{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "5e4e7b5040b933b5", "cert_id": 5551, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "Cisco FTD FX-OS on 4K/9K Cryptographic Module", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-10-15", "validation_type": "Initial", "lab": "Gossamer Security Solutions"}], "vendor_url": "http://www.cisco.com", "vendor": "Cisco Systems, Inc.", "certificate_pdf_url": null, "module_type": "Hardware", "standard": "FIPS 140-3", "status": "active", "level": 2, "caveat": "When operated in approved mode; The tamper evident seals and Physical Kit installed as indicated in the Security Policy; This module contains the embedded module [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module] validated to FIPS 140-3 under Cert. #5456 operating in approved mode.", "exceptions": ["Roles, services, and authentication: Level 3", "Operational environment: N/A", "Non-invasive security: N/A", "Mitigation of other attacks: N/A"], "embodiment": "MultiChipStand", "description": "Cisco FTD FX-OS on 4K/9K Cryptographic Module is an integrated network security system providing enterprise-class firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications, HTTPS/TLSv1.2, SSHv2, IPsec/IKEv2, SNMPv3 and Cryptographic Cipher Suite B.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {"5456": 1}, "historical_reason": null, "date_sunset": "2031-10-14", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {"Cert": {"#5456": 2, "#8": 1, "#9": 1, "#5": 1, "#7": 1, "#1": 1}}, "fips_security_level": {"Level": {"Level 2": 2}}, "fips_certlike": {"Certlike": {"HMAC- SHA-1": 6, "HMACSHA-1": 1, "HMAC-SHA-1": 12, "SHA2-256": 13, "SHA2-384": 11, "SHA2-512": 14, "SHA-1": 21, "SHA2- 224": 4, "SHA2- 256": 21, "SHA2- 384": 9, "SHA2- 512": 11, "SHA2-224": 2, "SHA3-256": 1, "RSA 2048": 3, "- PKCS 1": 4, "AES-128": 6, "AES-192": 4, "AES-256": 5, "DRBG 384": 2, "PKCS 1": 4}}, "vendor": {"Cisco": {"Cisco Systems, Inc": 156, "Cisco": 86, "Cisco Systems": 1}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-": 14, "AES-128": 6, "AES-192": 4, "AES-256": 5, "AES": 101}, "CAST": {"CAST": 112}}, "DES": {"3DES": {"3DES": 12}}, "constructions": {"MAC": {"HMAC": 99}}}, "asymmetric_crypto": {"RSA": {"RSA 2048": 3}, "ECC": {"ECDH": {"ECDH": 180, "ECDHE": 2}, "ECDSA": {"ECDSA": 165}, "ECC": {"ECC": 21}}, "FF": {"DH": {"Diffie-Hellman": 4, "DH": 175}, "DSA": {"DSA": 3}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 21}, "SHA3": {"SHA3-256": 1}}}, "crypto_scheme": {"MAC": {"MAC": 24}}, "crypto_protocol": {"SSH": {"SSH": 248, "SSHv2": 286}, "TLS": {"TLS": {"TLS v1.2": 12, "TLSv1.2": 287, "TLSv1.3": 8, "TLS": 252}}, "IKE": {"IKEv2": 136, "IKE": 3}, "IPsec": {"IPsec": 2}, "VPN": {"VPN": 2}}, "randomness": {"PRNG": {"DRBG": 174}, "RNG": {"RBG": 2}}, "cipher_mode": {"CBC": {"CBC": 3}, "GCM": {"GCM": 15}}, "ecc_curve": {"NIST": {"P-256": 114, "P-384": 104, "P-521": 104, "secp256r1": 2, "secp384r1": 2, "secp521r1": 2}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 36}, "IBM": {"SSC": 14}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 9, "FIPS18": 12, "FIPS 186-4": 14, "FIPS 198-1": 14, "FIPS 180-4": 14, "FIPS186-4": 39}, "NIST": {"SP 800-140": 1, "SP 800-52": 1}, "PKCS": {"PKCS 1": 4}, "RFC": {"RFC762": 2, "RFC 5647": 4, "RFC 5288": 1, "RFC 7296": 2, "RFC 4419": 2, "RFC 7919": 2, "RFC 3526": 2, "RFC 4492": 1, "RFC 5903": 1, "RFC7627": 4}, "ISO": {"ISO/IEC 19790": 2}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {"OutOfScope": {"out of scope": 2, "fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation": 1, "Table 2 above. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configure": 1}}}, "policy_metadata": {"pdf_file_size_bytes": 2514940, "pdf_is_encrypted": false, "pdf_number_of_pages": 151, "/Author": "JustinBettencourt", "/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos", "/ClassificationContentMarkingHeaderShapeIds": "5be8cbcb,552f038a,66e93203", "/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT", "/Comments": "", "/Company": "", "/CreationDate": "D:20261009130500-04'00'", "/Creator": "Acrobat PDFMaker 26 for Word", "/Keywords": "", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "6c4edfa8-fc04-4733-9ade-268781926b28", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-10-09T14:55:51Z", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1", "/ModDate": "D:20261009130955-04'00'", "/Producer": "Adobe PDF Library 26.2.141", "/SourceModified": "", "/Subject": "", "/Title": "", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421625.jpg", "https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421282.jpg", "https://www.cisco.com/c/en/us/td/docs/security/firepower/740/fdm/fptd-fdm-config-guide-740.html", "https://www.cisco.com/c/en/us/products/collateral/security/firepower-9000-series/datasheet-c78-742471.html", "https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/mount_and_connect.html#id_12047", "https://www.cisco.com/c/en/us/products/collateral/security/firepower-4100-series/datasheet-c78-742474.html", "https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp4100/firepower-4100-gsg.html", "https://www.cisco.com/c/dam/en/us/td/i/400001-500000/420001-430000/421001-422000/421569.jpg", "https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/overview.html#concept_5D7C952A9363415CB14DB5175EE46654", "https://www.cisco.com/c/dam/en/us/td/i/400001-500000/410001-420000/411001-412000/411270.jpg", "https://www.cisco.com/c/en/us/td/docs/security/firepower/4100/hw/guide/b_install_guide_4100/overview.html#concept_4386239138B84D40979C3AFA97BA852D"]}}, "module_algorithms": {"_type": "Set", "elements": ["HMAC-SHA2-384C1026", "SHA2-384C1026", "RSA SigGen (FIPS186-4)A4446", "HMAC-SHA-1C1026", "Safe Primes Key GenerationA4446", "KDF SNMPA4446", "KDF IKEv2A4446", "HMAC-SHA2-224A4446", "ECDSA SigGen (FIPS186-4)A4446", "KDF SSHA4446", "AES-CBCC1026", "Counter DRBGA4446", "SHA2-256C1026", "SHA2-512C1026", "HMAC-SHA2-512C1026", "ECDSA KeyGen (FIPS186-4)A4446", "KAS-ECC-SSC Sp800-56Ar3A4446", "SHA-1C1026", "SHA2-224A4446", "RSA KeyGen (FIPS186-4)A4446", "ECDSA SigVer (FIPS186-4)A4446", "KAS-FFC-SSC Sp800-56Ar3A4446", "AES-GCMC1026", "HMAC-SHA2-256C1026", "RSA SigVer (FIPS186-4)A4446", "TLS v1.2 KDF RFC7627A4446"]}, "policy_algorithms": {"_type": "Set", "elements": ["#46", "#A44"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "2"}, {"section": "2", "title": "Cryptographic module specification", "level": "2"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "2"}, {"section": "4", "title": "Roles, services, and authentication", "level": "3"}, {"section": "5", "title": "Software/Firmware security", "level": "2"}, {"section": "6", "title": "Operational environment", "level": "N/A"}, {"section": "7", "title": "Physical security", "level": "2"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "2"}, {"section": "10", "title": "Self-tests", "level": "2"}, {"section": "11", "title": "Life-cycle assurance", "level": "2"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "2"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": true, "entries": [{"modelPartNum": "FPR 4112", "hwVersion": "FPR4K- SM-12S", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Silver 4116 (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 4115", "hwVersion": "FPR4K- SM-24S", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Silver 4116 (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 4125", "hwVersion": "FPR4K- SM-32S", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6130T (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 4145", "hwVersion": "FPR4K- SM-44S", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6152 (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 9300 SM-40", "hwVersion": "FPR9K- SM-40", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Gold 6138T (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 9300 SM-48", "hwVersion": "FPR9K- SM-48", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Platinum 8160 (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}, {"modelPartNum": "FPR 9300 SM-56", "hwVersion": "FPR9K- SM-56", "fwVersion": "2.14(1.143)", "processors": "Intel i3-3115C (Ivy Bridge); Intel Xeon Platinum 8176 (Skylake) & NITROX-V, Marvell Semiconductor, NITROX", "features": "N/A"}]}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": true, "entries": [{"name": "Approved Mode of Operation", "description": "The module is always in the approved mode of operation after initial operations are performed.", "type": "Approved", "statusIndicator": "Approved mode indicator: \"FIPS Mode Admin State: Enabled\""}, {"name": "Non- Approved Mode of Operation", "description": "The module is configured to have the Approved Mode disabled (Which is not recommended by Cisco). In the Non- Approved Mode, both Non-Approved and Approved algorithms can be configured.", "type": "Non- Approved", "statusIndicator": "Non-Approved mode indicator: \"FIPS Mode Admin State: Disabled\""}]}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES- CBC", "cavpCertName": "A44 46", "properties": "Key Length - 128, 256", "reference": "SP 800- 38A"}, {"algorithm": "AES- GCM", "cavpCertName": "A44 46", "properties": "Key Length - 128, 256", "reference": "SP 800- 38D"}, {"algorithm": "Counter DRBG", "cavpCertName": "A44 46", "properties": "Prediction Resistance - Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 128-256 Increment 128, Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0- 256 Increment 256 Returned Bits - 256", "reference": "SP 800- 90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates", "reference": "FIPS 186-4"}, {"algorithm": "ECDSA SigGen", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-4"}, {"algorithm": "(FIPS18 6-4)", "cavpCertName": "", "properties": "", "reference": ""}, {"algorithm": "ECDSA SigVer (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-4"}, {"algorithm": "HMAC- SHA-1", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 224", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 256", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 384", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 512", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS- ECC- SSC Sp800- 56Ar3", "cavpCertName": "A44 46", "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "KAS- FFC- SSC Sp800- 56Ar3", "cavpCertName": "A44 46", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A44 46", "properties": "Initiator Nonce Length - Initiator Nonce Length: 2048 Responder Nonce Length - Responder Nonce Length: 2048 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "KDF SNMP (CVL)", "cavpCertName": "A44 46", "properties": "Password Length - Password Length: 256, 64 Engine ID - 000002b87766554433221100, 800002B805123456789ABCDEF0123456789ABCDEF01234567 89ABCDEF0123456", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A44 46", "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "RSA KeyGen", "cavpCertName": "A44 46", "properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096", "reference": "FIPS 186-4"}, {"algorithm": "(FIPS18 6-4)", "cavpCertName": "", "properties": "Hash Algorithm - SHA2-256 Info Generated By Server - Yes Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard", "reference": ""}, {"algorithm": "RSA SigGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096", "reference": "FIPS 186-4"}, {"algorithm": "Safe Primes Key Generat ion", "cavpCertName": "A44 46", "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp- 2048, modp-3072, modp-4096", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "SHA-1", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 224", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 256", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 384", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 512", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "TLS v1.2 KDF RFC762 7 (CVL)", "cavpCertName": "A44 46", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "AES- CBC", "cavpCertName": "A44 46", "properties": "Key Length - 128, 256", "reference": "SP 800- 38A"}, {"algorithm": "AES- CBC", "cavpCertName": "C10 26", "properties": "Key Length - 128, 256", "reference": "SP 800- 38A"}, {"algorithm": "AES- GCM", "cavpCertName": "A44 46", "properties": "Key Length - 128, 256", "reference": "SP 800- 38D"}, {"algorithm": "AES- GCM", "cavpCertName": "C10 26", "properties": "Key Length - 128, 256", "reference": "SP 800- 38D"}, {"algorithm": "Counter DRBG", "cavpCertName": "A44 46", "properties": "Prediction Resistance - Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 128-256 Increment 128, Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0- 256 Increment 256 Returned Bits - 256", "reference": "SP 800- 90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates", "reference": "FIPS 186-4"}, {"algorithm": "ECDSA SigGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-4"}, {"algorithm": "ECDSA SigVer (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-4"}, {"algorithm": "HMAC- SHA-1", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA-1", "cavpCertName": "C10 26", "properties": "MAC - MAC: 160 Key sizes < block size - Yes Key size = block size - Yes Key sizes > block size - Yes", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 224", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 256", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 256", "cavpCertName": "C10 26", "properties": "MAC - MAC: 256 Key sizes < block size - Yes Key size = block size - Yes Key sizes > block size - Yes", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 384", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 384", "cavpCertName": "C10 26", "properties": "MAC - MAC: 384 Key sizes < block size - Yes Key sizes > block size - Yes Key size = block size - Yes", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 512", "cavpCertName": "A44 46", "properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8, Key Length: 8- 524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC- SHA2- 512", "cavpCertName": "C10 26", "properties": "MAC - MAC: 512 Key sizes < block size - Yes Key size = block size - Yes Key sizes > block size - Yes", "reference": "FIPS 198-1"}, {"algorithm": "KAS- ECC- SSC Sp800- 56Ar3", "cavpCertName": "A44 46", "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "KAS- FFC- SSC Sp800- 56Ar3", "cavpCertName": "A44 46", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A44 46", "properties": "Initiator Nonce Length - Initiator Nonce Length: 2048 Responder Nonce Length - Responder Nonce Length: 2048 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "KDF SNMP (CVL)", "cavpCertName": "A44 46", "properties": "Password Length - Password Length: 256, 64 Engine ID - 000002b87766554433221100, 800002B805123456789ABCDEF0123456789ABCDEF01234567 89ABCDEF0123456", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A44 46", "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "RSA KeyGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096 Hash Algorithm - SHA2-256 Info Generated By Server - Yes Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigGen (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS18 6-4)", "cavpCertName": "A44 46", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096", "reference": "FIPS 186-4"}, {"algorithm": "Safe Primes Key Generat ion", "cavpCertName": "A44 46", "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp- 2048, modp-3072, modp-4096", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "SHA-1", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA-1", "cavpCertName": "C10 26", "properties": "Message Length - Message Length: 0-51200 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 224", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 256", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 256", "cavpCertName": "C10 26", "properties": "Message Length - Message Length: 0-51200 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 384", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 384", "cavpCertName": "C10 26", "properties": "Message Length - Message Length: 0-102400 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 512", "cavpCertName": "A44 46", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2- 512", "cavpCertName": "C10 26", "properties": "Message Length - Message Length: 0-102400 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "TLS v1.2 KDF RFC762 7 (CVL)", "cavpCertName": "A44 46", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800- 135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG", "algoPropList": "Key Type:Asymmetric", "implName": "N/A", "reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per section 4 example 1 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG (A4446)"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "3DES", "use": "Used for symmetric encryption in SSHv2, TLSv1, TLSv1.2, IPsec/IKEv2, and SNMPv3"}, {"name": "[FTD-CM] 3DES", "use": "Used for symmetric encryption in FTD-CM SSHv2, TLSv1, TLSv1.2, IPsec/IKEv2, and SNMPv3 [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]"}, {"name": "ChaCha20- poly1305", "use": "Used for authenticated symmetric encryption in SSHv2, and TLSv1.3"}, {"name": "[FTD-CM] ChaCha20- poly1305", "use": "Used for authenticated symmetric encryption in FTD-CM SSHv2, and TLSv1.3 [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]"}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, and Console Port", "logicalInterface": "Data Input", "data": "Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data."}, {"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port and Console Port", "logicalInterface": "Data Output", "data": "Data output from the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data."}, {"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, Console Port and RESET", "logicalInterface": "Control Input", "data": "Control Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data."}, {"physicalPort": "Ethernet Port, SFP (1G) port, SFP+ (10G) port, Console Port and LEDs", "logicalInterface": "Status Output", "data": "Status Information output from the module."}, {"physicalPort": "N/A", "logicalInterface": "Control Output", "data": "N/A"}, {"physicalPort": "Power", "logicalInterface": "Power", "data": "Provide the Power Supply to the module."}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "Password", "description": "The minimum length is eight (8) characters (94 possible characters). The configuration supports at most ten failed attempts to authenticate in a one- minute period.", "mechanism": "Password Based", "strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000.", "perMinute": "The probability of successfully authenticating to the module within one minute is 10/(94^8), which is less than 1/100,000."}, {"name": "RSA- Based Certificate", "description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than 1/100,000.", "mechanism": "RSA SigVer (FIPS186-4) (A4446)", "strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details.", "perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details."}, {"name": "ECDSA- Based Certificate", "description": "The modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength.", "mechanism": "ECDSA SigVer (FIPS186-4) (A4446)", "strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than", "perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128)."}, {"name": "", "description": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.", "mechanism": "", "strength": "1/1,000,000. Please refer to Description section in this table for more details.", "perMinute": "Please refer to Description section in this table for more details."}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Crypto Officer", "type": "Identity", "operatorType": "CO", "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate"}, {"name": "[FTD-CM] Crypto Officer", "type": "Identity", "operatorType": "CO", "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate"}, {"name": "User", "type": "Identity", "operatorType": "User", "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate"}, {"name": "[FTD-CM] User", "type": "Identity", "operatorType": "User", "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Show Status", "description": "Provide Module's current status (return codes and/or syslog messages )", "indicator": "N/A", "inputs": "Command used to show Module's Status", "outputs": "Module's Operation al Status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer User"}, {"name": "[FTD-CM] Show Status", "description": "Provide FTD-CM Module's current status (return codes and/or syslog messages )", "indicator": "N/A", "inputs": "Command used to show Module's Status", "outputs": "Module's Operation al Status", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer [FTD-CM] User"}, {"name": "Show Version", "description": "Provide Module's name and version informatio n", "indicator": "N/A", "inputs": "Command to show version", "outputs": "Module's ID and versioning informatio n", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer User"}, {"name": "[FTD-CM] Show Version", "description": "Provide FTD-CM Module's name and version informatio n", "indicator": "N/A", "inputs": "Command to show version", "outputs": "Module's ID and versioning informatio n", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer [FTD-CM] User"}, {"name": "Perform Self-Tests", "description": "Perform Self-Tests (Pre- operation al self-test and Condition al Self- Tests)", "indicator": "N/A", "inputs": "Command to trigger Self-Test", "outputs": "Status of the self- tests results", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer User Unauthentic ated"}, {"name": "[FTD-CM] Perform Self-Tests", "description": "Perform FTD-CM Self-Tests", "indicator": "N/A", "inputs": "Command to trigger Self-Test", "outputs": "Status of the self-", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer"}, {"name": "", "description": "(Pre- operation al self-test and Condition al Self- Tests)", "indicator": "", "inputs": "", "outputs": "tests results", "secFunImpl": "", "rolesSspAccess": "[FTD-CM] User Unauthentic ated"}, {"name": "Perform Zeroizatio n", "description": "Perform Zeroizatio n", "indicator": "N/A", "inputs": "Command to zeroize the module", "outputs": "Status of the SSPs zeroizatio n", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State V value: Z - DRBG Key: Z - User Password: Z - Crypto Officer Password: Z - Firmware Load Test Key: Z - SSH DH Private Key: Z - SSH DH Public Key: Z - SSH Peer DH Public Key: Z - SSH DH Shared Secret: Z - SSH ECDH Private Key: Z - SSH ECDH"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Public Key: Z - SSH Peer ECDH Public Key: Z - SSH ECDH Shared Secret: Z - SSH RSA Private Key: Z - SSH RSA Public Key: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authenticati on Key: Z - TLS DH Private Key: Z - TLS DH Public Key: Z - TLS Peer DH Public Key: Z - TLS DH Shared Secret: Z - TLS ECDH Private Key: Z"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "- TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z - TLS ECDSA Private Key: Z - TLS ECDSA Public Key: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authenticati on Key: Z - IPSec/IKE DH Private Key: Z - IPSec/IKE DH Public Key: Z - IPSec/IKE Peer DH Public Key: Z - IPSec/IKE"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "DH Shared Secret: Z - IPSec/IKE ECDH Private Key: Z - IPSec/IKE ECDH Public Key: Z - IPSec/IKE Peer ECDH Public Key: Z - IPSec/IKE ECDH Shared Secret: Z - IPSec/IKE ECDSA Private Key: Z - IPSec/IKE ECDSA Public Key: Z - IPSec/IKE RSA Private Key: Z - IPSec/IKE RSA Public Key: Z - IPSec/IKE Pre-shared Secret: Z - SKEYSEED : Z - IPSec/IKE Session Encryption Key: Z - IPSec/IKE Authenticati on Key: Z - SNMPv3 Shared"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticati on Key: Z"}, {"name": "[FTD-CM] Perform Zeroizatio n", "description": "Perform Zeroizatio n on FTD- CM", "indicator": "N/A", "inputs": "Command to zeroize the module", "outputs": "Status of the SSPs zeroizatio n", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] DRBG Entropy Input: Z - [FTD-CM] DRBG Seed: Z - [FTD-CM] DRBG Internal State V value: Z - [FTD-CM] DRBG Key: Z - [FTD-CM] User Password: Z - [FTD-CM] Crypto Officer Password: Z - [FTD-CM] Firmware Load Test Key: Z - [FTD-CM] SSH DH Private Key: Z - [FTD-CM] SSH DH Public Key: Z - [FTD-CM] SSH Peer"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "DH Public Key: Z - [FTD-CM] SSH DH Shared Secret: Z - [FTD-CM] SSH ECDH Private Key: Z - [FTD-CM] SSH ECDH Public Key: Z - [FTD-CM] SSH Peer ECDH Public Key: Z - [FTD-CM] SSH ECDH Shared Secret: Z - [FTD-CM] SSH RSA Private Key: Z - [FTD-CM] SSH RSA Public Key: Z - [FTD-CM] SSH ECDSA Private Key: Z - [FTD-CM] SSH ECDSA Public Key: Z - [FTD-CM] SSH Session Encryption Key: Z - [FTD-CM] SSH"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Session Authenticati on Key: Z - [FTD-CM] TLS DH Private Key: Z - [FTD-CM] TLS DH Public Key: Z - [FTD-CM] TLS Peer DH Public Key: Z - [FTD-CM] TLS DH Shared Secret: Z - [FTD-CM] TLS ECDH Private Key: Z - [FTD-CM] TLS ECDH Public Key: Z - [FTD-CM] TLS Peer ECDH Public Key: Z - [FTD-CM] TLS ECDH Shared Secret: Z - [FTD-CM] TLS ECDSA Private Key: Z - [FTD-CM] TLS ECDSA Public Key: Z - [FTD-CM] TLS RSA"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Private Key: Z - [FTD-CM] TLS RSA Public Key: Z - [FTD-CM] TLS Master Secret: Z - [FTD-CM] TLS Session Encryption Key: Z - [FTD-CM] TLS Session Authenticati on Key: Z - [FTD-CM] IPSec/IKE DH Private Key: Z - [FTD-CM] IPSec/IKE DH Public Key: Z - [FTD-CM] IPSec/IKE Peer DH Public Key: Z - [FTD-CM] IPSec/IKE DH Shared Secret: Z - [FTD-CM] IPSec/IKE ECDH Private Key: Z - [FTD-CM] IPSec/IKE ECDH Public Key: Z - [FTD-CM] IPSec/IKE"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Access Peer ECDH Public Key: Z - [FTD-CM] IPSec/IKE ECDH Shared Secret: Z - [FTD-CM] IPSec/IKE ECDSA Private Key: Z - [FTD-CM] IPSec/IKE ECDSA Public Key: Z - [FTD-CM] IPSec/IKE RSA Private Key: Z - [FTD-CM] IPSec/IKE RSA Public Key: Z - [FTD-CM] IPSec/IKE Pre-shared Secret: Z - [FTD-CM] SKEYSEED : Z - [FTD-CM] IPSec/IKE Session Encryption Key: Z - [FTD-CM] IPSec/IKE Authenticati on Key: Z - [FTD-CM] SNMPv3 Shared Secret: Z - [FTD-CM]"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "SNMPv3 Encryption Key: Z - [FTD-CM] SNMPv3 Authenticati on Key: Z"}, {"name": "Configure Network", "description": "Sets configurati on of the systems", "indicator": "N/A", "inputs": "Command s to configure the network", "outputs": "Status of the completio n of network configurati on status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer"}, {"name": "[FTD-CM] Configure Network", "description": "Sets configurati on of the FTD-CM systems", "indicator": "N/A", "inputs": "Command s to configure the network", "outputs": "Status of the completio n of network configurati on status", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer"}, {"name": "Crypto Officer Authentic ation", "description": "CO Role Authentic ation", "indicator": "N/A", "inputs": "CO Authentic ation Request", "outputs": "Status of the CO authentica tion", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - Crypto Officer Password: W,Z"}, {"name": "[FTD-CM] Crypto Officer Authentic ation", "description": "FTD-CM CO Role Authentic ation", "indicator": "N/A", "inputs": "CO Authentic ation Request", "outputs": "Status of the CO authentica tion", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] Crypto Officer Password: W,Z"}, {"name": "User Authentic ation", "description": "User Role Authentic ation", "indicator": "N/A", "inputs": "User role authentica tion request", "outputs": "Status of the User role authentica tion", "secFunImpl": "None", "rolesSspAccess": "User - User Password: W,Z"}, {"name": "[FTD-CM] User Authentic ation", "description": "FTD-CM User Role Authentic ation", "indicator": "N/A", "inputs": "User role authentica tion request", "outputs": "Status of the User role authentica tion", "secFunImpl": "None", "rolesSspAccess": "[FTD-CM] User - [FTD-CM] User Password: W,Z"}, {"name": "Configure SSHv2 Function", "description": "Configure SSHv2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SSHv2 configura tion success status message", "inputs": "Command s to configure SSHv2", "outputs": "Status of the completio n of the SSHv2 configurati on", "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function", "rolesSspAccess": "Crypto Officer - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E"}, {"name": "[FTD-CM] Configure SSHv2 Function", "description": "Configure FTD-CM SSHv2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SSHv2 configura tion success status message", "inputs": "Command s to configure SSHv2", "outputs": "Status of the completio n of the SSHv2 configurati on", "secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM] SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function", "rolesSspAccess": "- [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E"}, {"name": "Configure HTTPS over TLSv1.2 Function", "description": "Configure HTTPS over TLSv1.2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and HTTPS over TLSv1.2 configura tion success status message", "inputs": "Command s to configure TLSv1.2", "outputs": "Status of the completio n of TLSv1.2 configurati on", "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function", "rolesSspAccess": "Crypto Officer - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E"}, {"name": "[FTD-CM] Configure HTTPS over TLSv1.2 Function", "description": "Configure FTD-CM HTTPS over TLSv1.2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin", "inputs": "Command s to configure TLSv1.2", "outputs": "Status of the completio n of TLSv1.2", "secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] TLS ECDSA"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP"}, {"name": "", "description": "", "indicator": "State: Enabled\" and HTTPS over TLSv1.2 configura tion success status message", "inputs": "", "outputs": "configurati on", "secFunImpl": "AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function", "rolesSspAccess": "Access Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E"}, {"name": "Configure IPsec/IKE v2 Function", "description": "Configure IPSec/IKE v2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" with IPsec/IK Ev2 configura tion success status message", "inputs": "Command s to configure IPsec/IKE v2", "outputs": "Status of the completio n of IPsec/IKE v2 configurati on", "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and", "rolesSspAccess": "Crypto Officer - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "IKEv2) DRBG Function", "rolesSspAccess": "Pre-shared Secret: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E"}, {"name": "[FTD-CM] Configure IPsec/IKE v2 Function", "description": "Configure FTD-CM IPSec/IKE v2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" with IPsec/IK Ev2 configura tion success status message", "inputs": "Command s to configure IPsec/IKE v2", "outputs": "Status of the completio n of IPsec/IKE v2 configurati on", "secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA KeyGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] DRBG Function", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key: W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM] IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Internal State V value: W,E - [FTD-CM] DRBG Key: W,E"}, {"name": "Configure SNMPv3 Function", "description": "Configure SNMPv3 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SNMPv3 configura tion success status message", "inputs": "Command s to configure SNMPv3", "outputs": "Status of the completio n of SNMPv3 configurati on", "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)", "rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E"}, {"name": "[FTD-CM] Configure SNMPv3 Function", "description": "Configure FTD-CM SNMPv3 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and SNMPv3 configura tion success status message", "inputs": "Command s to configure SNMPv3", "outputs": "Status of the completio n of SNMPv3 configurati on", "secFunImpl": "[FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM)", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key:"}, {"name": "Run SSHv2 Function", "description": "Execute SSHv2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SSHv2", "inputs": "Initiate SSHv2 tunnel establish ment", "outputs": "Status of SSHv2 tunnel establish ment", "secFunImpl": "KAS-ECC (SSHv2) KAS-FFC (SSHv2) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA SigGen (SSHv2,", "rolesSspAccess": "W,E Crypto Officer - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "log message", "inputs": "", "outputs": "", "secFunImpl": "Functions TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (SSHv2) Session Authentication (SSHv2) SSHv2 Keying Materials Development DRBG Function", "rolesSspAccess": "- SSH DH Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Internal State V value: W,E - DRBG Key: W,E User - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E"}, {"name": "[FTD-CM] Run SSHv2 Function", "description": "Execute FTD-CM SSHv2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SSHv2 log message", "inputs": "Initiate SSHv2 tunnel establish ment", "outputs": "Status of SSHv2 tunnel establish ment", "secFunImpl": "[FTD-CM] KAS- ECC (SSHv2) [FTD-CM] KAS- FFC (SSHv2) [FTD-CM] KTS (SSHv2 with AES and HMAC) [FTD-CM] KTS (SSHv2 with AES-GCM) [FTD-CM] RSA SigGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] ECDSA SigVer (SSHv2,", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SSH DH Private Key: W,E - [FTD-CM] SSH DH Public Key: W,E - [FTD-CM] SSH Peer DH Public Key: W,E - [FTD-CM] SSH DH Shared Secret: W,E - [FTD-CM] SSH ECDH Private Key: W,E - [FTD-CM] SSH ECDH Public Key: W,E - [FTD-CM]"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP"}, {"name": "", "description": "on", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (SSHv2) [FTD-CM] Session Authentication (SSHv2) [FTD-CM] SSHv2 Keying Materials Development [FTD-CM] DRBG Function", "rolesSspAccess": "Access SSH Peer ECDH Public Key: W,E - [FTD-CM] SSH ECDH Shared Secret: W,E - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM] SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E - [FTD-CM] SSH Session Encryption Key: W,E - [FTD-CM] SSH Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] SSH DH Private Key: W,E - [FTD-CM] SSH DH Public Key: W,E - [FTD-CM] SSH Peer DH Public Key: W,E - [FTD-CM] SSH DH Shared Secret: W,E - [FTD-CM] SSH ECDH Private Key: W,E - [FTD-CM] SSH ECDH Public Key: W,E - [FTD-CM] SSH Peer ECDH Public Key: W,E - [FTD-CM] SSH ECDH Shared Secret: W,E - [FTD-CM] SSH RSA Private Key: W,E - [FTD-CM] SSH RSA Public Key: W,E - [FTD-CM]"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Access SSH ECDSA Private Key: W,E - [FTD-CM] SSH ECDSA Public Key: W,E - [FTD-CM] SSH Session Encryption Key: W,E - [FTD-CM] SSH Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key:"}, {"name": "Run HTTPS over TLSv1.2 Function", "description": "Execute HTTPS over TLSv1.2 function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul HTTPS over", "inputs": "Initiate TLSv1.2 tunnel establish ment request", "outputs": "Status of TLSv1.2 tunnel establish ment", "secFunImpl": "KAS-ECC (TLSv1.2) KAS-FFC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2)", "rolesSspAccess": "W,E Crypto Officer - TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "TLSv1.2 log message", "inputs": "", "outputs": "", "secFunImpl": "ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (TLSv1.2) Session Authentication (TLSv1.2) TLSv1.2 Keying Materials Development DRBG Function", "rolesSspAccess": "Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - TLS Master Secret: W,E - TLS Session Encryption Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "- DRBG Internal State V value: W,E - DRBG Key: W,E User - TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "W,E - TLS Master Secret: W,E - TLS Session Encryption Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG"}, {"name": "[FTD-CM] Run HTTPS over TLSv1.2 Function", "description": "Execute FTD-CM HTTPS over TLSv1.2 function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul HTTPS over TLSv1.2 log message", "inputs": "Initiate TLSv1.2 tunnel establish ment request", "outputs": "Status of TLSv1.2 tunnel establish ment", "secFunImpl": "[FTD-CM] KAS- ECC (TLSv1.2) [FTD-CM] KAS- FFC (TLSv1.2) [FTD-CM] KTS (TLSv1.2 with AES and HMAC) [FTD-CM] KTS (TLSv1.2 with AES-GCM) [FTD-CM] RSA SigGen (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and", "rolesSspAccess": "Key: W,E [FTD-CM] Crypto Officer - [FTD-CM] TLS DH Private Key: W,E - [FTD-CM] TLS DH Public Key: W,E - [FTD-CM] TLS Peer DH Public Key: W,E - [FTD-CM] TLS DH Shared Secret: W,E - [FTD-CM] TLS ECDH Private Key: W,E - [FTD-CM]"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "IKEv2) [FTD-CM] ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (TLSv1.2) [FTD-CM] Session Authentication (TLSv1.2) [FTD-CM] TLSv1.2 Keying Materials Development [FTD-CM] DRBG Function", "rolesSspAccess": "TLS ECDH Public Key: W,E - [FTD-CM] TLS Peer ECDH Public Key: W,E - [FTD-CM] TLS ECDH Shared Secret: W,E - [FTD-CM] TLS ECDSA Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] TLS Master Secret: W,E - [FTD-CM] TLS Session Encryption Key: W,E - [FTD-CM] TLS Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "- [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] TLS DH Private Key: W,E - [FTD-CM] TLS DH Public Key: W,E - [FTD-CM] TLS Peer DH Public Key: W,E - [FTD-CM] TLS DH Shared Secret: W,E - [FTD-CM] TLS ECDH Private Key: W,E - [FTD-CM] TLS ECDH Public Key: W,E - [FTD-CM] TLS Peer ECDH Public Key: W,E - [FTD-CM] TLS ECDH Shared Secret: W,E - [FTD-CM] TLS"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "ECDSA Private Key: W,E - [FTD-CM] TLS ECDSA Public Key: W,E - [FTD-CM] TLS RSA Private Key: W,E - [FTD-CM] TLS RSA Public Key: W,E - [FTD-CM] TLS Master Secret: W,E - [FTD-CM] TLS Session Encryption Key: W,E - [FTD-CM] TLS Session Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E Crypto"}, {"name": "Run IPSec/IKE", "description": "Execute IPsec/IKE", "indicator": "Status Mode Indicator", "inputs": "Initiate IPsec/IKE v2 tunnel", "outputs": "Status of IPSec/IKE v2 tunnel", "secFunImpl": "KAS-ECC (IKEv2) KAS-FFC", "rolesSspAccess": "Officer - IPSec/IKE"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "v2 Function", "description": "v2 Function", "indicator": "\"FIPS Mode Admin State: Enabled\" and succesful IPsec/IK Ev2 log message", "inputs": "establish ment request", "outputs": "establish ment", "secFunImpl": "Functions (IKEv2) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (IPSec/IKE) Session Authentication (IPSec/IKEv2) IPSec/IKEv2 Keying Materials Development DRBG Function", "rolesSspAccess": "DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE ECDH Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": ": W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E User - IPSec/IKE DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE ECDH"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED : W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - DRBG Seed: W,E - DRBG Internal State V value: W,E - DRBG Key: W,E"}, {"name": "[FTD-CM] Run IPSec/IKE v2 Function", "description": "Execute FTD-CM IPsec/IKE v2 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin", "inputs": "Initiate IPsec/IKE v2 tunnel establish ment request", "outputs": "Status of IPSec/IKE v2 tunnel establish ment", "secFunImpl": "[FTD-CM] KAS- ECC (IKEv2) [FTD-CM] KAS- FFC (IKEv2) [FTD-CM] RSA SigGen", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] IPSec/IKE DH Private"}, {"name": "Name", "description": "Descripti", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "on", "indicator": "State: Enabled\" and succesful IPsec/IK Ev2 log message", "inputs": "", "outputs": "", "secFunImpl": "Functions (SSHv2, TLSv1.2, IKEv2) [FTD-CM] ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) [FTD-CM] RSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) [FTD-CM] Session Encryption/Decr yption (IPSec/IKE) [FTD-CM] Session Authentication (IPSec/IKEv2) [FTD-CM] IPSec/IKEv2 Keying Materials Development [FTD-CM] DRBG Function", "rolesSspAccess": "Key: W,E - [FTD-CM] IPSec/IKE DH Public Key: W,E - [FTD-CM] IPSec/IKE Peer DH Public Key: W,E - [FTD-CM] IPSec/IKE DH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDH Private Key: W,E - [FTD-CM] IPSec/IKE ECDH Public Key: W,E - [FTD-CM] IPSec/IKE Peer ECDH Public Key: W,E - [FTD-CM] IPSec/IKE ECDH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM] IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] SKEYSEED : W,E - [FTD-CM] IPSec/IKE Session Encryption Key: W,E - [FTD-CM] IPSec/IKE Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key: W,E [FTD-CM] User - [FTD-CM] IPSec/IKE DH Private Key: W,E - [FTD-CM] IPSec/IKE DH Public Key: W,E - [FTD-CM]"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "IPSec/IKE Peer DH Public Key: W,E - [FTD-CM] IPSec/IKE DH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDH Private Key: W,E - [FTD-CM] IPSec/IKE ECDH Public Key: W,E - [FTD-CM] IPSec/IKE Peer ECDH Public Key: W,E - [FTD-CM] IPSec/IKE ECDH Shared Secret: W,E - [FTD-CM] IPSec/IKE ECDSA Private Key: W,E - [FTD-CM] IPSec/IKE ECDSA Public Key: W,E - [FTD-CM] IPSec/IKE RSA Private Key: W,E - [FTD-CM] IPSec/IKE RSA Public Key: W,E - [FTD-CM]"}, {"name": "Name", "description": "Descripti on", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Access IPSec/IKE Pre-shared Secret: W,E - [FTD-CM] SKEYSEED : W,E - [FTD-CM] IPSec/IKE Session Encryption Key: W,E - [FTD-CM] IPSec/IKE Authenticati on Key: W,E - [FTD-CM] DRBG Entropy Input: W,E - [FTD-CM] DRBG Seed: W,E - [FTD-CM] DRBG Internal State V value: W,E - [FTD-CM] DRBG Key:"}, {"name": "Run SNMPv3 Function", "description": "Execute SNMPv3 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SNMPv3 log message", "inputs": "Initiate SNMPv3 tunnel establish ment request", "outputs": "Status of SNMPv3 tunnel establish ment", "secFunImpl": "Session Encryption/Decr yption (SNMPv3) Session Authentication (SNMPv3) SNMPv3 Keying Materials Development", "rolesSspAccess": "W,E Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E User - SNMPv3 Shared Secret: W,E - SNMPv3"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E"}, {"name": "[FTD-CM] Run SNMPv3 Function", "description": "Execute FTD-CM SNMPv3 Function", "indicator": "Status Mode Indicator \"FIPS Mode Admin State: Enabled\" and successf ul SNMPv3 log message", "inputs": "Initiate SNMPv3 tunnel establish ment request", "outputs": "Status of SNMPv3 tunnel establish ment", "secFunImpl": "[FTD-CM] Session Encryption/Decr yption (SNMPv3) [FTD-CM] Session Authentication (SNMPv3) [FTD-CM] SNMPv3 Keying Materials Development", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key: W,E [FTD-CM] User - [FTD-CM] SNMPv3 Shared Secret: W,E - [FTD-CM] SNMPv3 Encryption Key: W,E - [FTD-CM] SNMPv3 Authenticati on Key: W,E"}, {"name": "Firmware Load Test", "description": "Execute the Firmware Load Test", "indicator": "Successf ul Firmware Loading status message", "inputs": "Command s to load new firmware image", "outputs": "Outcome of the Firmware Load Test", "secFunImpl": "Firmware Load Test", "rolesSspAccess": "Crypto Officer - Firmware Load Test Key: R"}, {"name": "[FTD-CM] Firmware Load Test", "description": "Execute the FTD- CM Firmware Load Test", "indicator": "Successf ul Firmware Loading", "inputs": "Command s to load new firmware image", "outputs": "Outcome of the Firmware Load Test", "secFunImpl": "[FTD-CM] Firmware Load Test", "rolesSspAccess": "[FTD-CM] Crypto Officer - [FTD-CM] Firmware"}, {"name": "", "description": "", "indicator": "status message", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Load Test Key: R"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "SSHv2", "description": "Run SSHv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SSHv2 log message demonstrates the non- approved service", "alg_accessed": "3DES ChaCha20- poly1305", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] SSHv2", "description": "Run SSHv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SSHv2 log message demonstrates the non- approved service", "alg_accessed": "[FTD-CM] 3DES [FTD-CM] ChaCha20- poly1305", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}, {"name": "TLSv1", "description": "Run TLSv1 in the non-approved mode using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1 log message demonstrates the non-approved service", "alg_accessed": "3DES", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] TLSv1", "description": "Run TLSv1 in the non-approved mode using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1 log message demonstrates the non-approved service", "alg_accessed": "[FTD-CM] 3DES", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}, {"name": "TLSv1.2", "description": "Run TLSv1.2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.2 log message demonstrates the non- approved service", "alg_accessed": "3DES", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] TLSv1.2", "description": "Run TLSv1.2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.2 log message demonstrates the non- approved service", "alg_accessed": "[FTD-CM] 3DES", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}, {"name": "TLSv1.3", "description": "Run TLSv1.3 in the non-approved mode using non-approved algorithms. Non- Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.3 log message demonstrates the non-approved service", "alg_accessed": "ChaCha20- poly1305", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] TLSv1.3", "description": "Run TLSv1.3 in the non-approved mode using non-approved algorithms. Non- Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful TLSv1.3 log message demonstrates the non-approved service", "alg_accessed": "[FTD-CM] ChaCha20- poly1305", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}, {"name": "IPsec/IKEv2", "description": "Run IPsec/IKEv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful IPsec/IKEv2 log message demonstrates the non-approved service", "alg_accessed": "3DES", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] IPsec/IKEv2", "description": "Run IPsec/IKEv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful IPsec/IKEv2 log message demonstrates the non-approved service", "alg_accessed": "[FTD-CM] 3DES", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}, {"name": "SNMPv3", "description": "Run SNMPv3 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SNMPv3 log message demonstrates the non-approved service", "alg_accessed": "3DES", "role": "Crypto Officer, User"}, {"name": "[FTD-CM] SNMPv3", "description": "Run SNMPv3 using non-approved algorithms. Non-Approved mode indicator \"FIPS Mode Admin State: Disabled\" and successful SNMPv3 log message demonstrates the non-approved service", "alg_accessed": "[FTD-CM] 3DES", "role": "[FTD-CM] Crypto Officer, [FTD-CM] User"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": true, "entries": [{"mechanism": "Tamper labels (15 for 4100 Models; 12 for 9300 models) with Part Number: AIR-AP- FIPSKIT=", "inspectFreq": "Recommend 30 Days", "inspectGuidance": "Visible inspection of platform for residual evidence of tampering."}, {"mechanism": "Opacity Shield (1) with Part Number: FPR4K-SM-44S (for 4100 models) and FPR-C9300-FIPSKIT= (for 9300 models)", "inspectFreq": "Recommend 30 Days", "inspectGuidance": "Visible inspection of platform for evidence of tampering, removal or access."}]}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "DRAM", "description": "Volatile Memory", "persistance": "Dynamic"}, {"name": "Flash", "description": "Non-Volatile Memory", "persistance": "Static"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Peer Public Key Input", "source": "External (Outside of the Module's", "dest": "Module", "format": "Plaintext", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": ""}, {"name": "", "source": "Boundary )", "dest": "", "format": "", "distribution": "", "entry": "", "sfiAlgo": ""}, {"name": "Module Public Key Output", "source": "Module", "dest": "External (Outside of the Module's Boundary )", "format": "Plaintext", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": ""}, {"name": "Password/Secre t Input via SSHv2 encrypted by AES and HMAC", "source": "External (Outside of the Module's Boundary )", "dest": "Module", "format": "Encrypte d", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": "KTS (SSHv2 with AES and HMAC)"}, {"name": "Password/Secre t Input via SSHv2 encrypted by AES-GCM", "source": "External (Outside of the Module's Boundary )", "dest": "Module", "format": "Encrypte d", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": "KTS (SSHv2 with AES- GCM)"}, {"name": "Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC", "source": "External (Outside of the Module's Boundary )", "dest": "Module", "format": "Encrypte d", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)"}, {"name": "Password/Secre t Input via TLSv1.2 encrypted by AES-GCM", "source": "External (Outside of the Module's Boundary )", "dest": "Module", "format": "Encrypte d", "distribution": "Automated", "entry": "Electroni c", "sfiAlgo": "KTS (TLSv1.2 with AES- GCM)"}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Zeroization Command", "description": "CO issues zeroization service", "rationale": "The zeroization command will erase all SSPs stored in the DRAM or in the Flash of the module.", "operatorId": "'erase configuration' command"}, {"method": "Session Termination", "description": "Zeroization upon session termination", "rationale": "Session termination will automatically zeroize all session based temporary SSPs", "operatorId": "Terminate session"}, {"method": "Reboot", "description": "Zeroization upon rebooting the module", "rationale": "Reboot to zeroize all temporary SSPs stored in volatile memory", "operatorId": "Reboot"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "RSA SigVer (FIPS186-4) (A4446)", "testProps": "RSA SigVer 2048 bits with SHA2-512", "testMethod": "RSA signature verification", "type": "SW/FW Integrity", "indicator": "Module is in normal state", "details": "RSA SigVer"}, {"algorithmOrTest": "[FTD-CM] RSA SigVer (FIPS186-4) (A4446)", "testProps": "RSA SigVer 2048 bits with SHA2-512", "testMethod": "RSA signature verification", "type": "SW/FW Integrity", "indicator": "Module is in normal state", "details": "RSA SigVer [Cisco Firepower Threat Defense on 4K/9K Cryptographic Module]"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES-CBC Encrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Encrypt", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-CBC Encrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-CBC Encrypt KAT (C1026)", "testProps": "128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "AES-CBC Decrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Decrypt", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-CBC Decrypt KAT (C1026)", "testProps": "128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-CBC Decrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Authenticat ed Encrypt", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Encrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Authenticat ed Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Encrypt KAT (C1026)", "testProps": "128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Encrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Authenticat ed Decrypt", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Decrypt KAT (A4446)", "testProps": "256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Authenticat ed Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] AES-GCM Authenticated Decrypt KAT (C1026)", "testProps": "128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Decrypt [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "Counter DRBG Instantiate/Generate/Res eed KAT (A4446)", "testProps": "AES-128", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Instantiate, Generate, and Reseed KATs", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] Counter DRBG Instantiate/Generate/Res eed KAT (A4446)", "testProps": "AES-128", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Instantiate, Generate, and Reseed KATs [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-4) KAT (A4446)", "testProps": "P-256 curve with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "ECDSA SigGen KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] ECDSA SigGen (FIPS186-4) KAT (A4446)", "testProps": "P-256 curve with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "ECDSA SigGen KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-4) KAT (A4446)", "testProps": "P-256 curve with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "ECDSA SigVer KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] ECDSA SigVer (FIPS186-4) KAT (A4446)", "testProps": "P-256 curve with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "ECDSA SigVer KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "Entropy 90B Start-up Repetition Count Test (RCT)", "testProps": "Repetitio n Count Test", "testMethod": "RCT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time", "condition": "Power up"}, {"algorithmOrTest": "[FTD-CM] Entropy 90B Start-up Repetition Count Test (RCT)", "testProps": "Repetitio n Count Test", "testMethod": "RCT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time [Cisco Firepower Threat Defense on", "condition": "Power up"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "4K/9K Cryptograph ic Module]", "condition": ""}, {"algorithmOrTest": "Entropy 90B Start-up Adaptive Proportion Test (APT)", "testProps": "Adaptive Proportio n Test", "testMethod": "APT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source", "condition": "Power up"}, {"algorithmOrTest": "[FTD-CM] Entropy 90B Start-up Adaptive Proportion Test (APT)", "testProps": "Adaptive Proportio n Test", "testMethod": "APT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power up"}, {"algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RCT)", "testProps": "Repetitio n Count Test", "testMethod": "RCT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to quickly detect catastrophic failures that cause the noise source to become", "condition": "Entropy data is generated from the Entropy Source - Continuou s"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "\"stuck\" on a single output value for a long period of time", "condition": ""}, {"algorithmOrTest": "[FTD-CM] Entropy 90B Continuous Repetition Count Test (RCT)", "testProps": "Repetitio n Count Test", "testMethod": "RCT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Entropy data is generated from the Entropy Source - Continuou s"}, {"algorithmOrTest": "Entropy 90B Continuous Adaptive Proportion Test (APT)", "testProps": "Adaptive Proportio n Test", "testMethod": "APT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source", "condition": "Entropy data is generated from the Entropy Source - Continuou s"}, {"algorithmOrTest": "[FTD-CM] Entropy 90B Continuous Adaptive Proportion Test (APT)", "testProps": "Adaptive Proportio n Test", "testMethod": "APT", "type": "CAST", "indicator": "Module is in normal state", "details": "Designed to detect a large loss of entropy that might occur as a result", "condition": "Entropy data is generated from the Entropy Source -"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "of some physical failure or environment al change affecting the noise source [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Continuou s"}, {"algorithmOrTest": "HMAC-SHA-1 KAT (A4446)", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA-1", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA-1 KAT (A4446)", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA-1 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA-1 KAT (C1026)", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA-1 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "HMAC-SHA2-256 KAT (A4446)", "testProps": "SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-256", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 256 KAT (A4446)", "testProps": "SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-256 [Cisco Firepower Threat Defense on", "condition": "Power Up"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "4K/9K Cryptograph ic Module]", "condition": ""}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 256 KAT (C1026)", "testProps": "SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-256 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "HMAC-SHA2-384 KAT (A4446)", "testProps": "SHA2- 384", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-384", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 384 KAT (A4446)", "testProps": "SHA2- 384", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-384 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 384 KAT (C1026)", "testProps": "SHA2- 384", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-384 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "HMAC-SHA2-512 KAT (A4446)", "testProps": "SHA2- 512", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-512", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 512 KAT (A4446)", "testProps": "SHA2- 512", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-512 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] HMAC-SHA2- 512 KAT (C1026)", "testProps": "SHA2- 512", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "HMAC- SHA2-512 [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A4446)", "testProps": "P-256 Curve", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Primitive Z KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] KAS-ECC- SSC Sp800-56Ar3 KAT (A4446)", "testProps": "P-256 Curve", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Primitive Z KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A4446)", "testProps": "MODP- 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Primitive Z KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] KAS-FFC- SSC Sp800-56Ar3 KAT (A4446)", "testProps": "MODP- 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "Primitive Z KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "KDF IKEv2 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "N/A", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] KDF IKEv2 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "KDF SNMP KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in", "details": "N/A", "condition": "Power Up"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "normal state", "details": "", "condition": ""}, {"algorithmOrTest": "[FTD-CM] KDF SNMP KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "KDF SSH KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "N/A", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] KDF SSH KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "RSA SigGen (FIPS186- 4) KAT (A4446)", "testProps": "2048 bit modulus with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "RSA SigGen KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] RSA SigGen (FIPS186-4) KAT (A4446)", "testProps": "2048 bit modulus with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "RSA SigGen KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "RSA SigVer (FIPS186-4) KAT (A4446)", "testProps": "2048 bit modulus with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "RSA SigVer KAT", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] RSA SigVer (FIPS186-4) KAT (A4446)", "testProps": "2048 bit modulus with SHA2- 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "RSA SigVer KAT [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "SHA-1 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "N/A", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] SHA-1 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "N/A", "condition": "Power Up"}, {"algorithmOrTest": "[FTD-CM] TLS v1.2 KDF RFC7627 KAT (A4446)", "testProps": "N/A", "testMethod": "KAT", "type": "CAST", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Power Up"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS186-4) PCT (A4446)", "testProps": "Curve P- 256 with SHA2- 256", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "ECDSA", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "[FTD-CM] ECDSA KeyGen (FIPS186-4) PCT (A4446)", "testProps": "Curve P- 256 with SHA2- 256", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "ECDSA [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": "first operation al use."}, {"algorithmOrTest": "RSA KeyGen (FIPS186- 4) PCT (A4446)", "testProps": "2048 bit Modulus", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "RSA", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "[FTD-CM] RSA KeyGen (FIPS186-4) PCT (A4446)", "testProps": "2048 bit Modulus", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "RSA [Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A4446)", "testProps": "Curve P- 256 with SHA2- 256", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "N/A", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "[FTD-CM] KAS-ECC- SSC Sp800-56Ar3 PCT (A4446)", "testProps": "Curve P- 256 with SHA2- 256", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A4446)", "testProps": "MODP- 2048", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "N/A", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "[FTD-CM] KAS-FFC- SSC Sp800-56Ar3 PCT (A4446)", "testProps": "MODP- 2048", "testMethod": "PCT", "type": "PCT", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use."}, {"algorithmOrTest": "Firmware Load Test", "testProps": "HMAC- SHA2- 512", "testMethod": "KAT", "type": "SW/F W Load", "indicator": "Module is in normal state", "details": "N/A", "condition": "When firmware has been uploaded"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": "to the module"}, {"algorithmOrTest": "[FTD-CM] Firmware Load Test", "testProps": "HMAC- SHA2- 512", "testMethod": "KAT", "type": "SW/F W Load", "indicator": "Module is in normal state", "details": "[Cisco Firepower Threat Defense on 4K/9K Cryptograph ic Module]", "condition": "When firmware has been uploaded to the module"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Error State", "description": "If self-test tests fail, the module is put into an error state", "conditions": "Self-test failure", "recoveryMethod": "Reboot the module", "indicator": "System Halt"}, {"name": "[FTD-CM] Error State", "description": "If any self-test tests for the FTD- CM fail, the FTD-CM module is put into an error state", "conditions": "FTD-CM Self- test failure", "recoveryMethod": "Reboot the module", "indicator": "FTD-CM System Halt"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["HMAC-SHA2-384C1026", "SHA2-384C1026", "RSA SigGen (FIPS186-4)A4446", "HMAC-SHA-1C1026", "Safe Primes Key GenerationA4446", "KDF SNMPA4446", "KDF IKEv2A4446", "HMAC-SHA2-224A4446", "ECDSA SigGen (FIPS186-4)A4446", "KDF SSHA4446", "AES-CBCC1026", "Counter DRBGA4446", "SHA2-256C1026", "SHA2-512C1026", "HMAC-SHA2-512C1026", "ECDSA KeyGen (FIPS186-4)A4446", "KAS-ECC-SSC Sp800-56Ar3A4446", "SHA-1C1026", "SHA2-224A4446", "#46", "RSA KeyGen (FIPS186-4)A4446", "#A44", "ECDSA SigVer (FIPS186-4)A4446", "KAS-FFC-SSC Sp800-56Ar3A4446", "AES-GCMC1026", "HMAC-SHA2-256C1026", "RSA SigVer (FIPS186-4)A4446", "TLS v1.2 KDF RFC7627A4446"]}, "extracted_versions": {"_type": "Set", "elements": ["-"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": ["5456"]}, "module_prunned_references": {"_type": "Set", "elements": ["5456"]}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": {"_type": "Set", "elements": ["5456"]}, "indirectly_referencing": {"_type": "Set", "elements": ["5456"]}}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": {"_type": "Set", "elements": ["5456"]}, "indirectly_referencing": {"_type": "Set", "elements": ["5456"]}}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "8dc94571f0dc06661ea6780626b44a3bb6c1a1da32bb5de88ea2d40ef3e323f2", "txt_hash": "7a33dfba6b78bbed696a538815a7b3d385b2fe21f7ad7746711e3e85e9dd25d1", "json_hash": "146a666a5ce80b7dc875d5ba77afb829fa749c8dbeb050247863e538c96242b0"}}}