This page was not yet optimized for use on mobile devices.
u.trust Anchor
Certificate details
| Certificate ID | #5223 |
|---|---|
| Status | active |
| Validation dates | 01.04.2026 , 22.04.2026 |
| Sunset date | 31-03-2031 |
| Standard | FIPS 140-3 |
| Security level | 3 |
| Type | Hardware |
| Embodiment | MultiChipEmbed |
| Caveat | When operated in approved mode. When installed, initialized and configured as specified in Section 11.1 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | u.trust Anchor is a new generation of HSM, comprising all traditional hardware security features and introducing containerized HSMs (cHSMs). Each cHSM provides secure cryptographic services such as signing and verification of data, encryption or decryption, hashing, on-board random number generation and secure key generation, key storage and key management functions in a tamper-protected multi-tenant environment. The HSM delivers a highly elastic HSM architecture that scales rapidly on demand and enables service providers to deliver HSM as a Service (HSMaaS) in multiple use cases. |
| Vendor | Utimaco IS GmbH http://www.utimaco.com |
| Lab | Penumbra Security, Inc. |
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-, CAST, DES, TDES, Triple-DES, SM4, HMAC, CMACAsymmetric Algorithms
RSA 3072, RSA 2048, ECDH, ECDSA, ECIES, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA1, SHA-224, SHA-256, SHA-384, SHA-512, SHA256, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHA-3, SHAKE256, MD5, RIPEMD-160, PBKDFSchemes
MAC, Key AgreementProtocols
TLS, TLS 1.2Randomness
TRNG, DRBG, RBGLibraries
OpenSSLElliptic Curves
P-224, P-256, P-384, P-521, P-192, B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, B-163, K-163, secp256k1, secp224k1, sect239k1, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1, brainpoolP224t1, brainpoolP256t1, brainpoolP320t1, brainpoolP384t1, brainpoolP512t1, FRP256v1, Curve25519, Ed25519, Ed448Block cipher modes
ECB, CBC, CTR, GCMJavaCard API constants
SM2Trusted Execution Environments
PSPSecurity level
Level 3, Level 1Standards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS186-2, FIPS 180-4, FIPS 202, FIPS 186-2, SP 800-38A, SP 800-38C, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-90A, SP 800-56A, SP 800-56C, SP 800-135, SP 800-108, SP 800-56B, NIST SP 800-186, SP 800-38E, NIST SP 800-38C, NIST SP 800-90A, NIST SP 800-56A, SP 800-133, NIST SP 800-38A, NIST SP 800-38D, NIST SP 800-38B, NIST SP 800-133, NIST SP 800-108, NIST SP 800-90B, SP 800-63B, NIST SP 800-56C, PKCS 1, PKCS#1, PKCS#11, PKCS1Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5223,
"dgst": "6b25866c1f7dc45d",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"AES-GCMA6714",
"SHA3-384A6713",
"KAS-ECC-SSC Sp800-56Ar3A6717",
"EDDSA KeyVerA6716",
"RSA KeyGen (FIPS186-5)A6717",
"AES-KWPA6713",
"KDF SP800-108A6714",
"HMAC-SHA2-256A6714",
"SHA-1A6713",
"RSA SigVer (FIPS186-5)A6717",
"KDF ANS 9.63A6713",
"ECDSA SigVer (FIPS186-5)A6717",
"AES-CCMA6713",
"EDDSA SigGenA6716",
"AES-OFBA6713",
"HMAC-SHA-1A6713",
"SHA2-512A6715",
"DSA SigVer (FIPS186-4)A6713",
"HMAC-SHA2-512A6713",
"AES-GMACA6713",
"AES-CBCA6714",
"ECDSA KeyVer (FIPS186-5)A6717",
"ECDSA KeyGen (FIPS186-5)A6717",
"ECDSA SigGen (FIPS186-5)A6717",
"SHA2-224A6713",
"EDDSA KeyGenA6716",
"RSA SigVer (FIPS186-4)A6717",
"SHA3-224A6713",
"AES-ECBA6713",
"KDA OneStep SP800-56Cr2A6714",
"EDDSA SigVerA6716",
"HMAC-SHA3-512A6713",
"HMAC-SHA3-384A6713",
"SHA3-512A6713",
"ECDSA KeyVer (FIPS186-4)A6717",
"AES-CMACA6714",
"SHAKE-256A6713",
"Hash DRBGA6715",
"SHA2-256A6714",
"RSA SigGen (FIPS186-5)A6717",
"SHA2-384A6713",
"AES-KWA6713",
"HMAC-SHA2-384A6713",
"KDF TLSA6713",
"RSA SigVer (FIPS186-2)A6717",
"HMAC-SHA2-224A6713",
"HMAC-SHA3-224A6713",
"ECDSA SigVer (FIPS186-4)A6717",
"KTS-IFCA6717",
"HMAC-SHA3-256A6713",
"SHA3-256A6713"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 3
},
"ECDH": {
"ECDH": 9
},
"ECDSA": {
"ECDSA": 81
},
"ECIES": {
"ECIES": 3
}
},
"FF": {
"DH": {
"DH": 1,
"Diffie-Hellman": 3
},
"DSA": {
"DSA": 17
}
},
"RSA": {
"RSA 2048": 1,
"RSA 3072": 2
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 22
},
"CTR": {
"CTR": 7
},
"ECB": {
"ECB": 9
},
"GCM": {
"GCM": 5
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 1
}
},
"crypto_protocol": {
"TLS": {
"TLS": {
"TLS": 6,
"TLS 1.2": 2
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 4
},
"MAC": {
"MAC": 39
}
},
"device_model": {},
"ecc_curve": {
"ANSSI": {
"FRP256v1": 7
},
"Brainpool": {
"brainpoolP224t1": 4,
"brainpoolP256r1": 4,
"brainpoolP256t1": 4,
"brainpoolP320r1": 4,
"brainpoolP320t1": 5,
"brainpoolP384r1": 4,
"brainpoolP384t1": 4,
"brainpoolP512r1": 4,
"brainpoolP512t1": 4
},
"Curve": {
"Curve25519": 3
},
"Edwards": {
"Ed25519": 2,
"Ed448": 2
},
"NIST": {
"B-163": 5,
"B-233": 13,
"B-283": 12,
"B-409": 17,
"B-571": 13,
"K-163": 5,
"K-233": 17,
"K-283": 13,
"K-409": 16,
"K-571": 13,
"P-192": 22,
"P-224": 68,
"P-256": 90,
"P-384": 72,
"P-521": 116,
"secp224k1": 1,
"secp256k1": 13,
"sect239k1": 1
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"DRBG 512": 1,
"HMAC- SHA256": 1,
"HMAC-SHA-1": 2,
"PKCS 1": 30,
"PKCS#1": 2,
"PKCS#11": 2,
"PKCS1": 2,
"RSA 2048": 1,
"RSA 3072": 2,
"SHA- 3": 1,
"SHA-1": 14,
"SHA-224": 2,
"SHA-256": 1,
"SHA-3": 1,
"SHA-384": 1,
"SHA-512": 1,
"SHA1": 1,
"SHA2- 256": 5,
"SHA2- 384": 4,
"SHA2-224": 23,
"SHA2-256": 44,
"SHA2-384": 21,
"SHA2-512": 40,
"SHA256": 1,
"SHA3- 512": 3,
"SHA3-224": 23,
"SHA3-256": 23,
"SHA3-384": 24,
"SHA3-512": 19
}
},
"fips_security_level": {
"Level": {
"Level 1": 1,
"Level 3": 4
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 6
}
},
"PBKDF": {
"PBKDF": 1
},
"RIPEMD": {
"RIPEMD-160": 1
},
"SHA": {
"SHA1": {
"SHA-1": 14,
"SHA1": 1
},
"SHA2": {
"SHA-224": 2,
"SHA-256": 1,
"SHA-384": 1,
"SHA-512": 1,
"SHA256": 1
},
"SHA3": {
"SHA-3": 1,
"SHA3-224": 23,
"SHA3-256": 23,
"SHA3-384": 24,
"SHA3-512": 19
}
},
"SHAKE": {
"SHAKE256": 4
}
},
"ic_data_group": {},
"javacard_api_const": {
"curves": {
"SM2": 2
}
},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 38
},
"RNG": {
"RBG": 2
},
"TRNG": {
"TRNG": 1
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 18,
"FIPS 180-4": 10,
"FIPS 186-2": 3,
"FIPS 186-4": 21,
"FIPS 186-5": 49,
"FIPS 198-1": 12,
"FIPS 202": 6,
"FIPS186-2": 4,
"FIPS186-4": 20,
"FIPS186-5": 52
},
"NIST": {
"NIST SP 800-108": 1,
"NIST SP 800-133": 1,
"NIST SP 800-186": 3,
"NIST SP 800-38A": 2,
"NIST SP 800-38B": 1,
"NIST SP 800-38C": 1,
"NIST SP 800-38D": 1,
"NIST SP 800-56A": 1,
"NIST SP 800-56C": 1,
"NIST SP 800-90A": 2,
"NIST SP 800-90B": 2,
"SP 800-108": 4,
"SP 800-133": 1,
"SP 800-135": 3,
"SP 800-38A": 6,
"SP 800-38B": 2,
"SP 800-38C": 1,
"SP 800-38D": 3,
"SP 800-38E": 1,
"SP 800-38F": 2,
"SP 800-56A": 4,
"SP 800-56B": 4,
"SP 800-56C": 2,
"SP 800-63B": 1,
"SP 800-90A": 3
},
"PKCS": {
"PKCS 1": 15,
"PKCS#1": 1,
"PKCS#11": 1,
"PKCS1": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 27,
"AES-": 1
},
"CAST": {
"CAST": 53
}
},
"DES": {
"3DES": {
"TDES": 15,
"Triple-DES": 1
},
"DES": {
"DES": 16
}
},
"constructions": {
"MAC": {
"CMAC": 1,
"HMAC": 9
}
},
"miscellaneous": {
"SM4": {
"SM4": 2
}
}
},
"tee_name": {
"AMD": {
"PSP": 17
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"policy_metadata": {
"/Author": "Josh Klein Valente",
"/CreationDate": "D:20260330105546-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "dd040b49-83fc-40da-83e2-beaee13c9371",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-03-30T14:51:05Z",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1",
"/ModDate": "D:20260330105546-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1835705,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/108",
"https://support.hsm.utimaco.com/",
"mailto:[email protected]"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 102
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": "5f8919f735cb60ca0c3e8e44d82b7bd32cae69ec7fd8d1e57a7c453239b1865e",
"txt_hash": "9a0d4a260d3b5ff065a641670f2b7007ce3756444fa976daed38c3016b559ad3"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. When installed, initialized and configured as specified in Section 11.1 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/April 2026_010526_0732.pdf",
"date_sunset": "2031-03-31",
"description": "u.trust Anchor is a new generation of HSM, comprising all traditional hardware security features and introducing containerized HSMs (cHSMs). Each cHSM provides secure cryptographic services such as signing and verification of data, encryption or decryption, hashing, on-board random number generation and secure key generation, key storage and key management functions in a tamper-protected multi-tenant environment. The HSM delivers a highly elastic HSM architecture that scales rapidly on demand and enables service providers to deliver HSM as a Service (HSMaaS) in multiple use cases.",
"embodiment": "MultiChipEmbed",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 3,
"mentioned_certs": {},
"module_name": "u.trust Anchor",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-04-01",
"lab": "Penumbra Security, Inc.",
"validation_type": "Initial"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-04-22",
"lab": "Penumbra Security, Inc.",
"validation_type": "Update"
}
],
"vendor": "Utimaco IS GmbH",
"vendor_url": "http://www.utimaco.com"
}
}