© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 1 of 87
Red Hat, LLC
Red Hat Enterprise Linux 8 Kernel Cryptographic API
FIPS 140-3 Non-Proprietary Security Policy
Document Version: 1.1
Last Modified: 2026/07/27
Prepared by:
atsec information security corporation
4516 Seton Center Parkway, Suite 250
Austin, TX 78759
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 2 of 87
www.atsec.com
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 3 of 87
Table of Contents
1 General.......................................................................................................................................................................6
1.1 Overview ............................................................................................................................................................6
1.1.1 How this Security Policy was prepared .....................................................................................................6
1.2 Security Levels....................................................................................................................................................6
2 Cryptographic Module Specification........................................................................................................................7
2.1 Description .........................................................................................................................................................7
2.2 Tested and Vendor Affirmed Module Version and Identification ..................................................................8
2.3 Excluded Components .....................................................................................................................................10
2.4 Modes of Operation..........................................................................................................................................10
2.5 Algorithms........................................................................................................................................................10
2.6 Security Function Implementations................................................................................................................14
2.7 Algorithm Specific Information ......................................................................................................................18
2.7.1 AES GCM IV .............................................................................................................................................18
2.7.2 AES XTS ....................................................................................................................................................18
2.7.3 RSA............................................................................................................................................................19
2.7.4 SHA-3........................................................................................................................................................19
2.7.5 SHA-1........................................................................................................................................................19
2.8 RBG and Entropy .............................................................................................................................................19
2.9 Key Generation ................................................................................................................................................20
2.10 Key Establishment..........................................................................................................................................20
2.11 Industry Protocols..........................................................................................................................................20
3 Cryptographic Module Interfaces...........................................................................................................................21
3.1 Ports and Interfaces..........................................................................................................................................21
4 Roles, Services, and Authentication .......................................................................................................................22
4.1 Authentication Methods..................................................................................................................................22
4.2 Roles..................................................................................................................................................................22
4.3 Approved Services............................................................................................................................................22
4.4 Non-Approved Services ...................................................................................................................................27
4.5 External Software/Firmware Loaded...............................................................................................................27
5 Software/Firmware Security ...................................................................................................................................28
5.1 Integrity Techniques........................................................................................................................................28
5.2 Initiate on Demand ..........................................................................................................................................28
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 4 of 87
6 Operational Environment .......................................................................................................................................29
6.1 Operational Environment Type and Requirements .......................................................................................29
6.2 Configuration Settings and Restrictions..........................................................................................................29
6.3 Additional Information....................................................................................................................................29
7 Physical Security .....................................................................................................................................................30
8 Non-Invasive Security.............................................................................................................................................31
9 Sensitive Security Parameters Management ..........................................................................................................32
9.1 Storage Areas....................................................................................................................................................32
9.2 SSP Input-Output Methods .............................................................................................................................32
9.3 SSP Zeroization Methods.................................................................................................................................32
9.4 SSPs...................................................................................................................................................................33
9.5 Transitions........................................................................................................................................................38
10 Self-Tests................................................................................................................................................................39
10.1 Pre-Operational Self-Tests.............................................................................................................................39
10.2 Conditional Self-Tests....................................................................................................................................39
10.3 Periodic Self-Test Information ......................................................................................................................72
10.4 Error States .....................................................................................................................................................82
10.5 Operator Initiation of Self-Tests....................................................................................................................82
11 Life-Cycle Assurance.............................................................................................................................................83
11.1 Installation, Initialization, and Startup Procedures......................................................................................83
11.2 Administrator Guidance ................................................................................................................................83
11.3 Non-Administrator Guidance........................................................................................................................83
11.6 End of Life ......................................................................................................................................................83
12 Mitigation of Other Attacks..................................................................................................................................84
Appendix A. Glossary and Abbreviations .................................................................................................................85
Appendix B. References .............................................................................................................................................86
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 5 of 87
List of Tables
Table 1: Security Levels................................................................................................................................................6
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets) ...............................8
Table 3: Tested Operational Environments - Software, Firmware, Hybrid ..............................................................9
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid ............................................9
Table 5: Modes List and Description .........................................................................................................................10
Table 6: Approved Algorithms...................................................................................................................................13
Table 7: Non-Approved, Not Allowed Algorithms...................................................................................................14
Table 8: Security Function Implementations............................................................................................................18
Table 9: Entropy Certificates .....................................................................................................................................19
Table 10: Entropy Sources..........................................................................................................................................19
Table 11: Ports and Interfaces....................................................................................................................................21
Table 12: Roles............................................................................................................................................................22
Table 13: Approved Services......................................................................................................................................27
Table 14: Non-Approved Services .............................................................................................................................27
Table 15: Storage Areas ..............................................................................................................................................32
Table 16: SSP Input-Output Methods .......................................................................................................................32
Table 17: SSP Zeroization Methods...........................................................................................................................33
Table 18: SSP Table 1 .................................................................................................................................................36
Table 19: SSP Table 2 .................................................................................................................................................38
Table 20: Pre-Operational Self-Tests.........................................................................................................................39
Table 21: Conditional Self-Tests ................................................................................................................................72
Table 22: Pre-Operational Periodic Information......................................................................................................72
Table 23: Conditional Periodic Information .............................................................................................................82
Table 24: Error States .................................................................................................................................................82
List of Figures
Figure 1: Block Diagram...............................................................................................................................................7
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 6 of 87
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy for version kernel 4.18.0-553.123.1.el8_10;
libkcapi 1.4.0-2.el8 of the Red Hat Enterprise Linux 8 Kernel Cryptographic API module. It contains the
security rules under which the module must operate and describes how this module meets the requirements as
specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall
Security Level 1 module.
This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and intact and
including this notice. Other documentation is proprietary to their authors.
1.1.1 How this Security Policy was prepared
In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for
consolidation without altering the technical statements therein contained. The further refining of the Security
Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy
was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also
supply additional documentation, which the laboratory formatted into the existing Security Policy, and
resubmitted to the vendor for their final editing.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 1
12 Mitigation of other attacks N/A
Overall Level 1
Table 1: Security Levels
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 7 of 87
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The Red Hat Enterprise Linux 8 Kernel Cryptographic API (hereafter referred to as “the module”) provides a C
language application program interface (API) for use by other (kernel space and user space) processes that
require cryptographic functionality. The module operates on a general-purpose computer as part of the Linux
kernel. Its cryptographic functionality can be accessed using the Linux Kernel Crypto API.
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Cryptographic Boundary:
The cryptographic boundary of the module is defined as the kernel binary and the kernel crypto object files, the
libkcapi library, and the sha512hmac binary, which is used to verify the integrity of the software components.
In addition, the cryptographic boundary contains the .hmac files which store the expected integrity values for
each of the software components.
Tested Operational Environment’s Physical Perimeter (TOEPP):
The TOEPP of the module is defined as the general-purpose computer on which the module is installed.
The PAA/PAI provided by the processor are located within the module’s physical perimeter and outside of the
module’s cryptographic boundary.
Figure 1: Block Diagram
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 8 of 87
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File Name
Software/
Firmware
Version
Features Integrity Test
/boot/vmlinuz-4.18.0-553.123.1.el8_10.x86_64; *.ko
and *.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.x86_64/kernel/crypto *.ko and
*.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.x86_64/kernel/arch/x86/crypto;
/usr/lib64/libkcapi.so.1.4.0, /usr/bin/sha512hmac on
Dell PowerEdge R440
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
N/A
HMAC-SHA2-
512; Signature
Verification
with RSA
/boot/vmlinuz-4.18.0-553.123.1.el8_10.s390x; *.ko
and *.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.s390x/kernel/crypto *.ko and *.ko.xz
files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.s390x/kernel/arch/s390x/crypto;
/usr/lib64/libkcapi.so.1.4.0, /usr/bin/sha512hmac on
IBM z15 8561-T01
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
N/A
HMAC-SHA2-
512; Signature
Verification
with RSA
/boot/vmlinuz-4.18.0-553.123.1.el8_10.ppc64le; *.ko
and *.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.ppc64le/kernel/crypto *.ko and
*.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.ppc64le/kernel/arch/ppc64le/crypto;
/usr/lib64/libkcapi.so.1.4.0, /usr/bin/sha512hmac on
IBM 9009-42A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
N/A
HMAC-SHA2-
512; Signature
Verification
with RSA
/boot/vmlinuz-4.18.0-553.123.1.el8_10.ppc64le; *.ko
and *.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.ppc64le/kernel/crypto *.ko and
*.ko.xz files in /usr/lib/modules/4.18.0-
553.123.1.el8_10.ppc64le/kernel/arch/ppc64le/crypto;
/usr/lib64/libkcapi.so.1.4.0, /usr/bin/sha512hmac on
IBM 9080-HEX
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
N/A
HMAC-SHA2-
512; Signature
Verification
with RSA
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Tested Operational Environments - Software, Firmware, Hybrid:
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 9 of 87
Operating System
Hardware
Platform
Processors PAA/PAI
Hypervisor
or Host OS
Version(s)
Red Hat Enterprise Linux
8
Dell
PowerEdge
R440
Intel Xeon
Silver 4216
Yes N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8
Dell
PowerEdge
R440
Intel Xeon
Silver 4216
No N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PR/SM Driver
Level 41 with Bundle
Level H63
IBM z15
8561-T01
IBM z15 Yes N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PR/SM Driver
Level 41 with Bundle
Level H63
IBM z15
8561-T01
IBM z15 No N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PowerVM
FW950.80 with VIOS
3.1.2.00
IBM 9009-
42A
IBM
POWER9
Yes N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PowerVM
FW950.80 with VIOS
3.1.2.00
IBM 9009-
42A
IBM
POWER9
No N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PowerVM
FW1040.00 with VIOS
3.1.3.00
IBM 9080-
HEX
IBM
POWER10
Yes N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Red Hat Enterprise Linux
8 with PowerVM
FW1040.00 with VIOS
3.1.3.00
IBM 9080-
HEX
IBM
POWER10
No N/A
4.18.0-
553.123.1.el8_10;
1.4.0-2.el8
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
Operating System
Hardware
Platform
Red Hat Enterprise Linux 8 Intel Xeon E5
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid
CMVP makes no statement as to the correct operation of the module or the security strengths of the generated
keys when so ported if the specific operational environment is not listed on the validation certificate.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 10 of 87
2.3 Excluded Components
There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.
2.4 Modes of Operation
Modes List and Description:
Mode
Name
Description Type Status Indicator
Approved
mode
Automatically
entered whenever
an approved service
is requested
Approved
Mapped to approved service indicator in Section 4.3 for all
approved algorithms except GCM: respective approved
service function returns indicator 0. For GCM:
crypto_aead_get_flags(tfm) has the
CRYPTO_TFM_FIPS_COMPLIANCE flag set
Non-
approved
mode
Automatically
entered whenever a
non-approved
service is requested
Non-
Approved
No service indicator required for non-approved services per
IG 2.4.C
Table 5: Modes List and Description
Once the module is installed and initilized as per Section 11.1, after passing all pre-operational self-tests and
cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved
mode. On startup, no operator intervention is required to reach this point.
Mode Change Instructions and Status:
The module automatically switches between the approved and non-approved modes depending on the services
requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the
service that was requested.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP Cert Properties Reference
AES-CBC A7185, A7189, A7197, A7202, A7205, A7402
Direction - Decrypt,
Encrypt
Key Length - 128, 192,
256
SP 800-38A
AES-CBC-CS3 A7193, A7200, A7209
Direction - decrypt,
encrypt
Key Length - 128, 192,
256
SP 800-38A
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 11 of 87
Algorithm CAVP Cert Properties Reference
AES-CCM A7189, A7197, A7202, A7205
Key Length - 128, 192,
256
SP 800-38C
AES-CFB128 A7192, A7199, A7208
Direction - Decrypt,
Encrypt
Key Length - 128, 192,
256
SP 800-38A
AES-CMAC A7189, A7197, A7202, A7205
Direction - Generation
Key Length - 128, 192,
256
SP 800-38B
AES-CTR A7185, A7189, A7197, A7202, A7205, A7402
Direction - Decrypt,
Encrypt
Key Length - 128, 192,
256
SP 800-38A
AES-ECB
A7185, A7186, A7187, A7188, A7189, A7190,
A7191, A7197, A7201, A7202, A7203, A7204,
A7205, A7206, A7207
Direction - Decrypt,
Encrypt
Key Length - 128, 192,
256
SP 800-38A
AES-GCM
A7185, A7186, A7188, A7189, A7191, A7197,
A7202, A7204, A7205, A7207
Direction - Decrypt,
Encrypt
IV Generation - External
Key Length - 128, 192,
256
SP 800-38D
AES-GCM A7187, A7190, A7201, A7203, A7206
Direction - Encrypt
IV Generation - Internal
IV Generation Mode -
8.2.1
Key Length - 128, 192,
256
SP 800-38D
AES-GMAC A7189, A7197, A7202, A7205
Direction - Decrypt,
Encrypt
IV Generation - External
Key Length - 128, 192,
256
SP 800-38D
AES-XTS
Testing Revision
2.0
A7185, A7189, A7197, A7202, A7205, A7402
Direction - Decrypt,
Encrypt
Key Length - 128, 256
SP 800-38E
Counter DRBG
A7185, A7186, A7187, A7188, A7189, A7190,
A7191, A7197, A7201, A7202, A7203, A7204,
A7205, A7206, A7207
Prediction Resistance -
No, Yes
Mode - AES-128, AES-
192, AES-256
Derivation Function
Enabled - Yes
SP 800-90A
Rev. 1
Hash DRBG
A7185, A7186, A7187, A7188, A7189, A7190,
A7191, A7194, A7195, A7196, A7197, A7201,
A7203, A7204, A7205, A7206, A7207
Prediction Resistance -
No, Yes
SP 800-90A
Rev. 1
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 12 of 87
Algorithm CAVP Cert Properties Reference
Mode - SHA-1, SHA2-
256, SHA2-512
HMAC DRBG
A7185, A7186, A7187, A7188, A7189, A7190,
A7191, A7194, A7195, A7196, A7197, A7201,
A7203, A7204, A7205, A7206, A7207
Prediction Resistance -
No, Yes
Mode - SHA-1, SHA2-
256, SHA2-512
SP 800-90A
Rev. 1
HMAC-SHA-1 A7194, A7195, A7196, A7197, A7205
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-
224
A7194, A7195, A7196, A7197, A7205
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-
256
A7194, A7195, A7196, A7197, A7205
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-
384
A7194, A7195, A7196, A7197, A7205
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-
512
A7194, A7195, A7196, A7197, A7205
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-
224
A7198, A7210
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-
256
A7198, A7210
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-
384
A7198, A7210
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-
512
A7198, A7210
Key Length - Key
Length: 112-524288
Increment 8
FIPS 198-1
RSA SigVer
(FIPS186-5)
A7197
Modulo - 2048, 3072,
4096
Signature Type -
pkcs1v1.5
FIPS 186-5
SHA-1 A7194, A7195, A7196, A7197, A7205
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 180-4
SHA2-224 A7194, A7195, A7196, A7197, A7205
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 180-4
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 13 of 87
Algorithm CAVP Cert Properties Reference
SHA2-256 A7194, A7195, A7196, A7197, A7205
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 180-4
SHA2-384 A7194, A7195, A7196, A7197, A7205
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 180-4
SHA2-512 A7194, A7195, A7196, A7197, A7205
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 180-4
SHA3-224 A7198, A7210
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 202
SHA3-256 A7198, A7210
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 202
SHA3-384 A7198, A7210
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 202
SHA3-512 A7198, A7210
Message Length -
Message Length: 0-65536
Increment 8
Large Message Sizes - 1, 2
FIPS 202
Table 6: Approved Algorithms
Vendor-Affirmed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 14 of 87
Name Use and Function
AES-GCM with external IV Encryption with external IV (not compliant to FIPS 140-3 IG C.H)
KBKDF (libkcapi) Key derivation with implementation not tested by CAVP
HKDF (libkcapi) Key derivation with implementation not tested by CAVP
PBKDF2 (libkcapi) Password-based key derivation with implementation not tested by CAVP
RSA Encryption primitive; Decryption primitive (not compliant to SP 800-56Br2)
RSA with PKCS#1 v1.5
padding
Signature generation (pre-hashed message); Signature verification (pre-
hashed message)
Table 7: Non-Approved, Not Allowed Algorithms
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Symmetric
Encryption with
AES
BC-UnAuth
Symmetric
Encryption using
AES
AES-CBC: (A7185,
A7189, A7197,
A7202, A7205,
A7402)
AES-CBC-CS3:
(A7193, A7200,
A7209)
AES-CFB128:
(A7192, A7199,
A7208)
AES-CTR: (A7185,
A7189, A7197,
A7202, A7205,
A7402)
AES-ECB: (A7185,
A7186, A7187,
A7188, A7189,
A7190, A7191,
A7197, A7201,
A7202, A7203,
A7204, A7205,
A7206, A7207)
AES-XTS Testing
Revision 2.0:
(A7185, A7189,
A7197, A7202,
A7205, A7402)
Symmetric
Decryption with
AES
BC-UnAuth
Decrypt a
ciphertext with
AES
AES-CBC: (A7185,
A7189, A7197,
A7202, A7205,
A7402)
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 15 of 87
Name Type Description Properties Algorithms
AES-CBC-CS3:
(A7193, A7200,
A7209)
AES-CFB128:
(A7192, A7199,
A7208)
AES-CTR: (A7185,
A7189, A7197,
A7202, A7205,
A7402)
AES-ECB: (A7185,
A7186, A7187,
A7188, A7189,
A7190, A7191,
A7197, A7201,
A7202, A7203,
A7204, A7205,
A7206, A7207)
AES-XTS Testing
Revision 2.0:
(A7185, A7189,
A7197, A7202,
A7205, A7402)
Message Digest
with SHA
SHA
Compute a message
digest
SHA-1: (A7194,
A7195, A7196,
A7197, A7205)
SHA2-224: (A7194,
A7195, A7196,
A7197, A7205)
SHA2-256: (A7194,
A7195, A7196,
A7197, A7205)
SHA2-384: (A7194,
A7195, A7196,
A7197, A7205)
SHA2-512: (A7194,
A7195, A7196,
A7197, A7205)
SHA3-224: (A7198,
A7210)
SHA3-256: (A7198,
A7210)
SHA3-384: (A7198,
A7210)
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 16 of 87
Name Type Description Properties Algorithms
SHA3-512: (A7198,
A7210)
Message
Authentication
Code (MAC) with
HMAC
MAC
Compute a MAC
tag
HMAC-SHA-1:
(A7194, A7195,
A7196, A7197,
A7205)
HMAC-SHA2-224:
(A7194, A7195,
A7196, A7197,
A7205)
HMAC-SHA2-256:
(A7194, A7195,
A7196, A7197,
A7205)
HMAC-SHA2-384:
(A7194, A7195,
A7196, A7197,
A7205)
HMAC-SHA2-512:
(A7194, A7195,
A7196, A7197,
A7205)
HMAC-SHA3-224:
(A7198, A7210)
HMAC-SHA3-256:
(A7198, A7210)
HMAC-SHA3-384:
(A7198, A7210)
HMAC-SHA3-512:
(A7198, A7210)
Message
Authentication
Code (MAC) with
AES
MAC
Compute a MAC
tag
AES-CMAC:
(A7189, A7197,
A7202, A7205)
AES-GMAC:
(A7189, A7197,
A7202, A7205)
Random Number
Generation with
HMAC_DRBG
DRBG
Generate random
bitstrings
HMAC DRBG:
(A7185, A7186,
A7187, A7188,
A7189, A7190,
A7191, A7194,
A7195, A7196,
A7197, A7201,
A7203, A7204,
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 17 of 87
Name Type Description Properties Algorithms
A7205, A7206,
A7207)
Random Number
Generation with
Hash_DRBG
DRBG
Generate random
numbers from
DRBGs
Hash DRBG:
(A7185, A7186,
A7187, A7188,
A7189, A7190,
A7191, A7194,
A7195, A7196,
A7197, A7201,
A7203, A7204,
A7205, A7206,
A7207)
Random Number
Generation with
CTR_DRBG
DRBG
Generate random
numbers from
DRBGs
Counter DRBG:
(A7185, A7186,
A7187, A7188,
A7189, A7190,
A7191, A7197,
A7201, A7202,
A7203, A7204,
A7205, A7206,
A7207)
Signature
Verification with
RSA
DigSig-SigVer
Internal function
for RSA signature
verification for
integrity test for
kernel crypto
object files
Padding:PKCS#1
v1.5
Hashes:SHA-256
Key size(s):3072
bits (128 bits)
RSA SigVer
(FIPS186-5):
(A7197)
Authenticated
Symmetric
Encryption with
AES
BC-Auth
Encrypt and
authenticate a
plaintext
AES-CCM: (A7189,
A7197, A7202,
A7205)
AES-GCM: (A7185,
A7186, A7187,
A7188, A7189,
A7190, A7191,
A7197, A7201,
A7202, A7203,
A7204, A7205,
A7206, A7207)
Authenticated
Symmetric
Decryption with
AES
BC-Auth
Decrypt and
authenticate a
ciphertext
AES-CCM: (A7189,
A7197, A7202,
A7205)
AES-GCM: (A7185,
A7186, A7187,
A7188, A7189,
A7190, A7191,
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 18 of 87
Name Type Description Properties Algorithms
A7197, A7201,
A7202, A7203,
A7204, A7205,
A7206, A7207)
Table 8: Security Function Implementations
2.7 Algorithm Specific Information
2.7.1 AES GCM IV
The Crypto Officer shall consider the following requirements and restrictions when using the module.
For IPsec, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG
C.H. The mechanism for IV generation is compliant with RFC 4106. IVs generated using this mechanism may
only be used in the context of AES GCM encryption within the IPsec protocol.
The module does not implement IPsec. The module’s implementation of AES GCM is used together with an
application that runs outside the module’s cryptographic boundary. This application must use RFC 7296
compliant IKEv2 to establish the shared secret SKEYSEED from which the AES GCM encryption keys are
derived.
The design of the IPsec protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not
exhaust the maximum number of possible values for a given session key.
In the event the module’s power is lost and restored, the consuming application must ensure that a new key for
use with the AES GCM key encryption or decryption under this scenario shall be established.
The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs
from the operator. This service can be requested by invoking the crypto_aead_encrypt API function with an
AES GCM handle. When this is the case, the API will not set an approved service indicator, as described in
section 4.3.
2.7.2 AES XTS
The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 220 AES blocks, that is
16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E.
The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be
used for other purposes, such as the encryption of data in transit.
To meet the requirement stated in IG C.I, the module implements a check to ensure that the two AES keys used
in AES XTS mode are not identical. As the module does not implement symmetric key generation, this check is
performed when the keys are input by the operator. Key_1 and Key_2 shall be generated and/or established
independently according to the rules for component symmetric keys from NIST SP 800-133r2, Section 6.3.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 19 of 87
2.7.3 RSA
For RSA signature verification, the module supports modulus size 3072 bits. The supported modulus size has
been CAVP tested.
2.7.4 SHA-3
The module provides SHA-3 hash functions compliant with IG C.C. Every implementation of each SHA-3
function was tested and validated on all the module’s operating environments. SHAKE functions are not
implemented. SHA-3 hash functions are also used as part of a higher-level algorithm for HMAC.
2.7.5 SHA-1
Digital signature generation using SHA-1 is non-approved and not allowed in approved services.
2.8 RBG and Entropy
Cert
Number
Vendor
Name
E174 Red Hat, LLC
Table 9: Entropy Certificates
Name Type Operational Environment
Sample
Size
Entropy
per
Sample
Conditioning
Component
RHEL 8
Kernel CPU
Time Jitter
RNG Entropy
Source
Non-
Physical
Red Hat Enterprise Linux 8 on Dell
PowerEdge R440; Red Hat Enterprise
Linux 8 on IBM z15 8561-T01; Red Hat
Enterprise Linux 8 on IBM 9009-42A;
Red Hat Enterprise Linux 8 on IBM
9080-HEX
64 bits 57 bits
Linear-Feedback
Shift Register
(LFSR)
Table 10: Entropy Sources
The module implements three different Deterministic Random Bit Generator (DRBG) implementations based
on SP 800-90Ar1: Counter DRBG, Hash DRBG, and HMAC DRBG. Each of these DRBG implementations can
be instantiated by the operator of the module, using the parameters listed specified in the Security Function
Implementations table. When instantiated, these DRBGs can be used to generate random numbers for external
usage.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 20 of 87
The module complies with the Public Use Document for ESV certificate E174 by reading entropy data from the
jent_kcapi_random() function, which corresponds to the GetEntropy() conceptual interface. This function
outputs 256 bits of full entropy.
The operational environment on the ESV certificate is identical to the operating system described in this
document, and the entropy source is implemented inside the cryptographic boundary. Thus, the module is
compliant with scenario 1 of IG 9.3.A. There are no maintenance requirements for the entropy source.
2.9 Key Generation
The module does not provide key generation.
2.10 Key Establishment
The module does not provide key establishment.
2.11 Industry Protocols
AES GCM with internal IV generation in the approved mode is compliant with RFC 4106 and shall only be
used in conjunction with the IPsec protocol. No parts of this protocol, other than the AES GCM
implementation, have been tested by the CAVP and CMVP.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 21 of 87
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Data Input API data input parameters, AF_ALG type sockets
N/A Data Output API data output parameters, AF_ALG type sockets
N/A
Control
Input
API function calls, API control input parameters, AF_ALG type sockets, kernel
command line
N/A
Status
Output
API return values, AF_ALG type sockets, kernel logs
Table 11: Ports and Interfaces
The logical interfaces are the APIs through which the applications request services. These logical interfaces are
logically separated from each other by the API design, AF_ALG type socket that allows the applications
running in the user space to request cryptographic services from the module.
The module does not support a control output interface.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 22 of 87
4 Roles, Services, and Authentication
4.1 Authentication Methods
The module does not implement authentication.
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Role CO None
Table 12: Roles
The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the
operator of the module. No support is provided for multiple concurrent operators.
4.3 Approved Services
Name
Descriptio
n
Indicator Inputs Outputs
Security
Functions
SSP Access
Symmetric
Encryption
Symmetri
c
Encryptio
n using
AES
crypto_skcipher_setkey
returns 0
AES
key,
plaintex
t
Cipherte
xt
Symmetric
Encryption
with AES
Crypto
Officer
- AES key:
W,E
Symmetric
Decryption
Symmetri
c
Decryptio
n using
AES
crypto_skcipher_setkey
returns 0
AES
key,
cipherte
xt
Plaintext
Symmetric
Decryption
with AES
Crypto
Officer
- AES key:
W,E
Authentica
ted
Symmetric
Encryption
Encrypt
and
authentica
te a
plaintext
For all except AES GCM:
crypto_aead_setkey returns
0; For AES GCM:
crypto_aead_get_flags(tfm)
has the
CRYPTO_TFM_FIPS_COM
PLIANCE flag set
AES
key,
plaintex
t, IV
Cipherte
xt, MAC
tag
Authentica
ted
Symmetric
Encryption
with AES
Crypto
Officer
- AES key:
W,E
- GCM IV:
G,R,E
Authentica
ted
Symmetric
Decryption
Decrypt
and
authentica
te a
ciphertext
For all except AES GCM:
crypto_aead_setkey returns
0; For AES GCM:
crypto_aead_get_flags(tfm)
has the
AES
key,
cipherte
xt,
MAC
tag, IV
Plaintext
Authentica
ted
Symmetric
Decryption
with AES
Crypto
Officer
- AES key:
W,E
- GCM IV:
W,E
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 23 of 87
Name
Descriptio
n
Indicator Inputs Outputs
Security
Functions
SSP Access
CRYPTO_TFM_FIPS_COM
PLIANCE flag set
Message
Authentica
tion Code
(MAC)
Compute
a MAC tag
crypto_shash_init returns 0
AES:
AES
key,
message
;
HMAC:
HMAC
key,
message
MAC tag
Message
Authentica
tion Code
(MAC)
with AES
Message
Authentica
tion Code
(MAC)
with
HMAC
Crypto
Officer
- AES key:
W,E
- HMAC
key: W,E
Random
Number
Generation
Generate
random
bytes
crypto_rng_get_bytes
returns 0
Output
length
Random
bytes
Random
Number
Generation
with
CTR_DRB
G
Random
Number
Generation
with
HMAC_D
RBG
Random
Number
Generation
with
Hash_DRB
G
Crypto
Officer
- Entropy
input: G,E,Z
-
CTR_DRBG
Seed (IG
D.L): G,E
-
Hash_DRBG
Seed (IG
D.L): G,E
-
HMAC_DR
BG Seed (IG
D.L): G,E
-
CTR_DRBG
Internal
State (V,
Key) (IG
D.L): G,W,E
-
Hash_DRBG
Internal
State (V, C)
(IG D.L):
G,W,E
-
HMAC_DR
BG Internal
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 24 of 87
Name
Descriptio
n
Indicator Inputs Outputs
Security
Functions
SSP Access
State (V,
Key) (IG
D.L): G,W,E
Random
number
generation
using
entropy
source
Get
entropy
from a
dedicated
instance
of the
Jitter
crypto_rng_get_bytes
returns 0
Output
length
Random
bytes
None
Crypto
Officer
Message
digest
Compute
a message
digest
crypto_shash_init returns 0 Message
Digest
value
Message
Digest with
SHA
Crypto
Officer
Error
detection
code
Compute
an EDC
(crc32,
crct10dif)
None Message EDC None
Crypto
Officer
Compressio
n
Compress
data
(deflate,
lz4, lz4hc,
lzo,
zlibdeflate
, zstd)
None Data
Compres
sed data
None
Crypto
Officer
Generic
system call
Use the
kernel to
perform
various
non-
cryptogra
phic
operations
None
Identifi
er,
various
argume
nts
Various
return
values
None
Crypto
Officer
Show
module
name and
version
Return
the
module
name and
version
informatio
n
None N/A
Module
name
and
version
None
Unauthentic
ated
Show
status
Return
the
module
status
None N/A
Module
status
None
Unauthentic
ated
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 25 of 87
Name
Descriptio
n
Indicator Inputs Outputs
Security
Functions
SSP Access
Self-test
Perform
the CASTs
and
integrity
tests
None N/A
Pass/fail
result of
self-tests
Symmetric
Encryption
with AES
Authentica
ted
Symmetric
Encryption
with AES
Symmetric
Decryption
with AES
Authentica
ted
Symmetric
Decryption
with AES
Message
Digest with
SHA
Random
Number
Generation
with
CTR_DRB
G
Random
Number
Generation
with
HMAC_D
RBG
Random
Number
Generation
with
Hash_DRB
G
Message
Authentica
tion Code
(MAC)
with
HMAC
Message
Unauthentic
ated
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 26 of 87
Name
Descriptio
n
Indicator Inputs Outputs
Security
Functions
SSP Access
Authentica
tion Code
(MAC)
with AES
Signature
Verificatio
n with RSA
Zeroization
Zeroize
SSPs
None
Any
SSP
N/A None
Crypto
Officer
- AES key: Z
- HMAC
key: Z
- Entropy
input: Z
-
CTR_DRBG
Seed (IG
D.L): Z
-
Hash_DRBG
Seed (IG
D.L): Z
-
HMAC_DR
BG Seed (IG
D.L): Z
-
CTR_DRBG
Internal
State (V,
Key) (IG
D.L): Z
-
Hash_DRBG
Internal
State (V, C)
(IG D.L): Z
-
HMAC_DR
BG Internal
State (V,
Key) (IG
D.L): Z
- GCM IV: Z
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 27 of 87
Table 13: Approved Services
The table above lists the approved services. The following convention is used to specify access rights to SSPs:
• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP.
4.4 Non-Approved Services
Name Description Algorithms Role
AES GCM external IV encryption
Encrypt a plaintext using AES GCM
with an external IV
AES-GCM with
external IV
CO
Key derivation
Derive a key from a key-derivation key
or a shared secret
KBKDF (libkcapi)
HKDF (libkcapi)
CO
Password-based key derivation Derive a key from a password PBKDF2 (libkcapi) CO
RSA encryption primitive
Compute the raw RSA encryption of a
plaintext
RSA CO
RSA decryption primitive
Compute the raw RSA decryption of a
cipertext
RSA CO
RSA signature generation (pre-
hashed message)
Generate a digital signature for a pre-
hashed message
RSA with PKCS#1 v1.5
padding
CO
RSA signature verification (pre-
hashed message)
Verify a digital signature for a pre-
hashed message
RSA with PKCS#1 v1.5
padding
CO
Table 14: Non-Approved Services
4.5 External Software/Firmware Loaded
The module does not load external software or firmware.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 28 of 87
5 Software/Firmware Security
5.1 Integrity Techniques
The static kernel binary is integrity tested using an HMAC-SHA2-512 calculation performed by the
sha512hmac utility (which utilizes the module’s HMAC and SHA-512 implementations). The sha512hmac
utility first executes the HMAC-SHA2-512 self-test. After this self-test is successful, the sha512hmac utility is
used to perform an HMAC calculation of the libkcapi library, the kernel binary, and of its own binary to verify
their integrity.
After the integrity of these components has been verified, the self-test for the RSA signature verification
implementation is run. Upon successful run of this self-test, the RSA signature verification implementation of
the kernel (with PKCS#1 v1.5 padding, SHA-256, and a 3072-bit key) is used to verify the integrity of the
crypto object files listed in section 2.2 and loaded at start-up.
5.2 Initiate on Demand
Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is
initialized. The integrity tests can be invoked on demand by unloading and subsequently re-initializing the
module, which will perform (among others) the software integrity tests.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 29 of 87
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Modifiable
How Requirements are Satisfied:
The operating system provides process isolation and memory protection mechanisms that ensure appropriate
separation for memory access among the processes on the system. Each process has control over its own data
and uncontrolled access to the data of other processes is prevented.
6.2 Configuration Settings and Restrictions
The module shall be installed as stated in Section 11.1.
Instrumentation tools like the ptrace system call, gdb and strace, as well as other tracing mechanisms offered by
the Linux environment such as ftrace or systemtap, shall not be used in the operational environments. The use
of any of these tools implies that the cryptographic module is running in a non-validated operational
environment.
6.3 Additional Information
The Red Hat Enterprise Linux operating system is used as the basis of other products which include but are not
limited to:
• Red Hat Enterprise Linux CoreOS
• Red Hat Ansible Automation Platform
• Red Hat OpenStack Platform
• Red Hat OpenShift
• Red Hat Gluster Storage
• Red Hat Satellite
Compliance is maintained for these products whenever the binary is found unchanged.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 30 of 87
7 Physical Security
The module is comprised of software only and therefore this section is not applicable.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 31 of 87
8 Non-Invasive Security
This module does not implement any non-invasive security mechanism and therefore this section is not
applicable.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 32 of 87
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description
Persistence
Type
RAM Temporary storage for SSPs used by the module as part of service execution Dynamic
Table 15: Storage Areas
The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in
plaintext form. SSPs are provided to the module by the calling process and are destroyed when released by the
appropriate zeroization function calls.
9.2 SSP Input-Output Methods
Name From To
Format
Type
Distribution
Type
Entry
Type
SFI or
Algorithm
API input
parameters;
AF_ALG_type
sockets (input)
Operator calling
application
(TOEPP)
Cryptographic
module
Plaintext Manual Electronic
API output
parameters;
AF_ALG_type
sockets (output)
Cryptographic
module
Operator calling
application
(TOEPP), kernel
space
Plaintext Manual Electronic
Table 16: SSP Input-Output Methods
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator Initiation
Free cipher
handle
Zeroizes the SSPs
contained within
the cipher
handle.
Memory occupied by SSPs is
overwritten with zeroes and
then it is released, which
renders the SSP values
irretrievable. The completion of
the zeroization routine indicates
that the zeroization procedure
succeeded.
By calling the appropriate cipher
related zeroization API functions:
AES key: crypto_free_skcipher and
crypto_free_aead; HMAC key:
crypto_free_shash and
crypto_free_ahash; DRBG internal
state: crypto_free_rng
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 33 of 87
Zeroization
Method
Description Rationale Operator Initiation
Automatic
Automatically
zeroized by the
module when no
longer needed
Memory occupied by SSPs is
overwritten with zeroes, which
renders the SSP values
irretrievable.
N/A
Remove
power from
the module
De-allocates the
volatile memory
used to store SSPs
Volatile memory used by the
module is overwritten within
nanoseconds when power is
removed. Module power off
indicates that the zeroization
procedure succeeded. The
successful removal of power
implicitly indicates that the
zeroization is complete.
By removing power
Table 17: SSP Zeroization Methods
9.4 SSPs
Name Description
Size -
Strengt
h
Type -
Category
Generated By
Establishe
d By
Used By
AES key
AES key used
for
encryption,
decryption,
and
computing
MAC tags.
XTS:
128, 256
bits;
Other
modes:
128,
192, 256
bits -
XTS:
128, 256
bits;
Other
modes:
128,
192, 256
bits
Symmetric
Key - CSP
Symmetric
Encryption
with AES
Authenticated
Symmetric
Encryption
with AES
Symmetric
Decryption
with AES
Authenticated
Symmetric
Decryption
with AES
Message
Authenticatio
n Code (MAC)
with AES
HMAC key
HMAC key
used for
112-
524288
bits -
Authenticatio
n key - CSP
Message
Authenticatio
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 34 of 87
Name Description
Size -
Strengt
h
Type -
Category
Generated By
Establishe
d By
Used By
computing
MAC tags
112-256
bits
n Code (MAC)
with HMAC
Entropy input
Entropy
input used
for Random
number
generation
128-384
bits -
128-384
bits
Entropy Input
- CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
CTR_DRBG
Seed (IG D.L)
DRBG seed
derived from
Entropy
Input
256,
320, 384
bits -
128,
192, 256
bits
Seed - CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRB
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
Hash_DRBG
Seed (IG D.L)
DRBG seed
derived from
Entropy
Input
440, 888
bits -
128, 256
bits
Seed - CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRB
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 35 of 87
Name Description
Size -
Strengt
h
Type -
Category
Generated By
Establishe
d By
Used By
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
Hash_DRBG
HMAC_DRB
G Seed (IG
D.L)
DRBG seed
derived from
Entropy
Input
440, 888
bits -
128, 256
bits
Seed - CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRB
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
CTR_DRBG
Internal State
(V, Key) (IG
D.L)
Internal state
of Counter
DRBG
instance
256,
320, 384
bits -
128,
192, 256
bits
Internal state -
CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRB
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
Hash_DRBG
Internal State
(V, C) (IG
D.L)
Internal state
of Hash
DRBG
instance
880,
1776
bits -
128, 256
bits
Internal state -
CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
CTR_DRBG
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 36 of 87
Name Description
Size -
Strengt
h
Type -
Category
Generated By
Establishe
d By
Used By
Random
Number
Generation
with
HMAC_DRB
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
HMAC_DRB
G Internal
State (V, Key)
(IG D.L)
Internal state
of HMAC
DRBG
instance
320,
512,
1024
bits -
128, 256
bits
Internal state -
CSP
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRB
G
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
CTR_DRBG
Random
Number
Generation
with
HMAC_DRBG
Random
Number
Generation
with
Hash_DRBG
GCM IV
AES GCM IV
used for
authenticate
d encryption
and
decryption
96 bits -
N/A
Initialization
vector - PSP
Authenticated
Symmetric
Encryption
with AES
Authenticated
Symmetric
Encryption
with AES
Authenticated
Symmetric
Decryption
with AES
Table 18: SSP Table 1
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
AES key
API input
parameters;
RAM:Plaintext
From service
invocation to
Free cipher
handle
Remove
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 37 of 87
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
AF_ALG_type
sockets (input)
service
completion
power from
the module
HMAC key
API input
parameters;
AF_ALG_type
sockets (input)
RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
power from
the module
Entropy input RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
power from
the module
CTR_DRBG Seed
(IG D.L):Derives
Hash_DRBG Seed
(IG D.L):Derives
HMAC_DRBG
Seed (IG
D.L):Derives
CTR_DRBG Seed
(IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Automatic
Remove
power from
the module
Entropy Input (IG
D.L):Derived
From
CTR_DRBG
Internal State (V,
Key) (IG
D.L):Derives
Hash_DRBG
Seed (IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Automatic
Remove
power from
the module
Entropy Input (IG
D.L):Derived
From
Hash_DRBG
Internal State (V,
C) (IG
D.L):Derives
HMAC_DRBG
Seed (IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Automatic
Remove
power from
the module
Entropy Input (IG
D.L):Derived
From
HMAC_DRBG
Internal State (V,
Key) (IG
D.L):Derives
CTR_DRBG
Internal State (V,
Key) (IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
power from
the module
CTR_DRBG Seed
(IG D.L):Derived
From
Hash_DRBG
Internal State (V,
C) (IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
Hash_DRBG Seed
(IG D.L):Derived
From
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 38 of 87
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
power from
the module
HMAC_DRBG
Internal State (V,
Key) (IG D.L)
RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
power from
the module
HMAC_DRBG
Seed (IG
D.L):Derived
From
GCM IV
API input
parameters;
AF_ALG_type
sockets (input)
API output
parameters;
AF_ALG_type
sockets (output)
RAM:Plaintext
From service
invocation to
service
completion
Free cipher
handle
Remove
power from
the module
Table 19: SSP Table 2
9.5 Transitions
The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1,
2031.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 39 of 87
10 Self-Tests
10.1 Pre-Operational Self-Tests
Algorithm or
Test
Test
Properties
Test Method Test Type Indicator Details
HMAC-
SHA2-512
128-bit key
Message
Authentication
SW/FW
Integrity
Module becomes
operational and
services are
available for use.
Integrity test for
kernel binary, libkcapi
components and
sha512hmac binary
RSA SigVer
(FIPS186-5)
(A7197)
3072-bit key
with SHA-
256
Signature
Verification
SW/FW
Integrity
Module becomes
operational and
services are
available for use.
Integrity test for
kernel crypto object
files
Table 20: Pre-Operational Self-Tests
The pre-operational software integrity tests are performed automatically when the module is powered on,
before the module transitions into the operational state. The algorithms used for the integrity test (i.e., HMAC-
SHA2-512 and RSA SigVer with 3072-bit key) run their CASTs before the integrity test is performed. While the
module is executing the self-tests, services are not available, and data output (via the data output interface) is
inhibited until the pre-operational software integrity self-tests are successfully completed. The module
transitions to the operational state only after the pre-operational self-tests are passed successfully.
10.2 Conditional Self-Tests
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA-1
(A7194)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA-1
(A7195)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA-1
(A7196)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
Message digest
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 40 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use.
SHA-1
(A7197)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA-1
(A7205)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-224
(A7194)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-224
(A7195)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-224
(A7196)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-224
(A7197)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-224
(A7205)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 41 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-256
(A7194)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-256
(A7195)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-256
(A7196)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-256
(A7197)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-256
(A7205)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-384
(A7194)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-384
(A7195)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-384
(A7196)
0-8184 bit
messages
KAT CAST
Module
becomes
Message digest
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 42 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
operational
and services
are available
for use.
SHA2-384
(A7197)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-384
(A7205)
0-8184 bit
messages
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-512
(A7194)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-512
(A7195)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-512
(A7196)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-512
(A7197)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA2-512
(A7205)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
Message digest
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 43 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use.
SHA3-224
(A7198)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-224
(A7210)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-256
(A7198)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-256
(A7210)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-384
(A7198)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-384
(A7210)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
SHA3-512
(A7198)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 44 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA3-512
(A7210)
0-8184 bit
message
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message digest
Module
initialization
AES-ECB -
Encrypt
(A7185)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7186)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7187)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7188)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7190)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 45 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB -
Encrypt
(A7191)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7201)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7202)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7203)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7204)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 46 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB -
Encrypt
(A7206)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Encrypt
(A7207)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-ECB -
Decrypt
(A7185)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7186)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7187)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7188)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 47 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB -
Decrypt
(A7190)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7191)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7201)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7202)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7203)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7204)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 48 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-ECB -
Decrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7206)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-ECB -
Decrypt
(A7207)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC -
Encrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CBC -
Encrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CBC -
Encrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CBC -
Encrypt
(A7402)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 49 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CBC -
Decrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC -
Decrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC -
Decrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC -
Decrypt
(A7402)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC-
CS3 -
Encrypt
(A7193)
128 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CBC-
CS3 -
Encrypt
(A7200)
128 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CBC-
CS3 -
Encrypt
(A7209)
128 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 50 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CFB128
- Encrypt
(A7192)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CFB128
- Encrypt
(A7199)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CFB128
- Encrypt
(A7208)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CTR -
Encrypt
(A7185)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CTR -
Encrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CTR -
Encrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CTR -
Encrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 51 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CTR -
Encrypt
(A7402)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CCM -
Encrypt
(A7189)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CCM -
Encrypt
(A7197)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CCM -
Encrypt
(A7205)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7185)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7186)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7187)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 52 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM -
Encrypt
(A7188)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7189)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7190)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7191)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7197)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7201)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7202)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 53 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM -
Encrypt
(A7203)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7204)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7205)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7206)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-GCM -
Encrypt
(A7207)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Encrypt
(A7189)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Encrypt
(A7197)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-XTS
Testing
128 and 256 bit
keys
KAT CAST
Module
becomes
Encryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 54 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
Revision 2.0 -
Encrypt
(A7202)
operational
and services
are available
for use.
AES-XTS
Testing
Revision 2.0 -
Encrypt
(A7205)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Encrypt
(A7402)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Encryption
Module
initialization
AES-CMAC -
Encrypt
(A7189)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
AES-CMAC -
Encrypt
(A7197)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
AES-CMAC -
Encrypt
(A7205)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
AES-CBC-
CS3 -
Decrypt
(A7193)
128 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CBC-
CS3 -
Decrypt
(A7200)
128 bit keys KAT CAST
Module
becomes
operational
and services
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 55 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use.
AES-CBC-
CS3 -
Decrypt
(A7209)
128 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CFB128
- Decrypt
(A7192)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CFB128
- Decrypt
(A7199)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CFB128
- Decrypt
(A7208)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CTR -
Decrypt
(A7185)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CTR -
Decrypt
(A7189)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CTR -
Decrypt
(A7197)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 56 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CTR -
Decrypt
(A7205)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CTR -
Decrypt
(A7402)
128, 192, 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CCM -
Decrypt
(A7189)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CCM -
Decrypt
(A7197)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CCM -
Decrypt
(A7205)
128, 192, 256 bit
keys; 128-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7185)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7186)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 57 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM -
Decrypt
(A7187)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7188)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7189)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7190)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7191)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7197)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7201)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 58 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM -
Decrypt
(A7202)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7203)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7204)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7205)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7206)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-GCM -
Decrypt
(A7207)
128, 192, 256 bit
keys, 96-bit IVs
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Decrypt
(A7189)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-XTS
Testing
128 and 256 bit
keys
KAT CAST
Module
becomes
Decryption
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 59 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
Revision 2.0 -
Decrypt
(A7197)
operational
and services
are available
for use.
AES-XTS
Testing
Revision 2.0 -
Decrypt
(A7202)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Decrypt
(A7205)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-XTS
Testing
Revision 2.0 -
Decrypt
(A7402)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Decryption
Module
initialization
AES-CMAC -
Decrypt
(A7189)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
AES-CMAC -
Decrypt
(A7197)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
AES-CMAC -
Decrypt
(A7205)
128 and 256 bit
keys
KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-SHA-
1 (A7194)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
Message
authentication
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 60 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use.
HMAC-SHA-
1 (A7195)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-SHA-
1 (A7196)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-SHA-
1 (A7197)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-SHA-
1 (A7205)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-224
(A7194)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-224
(A7195)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-224
(A7196)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 61 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-
SHA2-224
(A7197)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-224
(A7205)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-256
(A7194)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-256
(A7195)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-256
(A7196)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-256
(A7197)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-256
(A7205)
32-64 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 62 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-
SHA2-384
(A7194)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-384
(A7195)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-384
(A7196)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-384
(A7197)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-384
(A7205)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA2-512
(A7194)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization.
Before
integrity test.
HMAC-
SHA2-512
(A7195)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization.
Before
integrity test.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 63 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-
SHA2-512
(A7196)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization.
Before
integrity test.
HMAC-
SHA2-512
(A7197)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization.
Before
integrity test.
HMAC-
SHA2-512
(A7205)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization.
Before
integrity test.
HMAC-
SHA3-224
(A7198)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-224
(A7210)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-256
(A7198)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-256
(A7210)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 64 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-
SHA3-384
(A7198)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-384
(A7210)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-512
(A7198)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
HMAC-
SHA3-512
(A7210)
32-1048 bit keys KAT CAST
Module
becomes
operational
and services
are available
for use.
Message
authentication
Module
initialization
Counter
DRBG
(A7185)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7186)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7187)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 65 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
Counter
DRBG
(A7188)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7189)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7190)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7191)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7197)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7201)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7202)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 66 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
Counter
DRBG
(A7203)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7204)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7205)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7206)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Counter
DRBG
(A7207)
128, 192, 256 bit
keys
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7185)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7186)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7187)
SHA-256
With/without PR;
KAT CAST
Module
becomes
SP 800-90Ar1
(instantiate,
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 67 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
Health test per
section 11.3 of SP
800-90Arev1
operational
and services
are available
for use.
reseed, generate)
health test
Hash DRBG
(A7188)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7189)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7190)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7191)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7194)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7195)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7196)
SHA-256
With/without PR;
Health test per
KAT CAST
Module
becomes
operational
and services
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 68 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
section 11.3 of SP
800-90Arev1
are available
for use.
Hash DRBG
(A7197)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7201)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7203)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7204)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7205)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7206)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
Hash DRBG
(A7207)
SHA-256
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 69 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC
DRBG
(A7185)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7186)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7187)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7188)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7189)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7190)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7191)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 70 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC
DRBG
(A7194)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7195)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7196)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7197)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7201)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7203)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7204)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 71 of 87
Algorithm or
Test
Test Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC
DRBG
(A7205)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7206)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
HMAC
DRBG
(A7207)
SHA-256, SHA512
With/without PR;
Health test per
section 11.3 of SP
800-90Arev1
KAT CAST
Module
becomes
operational
and services
are available
for use.
SP 800-90Ar1
(instantiate,
reseed, generate)
health test
Module
initialization
RSA SigVer
(FIPS186-5)
(A7197)
4096-bit key with
SHA-256
KAT CAST
Module
becomes
operational
and services
are available
for use.
Verify
Module
initialization.
Before
integrity test.
Entropy
Source - Init
RCT
1024 samples RCT CAST
Module
becomes
operational
and services
are available
for use.
Entropy source
start-up test
Entropy source
initialization
Entropy
Source - Init
APT
1024 samples APT CAST
Module
becomes
operational
and services
are available
for use.
Entropy source
start-up test
Entropy source
initialization
Entropy
Source -
Continuous
RCT
Cutoff C = 61 RCT CAST
Entropy
source is
operational
Entropy source
continuous test
Continuously
Entropy
Source -
Continuous
APT
Cutoff C = 355 APT CAST
Entropy
source is
operational
Entropy source
continuous test
Continuously
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 72 of 87
Table 21: Conditional Self-Tests
The module performs self-tests on all approved cryptographic algorithms as part of the approved services
supported in the approved mode of operation, using the tests shown in the table above. Services are not
available, and data output (via the data output interface) is inhibited during the conditional self-tests. If any of
these tests fails, the module transitions to the Error State.
10.3 Periodic Self-Test Information
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-512
Message
Authentication
SW/FW Integrity On demand Manually
RSA SigVer
(FIPS186-5)
(A7197)
Signature
Verification
SW/FW Integrity On demand Manually
Table 22: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
SHA-1 (A7194) KAT CAST On demand Manually
SHA-1 (A7195) KAT CAST On demand Manually
SHA-1 (A7196) KAT CAST On demand Manually
SHA-1 (A7197) KAT CAST On demand Manually
SHA-1 (A7205) KAT CAST On demand Manually
SHA2-224 (A7194) KAT CAST On demand Manually
SHA2-224 (A7195) KAT CAST On demand Manually
SHA2-224 (A7196) KAT CAST On demand Manually
SHA2-224 (A7197) KAT CAST On demand Manually
SHA2-224 (A7205) KAT CAST On demand Manually
SHA2-256 (A7194) KAT CAST On demand Manually
SHA2-256 (A7195) KAT CAST On demand Manually
SHA2-256 (A7196) KAT CAST On demand Manually
SHA2-256 (A7197) KAT CAST On demand Manually
SHA2-256 (A7205) KAT CAST On demand Manually
SHA2-384 (A7194) KAT CAST On demand Manually
SHA2-384 (A7195) KAT CAST On demand Manually
SHA2-384 (A7196) KAT CAST On demand Manually
SHA2-384 (A7197) KAT CAST On demand Manually
SHA2-384 (A7205) KAT CAST On demand Manually
SHA2-512 (A7194) KAT CAST On demand Manually
SHA2-512 (A7195) KAT CAST On demand Manually
SHA2-512 (A7196) KAT CAST On demand Manually
SHA2-512 (A7197) KAT CAST On demand Manually
SHA2-512 (A7205) KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 73 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
SHA3-224 (A7198) KAT CAST On demand Manually
SHA3-224 (A7210) KAT CAST On demand Manually
SHA3-256 (A7198) KAT CAST On demand Manually
SHA3-256 (A7210) KAT CAST On demand Manually
SHA3-384 (A7198) KAT CAST On demand Manually
SHA3-384 (A7210) KAT CAST On demand Manually
SHA3-512 (A7198) KAT CAST On demand Manually
SHA3-512 (A7210) KAT CAST On demand Manually
AES-ECB - Encrypt
(A7185)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7186)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7187)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7188)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7189)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7190)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7191)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7197)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7201)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7202)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7203)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7204)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7205)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7206)
KAT CAST On demand Manually
AES-ECB - Encrypt
(A7207)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7185)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7186)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7187)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 74 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
AES-ECB - Decrypt
(A7188)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7189)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7190)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7191)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7197)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7201)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7202)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7203)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7204)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7205)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7206)
KAT CAST On demand Manually
AES-ECB - Decrypt
(A7207)
KAT CAST On demand Manually
AES-CBC -
Encrypt (A7189)
KAT CAST On demand Manually
AES-CBC -
Encrypt (A7197)
KAT CAST On demand Manually
AES-CBC -
Encrypt (A7205)
KAT CAST On demand Manually
AES-CBC -
Encrypt (A7402)
KAT CAST On demand Manually
AES-CBC -
Decrypt (A7189)
KAT CAST On demand Manually
AES-CBC -
Decrypt (A7197)
KAT CAST On demand Manually
AES-CBC -
Decrypt (A7205)
KAT CAST On demand Manually
AES-CBC -
Decrypt (A7402)
KAT CAST On demand Manually
AES-CBC-CS3 -
Encrypt (A7193)
KAT CAST On demand Manually
AES-CBC-CS3 -
Encrypt (A7200)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 75 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
AES-CBC-CS3 -
Encrypt (A7209)
KAT CAST On demand Manually
AES-CFB128 -
Encrypt (A7192)
KAT CAST On demand Manually
AES-CFB128 -
Encrypt (A7199)
KAT CAST On demand Manually
AES-CFB128 -
Encrypt (A7208)
KAT CAST On demand Manually
AES-CTR -
Encrypt (A7185)
KAT CAST On demand Manually
AES-CTR -
Encrypt (A7189)
KAT CAST On demand Manually
AES-CTR -
Encrypt (A7197)
KAT CAST On demand Manually
AES-CTR -
Encrypt (A7205)
KAT CAST On demand Manually
AES-CTR -
Encrypt (A7402)
KAT CAST On demand Manually
AES-CCM -
Encrypt (A7189)
KAT CAST On demand Manually
AES-CCM -
Encrypt (A7197)
KAT CAST On demand Manually
AES-CCM -
Encrypt (A7205)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7185)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7186)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7187)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7188)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7189)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7190)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7191)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7197)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7201)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7202)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 76 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
AES-GCM -
Encrypt (A7203)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7204)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7205)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7206)
KAT CAST On demand Manually
AES-GCM -
Encrypt (A7207)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Encrypt (A7189)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Encrypt (A7197)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Encrypt (A7202)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Encrypt (A7205)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Encrypt (A7402)
KAT CAST On demand Manually
AES-CMAC -
Encrypt (A7189)
KAT CAST On demand Manually
AES-CMAC -
Encrypt (A7197)
KAT CAST On demand Manually
AES-CMAC -
Encrypt (A7205)
KAT CAST On demand Manually
AES-CBC-CS3 -
Decrypt (A7193)
KAT CAST On demand Manually
AES-CBC-CS3 -
Decrypt (A7200)
KAT CAST On demand Manually
AES-CBC-CS3 -
Decrypt (A7209)
KAT CAST On demand Manually
AES-CFB128 -
Decrypt (A7192)
KAT CAST On demand Manually
AES-CFB128 -
Decrypt (A7199)
KAT CAST On demand Manually
AES-CFB128 -
Decrypt (A7208)
KAT CAST On demand Manually
AES-CTR -
Decrypt (A7185)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 77 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
AES-CTR -
Decrypt (A7189)
KAT CAST On demand Manually
AES-CTR -
Decrypt (A7197)
KAT CAST On demand Manually
AES-CTR -
Decrypt (A7205)
KAT CAST On demand Manually
AES-CTR -
Decrypt (A7402)
KAT CAST On demand Manually
AES-CCM -
Decrypt (A7189)
KAT CAST On demand Manually
AES-CCM -
Decrypt (A7197)
KAT CAST On demand Manually
AES-CCM -
Decrypt (A7205)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7185)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7186)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7187)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7188)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7189)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7190)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7191)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7197)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7201)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7202)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7203)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7204)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7205)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7206)
KAT CAST On demand Manually
AES-GCM -
Decrypt (A7207)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 78 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
AES-XTS Testing
Revision 2.0 -
Decrypt (A7189)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Decrypt (A7197)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Decrypt (A7202)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Decrypt (A7205)
KAT CAST On demand Manually
AES-XTS Testing
Revision 2.0 -
Decrypt (A7402)
KAT CAST On demand Manually
AES-CMAC -
Decrypt (A7189)
KAT CAST On demand Manually
AES-CMAC -
Decrypt (A7197)
KAT CAST On demand Manually
AES-CMAC -
Decrypt (A7205)
KAT CAST On demand Manually
HMAC-SHA-1
(A7194)
KAT CAST On demand Manually
HMAC-SHA-1
(A7195)
KAT CAST On demand Manually
HMAC-SHA-1
(A7196)
KAT CAST On demand Manually
HMAC-SHA-1
(A7197)
KAT CAST On demand Manually
HMAC-SHA-1
(A7205)
KAT CAST On demand Manually
HMAC-SHA2-224
(A7194)
KAT CAST On demand Manually
HMAC-SHA2-224
(A7195)
KAT CAST On demand Manually
HMAC-SHA2-224
(A7196)
KAT CAST On demand Manually
HMAC-SHA2-224
(A7197)
KAT CAST On demand Manually
HMAC-SHA2-224
(A7205)
KAT CAST On demand Manually
HMAC-SHA2-256
(A7194)
KAT CAST On demand Manually
HMAC-SHA2-256
(A7195)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 79 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A7196)
KAT CAST On demand Manually
HMAC-SHA2-256
(A7197)
KAT CAST On demand Manually
HMAC-SHA2-256
(A7205)
KAT CAST On demand Manually
HMAC-SHA2-384
(A7194)
KAT CAST On demand Manually
HMAC-SHA2-384
(A7195)
KAT CAST On demand Manually
HMAC-SHA2-384
(A7196)
KAT CAST On demand Manually
HMAC-SHA2-384
(A7197)
KAT CAST On demand Manually
HMAC-SHA2-384
(A7205)
KAT CAST On demand Manually
HMAC-SHA2-512
(A7194)
KAT CAST On demand Manually
HMAC-SHA2-512
(A7195)
KAT CAST On demand Manually
HMAC-SHA2-512
(A7196)
KAT CAST On demand Manually
HMAC-SHA2-512
(A7197)
KAT CAST On demand Manually
HMAC-SHA2-512
(A7205)
KAT CAST On demand Manually
HMAC-SHA3-224
(A7198)
KAT CAST On demand Manually
HMAC-SHA3-224
(A7210)
KAT CAST On demand Manually
HMAC-SHA3-256
(A7198)
KAT CAST On demand Manually
HMAC-SHA3-256
(A7210)
KAT CAST On demand Manually
HMAC-SHA3-384
(A7198)
KAT CAST On demand Manually
HMAC-SHA3-384
(A7210)
KAT CAST On demand Manually
HMAC-SHA3-512
(A7198)
KAT CAST On demand Manually
HMAC-SHA3-512
(A7210)
KAT CAST On demand Manually
Counter DRBG
(A7185)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 80 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
Counter DRBG
(A7186)
KAT CAST On demand Manually
Counter DRBG
(A7187)
KAT CAST On demand Manually
Counter DRBG
(A7188)
KAT CAST On demand Manually
Counter DRBG
(A7189)
KAT CAST On demand Manually
Counter DRBG
(A7190)
KAT CAST On demand Manually
Counter DRBG
(A7191)
KAT CAST On demand Manually
Counter DRBG
(A7197)
KAT CAST On demand Manually
Counter DRBG
(A7201)
KAT CAST On demand Manually
Counter DRBG
(A7202)
KAT CAST On demand Manually
Counter DRBG
(A7203)
KAT CAST On demand Manually
Counter DRBG
(A7204)
KAT CAST On demand Manually
Counter DRBG
(A7205)
KAT CAST On demand Manually
Counter DRBG
(A7206)
KAT CAST On demand Manually
Counter DRBG
(A7207)
KAT CAST On demand Manually
Hash DRBG
(A7185)
KAT CAST On demand Manually
Hash DRBG
(A7186)
KAT CAST On demand Manually
Hash DRBG
(A7187)
KAT CAST On demand Manually
Hash DRBG
(A7188)
KAT CAST On demand Manually
Hash DRBG
(A7189)
KAT CAST On demand Manually
Hash DRBG
(A7190)
KAT CAST On demand Manually
Hash DRBG
(A7191)
KAT CAST On demand Manually
Hash DRBG
(A7194)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 81 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
Hash DRBG
(A7195)
KAT CAST On demand Manually
Hash DRBG
(A7196)
KAT CAST On demand Manually
Hash DRBG
(A7197)
KAT CAST On demand Manually
Hash DRBG
(A7201)
KAT CAST On demand Manually
Hash DRBG
(A7203)
KAT CAST On demand Manually
Hash DRBG
(A7204)
KAT CAST On demand Manually
Hash DRBG
(A7205)
KAT CAST On demand Manually
Hash DRBG
(A7206)
KAT CAST On demand Manually
Hash DRBG
(A7207)
KAT CAST On demand Manually
HMAC DRBG
(A7185)
KAT CAST On demand Manually
HMAC DRBG
(A7186)
KAT CAST On demand Manually
HMAC DRBG
(A7187)
KAT CAST On demand Manually
HMAC DRBG
(A7188)
KAT CAST On demand Manually
HMAC DRBG
(A7189)
KAT CAST On demand Manually
HMAC DRBG
(A7190)
KAT CAST On demand Manually
HMAC DRBG
(A7191)
KAT CAST On demand Manually
HMAC DRBG
(A7194)
KAT CAST On demand Manually
HMAC DRBG
(A7195)
KAT CAST On demand Manually
HMAC DRBG
(A7196)
KAT CAST On demand Manually
HMAC DRBG
(A7197)
KAT CAST On demand Manually
HMAC DRBG
(A7201)
KAT CAST On demand Manually
HMAC DRBG
(A7203)
KAT CAST On demand Manually
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 82 of 87
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC DRBG
(A7204)
KAT CAST On demand Manually
HMAC DRBG
(A7205)
KAT CAST On demand Manually
HMAC DRBG
(A7206)
KAT CAST On demand Manually
HMAC DRBG
(A7207)
KAT CAST On demand Manually
RSA SigVer
(FIPS186-5)
(A7197)
KAT CAST On demand Manually
Entropy Source -
Init RCT
RCT CAST On demand Manually
Entropy Source -
Init APT
APT CAST On demand Manually
Entropy Source -
Continuous RCT
RCT CAST On demand Manually
Entropy Source -
Continuous APT
APT CAST On demand Manually
Table 23: Conditional Periodic Information
10.4 Error States
Name Description Conditions Recovery Method Indicator
Error
State
The Linux kernel immediately stops
executing
Any self-test
failure
Restart of the
module
Kernel
Panic
Table 24: Error States
In the Error State, the output interface is inhibited, and the module accepts no more inputs or requests (as the
module is no longer running).
10.5 Operator Initiation of Self-Tests
All self-tests, with the exception of the continuous health tests, can be invoked on demand by unloading and
subsequently re-initializing the module.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 83 of 87
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
The module is distributed as a part of the Red Hat Enterprise Linux 8 (RHEL 8) package in the form of the
kernel-4.18.0-553.123.1.el8_10, libkcapi-1.4.0-2.el8, and libkcapi-hmaccalc-1.4.0-2.el8 RPM packages.
The module can achieve FIPS validated configuration by:
• For installation add the fips=1 option to the kernel command line during the system installation.
During the software selection stage, do not install any third-party software. More information can be
found at the vendor documentation.
• Switching the system into the approved mode the installation. Execute the fips-mode-setup --enable
command. Restart the system. More information can be found at the vendor documentation.
In both cases, the Crypto Officer must verify the RHEL 8 system operates in the approved mode by executing
the “fips-mode-setup --check” command, which should output “FIPS mode is enabled.”
11.2 Administrator Guidance
After installation of the kernel-4.18.0-553.123.1.el8_10, libkcapi-1.4.0-2.el8, and libkcapi-hmaccalc-1.4.0-2.el8
RPM packages, the Crypto Officer must execute the “cat /proc/sys/crypto/fips_name” command. The Crypto
Officer must ensure that the proper name is listed in the output as follows:
Red Hat Enterprise Linux 8 - Kernel Cryptographic API
Then, the Crypto Officer must execute the “cat /proc/sys/crypto/fips_version” and “rpm -q libkcapi” commands.
These commands must output the following (one line per output):
4.18.0-553.123.1.el8_10.x86_64
libkcapi-1.4.0-2.el8.x86_64
11.3 Non-Administrator Guidance
There is no non-administrator guidance.
11.6 End of Life
As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the
module. This will zeroize all SSPs in volatile memory. Then, if desired, the kernel-4.18.0-553.123.1.el8_10,
libkcapi-1.4.0-2.el8, and libkcapi-hmaccalc-1.4.0-2.el8 RPM packages can be uninstalled from the RHEL 8
system.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 84 of 87
12 Mitigation of Other Attacks
The module does not offer mitigation of other attacks and therefore this section is not applicable.
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 85 of 87
Appendix A. Glossary and Abbreviations
AES Advanced Encryption Standard
API Application Programming Interface
CAST Cryptographic Algorithm Self-Test
CAVP Cryptographic Algorithm Validation Program
CBC Cipher Block Chaining
CCM Counter with Cipher Block Chaining-Message Authentication Code
CFB Cipher Feedback
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
CTR Counter
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
FIPS Federal Information Processing Standards
GCM Galois Counter Mode
GMAC Galois Counter Mode Message Authentication Code
HMAC Keyed-Hash Message Authentication Code
IPsec Internet Protocol Security
KAT Known Answer Test
MAC Message Authentication Code
NIST National Institute of Science and Technology
PAA Processor Algorithm Acceleration
PKCS Public-Key Cryptography Standards
RSA Rivest, Shamir, Addleman
SHA Secure Hash Algorithm
SSP Sensitive Security Parameter
XTS XEX-based Tweaked-codebook mode with cipher text Stealing
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 86 of 87
Appendix B. References
FIPS 140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules
March 2019
https://doi.org/10.6028/NIST.FIPS.140-3
FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module
Validation Program
18 April 2025
https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-
ig-announcements
FIPS 180-4 Secure Hash Standard (SHS)
March 2012
https://doi.org/10.6028/NIST.FIPS.180-4
FIPS 186-5 Digital Signature Standard (DSS)
February 2023
https://doi.org/10.6028/NIST.FIPS.186-5
FIPS 197 Advanced Encryption Standard
May 2023
https://doi.org/10.6028/NIST.FIPS.197-upd1
FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC)
July 2008
https://doi.org/10.6028/NIST.FIPS.198-1
FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
August 2015
https://doi.org/10.6028/NIST.FIPS.202
PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications
Version 2.1
February 2003
https://www.ietf.org/rfc/rfc3447.txt
RFC 4106 The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload
(ESP)
June 2005
https://www.rfc-editor.org/rfc/rfc4106.txt
RFC 7296 Internet Key Exchange Protocol Version 2 (IKEv2)
June 2005
https://www.rfc-editor.org/rfc/rfc7296.txt
SP 800-38A Recommendation for Block Cipher Modes of Operation Methods and Techniques
December 2001
https://doi.org/10.6028/NIST.SP.800-38A
© 2026 Red Hat, LLC/ atsec information security corporation.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 87 of 87
SP 800-38B Recommendation for Block Cipher Modes of Operation: The CMAC Mode for
Authentication
May 2005
https://doi.org/10.6028/NIST.SP.800-38B
SP 800-38C Recommendation for Block Cipher Modes of Operation: the CCM Mode for
Authentication and Confidentiality
May 2004
https://doi.org/10.6028/NIST.SP.800-38C
SP 800-38D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode
(GCM) and GMAC
November 2007
https://doi.org/10.6028/NIST.SP.800-38D
SP 800-38E Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for
Confidentiality on Storage Devices
January 2010
https://doi.org/10.6028/NIST.SP.800-38E
SP 800-38F Recommendation for Block Cipher Modes of Operation: Methods for Key
Wrapping
December 2012
https://doi.org/10.6028/NIST.SP.800-38F
SP 800-90A Rev. 1 Recommendation for Random Number Generation Using Deterministic Random
Bit Generators
June 2015
https://doi.org/10.6028/NIST.SP.800-90Ar1
SP 800-140B Rev. 1 Cryptographic Module Validation Program (CMVP) Security Policy Requirements
November 2023
https://doi.org/10.6028/NIST.SP.800-140Br1