allowed in
[FIPS140-2_IG] D.9
Diffie-Hellman with at least 2048 bit key
size
(CVL Certs. #1053, #1056, #1059, #1062,
#1065, #1067, #1069, #C1508, #C1511,
#C1512, #C1523, #C1525 and #C1526)
Provides between 112 and 256
bits of encryption strength.
Key Agreement; allowed in
[FIPS140-2_IG] D.8
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 30 of 55
Algorithm Caveat Use
EC Diffie-Hellman with P-224, P-256,
P-384, P-521 curves
(CVL Certs. #1053, #1054, #1056, #1057,
#1059, #1060, #1063, #1065, #1067,
#1068, #1069, #C1508, #C1511, #C1512,
#C1523, #C1525 and #C1526)
Provides between 112 and 256
bits of encryption strength.
Key Agreement; allowed in
[FIPS140-2_IG] D.8
RSA Key Generation and Digital
Signature Verification with at least 3072
bit key size, and Digital Signature
Generation with at least 4096 bits key
size
n/a Digital Signature; allowed in [SP800-
131A]
DSA Key Generation, Domain Parameter
Generation and Verification, Digital
Signature Generation and Verification
with at least 3072 bits key size
n/a Digital Signature; allowed in [SP800-
131A]
MD511
n/a Pseudo-random function (PRF) in
TLS v1.0 and v1.1; allowed in
[SP800-52]
SHA-1 used in the Digital Signature
Generation12
n/a Digital Signature Generation in TLS;
allowed in [SP800-52]
NDRNG n/a The module obtains the entropy
data from NDRNG to seed the
DRBG.
Table 11 – FIPS-Allowed Cryptographic Algorithms
The table below shows the non-Approved cryptographic algorithms implemented in the module that are only
available in non-FIPS mode.
Algorithm Use
RSA with key size greater than 1024 bits but smaller
than 2048 bits
Key Pair Generation, Digital Signature Generation,
Key Encapsulation
DSA with key size greater than 1024 bits but smaller
than 2048 bits
Key Pair Generation, Domain Parameters
Generation, Digital Signature Generation
11 According [SP800-52], MD5 is allowed to be used in TLS versions 1.0 and 1.1 as the hash
function used in the PRF, as defined in [RFC2246] and [RFC4346].
12 According [SP800-52], SHA-1 is disallowed for Key Pair Generation and Digital Signature
Generation, with the exception of digital signatures on ephemeral parameters in TLS.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 31 of 55
Diffie-Hellman with key size greater than 1024 bits but
smaller than 2048 bits
Key Agreement
MD5 Message Digest
HMAC with less than 112 bits key Message Authentication Code
2-key Triple-DES Data Encryption / Decryption
AES from multi-buffer AES-NI Authenticated Encryption cipher for Data Encryption
and Decryption
AES from AESNI-CBC+SHA-1 "stitch" implementation Authenticated Encryption cipher for Data Encryption
and Decryption
AES from AESNI-CBC+SHA-256 "stitch" implementation Authenticated Encryption cipher for Data Encryption
and Decryption
SHA-1 from AESNI-CBC+SHA-1 "stitch" implementation Authenticated Encryption cipher for Data Encryption
and Decryption
SHA-256 from AESNI-CBC+SHA-256 "stitch"
implementation
Authenticated Encryption cipher for Data Encryption
and Decryption
SHA-1 from multi-buffer SHA-1 Authenticated Encryption cipher for Data Encryption
and Decryption
SHA-256 from multi-buffer SHA-256 Authenticated Encryption cipher for Data Encryption
and Decryption
SHA-512 from multi-buffer SHA-512 Authenticated Encryption cipher for Data Encryption
and Decryption
ANSI X9.31 RSA Key Generation Key Pair Generation
SSLeay Deterministic Random Number Generator
(PRNG)
Random Number Generation
Table 12 - Non-Approved Cryptographic Algorithms
3.4. Operator Authentication
The module does not implement user authentication. The role of the user is implicitly assumed based on the
service requested.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 32 of 55
4. Physical Security
The module is comprised of software only and therefore this security policy does not make any claims on
physical security.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 33 of 55
5. Operational Environment
5.1. Applicability
The module operates in a modifiable operational environment per FIPS 140-2 level 1 specifications. The module
runs on a commercially available general-purpose operating system executing on the hardware specified in
Table 3 - Tested Platforms.
5.2. Policy
The operating system is restricted to a single operator; concurrent operators are explicitly excluded.
The application that requests cryptographic services is the single user of the module.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 34 of 55
6. Cryptographic Key Management
The following table summarizes the Critical Security Parameters (CSPs) that are used by the cryptographic
services implemented in the module:
Name Generation Entry and Output Zeroization
AES keys Not Applicable. The key
material may be generated
by the SP800-90A DRBG, or
generated during the Diffie-
Hellman or EC Diffie-
Hellman key agreement.
The key is passed into the
module via API input
parameters in plaintext.
EVP_CIPHER_CTX_cleanup()
Triple-DES keys EVP_CIPHER_CTX_cleanup()
HMAC key HMAC_CTX_cleanup()
RSA public-private
keys
The public-private keys are
generated using FIPS 86-4
Key Generation method,
and the random value used
in the key generation is
generated using SP800-90A
DRBG.
The key is passed into the
module via API input
parameters in plaintext.
The key is passed out of
the module via API output
parameters in plaintext.
RSA_free()
DSA public-private
keys
DSA_free()
ECDSA public-private
keys
EC_KEY_free()
Diffie-Hellman
domain parameters
The domain parameters
used in Diffie-Hellman and
the components to
generate the public-private
keys used in EC Diffie-
Hellman is generated using
SP800-90A DRBG.
The key is passed into the
module via API input
parameters in plaintext.
The key is passed out of
the module via API output
parameters in plaintext.
DH_free()
EC Diffie-Hellman
public-private keys
EC_KEY_free()
Shared secret Generated during the
Diffie-Hellman or EC Diffie-
Hellman key agreement.
None EC_KEY_free()
Entropy input string Obtained from NDRNG. None FIPS_drbg_free()
DRBG internal state
(V, C, Key)
During DRBG initialization. None FIPS_drbg_free()
Table 13 - Life cycle of Critical Security Parameters (CSP)
The following sections describe how CSPs, in particular cryptographic keys, are managed during its life cycle.
6.1. Random Number Generation
The module employs a Deterministic Random Bit Generator (DRBG) based on [SP800-90A] for the creation of
HMAC keys, key components of asymmetric keys, symmetric keys, server and client random numbers for the
TLS protocol, and internal CSPs. In addition, the module provides a Random Number Generation service to
calling applications.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 35 of 55
The DRBG supports the Hash_DRBG, HMAC_DRBG and CTR_DRBG mechanisms. The DRBG is initialized during
module initialization; the module loads by default the DRBG using the CTR_DRBG mechanism with AES-256 and
derivation function without prediction resistance. A different DRBG mechanism can be chosen through an API
function call.
The module uses a Non-Deterministic Random Number Generator (NDRNG), getrandom() system call, as the
entropy source for seeding the DRBG. The NDRNG is provided by the operational environment (i.e., Linux RNG),
which is within the module’s physical boundary but outside of the module’s logical boundary. The NDRNG
provides at least 128 bits of entropy to the DRBG during initialization (seed) and reseeding (reseed).
The module performs conditional self-tests on the output of NDRNG to ensure that consecutive random
numbers do not repeat, and performs DRBG health tests as defined in section 11.3 of [SP800-90A].
Note: According to Linux man pages [LMAN] random(4) and getrandom(2), the getrandom() system call is
prohibited until the Linux kernel has initialized its NDRNG during the kernel boot-up. This blocking behavior is
only observed during boot time. When defining systemd units using OpenSSL, the Crypto Officer should ensure
that these systemd units do not block the general systemd operation as otherwise the entire boot process may
be blocked based on the getrandom blocking behavior.
CAVEAT: The module generates cryptographic keys whose strengths are modified by available entropy.
6.2. Key Generation
For generating HMAC keys and symmetric keys, the module does not provide any dedicated key generation
service. However, the Random Number Generation service can be called by the user to obtain random
numbers which can be used as key material for symmetric algorithms or HMAC. The key material of HMAC keys
and symmetric keys may also be generated during the Diffie-Hellman or EC Diffie-Hellman key agreement.
For generating RSA, DSA and ECDSA keys, the module implements asymmetric key generation services
compliant with [FIPS186-4], and using DRBG compliant with [SP800-90A].
6.3. Key Agreement / Key Transport / Key Derivation
The module provides Diffie-Hellman and EC Diffie-Hellman key agreement schemes. These key agreement
schemes are also used as part of the TLS protocol key exchange.
The module also provides key wrapping using the AES with KW mode and RSA key encapsulation using private
key encryption and public key decryption primitives. RSA key encapsulation is also used as part of the TLS
protocol key exchange.
According to Table 2: Comparable strengths in [SP 800-57], the key sizes of AES, RSA, Diffie-Hellman and EC
Diffie-Hellman provides the following security strength in FIPS mode of operation:
• AES key wrapping provides between 128 and 256 bits of encryption strength.
• RSA key encapsulation provides between 112 and 256 bits of encryption strength.
• Diffie-Hellman key agreement provides between 112 and 256 bits of encryption strength.
• EC Diffie-Hellman key agreement provides between 112 and 256 bits of encryption strength.
The module supports key derivation for the TLS protocol. The module implements the pseudo-random
functions (PRF) for TLSv1.0/1.1 and TLSv1.2.
Note: As the module supports the size of RSA key pair and Diffie-Hellman domain parameters with 15360 bits
or more, the encryption strength 256 bits is claimed for RSA key encapsulations and Diffie-Hellman key
agreement.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 36 of 55
6.4. Key Entry / Output
The module does not support manual key entry or intermediate key generation key output. The keys are
provided to the module via API input parameters in plaintext form and output via API output parameters in
plaintext form. This is allowed by [FIPS140-2_IG] IG 7.7, according to the “CM Software to/from App Software
via GPC INT Path” entry on the Key Establishment Table.
6.5. Key / CSP Storage
Symmetric keys, HMAC keys, public and private keys are provided to the module by the calling application via
API input parameters, and are destroyed by the module when invoking the appropriate API function calls.
The module does not perform persistent storage of keys. The keys and CSPs are stored as plaintext in the RAM.
The only exception is the HMAC key used for the Integrity Test, which is stored in the module and relies on the
operating system for protection.
6.6. Key / CSP Zeroization
The memory occupied by keys is allocated by regular memory allocation operating system calls. The application
is responsible for calling the appropriate zeroization functions provided in the module's API listed in Table 13.
Calling the SSL_free() and SSL_clear() will zeroize the keys and CSPs stored in the TLS protocol internal state and
also invoke the module’s API listed in Table 13 automatically to zeroize the keys and CSPs. The zeroization
functions overwrite the memory occupied by keys with “zeros” and deallocate the memory with the regular
memory deallocation operating system call.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 37 of 55
7. Electromagnetic Interference/Electromagnetic Compatibility (EMI/EMC)
The test platforms listed in Table 3 - Tested Platforms have been tested and found to conform to the EMI/EMC
requirements specified by 47 Code of Federal Regulations, FCC PART 15, Subpart B, Unintentional Radiators,
Digital Devices, Class A (i.e., Business use). These devices are designed to provide reasonable protection against
harmful interference when the devices are operated in a commercial environment. They shall be installed and
used in accordance with the instruction manual.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 38 of 55
8. Self-Tests
FIPS 140-2 requires that the module perform power-up tests to ensure the integrity of the module and the
correctness of the cryptographic functionality at start up. In addition, some functions require continuous
testing of the cryptographic functionality, such as the asymmetric key generation. If any self-test fails, the
module returns an error code and enters the error state. No data output or cryptographic operations are
allowed in error state.
See section 9.2.7 for descriptions of possible self-test errors and recovery procedures.
8.1. Power-Up Tests
The module performs power-up tests when the module is loaded into memory, without operator intervention.
Power-up tests ensure that the module is not corrupted and that the cryptographic algorithms work as
expected.
While the module is executing the power-up tests, services are not available, and input and output are
inhibited. The module is not available for use by the calling application until the power-up tests are completed
successfully.
If any power-up test fails, the module returns the error code listed in Table 17 – Error Events, Error Codes and
Error Messages and displays the specific error message associated with the returned error code, and then
enters error state. The subsequent calls to the module will also fail - thus no further cryptographic operations
are possible. If the power-up tests complete successfully, the module will return 1 in the return code and will
accept cryptographic operation service requests.
8.1.1. Integrity Tests
The integrity of the module is verified by comparing an HMAC-SHA-256 value calculated at run time with the
HMAC value stored in the .hmac file that was computed at build time for each software component of the
module. If the HMAC values do not match, the test fails and the module enters the error state.
8.1.2. Cryptographic Algorithm Tests
The module performs self-tests on all FIPS-Approved cryptographic algorithms supported in the Approved
mode of operation, using the Known Answer Tests (KAT) and Pair-wise Consistency Tests (PCT) shown in the
following table:
Algorithm Power-Up Tests
AES • KAT AES ECB mode with 128-bit key, encryption
• KAT AES ECB mode with 128-bit key, decryption
Triple DES • KAT 3-key Triple-DES ECB mode, encryption
• KAT 3-key Triple-DES ECB mode, decryption
SHS • KAT SHA-1 and SHA-512
• KAT SHA-224 and SHA-384 are not required per IG 9.4
• KAT SHA-256 is covered in the Integrity Test which is allowed with IG 9.3
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 39 of 55
Algorithm Power-Up Tests
HMAC • KAT HMAC is covered in the Integrity Test which is allowed with IG 9.3 and 9.4
DSA • PCT DSA with L=2048, N=256 and SHA-256
ECDSA • PCT ECDSA with P-256 and SHA-256
• PCT ECDSA with K-233 and SHA-256
RSA • KAT RSA with 2048-bit key, PKCS#1 v1.5 scheme and SHA-256, signature
generation
• KAT RSA with 2048-bit key, PKCS#1 v1.5 scheme and SHA-256, signature
verification
DRBG • KAT Hash_DRBG without PR
• KAT HMAC_DRBG without PR
• KAT CTR_DRBG without PR, with DF
• KAT CTR_DRBG without PR, without DF
EC Diffie-Hellman • Primitive “Z” Computation KAT with P-256 curve
Diffie-Hellman • Primitive “Z” Computation KAT with 2048-bit key
TLS KDF • KAT KDF for TLSv1.0 and v1.1
• KAT KDF for TLSv1.2
Table 14- Self-Tests
For the KAT, the module calculates the result and compares it with the known value. If the answer does not
match the known answer, the KAT is failed and the module enters the Error state.
For the PCT, if the signature generation or verification fails, the module enters the Error state. As described in
section 3.3, only one AES or SHA implementation is available at run-time.
The KATs cover the different cryptographic implementations available in the operating environment.
8.2. On-Demand Self-Tests
On-Demand self-tests can be invoked by powering-off and reloading the module which cause the module to
run the power-up tests again. During the execution of the on-demand self-tests, services are not available and
no data output or input is possible.
8.3. Conditional Tests
The module performs conditional tests on the cryptographic algorithms, using the Pair-wise Consistency Tests
(PCT) and Continuous Random Number Generator Test (CRNGT), shown in the following table:
Algorithm Conditional Test
DSA key generation • PCT using SHA-256, signature generation and verification.
ECDSA key generation • PCT using SHA-256, signature generation and verification.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 40 of 55
Algorithm Conditional Test
RSA key generation • PCT using SHA-256, signature generation and verification.
• PCT for encryption and decryption.
DRBG • CRNGT is not required per IG 9.8
NDRNG • CRNGT
Table 15 - Conditional Tests
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 41 of 55
9. Guidance
9.1. Crypto Officer Guidance
The binaries of the module are contained in the Debian packages for delivery. The Crypto Officer shall follow
this Security Policy to configure the operational environment and install the module to be operated as a FIPS
140-2 validated module.
The following Debian packages contain the FIPS validated module:
Processor Architecture Debian packages
x86_64 libssl1.0.0_1.0.2g-1ubuntu4.fips.4.6.3_amd64.deb
libssl1.0.0-hmac_1.0.2g-1ubuntu4.fips.4.6.3_amd64.deb
Power system libssl1.0.0_1.0.2g-1ubuntu4.fips.4.6.3_ppc64el.deb
libssl1.0.0-hmac_1.0.2g-1ubuntu4.fips.4.6.3_ppc64el.deb
z System libssl1.0.0_1.0.2g-1ubuntu4.fips.4.6.3_s390x.deb
libssl1.0.0-hmac_1.0.2g-1ubuntu4.fips.4.6.3_s390x.deb
Table 16 – Debian packages
The libssl-doc_1.0.2g-1ubuntu4.fips.4.6.3_all.deb Debian package contains the man pages for the module.
Note: The prelink is not installed on Ubuntu, by default. For proper operation of the in-module integrity
verification, the prelink should be disabled.
9.1.1. Operating Environment Configurations
To configure the operating environment to support FIPS, the following shall be performed with the root
privilege:
(1) Install the linux-fips Debian package.
(2) Install the fips-initramfs Debian package. (Optional)
(3) For x86_64 and Power systems, create the file /etc/default/grub.d/99-fips.cfg with the content:
GRUB_CMDLINE_LINUX_DEFAULT=”$GRUB_CMDLINE_LINUX_DEFAULT fips=1”. For z system, edit
/etc/zipl.conf file and append the "fips=1" in the parameters line for the specified boot image.
(4) If /boot resides on a separate partition, the kernel parameter bootdev=UUID=<UUID of partition> must
also be appended in the aforementioned grub or zipl.conf file. Please see the following Note for more
details.
(5) Execute update-grub or zipl for z system to update the boot loader.
(6) Execute reboot to reboot the system with the new settings.
Now, the operating environment is configured to support FIPS operation. The Crypto Officer should check the
existence of the file, /proc/sys/crypto/fips_enabled, and that it contains “1”. If the file does not exist or does
not contain “1”, the operating environment is not configured to support FIPS and the module will not operate
as a FIPS validated module properly.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 42 of 55
Note: If /boot resides on a separate partition, the kernel parameter bootdev=UUID=<UUID of partition> must
be supplied. The partition can be identified with the command df /boot. For example:
$ df /boot
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sdb2 241965 127948 101525 56% /boot
The UUID of the /boot partition can be found by using the command grep /boot /etc/fstab. For example:
$ grep /boot /etc/fstab
# /boot was on /dev/sdb2 during installation
UUID=cec0abe7-14a6-4e72-83ba-b912468bbb38 /boot ext2 defaults 0 2
Then, the UUID shall be added in the /etc/default/grub. For example:
GRUB_CMDLINE_LINUX_DEFAULT="quiet bootdev=UUID=cec0abe7-14a6-4e72-83ba-b912468bbb38 fips=1"
9.1.2. Module Installation
Once the operating environment configuration is finished, the Crypto Officer can install the Debian packages
containing the module listed in Table 16 using normal packaging tool such as Advanced Package Tool (APT). All
the Debian packages are associated with hashes for integrity check. The integrity of the Debian package is
automatically verified by the packing tool during the installation of the module. The Crypto Officer shall not
install the Debian package if the integrity of the Debian package fails.
To download the FIPS validated version of the module, please contact the Canonical representative for the
repository path.
Once the module is installed successfully, a subsequent manual install/upgrade of the Debian packages (i.e.,
sudo apt install libssl1.0.0 libssl1.0.0-hmac) is prohibited. It could upgrade the FIPS validated module to latest
non-FIPS validated OpenSSL libraries, and this cannot be prevented by "holding" the Debian packages.
Note: During a system update, the installed FIPS validated module could get updated to a later non-FIPS
validated OpenSSL libraries. It is recommended to put a "hold" on the module's Debian packages (i.e.,
libssl1.0.0 and libssl1.0.0-hmac) to exclude the FIPS validated module from automatic system
updating/upgrading. The FIPS validated module will remain installed on the system after system update.
To hold the Debian package of the module,
$ sudo apt-mark hold libssl1.0.0 libssl1.0.0-hmac
To unhold the Debian packages of the module,
$ sudo apt-mark unhold libssl1.0.0 libssl1.0.0-hmac
9.2. User Guidance
In order to run in FIPS mode, the module must be operated using the FIPS Approved services, with their
corresponding FIPS Approved and FIPS allowed cryptographic algorithms provided in this Security Policy (see
section 3.2 Services). In addition, key sizes must comply with [SP800-131A].
9.2.1. TLS
The TLS protocol implementation provides both server and client sides. In order to operate in FIPS mode, digital
certificates used for server and client authentication shall comply with the restrictions of key size and message
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 43 of 55
digest algorithms imposed by [SP800-131A]. In addition, as required also by [SP800-131A], Diffie-Hellman with
keys smaller than 2048 bits must not be used.
The TLS protocol lacks the support to negotiate the used Diffie-Hellman key sizes. To ensure full support for all
TLS protocol versions, the TLS client implementation of the module accepts Diffie-Hellman key sizes smaller
than 2048 bits offered by the TLS server.
The TLS server implementation allows the application to set the Diffie-Hellman key size. The server side must
always set the DH parameters with the API call of SSL_CTX_set_tmp_dh(ctx, dh).
For complying with the requirement to not allow Diffie-Hellman key sizes smaller than 2048 bits, the Crypto
Officer must ensure that:
• in case the module is used as a TLS server, the Diffie-Hellman parameters of the aforementioned API
call must be 2048 bits or larger;
• in case the module is used as a TLS client, the TLS server must be configured to only offer Diffie-
Hellman keys of 2048 bits or larger.
9.2.2. AES GCM IV
In case the module’s power is lost and then restored, the key used for the AES GCM encryption or decryption
shall be redistributed.
The AES GCM IV generation is in compliance with the [RFC5288] and shall only be used for the TLS protocol
version 1.2 to be compliant with [FIPS140-2_IG] IG A.5, provision 1 (“TLS protocol IV generation”); thus, the
module is compliant with [SP800-52].
9.2.3. AES XTS
The AES algorithm in XTS mode can be only used for the cryptographic protection of data on storage devices, as
specified in [SP800-38E]. The length of a single data unit encrypted with the XTS-AES shall not exceed 2²⁰ AES
blocks that is 16MB of data. To meet the requirement in [FIPS140-2_IG] A.9, the module implements a check to
ensure that the two AES keys used in XTS-AES algorithm are not identical.
9.2.4. Random Number Generator
The RAND_cleanup() API function must not be used. This call will clean up the internal DRBG state. This call also
replaces the DRBG instance with the non-FIPS Approved SSLeay Deterministic Random Number Generator
when using the RAND_* API calls.
9.2.5. API Functions
Passing “0” to the FIPS_mode_set() API function is prohibited.
Executing the CRYPTO_set_mem_functions() API function is prohibited as it performs like a null operation in
the module.
9.2.6. Environment Variables
OPENSSL_ENFORCE_MODULUS_BITS
As described in [SP800-131A], less than 2048 bits of DSA and RSA key sizes are disallowed by NIST. Setting the
environment variable OPENSSL_ENFORCE_MODULUS_BITS can restrict the module to only generate the
acceptable key sizes of RSA and DSA. If the environment variable is set, the module can generate 2048 or 3072
bits of RSA key, and at least 2048 bits of DSA key.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 44 of 55
OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW
As described in [SP800-52], MD5 is allowed to be used in TLS versions 1.0 and 1.1 as the hash function used in
the PRF, as defined in [RFC2246] and [RFC4346]. By default, the module disables the MD5 algorithm. Setting
the environment variable OPENSSL_FIPS_NON_APPROVED_MD5_ALLOW can enable the MD5 algorithm in the
module. The MD5 algorithm shall not be used for other purposes other than the PRF in TLS version 1.0 and 1.1.
9.2.7. Handling FIPS Related Errors
When the module fails any self-test, the module will return an error code to indicate the error and enters error
state that any further cryptographic operation is inhibited. Errors occurred during the self-tests and conditional
tests transition the module into an error state. Here is the list of error codes when the module fails any self-
test, in error state or not supported in FIPS mode:
Error Events Error Codes/Messages
When the Integrity Test fails at the power-up FIPS_R_FINGERPRINT_DOES_NOT_MATCH (111)
“fingerprint does not match”
When the AES, TDES, SHA-1, SHA-512 KAT fails
at the power-up
FIPS_R_SELFTEST_FAILED (134)
“selftest failed”
When the KAT for RSA fails, or the PCT for
ECDSA or DSA fails at the power-up
FIPS_R_TEST_FAILURE (137)
“test failure”
When the KAT of DRBG fails at the power-up FIPS_R_NOPR_TEST1_FAILURE (145)
“nopr test1 failure”
When the KAT of Diffie-Hellman or EC Diffie-
Hellman fails at the power-up
0
When the new generated RSA, DSA or ECDSA
key pair fails the PCT
FIPS_R_PAIRWISE_TEST_FAILED (127)
“pairwise test failed”
When the CRNGT fails the output of the
NDRNG
FIPS_R_ENTROPY_SOURCE_STUCK (142)
“entropy source stuck”
When the SSLv2.0 or SSL v3.0 are called SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE (297)
“only tls allowed in fips mode”
When the module is in error state and any
cryptographic operation is called
FIPS_R_FIPS_SELFTEST_FAILED (115)
“fips selftest failed”
FIPS_R_SELFTEST_FAILED (134)
“selftest failed”
When the AES key and tweak keys for XTS-AES
are the same
FIPS_R_AES_XTS_WEAK_KEY (201)
“identical keys are weak”
Table 17 – Error Events, Error Codes and Error Messages
These errors are reported through the regular ERR interface of the modules and can be queried by functions
such as ERR_get_error(). See the OpenSSL man pages for the function description.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 45 of 55
When the module is in the error state and the application calls a crypto function of the module that cannot
return an error in normal circumstances (void return functions), the error message: “OpenSSL internal error,
assertion failed: FATAL FIPS SELFTEST FAILURE” is printed to stderr and the application is terminated with the
abort() call. The only way to recover from this error is to restart the application. If the failure persists, the
module must be reinstalled.
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 46 of 55
10. Mitigation of Other Attacks
10.1. Blinding Against RSA Timing Attacks
RSA is vulnerable to timing attacks. In a configuration where attackers can measure the time of RSA decryption
or signature operations, blinding must be used to protect the RSA operation from that attack.
The module provides the API functions RSA_blinding_on() and RSA_blinding_off() to turn the blinding on and
off for RSA. When the blinding is on, the module generates a random value to form a blinding factor in the RSA
key before the RSA key is used in the RSA cryptographic operations.
Please note that the DRBG must be seeded prior to calling RSA_blinding_on() to prevent the RSA Timing Attack.
10.2. Weak Triple-DES Keys Detection
The module implements the DES_set_key_checked() for checking the weak Triple-DES key and the correctness
of the parity bits when the Triple-DES key is going to be used in Triple-DES operations. The checking of the
weak Triple-DES key is implemented in the API function DES_is_weak_key() and the checking of the parity bits
is implemented in the API function DES_check_key_parity(). If the Triple-DES key does not pass the check, the
module will return -1 to indicate the parity check error and -2 if the Triple-DES key matches to any value listed
below:
static const DES_cblock weak_keys[NUM_WEAK_KEY] = {
/* weak keys */
{0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01},
{0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE},
{0x1F, 0x1F, 0x1F, 0x1F, 0x0E, 0x0E, 0x0E, 0x0E},
{0xE0, 0xE0, 0xE0, 0xE0, 0xF1, 0xF1, 0xF1, 0xF1},
/* semi-weak keys */
{0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE},
{0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01, 0xFE, 0x01},
{0x1F, 0xE0, 0x1F, 0xE0, 0x0E, 0xF1, 0x0E, 0xF1},
{0xE0, 0x1F, 0xE0, 0x1F, 0xF1, 0x0E, 0xF1, 0x0E},
{0x01, 0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1},
{0xE0, 0x01, 0xE0, 0x01, 0xF1, 0x01, 0xF1, 0x01},
{0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E, 0xFE},
{0xFE, 0x1F, 0xFE, 0x1F, 0xFE, 0x0E, 0xFE, 0x0E},
{0x01, 0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E},
{0x1F, 0x01, 0x1F, 0x01, 0x0E, 0x01, 0x0E, 0x01},
{0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1, 0xFE},
{0xFE, 0xE0, 0xFE, 0xE0, 0xFE, 0xF1, 0xFE, 0xF1}
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 47 of 55
};
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 48 of 55
Appendix A. TLS Cipher Suites
The module supports the following cipher suites for the TLS protocol. Each cipher suite defines the key
exchange algorithm, the bulk encryption algorithm (including the symmetric key size) and the MAC algorithm.
Cipher Suite Reference
TLS_RSA_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA RFC2246
TLS_RSA_WITH_AES_128_CBC_SHA RFC3268
TLS_DH_DSS_WITH_AES_128_CBC_SHA RFC3268
TLS_DH_RSA_WITH_AES_128_CBC_SHA RFC3268
TLS_DHE_DSS_WITH_AES_128_CBC_SHA RFC3268
TLS_DHE_RSA_WITH_AES_128_CBC_SHA RFC3268
TLS_DH_anon_WITH_AES_128_CBC_SHA RFC3268
TLS_RSA_WITH_AES_256_CBC_SHA RFC3268
TLS_DH_DSS_WITH_AES_256_CBC_SHA RFC3268
TLS_DH_RSA_WITH_AES_256_CBC_SHA RFC3268
TLS_DHE_DSS_WITH_AES_256_CBC_SHA RFC3268
TLS_DHE_RSA_WITH_AES_256_CBC_SHA RFC3268
TLS_DH_anon_WITH_AES_256_CBC_SHA RFC3268
TLS_RSA_WITH_AES_128_CBC_SHA256 RFC5246
TLS_RSA_WITH_AES_256_CBC_SHA256 RFC5246
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 RFC5246
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 RFC5246
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 RFC5246
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 RFC5246
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 RFC5246
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 RFC5246
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 RFC5246
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 49 of 55
Cipher Suite Reference
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 RFC5246
TLS_DH_anon_WITH_AES_128_CBC_SHA256 RFC5246
TLS_DH_anon_WITH_AES_256_CBC_SHA256 RFC5246
TLS_PSK_WITH_3DES_EDE_CBC_SHA RFC4279
TLS_PSK_WITH_AES_128_CBC_SHA RFC4279
TLS_PSK_WITH_AES_256_CBC_SHA RFC4279
TLS_RSA_WITH_AES_128_GCM_SHA256 RFC5288
TLS_RSA_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DH_RSA_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DH_RSA_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DH_DSS_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DH_DSS_WITH_AES_256_GCM_SHA384 RFC5288
TLS_DH_anon_WITH_AES_128_GCM_SHA256 RFC5288
TLS_DH_anon_WITH_AES_256_GCM_SHA384 RFC5288
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA RFC4492
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 50 of 55
Cipher Suite Reference
TLS_ECDH_anon_WITH_AES_128_CBC_SHA RFC4492
TLS_ECDH_anon_WITH_AES_256_CBC_SHA RFC4492
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 RFC5289
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 RFC5289
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 RFC5289
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 RFC5289
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 RFC5289
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 RFC5289
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 RFC5289
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 RFC5289
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 RFC5289
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 RFC5289
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 RFC5289
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 RFC5289
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 RFC5289
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 RFC5289
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 RFC5289
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 RFC5289
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 51 of 55
Appendix B. Glossary and Abbreviations
AES Advanced Encryption Standard
AES-NI Advanced Encryption Standard New Instructions
API Application Program Interface
APT Advanced Package Tool
CAVP Cryptographic Algorithm Validation Program
CAVS Cryptographic Algorithm Validation System
CBC Cipher Block Chaining
CCM Counter with Cipher Block Chaining-Message Authentication Code
CFB Cipher Feedback
CLMUL Carry-less Multiplication
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CPACF CP Assist for Cryptographic Function
CRNGT Continuous Random Number Generator Test
CSP Critical Security Parameter
CTR Counter Mode
DES Data Encryption Standard
DF Derivation Function
DSA Digital Signature Algorithm
DTLS Datagram Transport Layer Security
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECC Elliptic Curve Cryptography
EMI/EMC Electromagnetic Interference/Electromagnetic Compatibility
FCC Federal Communications Commission
FFC Finite Field Cryptography
FIPS Federal Information Processing Standards Publication
GCM Galois Counter Mode
GPC General Purpose Computer
HMAC Hash Message Authentication Code
IG Implementation Guidance
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 52 of 55
KAS Key Agreement Schema
KAT Known Answer Test
KDF Key Derivation Function
KW Key Wrap
LPAR Logical Partitions
MAC Message Authentication Code
NIST National Institute of Science and Technology
NDRNG Non-Deterministic Random Number Generator
OFB Output Feedback
PAA Processor Algorithm Acceleration
PAI Processor Algorithm Implementation
PCT Pair-wise Consistency Test
PR Prediction Resistance
PRNG Pseudo-Random Number Generator
PSS Probabilistic Signature Scheme
RSA Rivest, Shamir, Addleman
SHA Secure Hash Algorithm
SHS Secure Hash Standard
SSSE3 Supplemental Streaming SIMD Extensions 3
TLS Transport Layer Security
XTS XEX-based Tweaked-codebook mode with ciphertext Stealing
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 53 of 55
Appendix C. References
FIPS140-2 FIPS PUB 140-2 - Security Requirements For Cryptographic Modules
May 2001
http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf
FIPS140-2_IG Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation
Program
June 17, 2016
http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf
FIPS180-4 Secure Hash Standard (SHS)
March 2012
http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
FIPS186-4 Digital Signature Standard (DSS)
July 2013
http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
FIPS197 Advanced Encryption Standard
November 2001
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
FIPS198-1 The Keyed Hash Message Authentication Code (HMAC)
July 2008
http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
LMAN Linux Man Pages
http://man7.org/linux/man-pages/
PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1
February 2003
http://www.ietf.org/rfc/rfc3447.txt
RFC2246 The TLS Protocol Version 1.0
January 1999
https://www.ietf.org/rfc/rfc2246.txt
RFC4346 The Transport Layer Security (TLS) Protocol Version 1.1
April 2006
https://www.ietf.org/rfc/rfc4346.txt
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 54 of 55
RFC5246 The Transport Layer Security (TLS) Protocol Version 1.2
August 2008
https://tools.ietf.org/html/rfc5246.txt
RFC5288 AES Galois Counter Mode (GCM) Cipher Suites for TLS
August 2008
https://tools.ietf.org/html/rfc5288.txt
SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of Operation
Methods and Techniques
December 2001
http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of
Operation: The CMAC Mode for Authentication
May 2005
http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of
Operation: the CCM Mode for Authentication and Confidentiality
May 2004
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
SP800-38D NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of
Operation: Galois/Counter Mode (GCM) and GMAC
November 2007
http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
SP800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of
Operation: The XTS AES Mode for Confidentiality on Storage Devices
January 2010
http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf
SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of
Operation: Methods for Key Wrapping
December 2012
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
SP800-52 NIST Special Publication 800-52 Revision 1 - Guidelines for the Selection, Configuration,
and Use of Transport Layer Security (TLS) Implementations
April 2014
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf
SP800-56A NIST Special Publication 800-56A - Recommendation for Pair-Wise Key Establishment
Schemes Using Discrete Logarithm Cryptography (Revised)
March, 2007
http://csrc.nist.gov/publications/nistpubs/800-56A/SP800-56A_Revision1_Mar08-2007.pdf
OpenSSL Cryptographic Module FIPS 140-2 Non-Proprietary Security Policy
© 2020 Canonical Ltd. / atsec information security
This document can be reproduced and distributed only whole and intact, including this copyright notice. 55 of 55
SP800-57 NIST Special Publication 800-57 Part 1 Revision 4 - Recommendation for Key
Management Part 1: General
January 2016
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
SP800-67 NIST Special Publication 800-67 Revision 1 - Recommendation for the Triple Data
Encryption Algorithm (TDEA) Block Cipher
January 2012
http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf
SP800-90A NIST Special Publication 800-90A - Revision 1 - Recommendation for Random Number
Generation Using Deterministic Random Bit Generators
June 2015
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
SP800-131A NIST Special Publication 800-131A Revision 1- Transitions: Recommendation for
Transitioning the Use of Cryptographic Algorithms and Key Lengths
November 2015
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf
SP800-135rev1 NIST Special Publication 800-135 Revision 1 - Recommendation for Existing Application-
Specific Key Derivation Functions
December 2011
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf