This page was not yet optimized for use on mobile devices.
Cisco FTD FX-OS on 4K/9K Cryptographic Module
Certificate details
| Certificate ID | #5551 |
|---|---|
| Status | active |
| Validation dates | 15.10.2026 |
| Sunset date | 14-10-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode; The tamper evident seals and Physical Kit installed as indicated in the Security Policy; This module contains the embedded module [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module] validated to FIPS 140-3 under Cert. #5456 operating in approved mode. |
| Exceptions |
|
| Description | Cisco FTD FX-OS on 4K/9K Cryptographic Module is an integrated network security system providing enterprise-class firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications, HTTPS/TLSv1.2, SSHv2, IPsec/IKEv2, SNMPv3 and Cryptographic Cipher Suite B. |
| Vendor | Cisco Systems, Inc. http://www.cisco.com |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 1 certificates, transitively this expands into 1 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-, AES-128, AES-192, AES-256, AES, CAST, 3DES, HMACAsymmetric Algorithms
RSA 2048, ECDH, ECDHE, ECDSA, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA3-256Schemes
MACProtocols
SSH, SSHv2, TLS v1.2, TLSv1.2, TLSv1.3, TLS, IKEv2, IKE, IPsec, VPNRandomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, secp256r1, secp384r1, secp521r1Block cipher modes
CBC, GCMTrusted Execution Environments
PSP, SSCVendor
Cisco Systems, Inc, Cisco, Cisco SystemsSecurity level
Level 2Certification process
out of scope, fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation, Table 2 above. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configureStandards
FIPS 140-3, FIPS18, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS186-4, SP 800-140, SP 800-52, PKCS 1, RFC762, RFC 5647, RFC 5288, RFC 7296, RFC 4419, RFC 7919, RFC 3526, RFC 4492, RFC 5903, RFC7627, ISO/IEC 19790Cross-references
Outgoing- 5456 - active - Cisco Firepower Threat Defense on 4K/9K Cryptographic Module
Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
Loading...
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5551,
"dgst": "5e4e7b5040b933b5",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-384C1026",
"SHA2-384C1026",
"RSA SigGen (FIPS186-4)A4446",
"HMAC-SHA-1C1026",
"Safe Primes Key GenerationA4446",
"KDF SNMPA4446",
"KDF IKEv2A4446",
"HMAC-SHA2-224A4446",
"ECDSA SigGen (FIPS186-4)A4446",
"KDF SSHA4446",
"AES-CBCC1026",
"Counter DRBGA4446",
"SHA2-256C1026",
"SHA2-512C1026",
"HMAC-SHA2-512C1026",
"ECDSA KeyGen (FIPS186-4)A4446",
"KAS-ECC-SSC Sp800-56Ar3A4446",
"SHA-1C1026",
"SHA2-224A4446",
"#46",
"RSA KeyGen (FIPS186-4)A4446",
"#A44",
"ECDSA SigVer (FIPS186-4)A4446",
"KAS-FFC-SSC Sp800-56Ar3A4446",
"AES-GCMC1026",
"HMAC-SHA2-256C1026",
"RSA SigVer (FIPS186-4)A4446",
"TLS v1.2 KDF RFC7627A4446"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": {
"_type": "Set",
"elements": [
"5456"
]
},
"indirectly_referenced_by": null,
"indirectly_referencing": {
"_type": "Set",
"elements": [
"5456"
]
}
},
"module_prunned_references": {
"_type": "Set",
"elements": [
"5456"
]
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": {
"_type": "Set",
"elements": [
"5456"
]
},
"indirectly_referenced_by": null,
"indirectly_referencing": {
"_type": "Set",
"elements": [
"5456"
]
}
},
"policy_prunned_references": {
"_type": "Set",
"elements": [
"5456"
]
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES- CBC",
"cavpCertName": "A44 46",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES- GCM",
"cavpCertName": "A44 46",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A44 46",
"properties": "Prediction Resistance - Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 128-256 Increment 128, Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0- 256 Increment 256 Returned Bits - 256",
"reference": "SP 800- 90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "(FIPS18 6-4)",
"cavpCertName": "",
"properties": "",
"reference": ""
},
{
"algorithm": "ECDSA SigVer (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC- SHA-1",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 224",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 256",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 384",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 512",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS- ECC- SSC Sp800- 56Ar3",
"cavpCertName": "A44 46",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "KAS- FFC- SSC Sp800- 56Ar3",
"cavpCertName": "A44 46",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A44 46",
"properties": "Initiator Nonce Length - Initiator Nonce Length: 2048 Responder Nonce Length - Responder Nonce Length: 2048 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A44 46",
"properties": "Password Length - Password Length: 256, 64 Engine ID - 000002b87766554433221100, 800002B805123456789ABCDEF0123456789ABCDEF01234567 89ABCDEF0123456",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A44 46",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "RSA KeyGen",
"cavpCertName": "A44 46",
"properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "(FIPS18 6-4)",
"cavpCertName": "",
"properties": "Hash Algorithm - SHA2-256 Info Generated By Server - Yes Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard",
"reference": ""
},
{
"algorithm": "RSA SigGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generat ion",
"cavpCertName": "A44 46",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp- 2048, modp-3072, modp-4096",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 224",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 256",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 384",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 512",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC762 7 (CVL)",
"cavpCertName": "A44 46",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "AES- CBC",
"cavpCertName": "A44 46",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES- CBC",
"cavpCertName": "C10 26",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES- GCM",
"cavpCertName": "A44 46",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38D"
},
{
"algorithm": "AES- GCM",
"cavpCertName": "C10 26",
"properties": "Key Length - 128, 256",
"reference": "SP 800- 38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A44 46",
"properties": "Prediction Resistance - Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 128-256 Increment 128, Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0- 256 Increment 256 Returned Bits - 256",
"reference": "SP 800- 90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC- SHA-1",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA-1",
"cavpCertName": "C10 26",
"properties": "MAC - MAC: 160 Key sizes \u003c block size - Yes Key size = block size - Yes Key sizes \u003e block size - Yes",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 224",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 256",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 256",
"cavpCertName": "C10 26",
"properties": "MAC - MAC: 256 Key sizes \u003c block size - Yes Key size = block size - Yes Key sizes \u003e block size - Yes",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 384",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 384",
"cavpCertName": "C10 26",
"properties": "MAC - MAC: 384 Key sizes \u003c block size - Yes Key sizes \u003e block size - Yes Key size = block size - Yes",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 512",
"cavpCertName": "A44 46",
"properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC- SHA2- 512",
"cavpCertName": "C10 26",
"properties": "MAC - MAC: 512 Key sizes \u003c block size - Yes Key size = block size - Yes Key sizes \u003e block size - Yes",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS- ECC- SSC Sp800- 56Ar3",
"cavpCertName": "A44 46",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "KAS- FFC- SSC Sp800- 56Ar3",
"cavpCertName": "A44 46",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A44 46",
"properties": "Initiator Nonce Length - Initiator Nonce Length: 2048 Responder Nonce Length - Responder Nonce Length: 2048 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A44 46",
"properties": "Password Length - Password Length: 256, 64 Engine ID - 000002b87766554433221100, 800002B805123456789ABCDEF0123456789ABCDEF01234567 89ABCDEF0123456",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A44 46",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800- 135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096 Hash Algorithm - SHA2-256 Info Generated By Server - Yes Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS18 6-4)",
"cavpCertName": "A44 46",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generat ion",
"cavpCertName": "A44 46",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp- 2048, modp-3072, modp-4096",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "C10 26",
"properties": "Message Length - Message Length: 0-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 224",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 256",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 256",
"cavpCertName": "C10 26",
"properties": "Message Length - Message Length: 0-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 384",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 384",
"cavpCertName": "C10 26",
"properties": "Message Length - Message Length: 0-102400 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 512",
"cavpCertName": "A44 46",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2- 512",
"cavpCertName": "C10 26",
"properties": "Message Length - Message Length: 0-102400 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC762 7 (CVL)",
"cavpCertName": "A44 46",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
"reference": "SP 800- 135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provide Module\u0027s current status (return codes and/or syslog messages )",
"indicator": "N/A",
"inputs": "Command used to show Module\u0027s Status",
"name": "Show Status",
"outputs": "Module\u0027s Operation al Status",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Provide FTD-CM Module\u0027s current status (return codes and/or syslog messages )",
"indicator": "N/A",
"inputs": "Command used to show Module\u0027s Status",
"name": "[FTD-CM] Show Status",
"outputs": "Module\u0027s Operation al Status",
"rolesSspAccess": "[FTD-CM] Crypto Officer [FTD-CM] User",
"secFunImpl": "None"
},
{
"description": "Provide Module\u0027s name and version informatio n",
"indicator": "N/A",
"inputs": "Command to show version",
"name": "Show Version",
"outputs": "Module\u0027s ID and versioning informatio n",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Provide FTD-CM Module\u0027s name and version informatio n",
"indicator": "N/A",
"inputs": "Command to show version",
"name": "[FTD-CM] Show Version",
"outputs": "Module\u0027s ID and versioning informatio n",
"rolesSspAccess": "[FTD-CM] Crypto Officer [FTD-CM] User",
"secFunImpl": "None"
},
{
"description": "Perform Self-Tests (Pre- operation al self-test and Condition al Self- Tests)",
"indicator": "N/A",
"inputs": "Command to trigger Self-Test",
"name": "Perform Self-Tests",
"outputs": "Status of the self- tests results",
"rolesSspAccess": "Crypto Officer User Unauthentic ated",
"secFunImpl": "None"
},
{
"description": "Perform FTD-CM Self-Tests",
"indicator": "N/A",
"inputs": "Command to trigger Self-Test",
"name": "[FTD-CM] Perform Self-Tests",
"outputs": "Status of the self-",
"rolesSspAccess": "[FTD-CM] Crypto Officer",
"secFunImpl": "None"
},
{
"description": "(Pre- operation al self-test and Condition al Self- Tests)",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "tests results",
"rolesSspAccess": "[FTD-CM] User Unauthentic ated",
"secFunImpl": ""
},
{
"description": "Perform Zeroizatio n",
"indicator": "N/A",
"inputs": "Command to zeroize the module",
"name": "Perform Zeroizatio n",
"outputs": "Status of the SSPs zeroizatio n",
"rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State V value: Z - DRBG Key: Z - User Password: Z - Crypto Officer Password: Z - Firmware Load Test Key: Z - SSH DH Private Key: Z - SSH DH Public Key: Z - SSH Peer DH Public Key: Z - SSH DH Shared Secret: Z - SSH ECDH Private Key: Z - SSH ECDH",
"secFunImpl": "None"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: Z - SSH Peer ECDH Public Key: Z - SSH ECDH Shared Secret: Z - SSH RSA Private Key: Z - SSH RSA Public Key: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authenticati on Key: Z - TLS DH Private Key: Z - TLS DH Public Key: Z - TLS Peer DH Public Key: Z - TLS DH Shared Secret: Z - TLS ECDH Private Key: Z",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z - TLS ECDSA Private Key: Z - TLS ECDSA Public Key: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authenticati on Key: Z - IPSec/IKE DH Private Key: Z - IPSec/IKE DH Public Key: Z - IPSec/IKE Peer DH Public Key: Z - IPSec/IKE",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "DH Shared Secret: Z - IPSec/IKE ECDH Private Key: Z - IPSec/IKE ECDH Public Key: Z - IPSec/IKE Peer ECDH Public Key: Z - IPSec/IKE ECDH Shared Secret: Z - IPSec/IKE ECDSA Private Key: Z - IPSec/IKE ECDSA Public Key: Z - IPSec/IKE RSA Private Key: Z - IPSec/IKE RSA Public Key: Z - IPSec/IKE Pre-shared Secret: Z - SKEYSEED : Z - IPSec/IKE Session Encryption Key: Z - IPSec/IKE Authenticati on Key: Z - SNMPv3 Shared",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticati on Key: Z",
"secFunImpl": ""
},
{
"description": "Perform Zeroizatio n on FTD- CM",
"indicator": "N/A",
"inputs": "Command to zeroize the module",
"name": "[FTD-CM] Perform Zeroizatio n",
"outputs": "Status of the SSPs zeroizatio n",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] DRBG Entropy Input: Z - [FTD-CM] DRBG Seed: Z - [FTD-CM] DRBG Internal State V value: Z - [FTD-CM] DRBG Key: Z - [FTD-CM] User Password: Z - [FTD-CM] Crypto Officer Password: Z - [FTD-CM] Firmware Load Test Key: Z - [FTD-CM] SSH DH Private Key: Z - [FTD-CM] SSH DH Public Key: Z - [FTD-CM] SSH Peer",
"secFunImpl": "None"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "DH Public Key: Z - [FTD-CM] SSH DH Shared Secret: Z - [FTD-CM] SSH ECDH Private Key: Z - [FTD-CM] SSH ECDH Public Key: Z - [FTD-CM] SSH Peer ECDH Public Key: Z - [FTD-CM] SSH ECDH Shared Secret: Z - [FTD-CM] SSH RSA Private Key: Z - [FTD-CM] SSH RSA Public Key: Z - [FTD-CM] SSH ECDSA Private Key: Z - [FTD-CM] SSH ECDSA Public Key: Z - [FTD-CM] SSH Session Encryption Key: Z - [FTD-CM] SSH",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Session Authenticati on Key: Z - [FTD-CM] TLS DH Private Key: Z - [FTD-CM] TLS DH Public Key: Z - [FTD-CM] TLS Peer DH Public Key: Z - [FTD-CM] TLS DH Shared Secret: Z - [FTD-CM] TLS ECDH Private Key: Z - [FTD-CM] TLS ECDH Public Key: Z - [FTD-CM] TLS Peer ECDH Public Key: Z - [FTD-CM] TLS ECDH Shared Secret: Z - [FTD-CM] TLS ECDSA Private Key: Z - [FTD-CM] TLS ECDSA Public Key: Z - [FTD-CM] TLS RSA",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: Z - [FTD-CM] TLS RSA Public Key: Z - [FTD-CM] TLS Master Secret: Z - [FTD-CM] TLS Session Encryption Key: Z - [FTD-CM] TLS Session Authenticati on Key: Z - [FTD-CM] IPSec/IKE DH Private Key: Z - [FTD-CM] IPSec/IKE DH Public Key: Z - [FTD-CM] IPSec/IKE Peer DH Public Key: Z - [FTD-CM] IPSec/IKE DH Shared Secret: Z - [FTD-CM] IPSec/IKE ECDH Private Key: Z - [FTD-CM] IPSec/IKE ECDH Public Key: Z - [FTD-CM] IPSec/IKE",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Peer ECDH Public Key: Z - [FTD-CM] IPSec/IKE ECDH Shared Secret: Z - [FTD-CM] IPSec/IKE ECDSA Private Key: Z - [FTD-CM] IPSec/IKE ECDSA Public Key: Z - [FTD-CM] IPSec/IKE RSA Private Key: Z - [FTD-CM] IPSec/IKE RSA Public Key: Z - [FTD-CM] IPSec/IKE Pre-shared Secret: Z - [FTD-CM] SKEYSEED : Z - [FTD-CM] IPSec/IKE Session Encryption Key: Z - [FTD-CM] IPSec/IKE Authenticati on Key: Z - [FTD-CM] SNMPv3 Shared Secret: Z - [FTD-CM]",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "SNMPv3 Encryption Key: Z - [FTD-CM] SNMPv3 Authenticati on Key: Z",
"secFunImpl": ""
},
{
"description": "Sets configurati on of the systems",
"indicator": "N/A",
"inputs": "Command s to configure the network",
"name": "Configure Network",
"outputs": "Status of the completio n of network configurati on status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Sets configurati on of the FTD-CM systems",
"indicator": "N/A",
"inputs": "Command s to configure the network",
"name": "[FTD-CM] Configure Network",
"outputs": "Status of the completio n of network configurati on status",
"rolesSspAccess": "[FTD-CM] Crypto Officer",
"secFunImpl": "None"
},
{
"description": "CO Role Authentic ation",
"indicator": "N/A",
"inputs": "CO Authentic ation Request",
"name": "Crypto Officer Authentic ation",
"outputs": "Status of the CO authentica tion",
"rolesSspAccess": "Crypto Officer - Crypto Officer Password: W,Z",
"secFunImpl": "None"
},
{
"description": "FTD-CM CO Role Authentic ation",
"indicator": "N/A",
"inputs": "CO Authentic ation Request",
"name": "[FTD-CM] Crypto Officer Authentic ation",
"outputs": "Status of the CO authentica tion",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] Crypto Officer Password: W,Z",
"secFunImpl": "None"
},
{
"description": "User Role Authentic ation",
"indicator": "N/A",
"inputs": "User role authentica tion request",
"name": "User Authentic ation",
"outputs": "Status of the User role authentica tion",
"rolesSspAccess": "User - User Password: W,Z",
"secFunImpl": "None"
},
{
"description": "FTD-CM User Role Authentic ation",
"indicator": "N/A",
"inputs": "User role authentica tion request",
"name": "[FTD-CM] User Authentic ation",
"outputs": "Status of the User role authentica tion",
"rolesSspAccess": "[FTD-CM] User - [FTD-CM] User Password: W,Z",
"secFunImpl": "None"
},
{
"description": "Configure SSHv2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SSHv2 configura tion success status message",
"inputs": "Command s to configure SSHv2",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completio n of the SSHv2 configurati on",
"rolesSspAccess": "Crypto Officer - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function"
},
{
"description": "Configure FTD-CM SSHv2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SSHv2 configura tion success status message",
"inputs": "Command s to configure SSHv2",
"name": "[FTD-CM] Configure SSHv2 Function",
"outputs": "Status of the completio n of the SSHv2 configurati on",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM] SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E",
"secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E",
"secFunImpl": "KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function"
},
{
"description": "Configure HTTPS over TLSv1.2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and HTTPS over TLSv1.2 configura tion success status message",
"inputs": "Command s to configure TLSv1.2",
"name": "Configure HTTPS over TLSv1.2 Function",
"outputs": "Status of the completio n of TLSv1.2 configurati on",
"rolesSspAccess": "Crypto Officer - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function"
},
{
"description": "Configure FTD-CM HTTPS over TLSv1.2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin",
"inputs": "Command s to configure TLSv1.2",
"name": "[FTD-CM] Configure HTTPS over TLSv1.2 Function",
"outputs": "Status of the completio n of TLSv1.2",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] TLS ECDSA",
"secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "State: Enabled\" and HTTPS over TLSv1.2 configura tion success status message",
"inputs": "",
"name": "",
"outputs": "configurati on",
"rolesSspAccess": "Access Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E",
"secFunImpl": "AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function"
},
{
"description": "Configure IPSec/IKE v2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" with IPsec/IK Ev2 configura tion success status message",
"inputs": "Command s to configure IPsec/IKE v2",
"name": "Configure IPsec/IKE v2 Function",
"outputs": "Status of the completio n of IPsec/IKE v2 configurati on",
"rolesSspAccess": "Crypto Officer - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Pre-shared Secret: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E",
"secFunImpl": "IKEv2) DRBG Function"
},
{
"description": "Configure FTD-CM IPSec/IKE v2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" with IPsec/IK Ev2 configura tion success status message",
"inputs": "Command s to configure IPsec/IKE v2",
"name": "[FTD-CM] Configure IPsec/IKE v2 Function",
"outputs": "Status of the completio n of IPsec/IKE v2 configurati on",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key: W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM] IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG",
"secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Internal State V value: W,E - [FTD-CM] DRBG Key: W,E",
"secFunImpl": ""
},
{
"description": "Configure SNMPv3 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SNMPv3 configura tion success status message",
"inputs": "Command s to configure SNMPv3",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completio n of SNMPv3 configurati on",
"rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)"
},
{
"description": "Configure FTD-CM SNMPv3 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SNMPv3 configura tion success status message",
"inputs": "Command s to configure SNMPv3",
"name": "[FTD-CM] Configure SNMPv3 Function",
"outputs": "Status of the completio n of SNMPv3 configurati on",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key:",
"secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM)"
},
{
"description": "Execute SSHv2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SSHv2",
"inputs": "Initiate SSHv2 tunnel establish ment",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 tunnel establish ment",
"rolesSspAccess": "W,E Crypto Officer - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E",
"secFunImpl": "KAS-ECC (SSHv2) KAS-FFC (SSHv2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA SigGen (SSHv2,"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH DH Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG",
"secFunImpl": "Functions TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (SSHv2) Session Authentication (SSHv2) SSHv2 Keying Materials Development DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Internal State V value: W,E - DRBG Key: W,E User - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E",
"secFunImpl": ""
},
{
"description": "Execute FTD-CM SSHv2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SSHv2 log message",
"inputs": "Initiate SSHv2 tunnel establish ment",
"name": "[FTD-CM] Run SSHv2 Function",
"outputs": "Status of SSHv2 tunnel establish ment",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SSH DH Private Key: W,E - [FTD-CM] SSH DH Public Key: W,E - [FTD-CM] SSH Peer DH Public Key: W,E - [FTD-CM] SSH DH Shared Secret: W,E - [FTD-CM] SSH ECDH Private Key: W,E - [FTD-CM] SSH ECDH Public Key: W,E - [FTD-CM]",
"secFunImpl": "[FTD-CM] KAS- ECC (SSHv2) [FTD-CM] KAS- FFC (SSHv2) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA SigGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] ECDSA SigVer (SSHv2,"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access SSH Peer ECDH Public Key: W,E - [FTD-CM] SSH ECDH Shared Secret: W,E - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM] SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E - [FTD-CM] SSH Session Encryption Key: W,E - [FTD-CM] SSH Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V",
"secFunImpl": "TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (SSHv2) [FTD-CM] Session Authentication (SSHv2) [FTD-CM] SSHv2 Keying Materials Development [FTD-CM] DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] SSH DH Private Key: W,E - [FTD-CM] SSH DH Public Key: W,E - [FTD-CM] SSH Peer DH Public Key: W,E - [FTD-CM] SSH DH Shared Secret: W,E - [FTD-CM] SSH ECDH Private Key: W,E - [FTD-CM] SSH ECDH Public Key: W,E - [FTD-CM] SSH Peer ECDH Public Key: W,E - [FTD-CM] SSH ECDH Shared Secret: W,E - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM]",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E - [FTD-CM] SSH Session Encryption Key: W,E - [FTD-CM] SSH Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key:",
"secFunImpl": "Functions"
},
{
"description": "Execute HTTPS over TLSv1.2 function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul HTTPS over",
"inputs": "Initiate TLSv1.2 tunnel establish ment request",
"name": "Run HTTPS over TLSv1.2 Function",
"outputs": "Status of TLSv1.2 tunnel establish ment",
"rolesSspAccess": "W,E Crypto Officer - TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared",
"secFunImpl": "KAS-ECC (TLSv1.2) KAS-FFC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2)"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "on",
"indicator": "TLSv1.2 log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - TLS Master Secret: W,E - TLS Session Encryption Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E",
"secFunImpl": "ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (TLSv1.2) Session Authentication (TLSv1.2) TLSv1.2 Keying Materials Development DRBG Function"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Internal State V value: W,E - DRBG Key: W,E User - TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key:",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E - TLS Master Secret: W,E - TLS Session Encryption Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG",
"secFunImpl": ""
},
{
"description": "Execute FTD-CM HTTPS over TLSv1.2 function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul HTTPS over TLSv1.2 log message",
"inputs": "Initiate TLSv1.2 tunnel establish ment request",
"name": "[FTD-CM] Run HTTPS over TLSv1.2 Function",
"outputs": "Status of TLSv1.2 tunnel establish ment",
"rolesSspAccess": "Key: W,E [FTD-CM] Crypto Officer - [FTD-CM] TLS DH Private Key: W,E - [FTD-CM] TLS DH Public Key: W,E - [FTD-CM] TLS Peer DH Public Key: W,E - [FTD-CM] TLS DH Shared Secret: W,E - [FTD-CM] TLS ECDH Private Key: W,E - [FTD-CM]",
"secFunImpl": "[FTD-CM] KAS- ECC (TLSv1.2) [FTD-CM] KAS- FFC (TLSv1.2) [FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] RSA SigGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "TLS ECDH Public Key: W,E - [FTD-CM] TLS Peer ECDH Public Key: W,E - [FTD-CM] TLS ECDH Shared Secret: W,E - [FTD-CM] TLS ECDSA Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] TLS Master Secret: W,E - [FTD-CM] TLS Session Encryption Key: W,E - [FTD-CM] TLS Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E",
"secFunImpl": "IKEv2) [FTD-CM] ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (TLSv1.2) [FTD-CM] Session Authentication (TLSv1.2) [FTD-CM] TLSv1.2 Keying Materials Development [FTD-CM] DRBG Function"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] TLS DH Private Key: W,E - [FTD-CM] TLS DH Public Key: W,E - [FTD-CM] TLS Peer DH Public Key: W,E - [FTD-CM] TLS DH Shared Secret: W,E - [FTD-CM] TLS ECDH Private Key: W,E - [FTD-CM] TLS ECDH Public Key: W,E - [FTD-CM] TLS Peer ECDH Public Key: W,E - [FTD-CM] TLS ECDH Shared Secret: W,E - [FTD-CM] TLS",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDSA Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] TLS Master Secret: W,E - [FTD-CM] TLS Session Encryption Key: W,E - [FTD-CM] TLS Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E Crypto",
"secFunImpl": "Functions"
},
{
"description": "Execute IPsec/IKE",
"indicator": "Status Mode Indicator",
"inputs": "Initiate IPsec/IKE v2 tunnel",
"name": "Run IPSec/IKE",
"outputs": "Status of IPSec/IKE v2 tunnel",
"rolesSspAccess": "Officer - IPSec/IKE",
"secFunImpl": "KAS-ECC (IKEv2) KAS-FFC"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "v2 Function",
"indicator": "\"FIPS Mode Admin State: Enabled\" and succesful IPsec/IK Ev2 log message",
"inputs": "establish ment request",
"name": "v2 Function",
"outputs": "establish ment",
"rolesSspAccess": "DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE ECDH Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED",
"secFunImpl": "Functions (IKEv2) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (IPSec/IKE) Session Authentication (IPSec/IKEv2) IPSec/IKEv2 Keying Materials Development DRBG Function"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": ": W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E User - IPSec/IKE DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE ECDH",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED : W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E",
"secFunImpl": "Functions"
},
{
"description": "Execute FTD-CM IPsec/IKE v2 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin",
"inputs": "Initiate IPsec/IKE v2 tunnel establish ment request",
"name": "[FTD-CM] Run IPSec/IKE v2 Function",
"outputs": "Status of IPSec/IKE v2 tunnel establish ment",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] IPSec/IKE DH Private",
"secFunImpl": "[FTD-CM] KAS- ECC (IKEv2) [FTD-CM] KAS- FFC (IKEv2) [FTD-CM] RSA SigGen"
},
{
"description": "Descripti",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "State: Enabled\" and succesful IPsec/IK Ev2 log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: W,E - [FTD-CM] IPSec/IKE DH Public Key: W,E - [FTD-CM] IPSec/IKE Peer DH Public Key: W,E - [FTD-CM] IPSec/IKE DH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDH Private Key: W,E - [FTD-CM] IPSec/IKE ECDH Public Key: W,E - [FTD-CM] IPSec/IKE Peer ECDH Public Key: W,E - [FTD-CM] IPSec/IKE ECDH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key:",
"secFunImpl": "Functions (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (IPSec/IKE) [FTD-CM] Session Authentication (IPSec/IKEv2) [FTD-CM] IPSec/IKEv2 Keying Materials Development [FTD-CM] DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM] IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] SKEYSEED : W,E - [FTD-CM] IPSec/IKE Session Encryption Key: W,E - [FTD-CM] IPSec/IKE Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] IPSec/IKE DH Private Key: W,E - [FTD-CM] IPSec/IKE DH Public Key: W,E - [FTD-CM]",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "IPSec/IKE Peer DH Public Key: W,E - [FTD-CM] IPSec/IKE DH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDH Private Key: W,E - [FTD-CM] IPSec/IKE ECDH Public Key: W,E - [FTD-CM] IPSec/IKE Peer ECDH Public Key: W,E - [FTD-CM] IPSec/IKE ECDH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key: W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM]",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] SKEYSEED : W,E - [FTD-CM] IPSec/IKE Session Encryption Key: W,E - [FTD-CM] IPSec/IKE Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key:",
"secFunImpl": ""
},
{
"description": "Execute SNMPv3 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SNMPv3 log message",
"inputs": "Initiate SNMPv3 tunnel establish ment request",
"name": "Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel establish ment",
"rolesSspAccess": "W,E Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E User - SNMPv3 Shared Secret: W,E - SNMPv3",
"secFunImpl": "Session Encryption/Decr yption (SNMPv3) Session Authentication (SNMPv3) SNMPv3 Keying Materials Development"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E",
"secFunImpl": ""
},
{
"description": "Execute FTD-CM SNMPv3 Function",
"indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SNMPv3 log message",
"inputs": "Initiate SNMPv3 tunnel establish ment request",
"name": "[FTD-CM] Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel establish ment",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key: W,E [FTD-CM] User - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key: W,E",
"secFunImpl": "[FTD-CM] Session Encryption/Decr yption (SNMPv3) [FTD-CM] Session Authentication (SNMPv3) [FTD-CM] SNMPv3 Keying Materials Development"
},
{
"description": "Execute the Firmware Load Test",
"indicator": "Successf ul Firmware Loading status message",
"inputs": "Command s to load new firmware image",
"name": "Firmware Load Test",
"outputs": "Outcome of the Firmware Load Test",
"rolesSspAccess": "Crypto Officer - Firmware Load Test Key: R",
"secFunImpl": "Firmware Load Test"
},
{
"description": "Execute the FTD- CM Firmware Load Test",
"indicator": "Successf ul Firmware Loading",
"inputs": "Command s to load new firmware image",
"name": "[FTD-CM] Firmware Load Test",
"outputs": "Outcome of the Firmware Load Test",
"rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] Firmware",
"secFunImpl": "[FTD-CM] Firmware Load Test"
},
{
"description": "",
"indicator": "status message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Load Test Key: R",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The minimum length is eight (8) characters (94 possible characters). The configuration supports at most ten failed attempts to authenticate in a one- minute period.",
"mechanism": "Password Based",
"name": "Password",
"perMinute": "The probability of successfully authenticating to the module within one minute is 10/(94^8), which is less than 1/100,000.",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000."
},
{
"description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than 1/100,000.",
"mechanism": "RSA SigVer (FIPS186-4) (A4446)",
"name": "RSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details.",
"strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details."
},
{
"description": "The modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength.",
"mechanism": "ECDSA SigVer (FIPS186-4) (A4446)",
"name": "ECDSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128).",
"strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than"
},
{
"description": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "",
"name": "",
"perMinute": "Please refer to Description section in this table for more details.",
"strength": "1/1,000,000. Please refer to Description section in this table for more details."
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4446)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-CBC Encrypt KAT (A4446)",
"condition": "Power Up",
"details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-CBC Encrypt KAT (C1026)",
"condition": "Power Up",
"details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4446)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-CBC Decrypt KAT (C1026)",
"condition": "Power Up",
"details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-CBC Decrypt KAT (A4446)",
"condition": "Power Up",
"details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4446)",
"condition": "Power Up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Encrypt KAT (A4446)",
"condition": "Power Up",
"details": "Authenticat ed Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Encrypt KAT (C1026)",
"condition": "Power Up",
"details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4446)",
"condition": "Power Up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Decrypt KAT (A4446)",
"condition": "Power Up",
"details": "Authenticat ed Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Decrypt KAT (C1026)",
"condition": "Power Up",
"details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate/Generate/Res eed KAT (A4446)",
"condition": "Power Up",
"details": "Instantiate, Generate, and Reseed KATs",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] Counter DRBG Instantiate/Generate/Res eed KAT (A4446)",
"condition": "Power Up",
"details": "Instantiate, Generate, and Reseed KATs [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "ECDSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] ECDSA SigGen (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "ECDSA SigGen KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "ECDSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] ECDSA SigVer (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "ECDSA SigVer KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Start-up Repetition Count Test (RCT)",
"condition": "Power up",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] Entropy 90B Start-up Repetition Count Test (RCT)",
"condition": "Power up",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time [Cisco Firepower Threat Defense on",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "4K/9K Cryptograph ic Module]",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "Entropy 90B Start-up Adaptive Proportion Test (APT)",
"condition": "Power up",
"details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] Entropy 90B Start-up Adaptive Proportion Test (APT)",
"condition": "Power up",
"details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RCT)",
"condition": "Entropy data is generated from the Entropy Source - Continuou s",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "\"stuck\" on a single output value for a long period of time",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "[FTD-CM] Entropy 90B Continuous Repetition Count Test (RCT)",
"condition": "Entropy data is generated from the Entropy Source - Continuou s",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Continuous Adaptive Proportion Test (APT)",
"condition": "Entropy data is generated from the Entropy Source - Continuou s",
"details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] Entropy 90B Continuous Adaptive Proportion Test (APT)",
"condition": "Entropy data is generated from the Entropy Source -",
"details": "Designed to detect a large loss of entropy that might occur as a result",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "Continuou s",
"details": "of some physical failure or environment al change affecting the noise source [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA-1",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA-1 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA-1 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA-1 KAT (C1026)",
"condition": "Power Up",
"details": "HMAC- SHA-1 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-256",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 256 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-256 [Cisco Firepower Threat Defense on",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "4K/9K Cryptograph ic Module]",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 256 KAT (C1026)",
"condition": "Power Up",
"details": "HMAC- SHA2-256 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-384",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 384 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-384 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 384 KAT (C1026)",
"condition": "Power Up",
"details": "HMAC- SHA2-384 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-512",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 512 KAT (A4446)",
"condition": "Power Up",
"details": "HMAC- SHA2-512 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 512 KAT (C1026)",
"condition": "Power Up",
"details": "HMAC- SHA2-512 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A4446)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 Curve",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] KAS-ECC- SSC Sp800-56Ar3 KAT (A4446)",
"condition": "Power Up",
"details": "Primitive Z KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 Curve",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A4446)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] KAS-FFC- SSC Sp800-56Ar3 KAT (A4446)",
"condition": "Power Up",
"details": "Primitive Z KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 KAT (A4446)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] KDF IKEv2 KAT (A4446)",
"condition": "Power Up",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SNMP KAT (A4446)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "normal state",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "[FTD-CM] KDF SNMP KAT (A4446)",
"condition": "Power Up",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A4446)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] KDF SSH KAT (A4446)",
"condition": "Power Up",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 4) KAT (A4446)",
"condition": "Power Up",
"details": "RSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] RSA SigGen (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "RSA SigGen KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "RSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] RSA SigVer (FIPS186-4) KAT (A4446)",
"condition": "Power Up",
"details": "RSA SigVer KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 KAT (A4446)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] SHA-1 KAT (A4446)",
"condition": "Power Up",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A4446)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "[FTD-CM] TLS v1.2 KDF RFC7627 KAT (A4446)",
"condition": "Power Up",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-4) PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "[FTD-CM] ECDSA KeyGen (FIPS186-4) PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the",
"details": "ECDSA [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "first operation al use.",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186- 4) PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bit Modulus",
"type": "PCT"
},
{
"algorithmOrTest": "[FTD-CM] RSA KeyGen (FIPS186-4) PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "RSA [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bit Modulus",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "[FTD-CM] KAS-ECC- SSC Sp800-56Ar3 PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "[FTD-CM] KAS-FFC- SSC Sp800-56Ar3 PCT (A4446)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "When firmware has been uploaded",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2- 512",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "",
"condition": "to the module",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "[FTD-CM] Firmware Load Test",
"condition": "When firmware has been uploaded to the module",
"details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2- 512",
"type": "SW/F W Load"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Self-test failure",
"description": "If self-test tests fail, the module is put into an error state",
"indicator": "System Halt",
"name": "Error State",
"recoveryMethod": "Reboot the module"
},
{
"conditions": "FTD-CM Self- test failure",
"description": "If any self-test tests for the FTD- CM fail, the FTD-CM module is put into an error state",
"indicator": "FTD-CM System Halt",
"name": "[FTD-CM] Error State",
"recoveryMethod": "Reboot the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Recommend 30 Days",
"inspectGuidance": "Visible inspection of platform for residual evidence of tampering.",
"mechanism": "Tamper labels (15 for 4100 Models; 12 for 9300 models) with Part Number: AIR-AP- FIPSKIT="
},
{
"inspectFreq": "Recommend 30 Days",
"inspectGuidance": "Visible inspection of platform for evidence of tampering, removal or access.",
"mechanism": "Opacity Shield (1) with Part Number: FPR4K-SM-44S (for 4100 models) and FPR-C9300-FIPSKIT= (for 9300 models)"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module is always in the approved mode of operation after initial operations are performed.",
"name": "Approved Mode of Operation",
"statusIndicator": "Approved mode indicator: \"FIPS Mode Admin State: Enabled\"",
"type": "Approved"
},
{
"description": "The module is configured to have the Approved Mode disabled (Which is not recommended by Cisco). In the Non- Approved Mode, both Non-Approved and Approved algorithms can be configured.",
"name": "Non- Approved Mode of Operation",
"statusIndicator": "Non-Approved mode indicator: \"FIPS Mode Admin State: Disabled\"",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "3DES",
"use": "Used for symmetric encryption in SSHv2, TLSv1, TLSv1.2, IPsec/IKEv2, and SNMPv3"
},
{
"name": "[FTD-CM] 3DES",
"use": "Used for symmetric encryption in FTD-CM SSHv2, TLSv1, TLSv1.2, IPsec/IKEv2, and SNMPv3 [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]"
},
{
"name": "ChaCha20- poly1305",
"use": "Used for authenticated symmetric encryption in SSHv2, and TLSv1.3"
},
{
"name": "[FTD-CM] ChaCha20- poly1305",
"use": "Used for authenticated symmetric encryption in FTD-CM SSHv2, and TLSv1.3 [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "3DES ChaCha20- poly1305",
"description": "Run SSHv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SSHv2 log message demonstrates the non- approved service",
"name": "SSHv2",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] 3DES [FTD-CM] ChaCha20- poly1305",
"description": "Run SSHv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SSHv2 log message demonstrates the non- approved service",
"name": "[FTD-CM] SSHv2",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
},
{
"alg_accessed": "3DES",
"description": "Run TLSv1 in the non-approved mode using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1 log message demonstrates the non-approved service",
"name": "TLSv1",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] 3DES",
"description": "Run TLSv1 in the non-approved mode using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1 log message demonstrates the non-approved service",
"name": "[FTD-CM] TLSv1",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
},
{
"alg_accessed": "3DES",
"description": "Run TLSv1.2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.2 log message demonstrates the non- approved service",
"name": "TLSv1.2",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] 3DES",
"description": "Run TLSv1.2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.2 log message demonstrates the non- approved service",
"name": "[FTD-CM] TLSv1.2",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
},
{
"alg_accessed": "ChaCha20- poly1305",
"description": "Run TLSv1.3 in the non-approved mode using non-approved algorithms. Non- Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.3 log message demonstrates the non-approved service",
"name": "TLSv1.3",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] ChaCha20- poly1305",
"description": "Run TLSv1.3 in the non-approved mode using non-approved algorithms. Non- Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.3 log message demonstrates the non-approved service",
"name": "[FTD-CM] TLSv1.3",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
},
{
"alg_accessed": "3DES",
"description": "Run IPsec/IKEv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful IPsec/IKEv2 log message demonstrates the non-approved service",
"name": "IPsec/IKEv2",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] 3DES",
"description": "Run IPsec/IKEv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful IPsec/IKEv2 log message demonstrates the non-approved service",
"name": "[FTD-CM] IPsec/IKEv2",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
},
{
"alg_accessed": "3DES",
"description": "Run SNMPv3 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SNMPv3 log message demonstrates the non-approved service",
"name": "SNMPv3",
"role": "Crypto Officer, User"
},
{
"alg_accessed": "[FTD-CM] 3DES",
"description": "Run SNMPv3 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SNMPv3 log message demonstrates the non-approved service",
"name": "[FTD-CM] SNMPv3",
"role": "[FTD-CM] Crypto Officer, [FTD-CM] User"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
"logicalInterface": "Data Input",
"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, and Console Port"
},
{
"data": "Data output from the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
"logicalInterface": "Data Output",
"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port and Console Port"
},
{
"data": "Control Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
"logicalInterface": "Control Input",
"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, Console Port and RESET"
},
{
"data": "Status Information output from the module.",
"logicalInterface": "Status Output",
"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, Console Port and LEDs"
},
{
"data": "N/A",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Provide the Power Supply to the module.",
"logicalInterface": "Power",
"physicalPort": "Power"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "[FTD-CM] Crypto Officer",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "User",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "[FTD-CM] User",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A4446)",
"details": "RSA SigVer",
"indicator": "Module is in normal state",
"testMethod": "RSA signature verification",
"testProps": "RSA SigVer 2048 bits with SHA2-512",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "[FTD-CM] RSA SigVer (FIPS186-4) (A4446)",
"details": "RSA SigVer [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]",
"indicator": "Module is in normal state",
"testMethod": "RSA signature verification",
"testProps": "RSA SigVer 2048 bits with SHA2-512",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "",
"sfiAlgo": "",
"source": "Boundary )"
},
{
"dest": "External (Outside of the Module\u0027s Boundary )",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via SSHv2 encrypted by AES-GCM",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input via TLSv1.2 encrypted by AES-GCM",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s Boundary )"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service",
"method": "Zeroization Command",
"operatorId": "\u0027erase configuration\u0027 command",
"rationale": "The zeroization command will erase all SSPs stored in the DRAM or in the Flash of the module."
},
{
"description": "Zeroization upon session termination",
"method": "Session Termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Zeroization upon rebooting the module",
"method": "Reboot",
"operatorId": "Reboot",
"rationale": "Reboot to zeroize all temporary SSPs stored in volatile memory"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile Memory",
"name": "DRAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile Memory",
"name": "Flash",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR4K- SM-12S",
"modelPartNum": "FPR 4112",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Silver 4116 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR4K- SM-24S",
"modelPartNum": "FPR 4115",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Silver 4116 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR4K- SM-32S",
"modelPartNum": "FPR 4125",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6130T (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR4K- SM-44S",
"modelPartNum": "FPR 4145",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6152 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR9K- SM-40",
"modelPartNum": "FPR 9300 SM-40",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6138T (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR9K- SM-48",
"modelPartNum": "FPR 9300 SM-48",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Platinum 8160 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
},
{
"features": "N/A",
"fwVersion": "2.14(1.143)",
"hwVersion": "FPR9K- SM-56",
"modelPartNum": "FPR 9300 SM-56",
"processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Platinum 8176 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per section 4 example 1 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG (A4446)"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 21
},
"ECDH": {
"ECDH": 180,
"ECDHE": 2
},
"ECDSA": {
"ECDSA": 165
}
},
"FF": {
"DH": {
"DH": 175,
"Diffie-Hellman": 4
},
"DSA": {
"DSA": 3
}
},
"RSA": {
"RSA 2048": 3
}
},
"certification_process": {
"OutOfScope": {
"Table 2 above. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configure": 1,
"fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation": 1,
"out of scope": 2
}
},
"cipher_mode": {
"CBC": {
"CBC": 3
},
"GCM": {
"GCM": 15
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 3,
"IKEv2": 136
},
"IPsec": {
"IPsec": 2
},
"SSH": {
"SSH": 248,
"SSHv2": 286
},
"TLS": {
"TLS": {
"TLS": 252,
"TLS v1.2": 12,
"TLSv1.2": 287,
"TLSv1.3": 8
}
},
"VPN": {
"VPN": 2
}
},
"crypto_scheme": {
"MAC": {
"MAC": 24
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 114,
"P-384": 104,
"P-521": 104,
"secp256r1": 2,
"secp384r1": 2,
"secp521r1": 2
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1,
"#5": 1,
"#5456": 2,
"#7": 1,
"#8": 1,
"#9": 1
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 4,
"AES-128": 6,
"AES-192": 4,
"AES-256": 5,
"DRBG 384": 2,
"HMAC- SHA-1": 6,
"HMAC-SHA-1": 12,
"HMACSHA-1": 1,
"PKCS 1": 4,
"RSA 2048": 3,
"SHA-1": 21,
"SHA2- 224": 4,
"SHA2- 256": 21,
"SHA2- 384": 9,
"SHA2- 512": 11,
"SHA2-224": 2,
"SHA2-256": 13,
"SHA2-384": 11,
"SHA2-512": 14,
"SHA3-256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 21
},
"SHA3": {
"SHA3-256": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 174
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 9,
"FIPS 180-4": 14,
"FIPS 186-4": 14,
"FIPS 198-1": 14,
"FIPS18": 12,
"FIPS186-4": 39
},
"ISO": {
"ISO/IEC 19790": 2
},
"NIST": {
"SP 800-140": 1,
"SP 800-52": 1
},
"PKCS": {
"PKCS 1": 4
},
"RFC": {
"RFC 3526": 2,
"RFC 4419": 2,
"RFC 4492": 1,
"RFC 5288": 1,
"RFC 5647": 4,
"RFC 5903": 1,
"RFC 7296": 2,
"RFC 7919": 2,
"RFC762": 2,
"RFC7627": 4
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 101,
"AES-": 14,
"AES-128": 6,
"AES-192": 4,
"AES-256": 5
},
"CAST": {
"CAST": 112
}
},
"DES": {
"3DES": {
"3DES": 12
}
},
"constructions": {
"MAC": {
"HMAC": 99
}
}
},
"tee_name": {
"AMD": {
"PSP": 36
},
"IBM": {
"SSC": 14
}
},
"tls_cipher_suite": {},
"vendor": {
"Cisco": {
"Cisco": 86,
"Cisco Systems": 1,
"Cisco Systems, Inc": 156
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-384C1026",
"SHA2-384C1026",
"RSA SigGen (FIPS186-4)A4446",
"HMAC-SHA-1C1026",
"Safe Primes Key GenerationA4446",
"KDF SNMPA4446",
"KDF IKEv2A4446",
"HMAC-SHA2-224A4446",
"ECDSA SigGen (FIPS186-4)A4446",
"KDF SSHA4446",
"AES-CBCC1026",
"Counter DRBGA4446",
"SHA2-256C1026",
"SHA2-512C1026",
"HMAC-SHA2-512C1026",
"ECDSA KeyGen (FIPS186-4)A4446",
"KAS-ECC-SSC Sp800-56Ar3A4446",
"SHA-1C1026",
"SHA2-224A4446",
"RSA KeyGen (FIPS186-4)A4446",
"ECDSA SigVer (FIPS186-4)A4446",
"KAS-FFC-SSC Sp800-56Ar3A4446",
"AES-GCMC1026",
"HMAC-SHA2-256C1026",
"RSA SigVer (FIPS186-4)A4446",
"TLS v1.2 KDF RFC7627A4446"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#46",
"#A44"
]
},
"policy_metadata": {
"/Author": "JustinBettencourt",
"/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos",
"/ClassificationContentMarkingHeaderShapeIds": "5be8cbcb,552f038a,66e93203",
"/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20261009130500-04\u002700\u0027",
"/Creator": "Acrobat PDFMaker 26 for Word",
"/Keywords": "",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "6c4edfa8-fc04-4733-9ade-268781926b28",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-10-09T14:55:51Z",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1",
"/ModDate": "D:20261009130955-04\u002700\u0027",
"/Producer": "Adobe PDF Library 26.2.141",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 2514940,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421625.jpg",
"https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421282.jpg",
"https://www.cisco.com/c/en/us/td/docs/security/firepower/740/fdm/fptd-fdm-config-guide-740.html",
"https://www.cisco.com/c/en/us/products/collateral/security/firepower-9000-series/datasheet-c78-742471.html",
"https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/mount_and_connect.html#id_12047",
"https://www.cisco.com/c/en/us/products/collateral/security/firepower-4100-series/datasheet-c78-742474.html",
"https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp4100/firepower-4100-gsg.html",
"https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421569.jpg",
"https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/overview.html#concept_5D7C952A9363415CB14DB5175EE46654",
"https://www.cisco.com/c/dam/en/us/td/i/400001-500000/410001-420000/411001-412000/411270.jpg",
"https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/overview.html#concept_4386239138B84D40979C3AFA97BA852D"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 151
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "146a666a5ce80b7dc875d5ba77afb829fa749c8dbeb050247863e538c96242b0",
"source_hash": "8dc94571f0dc06661ea6780626b44a3bb6c1a1da32bb5de88ea2d40ef3e323f2",
"txt_hash": "7a33dfba6b78bbed696a538815a7b3d385b2fe21f7ad7746711e3e85e9dd25d1"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode; The tamper evident seals and Physical Kit installed as indicated in the Security Policy; This module contains the embedded module [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module] validated to FIPS 140-3 under Cert. #5456 operating in approved mode.",
"certificate_pdf_url": null,
"date_sunset": "2031-10-14",
"description": "Cisco FTD FX-OS on 4K/9K Cryptographic Module is an integrated network security system providing enterprise-class firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications, HTTPS/TLSv1.2, SSHv2, IPsec/IKEv2, SNMPv3 and Cryptographic Cipher Suite B.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {
"5456": 1
},
"module_name": "Cisco FTD FX-OS on 4K/9K Cryptographic Module",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-10-15",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Cisco Systems, Inc.",
"vendor_url": "http://www.cisco.com"
}
}