##### Prepared by: atsec information security corporation 4516 Seton Center Pkwy, Suite 250 Austin, TX 78759 www.atsec.com ## Ctrl IQ, Inc. Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Document version: 1.2 Last update: 2026-02-26 © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## Table of Contents | 1 General ....................................................................................................................................................................... 7 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 Overview ............................................................................................................................................................ 7 | | 1.1.1 How this Security Policy was prepared ..................................................................................................... 7 | | 1.2 Security Levels .................................................................................................................................................... 7 | | 2 Cryptographic Module Specification ........................................................................................................................ 9 | | 2.1 Description ......................................................................................................................................................... 9 | | 2.2 Tested and Vendor Affirmed Module Version and Identification ................................................................ 10 | | 2.3 Excluded Components ..................................................................................................................................... 11 | | 2.4 Modes of Operation.......................................................................................................................................... 11 | | 2.5 Algorithms ........................................................................................................................................................ 11 | | 2.6 Security Function Implementations ................................................................................................................ 19 | | 2.7 Algorithm Specific Information ...................................................................................................................... 29 | | 2.7.1 AES GCM IV ............................................................................................................................................. 29 | | 2.7.2 AES XTS .................................................................................................................................................... 29 | | 2.7.3 Key Derivation using SP 800-132 PBKDF2 ............................................................................................. 30 | | 2.7.4 SP 800-56A Rev. 3 Assurances ................................................................................................................. 30 | | 2.7.5 RSA Signatures .......................................................................................................................................... 30 | | 2.8 RBG and Entropy ............................................................................................................................................. 31 | | 2.9 Key Generation ................................................................................................................................................ 31 | | 2.10 Key Establishment .......................................................................................................................................... 32 | | 2.11 Industry Protocols .......................................................................................................................................... 32 | | 3 Cryptographic Module Interfaces ........................................................................................................................... 33 | | 3.1 Ports and Interfaces .......................................................................................................................................... 33 | | 4.1 Authentication Methods .................................................................................................................................. 34 | | 4.2 Roles .................................................................................................................................................................. 34 | | 4.4 Non-Approved Services ................................................................................................................................... 46 | | 4.5 External Software/Firmware Loaded ............................................................................................................... 47 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 2 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | 5 Software/Firmware Security ................................................................................................................................... 48 | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 5.1 Integrity Techniques ........................................................................................................................................ 48 | | 5.2 Initiate on Demand .......................................................................................................................................... 48 | | 6 Operational Environment ....................................................................................................................................... 49 | | 6.1 Operational Environment Type and Requirements ....................................................................................... 49 | | 6.2 Configuration Settings and Restrictions .......................................................................................................... 49 | | 7 Physical Security ..................................................................................................................................................... 50 | | 8 Non-Invasive Security ............................................................................................................................................. 51 | | 9 Sensitive Security Parameters Management .......................................................................................................... 52 | | 9.1 Storage Areas .................................................................................................................................................... 52 | | 9.2 SSP Input-Output Methods ............................................................................................................................. 52 | | 9.3 SSP Zeroization Methods ................................................................................................................................. 53 | | 9.4 SSPs ................................................................................................................................................................... 54 | | 9.5 Transitions ........................................................................................................................................................ 63 | | 10 Self-Tests ................................................................................................................................................................ 64 | | 10.1 Pre-Operational Self-Tests ............................................................................................................................. 64 | | 10.2 Conditional Self-Tests .................................................................................................................................... 64 | | 10.3 Periodic Self-Test Information ...................................................................................................................... 84 | | 10.4 Error States ..................................................................................................................................................... 95 | | 10.5 Operator Initiation of Self-Tests .................................................................................................................... 96 | | 11 Life-Cycle Assurance ............................................................................................................................................. 97 | | 11.1 Installation, Initialization, and Startup Procedures ...................................................................................... 97 | | 11.2 Administrator Guidance ................................................................................................................................ 97 | | 11.4 Design and Rules ............................................................................................................................................ 97 | | 11.6 End of Life ...................................................................................................................................................... 97 | | 11.5 Maintenance Requirements ........................................................................................................................... 97 | | 12 Mitigation of Other Attacks .................................................................................................................................. 98 | | Appendix A. TLS Cipher Suites ................................................................................................................................. 99 | | 12.1 Attack List ................................................................................................................................................. 98 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 3 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Appendix B. Glossary and Abbreviations ................................................................................................................ 103 Appendix C. References ........................................................................................................................................... 105 © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 4 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ### List of Tables | Table 1: Security Levels ................................................................................................................................................ 8 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Table 2: Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets) ............................. 10 | | Table 3: Tested Operational Environments - Software, Firmware, Hybrid ............................................................ 11 | | Table 4: Modes List and Description ......................................................................................................................... 11 | | Table 5: Approved Algorithms ................................................................................................................................... 17 | | Table 6: Vendor-Affirmed Algorithms ...................................................................................................................... 17 | | Table 7: Non-Approved, Allowed Algorithms with No Security Claimed .............................................................. 18 | | Table 8: Non-Approved, Not Allowed Algorithms ................................................................................................... 19 | | Table 9: Security Function Implementations ............................................................................................................ 29 | | Table 10: Entropy Certificates ................................................................................................................................... 31 | | Table 11: Entropy Sources .......................................................................................................................................... 31 | | Table 12: Ports and Interfaces .................................................................................................................................... 33 | | Table 13: Roles ............................................................................................................................................................ 34 | | Table 14: Approved Services ...................................................................................................................................... 45 | | Table 15: Non-Approved Services ............................................................................................................................. 47 | | Table 16: Storage Areas .............................................................................................................................................. 52 | | Table 17: SSP Input-Output Methods ....................................................................................................................... 52 | | Table 18: SSP Zeroization Methods ........................................................................................................................... 53 | | Table 19: SSP Table 1 ................................................................................................................................................. 58 | | Table 20: SSP Table 2 ................................................................................................................................................. 63 | | Table 21: Pre-Operational Self-Tests ......................................................................................................................... 64 | | Table 22: Conditional Self-Tests ................................................................................................................................ 83 | | Table 23: Pre-Operational Periodic Information ...................................................................................................... 84 | | Table 24: Conditional Periodic Information ............................................................................................................. 95 | | Table 25: Error States ................................................................................................................................................. 96 | ### List of Figures © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 5 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Figure 1: Block Diagram ............................................................................................................................................. 10 © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 6 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 1 General ### 1.1 Overview This document is the non-proprietary FIPS 140-3 Security Policy for version Rocky8.20250314 of the Rocky Linux 8 OpenSSL Cryptographic Module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 module. This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and intact and including this notice. Other documentation is proprietary to their authors. #### 1.1.1 How this Security Policy was prepared In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing. ### 1.2 Security Levels | Section | Title | Security Level | |-----------|-----------------------------------------|------------------| | 1 | General | 1 | | 2 | Cryptographic module specification | 1 | | 3 | Cryptographic module interfaces | 1 | | 4 | Roles, services, and authentication | 1 | | 5 | Software/Firmware security | 1 | | 6 | Operational environment | 1 | | 7 | Physical security | N/A | | 8 | Non-invasive security | N/A | | 9 | Sensitive security parameter management | 1 | | 10 | Self-tests | 1 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 7 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Section | Title | Security Level | |-----------|-----------------------------|------------------| | 11 | Life-cycle assurance | 1 | | 12 | Mitigation of other attacks | 1 | | | Overall Level | 1 | Table 1: Security Levels © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 8 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 2 Cryptographic Module Specification ### 2.1 Description ###### Purpose and Use: The Rocky Linux 8 OpenSSL Cryptographic Module (hereafter referred to as 'the module') is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) for use by other applications that require cryptographic functionality. The module is a software library supporting FIPS 140-3 approved algorithms developed by Ctrl IQ, Inc. for its use by other applications that require cryptographic functionality. Module Type: Software Module Embodiment: MultiChipStand ###### Cryptographic Boundary: The cryptographic boundary of the module is defined as the libcrypto.so and libssl.so shared libraries and their respective integrity check files. libcrypto.so is the shared library that implements the cryptographic algorithms, while libssl.so is the shared library that implements the TLS/DTLS network protocols. ###### Tested Operational Environment's Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1 shows a block diagram that represents the design of the module when the module is operational and providing services to other user space applications. In this diagram, the physical perimeter of the operational environment is the general-purpose computer on which the module is installed. The cryptographic boundary is represented by the libssl and libcrypto shared libraries and their respective integrity check files. The 'Data/Control Input' and 'Data/Status Output' arrows indicate the flow of data between the cryptographic module and its operator application, through the logical interfaces defined in Section 3 Cryptographic Module Interfaces. Other components are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module's validation). For example, the kernel is responsible for managing system calls issued by the module itself, as well as other applications using the module for cryptographic services. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 9 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Figure 1: Block Diagram ### 2.2 Tested and Vendor Affirmed Module Version and Identification ###### Tested Module Identification -Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification -Software, Firmware, Hybrid (Executable Code Sets) | Package or File Name | Software/ Firmware Version | Features | Integrity Test | |----------------------------------------------------------------------|------------------------------|------------|------------------| | libcrypto.so, libssl.so, .libcrypto.so.1.1.hmac, .libssl.so.1.1.hmac | Rocky8.20250314 | N/A | HMAC-SHA2-256 | ###### Tested Operational Environments - Software, Firmware, Hybrid: | Operating System | Hardware Platform | Processors | PAA/PAI | Hypervisor or Host OS | Version(s) | |--------------------|-------------------------------|---------------------------------|-----------|-------------------------|-----------------| | Rocky Linux 8 | SuperMicro SuperServer 5039MS | Intel Kaby Lake Xeon E3-1270 v6 | Yes | N/A | Rocky8.20250314 | | Rocky Linux 8 | SuperMicro SuperServer 5039MS | Intel Kaby Lake Xeon E3-1270 v6 | No | N/A | Rocky8.20250314 | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 10 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Table 3: Tested Operational Environments - Software, Firmware, Hybrid ###### Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. ### 2.3 Excluded Components There are no components excluded from the requirements of the FIPS 140-3 standard. ### 2.4 Modes of Operation ###### Modes List and Description: Table 4: Modes List and Description | Mode Name | Description | Type | Status Indicator | |---------------|----------------------------------------------------------------------|---------------|-------------------------------------------------------| | Approved | Automatically entered whenever an approved service is requested. | Approved | Equivalent to the indicator of the requested service. | | Non- Approved | Automatically entered whenever a non- approved service is requested. | Non- Approved | Equivalent to the indicator of the requested service. | After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. The module operates in the approved mode of operation by default and can only transition into the nonapproved mode by calling one of the non-approved services listed in the Non-Approved Services table of the Security Policy. In the operational state, the module accepts service requests from calling applications through its logical interfaces. At any point in the operational state, a calling application can end its process, causing the module to end its operation. ###### Mode Change Instructions and Status: The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the service that was requested. ### 2.5 Algorithms ###### Approved Algorithms: | Algorithm | CAVP Cert | Properties | Reference | |-------------|---------------------|---------------------------------------------------------|-------------| | AES-CBC | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 11 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |-------------|---------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|-------------| | AES-CCM | A6738, A6739, A6740 | Key Length - 128, 192, 256 | SP 800-38C | | AES-CFB1 | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | | AES-CFB128 | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | | AES-CFB8 | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | | AES-CMAC | A6738, A6739, A6740 | Direction - Generation Key Length - 128, 192, 256 | SP 800-38B | | AES-CTR | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | | AES-ECB | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | | AES-GCM | A6741, A6742, A6743, A6744, A6745, A6746, A6747, A6748, A6749 | Direction - Decrypt, Encrypt IV Generation - External, Internal Key Length - 128, 192, 256 IV Generation Mode - 8.2.1, 8.2.2 | SP 800-38D | | AES-GMAC | A6741, A6742, A6743, A6744, A6745, A6746, A6747, A6748, A6749 | Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 | SP 800-38D | | AES-KW | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38F | | AES-KWP | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38F | | AES-OFB | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 12 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |------------------------------|-----------------------------------|----------------------------------------------------------------------------------------------------------------|-------------------| | AES-XTS Testing Revision 2.0 | A6738, A6739, A6740 | Direction - Decrypt, Encrypt Key Length - 128, 256 | SP 800-38E | | Counter DRBG | A6738, A6739, A6740 | Prediction Resistance - No, Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes | SP 800-90A Rev. 1 | | ECDSA KeyGen (FIPS186-5) | A6750, A6752, A6754, A6756, A6758 | Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates | FIPS 186-5 | | ECDSA KeyVer (FIPS186-5) | A6750, A6752, A6754, A6756, A6758 | Curve - P-224, P-256, P-384, P-521 | FIPS 186-5 | | ECDSA SigGen (FIPS186-5) | A6750, A6752, A6754, A6756, A6758 | Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No, Yes | FIPS 186-5 | | ECDSA SigGen (FIPS186-5) | A6760 | Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512 Component - No, Yes | FIPS 186-5 | | ECDSA SigVer (FIPS186-5) | A6750, A6752, A6754, A6756, A6758 | Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 | FIPS 186-5 | | ECDSA SigVer (FIPS186-5) | A6760 | Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512 | FIPS 186-5 | | EDDSA KeyGen | A6763 | Curve - ED-25519, ED-448 | FIPS 186-5 | | EDDSA SigGen | A6763 | Curve - ED-25519, ED-448 PreHash - No Pure - Yes | FIPS 186-5 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 13 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |--------------------|-----------------------------------|--------------------------------------------------|-------------| | EDDSA SigVer | A6763 | Curve - ED-25519, ED-448 PreHash - No Pure - Yes | FIPS 186-5 | | HMAC-SHA-1 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 224 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 256 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 384 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 512 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 512/224 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA2- 512/256 | A6750, A6752, A6754, A6756, A6758 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA3- 224 | A6760 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA3- 256 | A6760 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | HMAC-SHA3- 384 | A6760 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 14 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |-------------------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------| | HMAC-SHA3- 512 | A6760 | Key Length - Key Length: 112-524288 Increment 8 | FIPS 198-1 | | KAS-ECC-SSC Sp800-56Ar3 | A6750, A6752, A6754, A6756, A6758 | Domain Parameter Generation Methods - P-224, P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder | SP 800-56A Rev. 3 | | KAS-FFC-SSC Sp800-56Ar3 | A6762 | Domain Parameter Generation Methods - FB, FC, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder | SP 800-56A Rev. 3 | | KDA HKDF SP800-56Cr2 | A6761 | Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224- 2048 Increment 8 HMAC Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2- 512/256, SHA3-224, SHA3-256, SHA3-384, SHA3- 512 | SP 800-56C Rev. 2 | | KDF SSH (CVL) | A6751, A6753, A6755, A6757, A6759 | Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512 | SP 800-135 Rev. 1 | | KDF TLS (CVL) | A6750, A6752, A6754, A6756, A6758 | TLS Version - v1.0/1.1 | SP 800-135 Rev. 1 | | PBKDF | A6750, A6752, A6754, A6756, A6758, A6760 | Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1 | SP 800-132 | | RSA KeyGen (FIPS186-5) | A6750, A6752, A6754, A6756, A6758 | Key Generation Mode - probable Modulo - 2048, 3072, 4096, 6144, 8192 Primality Tests - 2powSecStr Private Key Format - standard | FIPS 186-5 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 15 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |------------------------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-------------------| | RSA SigGen (FIPS186-5) | A6750, A6752, A6754, A6756, A6758, A6760 | Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss | FIPS 186-5 | | RSA SigVer (FIPS186-5) | A6750, A6752, A6754, A6756, A6758, A6760 | Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss | FIPS 186-5 | | Safe Primes Key Generation | A6762 | Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192 | SP 800-56A Rev. 3 | | Safe Primes Key Verification | A6762 | Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192 | SP 800-56A Rev. 3 | | SHA-1 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA2-224 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA2-256 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA2-384 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA2-512 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA2-512/224 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 16 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Table 5: Approved Algorithms | Algorithm | CAVP Cert | Properties | Reference | |----------------------------|-----------------------------------|---------------------------------------------------------------------------------------|-------------------| | SHA2-512/256 | A6750, A6752, A6754, A6756, A6758 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4 | | SHA3-224 | A6760 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 202 | | SHA3-256 | A6760 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 202 | | SHA3-384 | A6760 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 202 | | SHA3-512 | A6760 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 202 | | SHAKE-128 | A6760 | Output Length - Output Length: 16-65536 Increment 8 | FIPS 202 | | SHAKE-256 | A6760 | Output Length - Output Length: 16-65536 Increment 8 | FIPS 202 | | TLS v1.2 KDF RFC7627 (CVL) | A6750, A6752, A6754, A6756, A6758 | Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 | SP 800-135 Rev. 1 | | TLS v1.3 KDF (CVL) | A6761 | HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE | SP 800-135 Rev. 1 | ###### Vendor-Affirmed Algorithms: Table 6: Vendor-Affirmed Algorithms | Name | Properties | Implementation | Reference | |-----------------------------------------------|---------------------|------------------|------------------------------------| | Asymmetric Cryptographic Key Generation (CKG) | Key type:Asymmetric | N/A | SP 800-133r2, section 4, example 1 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 17 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ###### Non-Approved, Allowed Algorithms: N/A for this module. ###### Non-Approved, Allowed Algorithms with No Security Claimed: Table 7: Non-Approved, Allowed Algorithms with No Security Claimed | Name | Caveat | Use and Function | |--------|----------------------------------------------------------|----------------------------------------------| | MD5 | Only allowed as the PRF in TLSv1.0 and v1.1 per IG 2.4.A | Message digest used in TLSv1.0/v1.1 KDF only | ###### Non-Approved, Not Allowed Algorithms: | Name | Use and Function | |------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------| | AES-GCM with external IV | Authenticated encryption | | HMAC with less than 112-bit keys, SipHash | Message authentication code (MAC) | | Diffie-Hellman with domain parameters other than safe primes | Key pair generation; Diffie-Hellman public key validation; Shared secret computation | | DSA with any key sizes | Digital signature verification | | EC Diffie-Hellman with P-192 curve, K curves, B curves and non-NIST curves | Shared secret computation | | ECDSA with P-192 curve, K curves, B curves and non-NIST curves | Key pair generation; Digital signature generation; Digital signature verification | | HKDF standalone | Key derivation as a standalone service | | PBKDF with non-approved message digest algorithms or using input parameters not meeting requirements stated in section 2.7.3 | Key derivation | | RSA with keys smaller than 2048 bits | Key pair generation; Digital signature generation; Digital signature verification | | RSA encryption with any key sizes | Key encapsulation | | RSA decryption with any key sizes | Key un-encapsulation | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 18 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Use and Function | |--------|--------------------------------------------------------------| | SHA-1 | Digital signature generation; Digital signature verification | Table 8: Non-Approved, Not Allowed Algorithms The table above lists all non-approved cryptographic algorithms of the module employed by the non-approved services of the Non-Approved Services table in Section 4.4 Non-Approved Services. ### 2.6 Security Function Implementations | Name | Type | Description | Properties | Algorithms | |----------------|---------|----------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Message digest | SHA XOF | Message digest using SHA or SHAKE algorithms | | SHA-1: (A6750, A6752, A6754, A6756, A6758) SHA2-224: (A6750, A6752, A6754, A6756, A6758) SHA2-256: (A6750, A6752, A6754, A6756, A6758) SHA2-384: (A6750, A6752, A6754, A6756, A6758) SHA2-512: (A6750, A6752, A6754, A6756, A6758) SHA2-512/224: (A6750, A6752, A6754, A6756, A6758) SHA2-512/256: (A6750, A6752, A6754, A6756, A6758) SHA3-224: (A6760) SHA3-256: (A6760) SHA3-384: (A6760) SHA3-512: (A6760) SHAKE-128: (A6760) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 19 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |------------|-----------|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | SHAKE-256: (A6760) | | Encryption | BC-UnAuth | Encryption with AES | Key size (XTS):128, 256 bits Security strength (XTS):128, 256 bits Key size (Others):128, 192, 256 bits Security strength (Others):128, 192, 256 bits | AES-CBC: (A6738, A6739, A6740) AES-CFB1: (A6738, A6739, A6740) AES-CFB128: (A6738, A6739, A6740) AES-CFB8: (A6738, A6739, A6740) AES-CTR: (A6738, A6739, A6740) AES-ECB: (A6738, A6739, A6740) AES-OFB: (A6738, A6739, A6740) AES-XTS Testing Revision 2.0: (A6738, A6739, | | Decryption | BC-UnAuth | Decryption with AES | Key size (XTS):128, 256 bits Security strength (XTS):128, 256 bits Key size:128, 192, 256 bits Security strength:128, 192, 256 bits | AES-CBC: (A6738, A6739, A6740) AES-CFB1: (A6738, A6739, A6740) AES-CFB128: (A6738, A6739, A6740) AES-CFB8: (A6738, A6739, A6740) AES-CTR: (A6738, A6739, A6740) AES-ECB: (A6738, A6739, A6740) AES-OFB: (A6738, A6739, A6740) AES-XTS Testing Revision 2.0: (A6738, A6739, A6740) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 20 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |--------------------------|---------|--------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Authenticated encryption | BC-Auth | Authenticated encryption | CBC+HMAC:Key lengths: 128, 256 bits; Security strength: 128, 256 bits; Used as part of the cipher suites listed in Appendix A for the TLS protocol CCM, GCM:Key lengths: 128, 192, 256 bits; Security strength: 128, 192, 256 bits CCM, GCM (in TLS):Key lengths: 128, 256 bits; Security strength: 128, 256 bits; Used as part of the cipher suites listed in Appendix A for the TLS protocol | AES-CCM: (A6738, A6739, A6740) AES-GCM: (A6741, A6742, A6743, A6744, A6745, A6746, A6747, A6748, A6749) AES-CBC: (A6738, A6739, A6740) HMAC-SHA2-256: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2-384: (A6750, A6752, A6754, A6756, A6758) | | Authenticated decryption | BC-Auth | Authenticated decryption | CBC+HMAC:Key lengths: 128, 256 bits; Security strength: 128, 256 bits; Used as part of the cipher suites listed in Appendix A for the TLS protocol CCM, GCM:Key lengths: 128, 192, 256 bits; Security strength: 128, 192, 256 bits CCM, GCM (in TLS):Key lengths: 128, 256 bits; Security strength: | AES-CCM: (A6738, A6739, A6740) AES-GCM: (A6741, A6742, A6743, A6744, A6745, A6746, A6747, A6748, A6749) AES-CBC: (A6738, A6739, A6740) HMAC-SHA2-256: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2-384: (A6750, A6752, A6754, A6756, A6758) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 21 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |-----------------------------------|----------|-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | 128, 256 bits; Used as part of the cipher suites listed in Appendix A for the TLS protocol | | | Key wrapping | KTS-Wrap | Key wrapping with AES | Key size:128, 192, 256 bits Security strength:128, 192, 256 bits Compliance:FIPS 140-3 IG D.G | AES-KW: (A6738, A6739, A6740) AES-KWP: (A6738, A6739, A6740) | | Key unwrapping | KTS-Wrap | Key unwrapping with AES | Key size:128, 192, 256 bits Security strength:128, 192, 256 bits Compliance:FIPS 140-3 IG D.G | AES-KW: (A6738, A6739, A6740) AES-KWP: (A6738, A6739, A6740) | | Message authentication code (MAC) | MAC | Message authentication code computation using AES or HMAC | AES Key size:128, 192, 256 bits AES Security strength:128, 192, 256 bits HMAC Key size:>= 112bits HMAC Security strength:112-256 bits | AES-CMAC: (A6738, A6739, A6740) AES-GMAC: (A6741, A6742, A6743, A6744, A6745, A6746, A6747, A6748, A6749) HMAC-SHA-1: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2-224: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2-256: (A6750, A6752, A6754, A6756, | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 22 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |--------------------------|-------------------------|-------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | A6758) HMAC-SHA2-384: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2-512: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2- 512/224: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA2- 512/256: (A6750, A6752, A6754, A6756, A6758) HMAC-SHA3-224: (A6760) HMAC-SHA3-256: (A6760) HMAC-SHA3-384: (A6760) HMAC-SHA3-512: (A6760) | | Random number generation | DRBG | Random number generation using a SP 800-90A Rev. 1 compliant DRBG | Mode:CTR-DRBG using AES-128, AES-192, AES-256 with/without DF, with/without PR Key size:128, 192, 256 bits Security strength:128, 192, 256 bits | Counter DRBG: (A6738, A6739, A6740) | | Key pair generation | AsymKeyPair- KeyGen CKG | Key pair generation using RSA, ECDSA, EDDSA, or Safe Primes | RSA:Key size: 2048-15360 bits; Mode: FIPS 186-5, Section A.1.3 - Random Probable | RSA KeyGen (FIPS186-5): (A6750, A6752, A6754, A6756, A6758) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 23 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |-----------------------|---------------------|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | Primes; Security strength: 112-256 bits ECDSA:Curves: P- 224, P-256, P-384, P-521; Mode: FIPS 186-5, Section A.2.2 - Rejection Sampling; Security strength: 112, 128, 192, and 256 bits EDDSA:Curves: ED-25519, ED-448; Mode: FIPS 186-5, Section A.2.3 - EdDSA Key Pair Generation; Security strength: 128, 224 bits Safe Primes:Groups: MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192; Mode: SP 800-56A Rev. 3, Section 5.6.1.1.4 - Testing Candidates; Security strength: 112-200 bits | ECDSA KeyGen (FIPS186-5): (A6750, A6752, A6754, A6756, A6758) EDDSA KeyGen: (A6763) Safe Primes Key Generation: (A6762) Asymmetric Cryptographic Key Generation (CKG): () | | Key pair verification | AsymKeyPair- KeyVer | Key pair verification using ECDSA or Safe Primes | ECDSA:Curves: P- 224, P-256, P-384, P-521; Security strength: 112, 128, 192, and 256 bits | ECDSA KeyVer (FIPS186-5): (A6750, A6752, A6754, A6756, A6758) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 24 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |--------------------------------|---------------|--------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | Safe Primes:Groups: MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192; Security strength: 112-200 bits | Safe Primes Key Verification: (A6762) | | Digital signature generation | DigSig-SigGen | Digital signature generation using RSA, ECDSA or EDDSA | RSA:Modulus Size: 2048-16384 bits; Paddings: PKCS#1 v1.5 and PSS; Hashes: SHA2-224, SHA2-256, SHA2- 384, SHA2-512, SHA3-224, SHA3- 256, SHA3-384, SHA3-512 ECDSA:Curves: P- 224, P-256, P-384, P-521; Hashes: SHA2-224, SHA2- 256, SHA2-384, SHA2-512, SHA3- 224, SHA3-256, SHA3-384, SHA3- 512 EDDSA:Curves: ED-22519, ED-448 Security strength:112-256 bits | RSA SigGen (FIPS186-5): (A6750, A6752, A6754, A6756, A6758, A6760) ECDSA SigGen (FIPS186-5): (A6750, A6752, A6754, A6756, A6758, A6760) EDDSA SigGen: (A6763) | | Digital signature verification | DigSig-SigVer | Digital signature verification using | RSA (FIPS 186- 5):Key size: 2048- | RSA SigVer (FIPS186-5): | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 25 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |---------------------------|---------|--------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| | | | RSA, ECDSA, or EDDSA | 16384 bits; Security strength: 112-256 bits; Hashes: SHA2-224, SHA2- 256, SHA2-384, SHA2-512, SHA3- 224, SHA3-256, SHA3-384, SHA3- 512 RSA Paddings:PKCS#1 v1.5 and PSS ECDSA (FIPS 186- 5):Curves: P-224, P-256, P-384, P- 521; Security strength: 112, 128, 192, and 256 bits; Hashes: SHA2-224, SHA2-256, SHA2- 384, SHA2-512, SHA3-224, SHA3- 256, SHA3-384, SHA3-512 EDDSA:Curves: ED-25519, ED-448; Security strength: 128, 224 bits | (A6750, A6752, A6754, A6756, A6758, A6760) ECDSA SigVer (FIPS186-5): (A6750, A6752, A6754, A6756, A6758, A6760) EDDSA SigVer: (A6763) | | Shared secret computation | KAS-SSC | Shared secret computation using DH or ECDH | DH:Groups: ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192; Security strength; 112-200 bits; Scheme: dhEphem | KAS-FFC-SSC Sp800-56Ar3: (A6762) KAS-ECC-SSC Sp800-56Ar3: (A6750, A6752, A6754, A6756, A6758) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 26 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |--------------------------|------------|-------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | | | | ECDH:Curves: P- 224, P-256, P-384, P-521; Security strength: 112, 128, 192, and 256 bits; Scheme: ephemeralUnified KAS Role:initiator, responder Compliance:SP 800-56A Rev. 3, FIPS 140-3 IG D.F. Scenario 2(1) and Scenario 2(2) | | | Key derivation with HKDF | KAS-56CKDF | Key derivation using HKDF | MACs:HMAC with SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224, SHA3- 256, SHA3-384, SHA3-512 Shared secret length:224-8192 bits Security strength:112-256 bits | KDA HKDF SP800- 56Cr2: (A6761) | | Key derivation with TLS | KAS-135KDF | Key derivation using TLS v1.0, v1.1, v1.2, v1.3 | TLS v1.2 KDF RFC7627:Hashes: SHA2-256, SHA2- 384, SHA2-512; Support: extended master secret TLS v1.3 KDF:Hashes: SHA2-256, SHA2- 384; Running modes: DHE, PSK, | KDF TLS: (A6750, A6752, A6754, A6756, A6758) TLS v1.2 KDF RFC7627: (A6750, A6752, A6754, A6756, A6758) TLS v1.3 KDF: (A6761) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 27 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |-------------------------------|------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------| | | | | PSK-DHE Security strength:112-256 bits | | | Key derivation with SSH KDF | KAS-135KDF | Key derivation using SSH KDF | Ciphers:AES-128, AES-192, AES-256 Hashes:SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512 Shared secret length:224-8192 bits Security strength:112-256 bits | KDF SSH: (A6751, A6753, A6755, A6757, A6759) | | Password-based key derivation | PBKDF | Key derivation using PBKDF | Option:1a Password length:20-128 characters Salt length:128- 4096 bits Iteration count:1000-10000 Hashes:SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512, SHA2- 512/224, SHA2- 512/256, SHA3- 224, SHA3-256, SHA3-384, SHA3- 512 Derived-key length:112-4096 bits Security strength:112-256 bits | PBKDF: (A6750, A6752, A6754, A6756, A6758, A6760) | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 28 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Table 9: Security Function Implementations ### 2.7 Algorithm Specific Information #### 2.7.1 AES GCM IV For TLS 1.2, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. The module is compliant with SP 800-52 Rev. 2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288 and 8446. The module does not implement the TLS protocol. The module's implementation of AES GCM is used together with an application that runs outside the module's cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module's power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Alternatively, the Crypto Officer can use the module's API to perform AES GCM encryption using internal IV generation. These IVs are always 96 bits and generated using the approved DRBG internal to the module's boundary, compliant to Scenario 2 of FIPS 140-3 IG C.H. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the EVP_EncryptInit_ex2 API function with a non-NULL IV value. When this is the case, the API will set a non-approved service indicator. Finally, for TLS 1.3, the AES GCM implementation uses the context of Scenario 5 of FIPS 140-3 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC8446 of August 2018, using the cipher-suites that explicitly select AES GCM as the encryption/decryption cipher (Appendix B.4 of RFC8446). The module supports acceptable AES GCM cipher suites from Section 3.3.1 of SP 80052 Rev. 2. The module's implementation of AES GCM is used together with an application that runs outside the module's cr yptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. #### 2.7.2 AES XTS The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 2² ⁰ AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. As the module does not generate symmetric keys, the check is performed when keys are input the service APIs. Key_1 and Key_2 shall be generated and/or established independently according to the rules for component symmetric keys from NIST SP 800-133rev2, Sec. 6.3. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 29 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy #### 2.7.3 Key Derivation using SP 800-132 PBKDF2 The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following requirements are met: - Derived keys shall be used only for storage applications, and shall not be used for any other purposes. The length of the MK or DPK is 112 bits or more. - Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys. - The minimum length of the password or passphrase accepted by the module is 20 characters. The probability of guessing the value, assuming a worst-case scenario of all digits, is estimated to be at most 10 -20 . Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks. - A portion of the salt shall be generated randomly using the SP 800-90A Rev. 1 DRBG provided by the module. The minimum length required is 128 bits. - The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The minimum value accepted by the module is 1000. If any of these requirements are not met, the requested service is non-approved (see Non-Approved Services table in Section 4.4 Non-Approved Services). #### 2.7.4 SP 800-56A Rev. 3 Assurances To comply with the assurances found in Section 5.6.2 of SP 800-56A Rev. 3, the operator must use the module in the context of the TLS or SSH protocols . Additionally, the module's approved key pair generation service (see Approved Services table in Section 4.3 Approved Services) must be used to generate ephemeral Diffie-Hellman or EC Diffie-Hellman key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the full public key validation of the generated public key. The module's shared secret computation service will internally perform the full public key validation of the peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 800-56A Rev. 3. #### 2.7.5 RSA Signatures Approved moduli for 2048, 3072, and 4096 bits are CAVP tested in compliance with FIPS 186-5 for RSA key generation, signature generation, and signature verification. All other RSA moduli mentioned in the Security Function Implementation table in Section 2.6 Security Function Implementations and not mentioned above cannot be tested by CAVP but are approved for RSA key generation, signature generation, and signature verification in IG C.F. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 30 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ### 2.8 RBG and Entropy Table 10: Entropy Certificates | Cert Number | Vendor Name | |---------------|---------------| | E219 | Ctrl IQ, Inc. | Table 11: Entropy Sources | Name | Type | Operational Environment | Sample Size | Entropy per Sample | Conditioning Component | |----------------------------------------------------------|---------------|--------------------------------------------------|---------------|----------------------|-------------------------------------------------------------------------| | Rocky Linux OpenSSL 1 CPU Time Jitter RNG Entropy Source | Non- Physical | Rocky Linux 8 on Intel Kaby Lake Xeon E3-1270 v6 | 256 bits | full entropy | SHA3-256 (A5807); SHA2- 512-HMAC-DRBG (A5807); AES-256-CTR-DRBG (A6740) | The module employs a Deterministic Random Bit Generator (DRBG) based on SP 800-90A Rev. 1. This DRBG is used internally by the module (e.g. to generate seeds for asymmetric key pairs and random numbers for security functions). It can also be accessed using the specified API functions. The DRBG supports the CTR_DRBG mechanisms. The DRBG is initialized during module initialization; the module loads by default the DRBG using the CTR_DRBG mechanism with AES-256, with derivation function, and without prediction resistance. The module uses an SP 800-90B-compliant entropy source. This entropy source is located within the physical perimeter, but outside of the cryptographic boundary of the module. The module obtains 384 bits to seed the DRBG, and 256 bits to reseed it, sufficient to provide a DRBG with 256 bits of security strength. The operational environment on the ESV certificate is identical to the operational environment listed in this document. There are no maintenance requirements for the entropy source. As per the Public Use Document of entropy certificate E219, the entropy source provides full entropy of 256 bits ### 2.9 Key Generation The module implements asymmetric key pair generation compliant with SP 800-133 Rev. 2. When random values are required, they are obtained from the SP 800-90A Rev. 1 approved DRBG, compliant with Section 4 of SP 800-133 Rev. 2 (without XOR): - Safe primes key pair generation: compliant with SP 800-133 Rev. 2, Section 5.2, which maps to SP 80056A Rev. 3. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 31 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy - RSA key pair generation: compliant with SP 800-133 Rev. 2, Section 5.1, which maps to FIPS 186-5. - ECC (ECDH and ECDSA) key pair generation: compliant with SP 800-133 Rev. 2, Section 5.1, which maps to FIPS 186-5. - EDDSA key pair generation: compliant with SP 800-133 Rev. 2, Section 5.1, which maps to FIPS 186-5. The key pair generation methods implemented for each of the services mentioned above have been CAVP tested and are described in Section 2.6 Security Function Implementations. Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service. Additionally, the module implements the following key derivation methods according to SP 800-135 Rev. 1: - KDF for the TLS protocol used as pseudo-random functions (PRF) for TLS v1.0/1.1, TLS v1.2, TLS v1.3; - KDA HKDF for the TLS protocol, used as pseudo-random function (PRF) for the TLS v1.3; - SSH KDF for the SSHv2 protocol. The module also supports password-based key derivation (PBKDF). The implementation is compliant with option 1a of [SP800-132]. ### 2.10 Key Establishment The module implements SSP agreement and SSP transport methods as listed in the Security Function Implementations table in Section 2.6 Security Function Implementations. ### 2.11 Industry Protocols The module implements KDF for the TLS protocol TLSv1.0, TLSv1.1, TLSv1.2. No parts of the TLS 1.0/1.1/1.2, other than the key derivation functions mentioned above, have been tested by the CAVP and CMVP. The module implements HKDF for the TLS protocol TLSv1.3. The implementation of the KDA HKDF has been tested by the CAVP and CMVP. AES-GCM with internal IV generation is offered in the approved mode compliant with TLS 1.2 and TLS 1.3 (RFC 5288 and RFC 8446). This functionality shall only be used in conjunction with the TLS protocol. The module implements the SSH key derivation function for use in the SSH protocol (RFC 4253 and RFC 6668). No parts of the SSH protocol, other than those mentioned above, have been tested by the CAVP and CMVP. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 32 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 3 Cryptographic Module Interfaces ### 3.1 Ports and Interfaces Table 12: Ports and Interfaces | Physical Port | Logical Interface(s) | Data That Passes | |-----------------|------------------------|-----------------------| | N/A | Data Input | API input parameters | | N/A | Data Output | API output parameters | | N/A | Control Input | API function calls | | N/A | Status Output | API return codes | The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module does not implement a control output interface. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 33 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 4 Roles, Services, and Authentication ### 4.1 Authentication Methods The module does not support authentication methods. ### 4.2 Roles Table 13: Roles | Name | Type | Operator Type | Authentication Methods | |----------------|--------|-----------------|--------------------------| | Crypto Officer | Role | CO | None | The module does not support multiple concurrent operators. ### 4.3 Approved Services | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |---------------------------|-----------------------------------------------------------------|------------------------------------------------|--------------------------|----------------------|---------------------------|-------------------------------| | Message digest | Used to generate a SHA-1, SHA-2, or SHA- 3/SHAKE message digest | fips_sli_SHA*_is_approved returns 1 | Message | Message digest | Message digest | Crypto Officer | | Encryption | Perform AES encryptio n | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Plaintext , AES key, IV | Cipherte xt | Encryption | Crypto Officer - AES key: W,E | | Decryptio n | Perform AES decryptio n | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Cipherte xt, AES key, IV | Plaintext | Decryptio n | Crypto Officer - AES key: W,E | | Authentica ted encryption | Perform authentica ted | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Cipherte xt, AES key or | Cipherte xt, MAC tag | Authentica ted encryption | Crypto Officer - AES key: W,E | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 34 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------------------------|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|-----------------------------------------------|----------------------|------------------------------------|-----------------------------------------------| | | encryptio n | | HMAC key, IV | | | - HMAC key: W,E | | Authentica ted decryption | Perform authentica ted decryptio n | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Cipherte xt, AES key or HMAC key, IV, MAC tag | Plaintext or failure | Authentica ted decryption | Crypto Officer - AES key: W,E - HMAC key: W,E | | Key wrapping | Perform AES- based key wrapping (complian t to SP 800-38F and FIPS 140-3 IG D.G) | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Key to be wrapped , AES key | Wrappe d key | Key wrapping | Crypto Officer - AES key: W,E | | Key unwrappin g | Perform AES- based key unwrappi ng (complian t to SP 800-38F and FIPS 140-3 IG D.G) | fips_sli_is_approved_EVP_CIP HER_CTX returns 1 | Wrappe d key, AES key | Unwrap ped key | Key unwrappin g | Crypto Officer - AES key: W,E | | Message authentica tion code (MAC) | Compute a MAC tag using AES or HMAC | fips_sli_is_approved_CMAC_C TX, fips_sli_HMAC_is_approved, or fips_sli_is_approved_EVP_CIP HER_CTX return 1 | Message, AES key or HMAC key | MAC tag | Message authentica tion code (MAC) | Crypto Officer - AES key: W,E - HMAC key: W,E | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 35 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------------------------|---------------------------------------|-------------------------------------------------------------------------------------|--------------------------------|--------------------------------------------------------|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Random number generation | Generate random bytes using CTR- DRBG | fips_sli_RAND_bytes_is_appro ved or fips_sli_RAND_priv_bytes_is_a pproved returns 1 | Output length | Random bytes | Random number generation | Crypto Officer - Entropy input: G,E,Z - DRBG seed: G,E,Z - DRBG internal state (V value, Key): G,W,E | | Key pair generation | Generate an asymmetri c key pair | fips_sli_is_approved_EVP_PKE Y_CTX returns 1 | Group or Curve or Modulus bits | DH key pair; EC key pair; RSA key pair; EDDSA key pair | Key pair generation Random number generation | Crypto Officer - Module- generated RSA private key: G,R - Module- generated RSA public key: G,R - Module- generated DH private key: G,R - Module- generated DH public key: G,R | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 36 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------------|-----------------------------------------|----------------------------------------------|-------------------------------------|-----------|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - Module- generated EC private key: G,R - Module- generated EC public key: G,R - Module- generated EDDSA private key: G,R - Module- generated EDDSA public key: G,R - Intermedi ate key generatio n value: G,E,Z - DRBG internal state (V value, Key): W,E | | Key pair verificatio n | Verify a generated asymmetri c key pair | fips_sli_is_approved_EVP_PKE Y_CTX returns 1 | Safe Primes key pair or EC key pair | Pass/Fail | Key pair verificatio n | Crypto Officer - DH private key: W,E | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 37 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |---------------------------------|------------------------------|----------------------------------------------|---------------------------------|------------|-------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - DH public key: W,E - EC private key: W,E - EC public key: W,E | | Digital signature generation | Generate a digital signature | fips_sli_is_approved_EVP_PKE Y_CTX returns 1 | Message, private key | Signatur e | Digital signature generation Random number generation | Crypto Officer - RSA private key: W,E - EC private key: W,E - EDDSA private key: W,E - DRBG internal state (V value, Key): W,E | | Digital signature verificatio n | Verify a digital signature | fips_sli_is_approved_EVP_PKE Y_CTX returns 1 | Message, public key, signatur e | Pass/Fail | Digital signature verificatio n | Crypto Officer - RSA public key: W,E - EC public key: W,E - EDDSA public key: W,E | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 38 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |----------------------------|---------------------------------------------------------|----------------------------------------------|--------------------------------|------------------|----------------------------|---------------------------------------------------------------------------------------------------------------------------| | Shared secret computati on | Compute a shared secret | fips_sli_is_approved_EVP_PKE Y_CTX returns 1 | Private key, public key (peer) | Shared secret | Shared secret computati on | Crypto Officer - DH private key: W,E - DH public key: W,E - EC private key: W,E - EC public key: W,E - Shared secret: G,R | | Key derivation with HKDF | Key derivation with KDA HKDF in the context of TLS v1.3 | fips_sli_is_approved_EVP_KDF _CTX returns 1 | Shared secret | HKDF derived key | Key derivation with HKDF | Crypto Officer - Shared secret: W,E - HKDF derived key: G,R | | Key derivation with TLS | Perform key derivation using TLS KDF | fips_sli_is_approved_EVP_KDF _CTX returns 1 | TLS pre- master secret | TLS derived key | Key derivation with TLS | Crypto Officer - TLS pre- master secret: W,E - TLS master secret: E,G,Z - TLS | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 39 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------------------------------|------------------------------------------------|-------------------------------------------------------------------------------------|----------------------------------|-------------------------------|--------------------------------|------------------------------------------------------------------------| | | | | | | | derived key: G,R | | Key derivation with SSH | Perform key derivation with SSH KDF | fips_sli_is_approved_EVP_KDF _CTX returns 1 | Shared secret | SSH derived key | Key derivation with SSH KDF | Crypto Officer - Shared secret: W,E - SSH derived key: G,R | | Key derivation from a password | Derive a key from a password or passphrase | fips_sli_PKCS5_PBKDF2_HMA C returns 1 | Passwor d or passphra se | PBKDF Derived key | Password- based key derivation | Crypto Officer - Password or passphras e: W,E - PBKDF derived key: G,R | | Show status | Show the current status of the module | None | N/A | Module status | None | Crypto Officer | | Show module name and version | Show module name and the version of the module | None | N/A | Name and version informat ion | None | Crypto Officer | | Transport Layer Security (TLS) | Provide supported cipher suites | SSL_CIPHER_get_protocol_ id or SSL_get_current_cipher return a two-byte ID matching | Cipher- suites listed in Appendi | Return codes and/or log | Message digest Authentica ted | Crypto Officer - RSA private | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 40 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------|-----------------------------------------|-------------------------------------------------|-----------------------------------------------------------------------|--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Network Protocol | (listed in Appendix A) in approved mode | an approved cipher suite (listed in Appendix A) | x A, Digital Certifica te, Public and Private Keys, Applicat ion Data | messages , Applicati on data | encryption Authentica ted decryption Message authentica tion code (MAC) Key pair generation Key pair verificatio n Digital signature generation Digital signature verificatio n Shared secret computati on Key derivation with HKDF Key derivation with TLS | key: W,E - RSA public key: W,E - EC private key: W,E - EC public key: W,E - TLS pre- master secret: G,W,E - TLS master secret: G,W,E,Z - DH private key: G,W,E - DH public key: G,W,E - TLS derived key: G,W,E - HKDF derived key: G,W,E | | Self-test | Perform CASTs and integrity test | None | N/A | Pass/fail result of self-tests | Message digest Encryption Decryptio n | Crypto Officer | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 41 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------------|----------------|-------------|----------|-----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------| | | | | | | Authentica ted encryption Authentica ted decryption Message authentica tion code (MAC) Random number generation Digital signature generation Digital signature verificatio n Shared secret computati on Key derivation with HKDF Key derivation with SSH KDF Key derivation with TLS Password- based key derivation | | | Zeroizatio n | Zeroize SSPs | None | Any SSP | N/A | None | Crypto Officer | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 42 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------|----------------|-------------|----------|-----------|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - AES key: Z - HMAC key: Z - Module- generated DH private key: Z - Module- generated DH public key: Z - Module- generated RSA private key: Z - Module- generated RSA public key: Z - Module- generated EC private key: Z - Module- generated EC public key: Z - Module- | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 43 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------|----------------|-------------|----------|-----------|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | generated EDDSA private key: Z - Module- generated EDDSA public key: Z - DH private key: Z - DH public key: Z - RSA private key: Z - RSA public key: Z - EC private key: Z - EC public key: Z - EDDSA private key: Z - EDDSA public key: Z - Shared secret: Z - Password or passphras e: Z | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 44 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Descriptio n | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------|----------------|-------------|----------|-----------|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - HKDF derived key: Z - SSH derived key: Z - TLS derived key: Z - PBKDF derived key: Z - Entropy input: Z - DRBG seed: Z - DRBG internal state (V value, Key): Z - Intermedi ate key generatio n value: Z - TLS pre- master secret: Z - TLS master secret: Z | ###### Table 14: Approved Services The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). The convention below applies when specifying the access permissions (types) that the service has for each SSP. - Generate (G): The module generates or derives the SSP. - Read (R): The SSP is read from the module (e.g. the SSP is output). © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 45 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy - Write (W): The SSP is updated, imported, or written to the module. - Execute (E): The module uses the SSP in performing a cryptographic operation. - Zeroize (Z): The module zeroizes the SSP. - N/A: The module does not access any SSP or key during its operation. The 'Indicator' column shows the service indicator API functions that must be used to verify the service indicator for each of the services. A value of 1 indicates that the service is approved, and 0 indicates that the service is non-approved. Additionally there is a separate indicator used for the following services: - The API function used to determine the indicator for the 'TLS network protocol' service returns the cipher suite established for the TLS session. If the returned cipher suite ID belongs to one of the cipher suites listed in Appendix A, then the service is approved, otherwise, it is non-approved. ### 4.4 Non-Approved Services | Name | Description | Algorithms | Role | |-----------------------------------|-------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|--------| | Authenticated encryption | Perform authenticated encryption using AES-GCM with an externally provided IV | AES-GCM with external IV | CO | | Message authentication code (MAC) | Compute a MAC tag | HMAC with less than 112-bit keys, SipHash | CO | | Shared secret computation | Perform shared secret computation | Diffie-Hellman with domain parameters other than safe primes EC Diffie-Hellman with P-192 curve, K curves, B curves and non-NIST curves | CO | | Signature generation | Generate a digital signature | ECDSA with P-192 curve, K curves, B curves and non-NIST curves RSA with keys smaller than 2048 bits SHA-1 | CO | | Signature verification | Verify a digital signature | DSA with any key sizes ECDSA with P-192 curve, K curves, B curves and non-NIST curves RSA with keys smaller than 2048 bits SHA-1 | CO | | Key pair generation | Generate a key pair | Diffie-Hellman with domain parameters other than safe primes | CO | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 46 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy Table 15: Non-Approved Services | Name | Description | Algorithms | Role | |-----------------------|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------|--------| | | | ECDSA with P-192 curve, K curves, B curves and non-NIST curves RSA with keys smaller than 2048 bits | | | Key derivation | Derive a symmetric key | HKDF standalone PBKDF with non-approved message digest algorithms or using input parameters not meeting requirements stated in section 2.7.3 | CO | | Key encapsulation | Encapsulate a symmetric key using RSA | RSA encryption with any key sizes | CO | | Key un- encapsulation | Unencapsulate a symmetric key using RSA | RSA decryption with any key sizes | CO | ### 4.5 External Software/Firmware Loaded The module does not load external software or firmware. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 47 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 5 Software/Firmware Security ### 5.1 Integrity Techniques The integrity of the module is verified by comparing a HMAC-SHA2-256 value calculated at run time with the HMAC-SHA2-256 value that was computed at build time (stored in the .hmac file) for each software component. The MAC key is hardcoded in the module. ### 5.2 Initiate on Demand Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity test may be invoked on-demand by unloading and subsequently re-initializing the module. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 48 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 6 Operational Environment ### 6.1 Operational Environment Type and Requirements ###### Type of Operational Environment: Modifiable ###### How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms, and only the module has control over these SSPs. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented. ### 6.2 Configuration Settings and Restrictions The module shall be installed as stated in Section 11 Life-Cycle Assurance. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 49 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 7 Physical Security The module is comprised of software only and therefore this section is not applicable. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 50 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 8 Non-Invasive Security This module does not implement any non-invasive security mechanisms, and therefore this section is not applicable. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 51 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 9 Sensitive Security Parameters Management ### 9.1 Storage Areas | Storage Area Name | Description | Persistence Type | |---------------------|-----------------------------------------------------------------------------|--------------------| | RAM | Temporary storage for SSPs used by the module as part of service execution. | Dynamic | Table 16: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in plaintext form. SSPs are stored until they are zeroized by the operator (using a zeroization call or removing power from the module) or zeroized automatically. ### 9.2 SSP Input-Output Methods | Name | From | To | Format Type | Distribution Type | Entry Type | SFI or Algorithm | |-----------------------|--------------------------------------|--------------------------------------|---------------|---------------------|--------------|--------------------| | API input parameters | Operator calling application (TOEPP) | Cryptographic module | Plaintext | Manual | Electronic | | | API output parameters | Cryptographic module | Operator calling application (TOEPP) | Plaintext | Manual | Electronic | | Table 17: SSP Input-Output Methods The module only supports SSP entry and output to and from the calling application running on the same operational environment. This corresponds to manual distribution, electronic entry/output ('CM Software to/from App via TOEPP Path') per FIPS 140 -3 IG 9.5.A Table 1. There is no entry or output of cryptographically protected SSPs. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 52 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ### 9.3 SSP Zeroization Methods | Zeroization Method | Description | Rationale | Operator Initiation | |----------------------|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Free cipher handle | Zeroizes the SSPs contained within the cipher handle. | Memory occupied by SSPs is overwritten with zeros, which renders the SSP values irretrievable. The successful completion of the zeroization routine indicates that the zeroization procedure succeeded. | By calling the appropriate zeroization functions: EVP_CIPHER_CTX_free, EVP_CIPHER_CTX_reset, HMAC_CTX_free, RSA_free, EC_KEY_free, DH_free, EVP_PKEY_free, FIPS_drbg_free, SSL_free, SSL_clear | | Automatic | Automatically zeroized by the module when no longer needed | Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable. The successful completion of the running service indicates that zeroization has completed. | N/A | | Module Reset | De-allocates the volatile memory used to store SSPs | Volatile memory used by the module is overwritten within nanoseconds when power is removed. The successful completion of the module reset indicates that zeroization has completed. | By unloading and reloading the module | ###### Table 18: SSP Zeroization Methods The application that uses the module is responsible for the appropriate zeroization of SSPs. The module provides key allocation and destruction functions, which overwrites the memory occupied by the SSP´s information with zeros before its deallocation. Calling the SSL_free() and SSL_clear() will zeroize the SSPs stored in the TLS protocol internal state and also invoke the corresponding API functions listed in Table 18 to zeroize SSPs. All data output is inhibited during zeroization. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 53 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ### 9.4 SSPs | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |-----------------------------------|-----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|--------------------------|---------------------|------------------|---------------------------------------------------------------------------------------------------------------------------------------| | AES key | AES key used for encryption, decryption, and computing MAC tags | AES-XTS: 128, 256 bits; Other modes: 128, 192, 256 bits - AES-XTS: 128, 256 bits; Other modes: 128, 192, 256 bits | Symmetric key - CSP | | | Encryption Decryption Authenticated encryption Authenticated decryption Key wrapping Key unwrapping Message authentication code (MAC) | | HMAC key | HMAC key used for computing MAC tags | 112- 524288 bits - 112- 256 bits | Authentication key - CSP | | | Authenticated encryption Authenticated decryption Message authentication code (MAC) | | Module- generated RSA private key | RSA private key generated by the module | 2048- 15360 bits - 112-256 bits | Private key - CSP | Key pair generation | | Key pair generation | | Module- generated RSA public key | RSA public key generated by the module | 2048- 15360 bits - 112-256 bits | Public key - PSP | Key pair generation | | Key pair generation | | RSA private key | RSA private key written to the module | 2048- 16384 bits - 112-256 bits | Private key - CSP | | | Digital signature generation | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 54 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |----------------------------------|----------------------------------------|--------------------------------------------------------------|-------------------|---------------------|------------------|-------------------------------------------------| | RSA public key | RSA public key written to the module | 2048- 16384 bits - 112-256 bits | Public key - PSP | | | Digital signature verification | | Module- generated DH private key | DH private key generated by the module | 2048- 8192 bits - 112-200 bits | Private key - CSP | Key pair generation | | Key pair generation | | Module- generated DH public key | DH public key generated by the module | 2048- 8192 bits - 112-200 bits | Public key - PSP | Key pair generation | | Key pair generation | | DH private key | DH private key written to the module | 2048- 8192 bits - 112-200 bits | Private key - CSP | | | Key pair verification Shared secret computation | | DH public key | DH public key written to the module | 2048- 8192 bits - 112-200 bits | Public key - PSP | | | Key pair verification Shared secret computation | | Module- generated EC private key | EC private key generated by the module | P-224, P- 256, P- 384, P- 521 bits - 112, 128, 192, 256 bits | Private key - CSP | Key pair generation | | Key pair generation | | Module- generated EC public key | EC public key generated by the module | P-224, P- 256, P- 384, P- 521 bits - 112, 128, 192, 256 bits | Public key - PSP | Key pair generation | | Key pair generation | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 55 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |-------------------------------------|-------------------------------------------|--------------------------------------------------------------|-------------------|---------------------|------------------|--------------------------------------------------------------------------------| | EC private key | EC private key written to the module | P-224, P- 256, P- 384, P- 521 bits - 112, 128, 192, 256 bits | Private key - CSP | | | Key pair verification Digital signature generation Shared secret computation | | EC public key | EC public key written to the module | P-224, P- 256, P- 384, P- 521 bits - 112, 128, 192, 256 bits | Public key - PSP | | | Key pair verification Digital signature verification Shared secret computation | | Module- generated EDDSA private key | EDDSA private key generated by the module | ED- 25519, ED-448 bits - 128, 224 bits | Private key - CSP | Key pair generation | | Key pair generation | | Module- generated EDDSA public key | EDDSA public key generated by the module | ED- 25519, ED-448 bits - 128, 224 bits | Public key - PSP | Key pair generation | | Key pair generation | | EDDSA private key | EDDSA private key written to the module | ED- 25519, ED-448 bits - 128, 224 bits | Private key - CSP | | | Digital signature generation | | EDDSA public key | EDDSA public key written to the module | ED- 25519, ED-448 bits - 128, 224 bits | Public key - PSP | | | Digital signature verification | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 56 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |------------------------|----------------------------------------------------------------------------|-------------------------------|---------------------|-----------------------------|---------------------------|--------------------------------------------------------------------------------| | Shared secret | Shared secret generated by ECDH or DH shared secret computation | 224-8912 bits - 112- 256 bits | Shared Secret - CSP | | Shared secret computation | Shared secret computation Key derivation with HKDF Key derivation with SSH KDF | | Password or passphrase | Password or passphrase used by PBKDF to derive symmetric keys | 20-128 character - N/A | Password - CSP | | | Password- based key derivation | | TLS pre- master secret | Used to derive the master secret in the TLS protocol | 224-8912 bits - 112- 256 bits | Shared secret - CSP | | Shared secret computation | Key derivation with TLS | | TLS master secret | Derived from the pre-master secret using the TLS KDF per SP 800-135 Rev. 1 | 384 bits - 128-256 bits | Master secret - CSP | Key derivation with TLS | | Key derivation with TLS | | TLS derived key | Generated using the TLS v1.0/1.1/1.2/1.3 KDF | 112-4096 bits - 112- 256 bits | Symmetric key - CSP | Key derivation with TLS | | Key derivation with TLS | | HKDF derived key | Derived using the HKDF | 112-4096 bits - 112- 256 bits | Symmetric key - CSP | Key derivation with HKDF | | Key derivation with HKDF | | SSH derived key | Generated using the SSH KDF | 112-4096 bits - 112- 256 bits | Symmetric key - CSP | Key derivation with SSH KDF | | Key derivation with SSH KDF | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 57 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |------------------------------------|--------------------------------------------------------------------------------------------------------------------|-----------------------------------------|--------------------------|--------------------------------|------------------|--------------------------------| | PBKDF derived key | Derived using the PBKDF | 112-4096 bits - 112- 256 bits | Symmetric key - CSP | Password- based key derivation | | Password- based key derivation | | Entropy input | Entropy input string used to seed the DRBG (IG D.L compliant) | 128-384 bits - 128- 256 bits | Entropy input - CSP | | | Random number generation | | DRBG seed | DRBG seed derived from entropy input (IG D.L compliant) | 256, 320, 384 bits - 128, 192, 256 bits | Seed - CSP | Random number generation | | Random number generation | | DRBG internal state (V value, Key) | Internal state of the CTR_DRBG | 256, 320, 384 bits - 128, 192, 256 bits | Internal state - CSP | Random number generation | | Random number generation | | Intermediate key generation value | Intermediate key generation value generated during key pair generation (SP 800-133 Rev. 2 Section 4, 5.1, and 5.2) | 112- 15360 bits - 112-256 bits | Intermediate value - CSP | Key pair generation | | Key pair generation | ###### Table 19: SSP Table 1 | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |---------|----------------------|---------------|------------------------------------------------------|---------------------------------|----------------| | AES key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 58 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |-----------------------------------|-----------------------|---------------|------------------------------------------------------|---------------------------------|-----------------------------------------------------------------------------------------------| | HMAC key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | | | Module- generated RSA private key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated RSA public key:Paired With Intermediate key generation value:Generated From | | Module- generated RSA public key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated RSA private key:Paired With Intermediate key generation value:Generated From | | RSA private key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | RSA public key:Paired With | | RSA public key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | RSA private key:Paired With | | Module- generated DH private key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated DH public key:Paired With Intermediate key generation value:Generated From | | Module- generated DH public key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated DH private key:Paired With Intermediate key | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 59 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |-------------------------------------|-----------------------|---------------|------------------------------------------------------|---------------------------------|----------------------------------------------------------------------------------------------| | | | | | | generation value:Generated From | | DH private key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | DH public key:Paired With TLS pre-master secret:Derivation of | | DH public key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | DH private key:Paired With TLS pre-master secret:Derivation of | | Module- generated EC private key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated EC public key:Paired With Intermediate key generation value:Generated From | | Module- generated EC public key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated EC private key:Paired With Intermediate key generation value:Generated From | | EC private key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | EC public key:Paired With TLS pre-master secret:Derivation of | | EC public key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | EC private key:Paired With TLS pre-master secret:Derivation of | | Module- generated EDDSA private key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated EDDSA public key:Paired With Intermediate key | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 60 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |------------------------------------|--------------------------------------------|---------------|------------------------------------------------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | generation value:Generated From | | Module- generated EDDSA public key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Module-generated EDDSA private key:Paired With Intermediate key generation value:Generated From | | EDDSA private key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | EDDSA public key:Paired With | | EDDSA public key | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | EDDSA private key:Paired With | | Shared secret | API input parameters API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | DH private key:Established By DH public key:Established By EC private key:Established By EC public key:Established By HKDF derived key:Derives SSH derived key:Derives | | Password or passphrase | API input parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | PBKDF derived key:Derives | | TLS pre-master secret | | RAM:Plaintext | From service invocation until | Free cipher handle | DH private key:Established By DH public | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 61 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |-------------------|-----------------------|---------------|------------------------------------------------------|---------------------------------|---------------------------------------------------------------------------------------------------------| | | | | cipher handle is freed | Module Reset | key:Established By EC private key:Established By EC public key:Established By TLS master secret:Derives | | TLS master secret | | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | TLS pre-master secret:Derived From TLS derived key:Derives | | TLS derived key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | TLS master secret:Derived From | | HKDF derived key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Shared secret:Derived From | | SSH derived key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Shared secret:Derived From | | PBKDF derived key | API output parameters | RAM:Plaintext | From service invocation until cipher handle is freed | Free cipher handle Module Reset | Password or passphrase:Derived From | | Entropy input | | RAM:Plaintext | From generation until DRBG seed is created | Automatic Module Reset | DRBG seed:Derives | | DRBG seed | | RAM:Plaintext | While the DRBG is instantiated | Automatic Module Reset | Entropy input:Derived From DRBG internal state | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 62 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |------------------------------------|------------------|---------------|------------------------------------------------------|---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | (V value, Key):Generates | | DRBG internal state (V value, Key) | | RAM:Plaintext | From DRBG instantiation until DRBG termination | Free cipher handle Module Reset | DRBG seed:Generated From | | Intermediate key generation value | | RAM:Plaintext | From service invocation until cipher handle is freed | Automatic Module Reset | Module-generated RSA private key:Generates Module-generated RSA public key:Generates Module-generated ECDSA private key:Generates Module-generated ECDSA public key:Generates Module-generated DH private key:Generates Module-generated DH public key:Generates Module-generated EDDSA private key:Generates Module-generated EDDSA public key:Generates | Table 20: SSP Table 2 ### 9.5 Transitions The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 63 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 10 Self-Tests ### 10.1 Pre-Operational Self-Tests Table 21: Pre-Operational Self-Tests | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | |---------------------|-------------------|------------------------|-----------------|---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | HMAC- SHA2-256 | 256-bit key | Message authentication | SW/FW Integrity | Module becomes operational and services are available for use | Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 that was computed at build time | The pre-operational software integrity tests are performed automatically when the module is initialized, before the module transitions into the operational state. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-tests are passed successfully. Prior the first use, a CAST is executed for the algorithms used in the Pre-operational Self-Tests. ### 10.2 Conditional Self-Tests | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------|-------------------|---------------|-------------|----------------------------|----------------|-------------------------------------------------| | SHA-1 (A6750) | 448-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA-1 (A6752) | 448-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA-1 (A6754) | 448-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 64 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------|-------------------|---------------|-------------|----------------------------|----------------|-------------------------------------------------| | SHA-1 (A6756) | 448-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA-1 (A6758) | 448-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-256 (A6750) | 72-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-256 (A6752) | 72-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-256 (A6754) | 72-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-256 (A6756) | 72-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-256 (A6758) | 72-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-512 (A6750) | 120-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 65 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------|-------------------|---------------|-------------|----------------------------|----------------|-------------------------------------------------| | SHA2-512 (A6752) | 120-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-512 (A6754) | 120-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-512 (A6756) | 120-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA2-512 (A6758) | 120-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA3-256 (A6760) | 144-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHA3-512 (A6760) | 144-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHAKE-128 (A6760) | 128-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | | SHAKE-256 (A6760) | 144-bit message | KAT | CAST | Module becomes operational | Message Digest | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 66 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------------|----------------------|---------------|-------------|----------------------------|--------------------------|-------------------------------------------------| | AES-ECB - Encrypt (A6738) | 128-bit key, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | | AES-ECB - Encrypt (A6739) | 128-bit key, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | | AES-ECB - Encrypt (A6740) | 128-bit key, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | | AES-ECB - Decrypt (A6738) | 128-bit key, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-ECB - Decrypt (A6739) | 128-bit key, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-ECB - Decrypt (A6740) | 128-bit key, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-CCM - Encrypt (A6738) | 192-bit key, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-CCM - Encrypt (A6739) | 192-bit key, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 67 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------------|----------------------------------|---------------|-------------|----------------------------|--------------------------|-------------------------------------------------| | AES-CCM - Encrypt (A6740) | 192-bit key, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-CCM - Decrypt (A6738) | 192-bit key, decrypt | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-CCM - Decrypt (A6739) | 192-bit key, decrypt | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-CCM - Decrypt (A6740) | 192-bit key, decrypt | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6741) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6742) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6743) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6744) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 68 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------------|-------------------------------------|---------------|-------------|----------------------------|--------------------------|-------------------------------------------------| | AES-GCM - Encrypt (A6745) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6746) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6747) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6748) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Encrypt (A6749) | 256-bit key, 96- bit IV, encrypt | KAT | CAST | Module becomes operational | Authenticated encryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6741) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6742) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6743) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 69 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------------------------------|-------------------------------------|---------------|-------------|----------------------------|--------------------------|-------------------------------------------------| | AES-GCM - Decrypt (A6744) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6745) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6746) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6747) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6748) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-GCM - Decrypt (A6749) | 256-bit key, 96- bit IV, decryption | KAT | CAST | Module becomes operational | Authenticated decryption | Test runs at power-on before the integrity test | | AES-XTS Testing Revision 2.0 - Encrypt (A6738) | 256, 512-bit keys, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | | AES-XTS Testing Revision 2.0 - Encrypt (A6739) | 256, 512-bit keys, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 70 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------------------------------|----------------------------|---------------|-------------|----------------------------|-----------------------------------------|-------------------------------------------------| | AES-XTS Testing Revision 2.0 - Encrypt (A6740) | 256, 512-bit keys, encrypt | KAT | CAST | Module becomes operational | Encryption | Test runs at power-on before the integrity test | | AES-XTS Testing Revision 2.0 - Decrypt (A6738) | 256, 512-bit keys, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-XTS Testing Revision 2.0 - Decrypt (A6739) | 256, 512-bit keys, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-XTS Testing Revision 2.0 - Decrypt (A6740) | 256, 512-bit keys, decrypt | KAT | CAST | Module becomes operational | Decryption | Test runs at power-on before the integrity test | | AES-CMAC (A6738) | 128-, 192, 256-bit keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | AES-CMAC (A6739) | 128-, 192, 256-bit keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | AES-CMAC (A6740) | 128-, 192, 256-bit keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 71 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------|-------------------|---------------|-------------|----------------------------|-----------------------------------------|-------------------------------------------------| | HMAC-SHA-1 (A6750) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA-1 (A6752) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA-1 (A6754) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA-1 (A6756) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA-1 (A6758) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 224 (A6750) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 224 (A6752) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 224 (A6754) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 72 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------|-------------------|---------------|-------------|----------------------------|-----------------------------------------|-------------------------------------------------| | HMAC-SHA2- 224 (A6756) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 224 (A6758) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 256 (A6750) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 256 (A6752) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 256 (A6754) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 256 (A6756) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 256 (A6758) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 384 (A6750) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 73 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------|-------------------|---------------|-------------|----------------------------|-----------------------------------------|-------------------------------------------------| | HMAC-SHA2- 384 (A6752) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 384 (A6754) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 384 (A6756) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 384 (A6758) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 512 (A6750) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 512 (A6752) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 512 (A6754) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA2- 512 (A6756) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 74 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |--------------------------------|-------------------------------------------------------------|---------------|-------------|----------------------------|-----------------------------------------|-------------------------------------------------| | HMAC-SHA2- 512 (A6758) | 160-bit key | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA3- 224 (A6760) | 224, 1152, 1376 bits keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA3- 256 (A6760) | 256, 1088, 1344 bits keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA3- 384 (A6760) | 384, 832, 1216 bits keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | HMAC-SHA3- 512 (A6760) | 512, 576, 1088 bits keys | KAT | CAST | Module becomes operational | Message authentication code computation | Test runs at power-on before the integrity test | | RSA SigGen (FIPS186-5) (A6750) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | RSA SigGen (FIPS186-5) (A6752) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | RSA SigGen (FIPS186-5) (A6754) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 75 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |--------------------------------|-------------------------------------------------------------|---------------|-------------|----------------------------|------------------------|-------------------------------------------------| | RSA SigGen (FIPS186-5) (A6756) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | RSA SigGen (FIPS186-5) (A6758) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | RSA SigGen (FIPS186-5) (A6760) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | RSA SigVer (FIPS186-5) (A6750) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | RSA SigVer (FIPS186-5) (A6752) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | RSA SigVer (FIPS186-5) (A6754) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | RSA SigVer (FIPS186-5) (A6756) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | RSA SigVer (FIPS186-5) (A6758) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 76 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |----------------------------------|-------------------------------------------------------------|---------------|-------------|----------------------------|------------------------|-------------------------------------------------| | RSA SigVer (FIPS186-5) (A6760) | 2048-bit key with SHA-256, with PKCS#1 v1.5 and PSS padding | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6750) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6752) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6754) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6756) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6758) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigGen (FIPS186-5) (A6760) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | ECDSA SigVer (FIPS186-5) (A6750) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 77 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |----------------------------------|---------------------|---------------|-------------|----------------------------|---------------------------|-------------------------------------------------| | ECDSA SigVer (FIPS186-5) (A6752) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | ECDSA SigVer (FIPS186-5) (A6754) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | ECDSA SigVer (FIPS186-5) (A6756) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | ECDSA SigVer (FIPS186-5) (A6758) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | ECDSA SigVer (FIPS186-5) (A6760) | P-256 with SHA- 256 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | EDDSA SigGen (A6763) | ED-25519, ED- 448 | KAT | CAST | Module becomes operational | Signature generation | Test runs at power-on before the integrity test | | EDDSA SigVer (A6763) | ED-25519, ED- 448 | KAT | CAST | Module becomes operational | Signature verification | Test runs at power-on before the integrity test | | KAS-FFC-SSC Sp800-56Ar3 (A6762) | ffdhe2048 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 78 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------------------|-------------------|---------------|-------------|----------------------------|---------------------------|-------------------------------------------------| | KAS-ECC-SSC Sp800-56Ar3 (A6750) | P-256 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | | KAS-ECC-SSC Sp800-56Ar3 (A6752) | P-256 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | | KAS-ECC-SSC Sp800-56Ar3 (A6754) | P-256 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | | KAS-ECC-SSC Sp800-56Ar3 (A6756) | P-256 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | | KAS-ECC-SSC Sp800-56Ar3 (A6758) | P-256 | KAT | CAST | Module becomes operational | Shared secret computation | Test runs at power-on before the integrity test | | TLS v1.2 KDF RFC7627 (A6750) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | TLS v1.2 KDF RFC7627 (A6752) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | TLS v1.2 KDF RFC7627 (A6754) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 79 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------------|-------------------|---------------|-------------|----------------------------|----------------|-------------------------------------------------| | TLS v1.2 KDF RFC7627 (A6756) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | TLS v1.2 KDF RFC7627 (A6758) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | TLS v1.3 KDF (A6761) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | KDA HKDF SP800-56Cr2 (A6761) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | KDF SSH (A6751) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | KDF SSH (A6753) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | KDF SSH (A6755) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | KDF SSH (A6757) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 80 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |---------------------|------------------------------------------------------------------|---------------|-------------|----------------------------|----------------|-------------------------------------------------| | KDF SSH (A6759) | SHA2-256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6750) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6752) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6754) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6756) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6758) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | | PBKDF (A6760) | 24 characters password, 288-bit salt, 4096 iterations, SHA2- 256 | KAT | CAST | Module becomes operational | Key derivation | Test runs at power-on before the integrity test | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 81 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------------------|------------------------------------------------------------------------------|---------------|-------------|------------------------------------|------------------------------------------------------|-------------------------------------------------| | Counter DRBG (A6738) | CTR-DRBG with AES with 256-bit keys with and without DF, with and without PR | KAT | CAST | Module becomes operational | Random number generation | Test runs at power-on before the integrity test | | Counter DRBG (A6739) | CTR-DRBG with AES with 256-bit keys with and without DF, with and without PR | KAT | CAST | Module becomes operational | Random number generation | Test runs at power-on before the integrity test | | Counter DRBG (A6740) | CTR-DRBG with AES with 256-bit keys with and without DF, with and without PR | KAT | CAST | Module becomes operational | Random number generation | Test runs at power-on before the integrity test | | Safe Primes Key Generation (A6762) | N/A | PCT | PCT | Key pair generation is successfull | PCT according to SP 800-56A Rev.3, Section 5.6.2.1.4 | Key pair generation | | ECDSA KeyGen (FIPS186-5) (A6750) | SHA2-256 | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | ECDSA KeyGen (FIPS186-5) (A6752) | SHA2-256 | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | ECDSA KeyGen (FIPS186-5) (A6754) | SHA2-256 | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | ECDSA KeyGen | SHA2-256 | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 82 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |----------------------------------|--------------------------------------------|---------------|-------------|------------------------------------|---------------------------------------|---------------------| | (FIPS186-5) (A6756) | | | | | | | | ECDSA KeyGen (FIPS186-5) (A6758) | SHA2-256 | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | RSA KeyGen (FIPS186-5) (A6750) | SHA2-256 with PKCS#1 v1.5 and PSS paddings | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | RSA KeyGen (FIPS186-5) (A6752) | SHA2-256 with PKCS#1 v1.5 and PSS paddings | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | RSA KeyGen (FIPS186-5) (A6754) | SHA2-256 with PKCS#1 v1.5 and PSS paddings | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | RSA KeyGen (FIPS186-5) (A6756) | SHA2-256 with PKCS#1 v1.5 and PSS paddings | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | RSA KeyGen (FIPS186-5) (A6758) | SHA2-256 with PKCS#1 v1.5 and PSS paddings | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | | EDDSA KeyGen (A6763) | N/A | PCT | PCT | Key pair generation is successfull | Signature generation and verification | Key pair generation | ###### Table 22: Conditional Self-Tests Data output through the data output interface is inhibited during the conditional self-tests. The module does not return control to the calling application until the tests are completed. If any of these tests fails, the module transitions to the error state (Section 10.4 Error States). © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 83 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ### 10.3 Periodic Self-Test Information | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |---------------------|------------------------|-----------------|-----------|-------------------| | HMAC-SHA2-256 | Message authentication | SW/FW Integrity | On demand | Manually | Table 23: Pre-Operational Periodic Information | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |---------------------|---------------|-------------|-----------|-------------------| | SHA-1 (A6750) | KAT | CAST | On demand | Manually | | SHA-1 (A6752) | KAT | CAST | On demand | Manually | | SHA-1 (A6754) | KAT | CAST | On demand | Manually | | SHA-1 (A6756) | KAT | CAST | On demand | Manually | | SHA-1 (A6758) | KAT | CAST | On demand | Manually | | SHA2-256 (A6750) | KAT | CAST | On demand | Manually | | SHA2-256 (A6752) | KAT | CAST | On demand | Manually | | SHA2-256 (A6754) | KAT | CAST | On demand | Manually | | SHA2-256 (A6756) | KAT | CAST | On demand | Manually | | SHA2-256 (A6758) | KAT | CAST | On demand | Manually | | SHA2-512 (A6750) | KAT | CAST | On demand | Manually | | SHA2-512 (A6752) | KAT | CAST | On demand | Manually | | SHA2-512 (A6754) | KAT | CAST | On demand | Manually | | SHA2-512 (A6756) | KAT | CAST | On demand | Manually | | SHA2-512 (A6758) | KAT | CAST | On demand | Manually | | SHA3-256 (A6760) | KAT | CAST | On demand | Manually | | SHA3-512 (A6760) | KAT | CAST | On demand | Manually | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 84 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |---------------------------|---------------|-------------|-----------|-------------------| | SHAKE-128 (A6760) | KAT | CAST | On demand | Manually | | SHAKE-256 (A6760) | KAT | CAST | On demand | Manually | | AES-ECB - Encrypt (A6738) | KAT | CAST | On demand | Manually | | AES-ECB - Encrypt (A6739) | KAT | CAST | On demand | Manually | | AES-ECB - Encrypt (A6740) | KAT | CAST | On demand | Manually | | AES-ECB - Decrypt (A6738) | KAT | CAST | On demand | Manually | | AES-ECB - Decrypt (A6739) | KAT | CAST | On demand | Manually | | AES-ECB - Decrypt (A6740) | KAT | CAST | On demand | Manually | | AES-CCM - Encrypt (A6738) | KAT | CAST | On demand | Manually | | AES-CCM - Encrypt (A6739) | KAT | CAST | On demand | Manually | | AES-CCM - Encrypt (A6740) | KAT | CAST | On demand | Manually | | AES-CCM - Decrypt (A6738) | KAT | CAST | On demand | Manually | | AES-CCM - Decrypt (A6739) | KAT | CAST | On demand | Manually | | AES-CCM - Decrypt (A6740) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 85 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |---------------------------|---------------|-------------|-----------|-------------------| | AES-GCM - Encrypt (A6741) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6742) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6743) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6744) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6745) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6746) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6747) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6748) | KAT | CAST | On demand | Manually | | AES-GCM - Encrypt (A6749) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6741) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6742) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6743) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6744) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6745) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 86 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |------------------------------------------------|---------------|-------------|-----------|-------------------| | AES-GCM - Decrypt (A6746) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6747) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6748) | KAT | CAST | On demand | Manually | | AES-GCM - Decrypt (A6749) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Encrypt (A6738) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Encrypt (A6739) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Encrypt (A6740) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Decrypt (A6738) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Decrypt (A6739) | KAT | CAST | On demand | Manually | | AES-XTS Testing Revision 2.0 - Decrypt (A6740) | KAT | CAST | On demand | Manually | | AES-CMAC (A6738) | KAT | CAST | On demand | Manually | | AES-CMAC (A6739) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 87 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |-----------------------|---------------|-------------|-----------|-------------------| | AES-CMAC (A6740) | KAT | CAST | On demand | Manually | | HMAC-SHA-1 (A6750) | KAT | CAST | On demand | Manually | | HMAC-SHA-1 (A6752) | KAT | CAST | On demand | Manually | | HMAC-SHA-1 (A6754) | KAT | CAST | On demand | Manually | | HMAC-SHA-1 (A6756) | KAT | CAST | On demand | Manually | | HMAC-SHA-1 (A6758) | KAT | CAST | On demand | Manually | | HMAC-SHA2-224 (A6750) | KAT | CAST | On demand | Manually | | HMAC-SHA2-224 (A6752) | KAT | CAST | On demand | Manually | | HMAC-SHA2-224 (A6754) | KAT | CAST | On demand | Manually | | HMAC-SHA2-224 (A6756) | KAT | CAST | On demand | Manually | | HMAC-SHA2-224 (A6758) | KAT | CAST | On demand | Manually | | HMAC-SHA2-256 (A6750) | KAT | CAST | On demand | Manually | | HMAC-SHA2-256 (A6752) | KAT | CAST | On demand | Manually | | HMAC-SHA2-256 (A6754) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 88 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |-----------------------|---------------|-------------|-----------|-------------------| | HMAC-SHA2-256 (A6756) | KAT | CAST | On demand | Manually | | HMAC-SHA2-256 (A6758) | KAT | CAST | On demand | Manually | | HMAC-SHA2-384 (A6750) | KAT | CAST | On demand | Manually | | HMAC-SHA2-384 (A6752) | KAT | CAST | On demand | Manually | | HMAC-SHA2-384 (A6754) | KAT | CAST | On demand | Manually | | HMAC-SHA2-384 (A6756) | KAT | CAST | On demand | Manually | | HMAC-SHA2-384 (A6758) | KAT | CAST | On demand | Manually | | HMAC-SHA2-512 (A6750) | KAT | CAST | On demand | Manually | | HMAC-SHA2-512 (A6752) | KAT | CAST | On demand | Manually | | HMAC-SHA2-512 (A6754) | KAT | CAST | On demand | Manually | | HMAC-SHA2-512 (A6756) | KAT | CAST | On demand | Manually | | HMAC-SHA2-512 (A6758) | KAT | CAST | On demand | Manually | | HMAC-SHA3-224 (A6760) | KAT | CAST | On demand | Manually | | HMAC-SHA3-256 (A6760) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 89 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |--------------------------------|---------------|-------------|-----------|-------------------| | HMAC-SHA3-384 (A6760) | KAT | CAST | On demand | Manually | | HMAC-SHA3-512 (A6760) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6750) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6752) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6754) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6756) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6758) | KAT | CAST | On demand | Manually | | RSA SigGen (FIPS186-5) (A6760) | KAT | CAST | On demand | Manually | | RSA SigVer (FIPS186-5) (A6750) | KAT | CAST | On demand | Manually | | RSA SigVer (FIPS186-5) (A6752) | KAT | CAST | On demand | Manually | | RSA SigVer (FIPS186-5) (A6754) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 90 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |----------------------------------|---------------|-------------|-----------|-------------------| | RSA SigVer (FIPS186-5) (A6756) | KAT | CAST | On demand | Manually | | RSA SigVer (FIPS186-5) (A6758) | KAT | CAST | On demand | Manually | | RSA SigVer (FIPS186-5) (A6760) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6750) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6752) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6754) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6756) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6758) | KAT | CAST | On demand | Manually | | ECDSA SigGen (FIPS186-5) (A6760) | KAT | CAST | On demand | Manually | | ECDSA SigVer (FIPS186-5) (A6750) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 91 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |----------------------------------|---------------|-------------|-----------|-------------------| | ECDSA SigVer (FIPS186-5) (A6752) | KAT | CAST | On demand | Manually | | ECDSA SigVer (FIPS186-5) (A6754) | KAT | CAST | On demand | Manually | | ECDSA SigVer (FIPS186-5) (A6756) | KAT | CAST | On demand | Manually | | ECDSA SigVer (FIPS186-5) (A6758) | KAT | CAST | On demand | Manually | | ECDSA SigVer (FIPS186-5) (A6760) | KAT | CAST | On demand | Manually | | EDDSA SigGen (A6763) | KAT | CAST | On demand | Manually | | EDDSA SigVer (A6763) | KAT | CAST | On demand | Manually | | KAS-FFC-SSC Sp800-56Ar3 (A6762) | KAT | CAST | On demand | Manually | | KAS-ECC-SSC Sp800-56Ar3 (A6750) | KAT | CAST | On demand | Manually | | KAS-ECC-SSC Sp800-56Ar3 (A6752) | KAT | CAST | On demand | Manually | | KAS-ECC-SSC Sp800-56Ar3 (A6754) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 92 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |---------------------------------|---------------|-------------|-----------|-------------------| | KAS-ECC-SSC Sp800-56Ar3 (A6756) | KAT | CAST | On demand | Manually | | KAS-ECC-SSC Sp800-56Ar3 (A6758) | KAT | CAST | On demand | Manually | | TLS v1.2 KDF RFC7627 (A6750) | KAT | CAST | On demand | Manually | | TLS v1.2 KDF RFC7627 (A6752) | KAT | CAST | On demand | Manually | | TLS v1.2 KDF RFC7627 (A6754) | KAT | CAST | On demand | Manually | | TLS v1.2 KDF RFC7627 (A6756) | KAT | CAST | On demand | Manually | | TLS v1.2 KDF RFC7627 (A6758) | KAT | CAST | On demand | Manually | | TLS v1.3 KDF (A6761) | KAT | CAST | On demand | Manually | | KDA HKDF SP800- 56Cr2 (A6761) | KAT | CAST | On demand | Manually | | KDF SSH (A6751) | KAT | CAST | On demand | Manually | | KDF SSH (A6753) | KAT | CAST | On demand | Manually | | KDF SSH (A6755) | KAT | CAST | On demand | Manually | | KDF SSH (A6757) | KAT | CAST | On demand | Manually | | KDF SSH (A6759) | KAT | CAST | On demand | Manually | | PBKDF (A6750) | KAT | CAST | On demand | Manually | | PBKDF (A6752) | KAT | CAST | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 93 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |------------------------------------|---------------|-------------|-----------|-------------------| | PBKDF (A6754) | KAT | CAST | On demand | Manually | | PBKDF (A6756) | KAT | CAST | On demand | Manually | | PBKDF (A6758) | KAT | CAST | On demand | Manually | | PBKDF (A6760) | KAT | CAST | On demand | Manually | | Counter DRBG (A6738) | KAT | CAST | On demand | Manually | | Counter DRBG (A6739) | KAT | CAST | On demand | Manually | | Counter DRBG (A6740) | KAT | CAST | On demand | Manually | | Safe Primes Key Generation (A6762) | PCT | PCT | On demand | Manually | | ECDSA KeyGen (FIPS186-5) (A6750) | PCT | PCT | On demand | Manually | | ECDSA KeyGen (FIPS186-5) (A6752) | PCT | PCT | On demand | Manually | | ECDSA KeyGen (FIPS186-5) (A6754) | PCT | PCT | On demand | Manually | | ECDSA KeyGen (FIPS186-5) (A6756) | PCT | PCT | On demand | Manually | | ECDSA KeyGen (FIPS186-5) (A6758) | PCT | PCT | On demand | Manually | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 94 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |--------------------------------|---------------|-------------|-----------|-------------------| | RSA KeyGen (FIPS186-5) (A6750) | PCT | PCT | On demand | Manually | | RSA KeyGen (FIPS186-5) (A6752) | PCT | PCT | On demand | Manually | | RSA KeyGen (FIPS186-5) (A6754) | PCT | PCT | On demand | Manually | | RSA KeyGen (FIPS186-5) (A6756) | PCT | PCT | On demand | Manually | | RSA KeyGen (FIPS186-5) (A6758) | PCT | PCT | On demand | Manually | | EDDSA KeyGen (A6763) | PCT | PCT | On demand | Manually | Table 24: Conditional Periodic Information ### 10.4 Error States | Name | Description | Conditions | Recovery Method | Indicator | |-----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------|-------------------------|-------------------------------------------------------------------------------------------------------------------| | Abort | If the module fails any of the preoperational self-tests or CASTs, the module enters this error state. In this error state, the module immediately stops functioning and ends the application process | Integrity test failure Any CAST failure | Module reinitialization | Message to stderr: "OpenSSL internal error, assertion failed: FATAL FIPS SELFTEST FAILURE". Module does not load. | | PCT Error | A PCT fails after generation of a key pair is requested | Any PCT failure | Module reinitialization | FIPS_selftest_failed() returns 1. The module returns an error code and stops functioning. Any | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 95 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Conditions | Recovery Method | Indicator | |--------|---------------|--------------|-------------------|---------------------------------------| | | | | | cryptographic operation is inhibited. | ###### Table 25: Error States In the ' PCT Error' state, errors are reported through the regular ERR interface of the modules and can be queried by functions such as ERR_get_error(). See the OpenSSL man pages for the function description. ### 10.5 Operator Initiation of Self-Tests Both conditional and pre-operational self-tests can be executed on-demand by unloading and subsequently reinitializing the module, or by calling the OSSL_PROVIDER_self_test function. The pair-wise consistency tests can be invoked on demand by requesting the key pair generation service. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 96 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 11 Life-Cycle Assurance ### 11.1 Installation, Initialization, and Startup Procedures Before the openssl-libs-1.1.1k-12.el8_6.ciqfips.0.10.x86_64 RPM package is installed, the Rocky Linux 8 system must operate in the FIPS validated configuration. This can be achieved by: - Adding the fips=1 option to the kernel command line during the system installation. During the software selection stage, do not install any third-party software. - Switching the system into the FIPS validated configuration after the installation. Execute the fipsmode-setup --enable command. Restart the system. In both cases, the Crypto Officer must verify the system operates in the FIPS validated configuration by executing the fips-mode-setup --check command, which should output 'FIPS mode is enabled.' ### 11.2 Administrator Guidance After the installation of the openssl-libs-1.1.1k-12.el8_6.ciqfips.0.10.x86_64 RPM package, the Crypto Officer must execute the 'Show module name and version' service by issuing the openssl version command. The output of this command must read: OpenSSL 1.1.1k FIPS 25 Mar 2021 Rocky release Rocky Linux 8 OpenSSL Cryptographic Module Rocky8.20250314 ### 11.3 Non-Administrator Guidance There is no administrator guidance. ### 11.4 Design and Rules Not applicable. ### 11.5 Maintenance Requirements Not applicable. ### 11.6 End of Life As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, the openssl-libs-1.1.1k12.el8_6.ciqfips.0.10.x86_64 RPM package can be uninstalled from the Rocky Linux 8 system. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 97 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## 12 Mitigation of Other Attacks ### 12.1 Attack List The module implements blinding against RSA timing attacks. RSA is vulnerable to timing attacks. In a setup where attackers can measure the time of RSA decryption or signature operations, blinding must be used to protect the RSA operation from that attack. The module provides the API functions RSA_blinding_on() and RSA_blinding_off() to turn the blinding on and off for RSA. When the blinding is on, the module generates a random value to form a blinding factor in the RSA key before the RSA key is used in the RSA cryptographic operations. © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 98 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## Appendix A. TLS Cipher Suites The module supports the following cipher suites for the TLS protocol versions 1.0, 1.1, 1.2 and 1.3 compliant with section 3.3.1 of [SP800-52rev2]. Each cipher suite defines the key exchange algorithm, the bulk encryption algorithm (including the symmetric key size) and the MAC algorithm. | Cipher Suite | ID | Reference | |--------------------------------------|----------------|-------------| | TLS_DH_RSA_WITH_AES_128_CBC_SHA | { 0x00, 0x31 } | RFC3268 | | TLS_DHE_RSA_WITH_AES_128_CBC_SHA | { 0x00, 0x33 } | RFC3268 | | TLS_DH_RSA_WITH_AES_256_CBC_SHA | { 0x00, 0x37 } | RFC3268 | | TLS_DHE_RSA_WITH_AES_256_CBC_SHA | { 0x00, 0x39 } | RFC3268 | | TLS_DH_RSA_WITH_AES_128_CBC_SHA256 | { 0x00,0x3F } | RFC5246 | | TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 | { 0x00,0x67 } | RFC5246 | | TLS_DH_RSA_WITH_AES_256_CBC_SHA256 | { 0x00,0x69 } | RFC5246 | | TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 | { 0x00,0x6B } | RFC5246 | | TLS_PSK_WITH_AES_128_CBC_SHA | { 0x00, 0x8C } | RFC4279 | | TLS_PSK_WITH_AES_256_CBC_SHA | { 0x00, 0x8D } | RFC4279 | | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | { 0x00, 0x9E } | RFC5288 | | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | { 0x00, 0x9F } | RFC5288 | | TLS_DH_RSA_WITH_AES_128_GCM_SHA256 | { 0x00, 0xA0 } | RFC5288 | | TLS_DH_RSA_WITH_AES_256_GCM_SHA384 | { 0x00, 0xA1 } | RFC5288 | | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA | { 0xC0, 0x04 } | RFC4492 | | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA | { 0xC0, 0x05 } | RFC4492 | | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | { 0xC0, 0x09 } | RFC4492 | | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | { 0xC0, 0x0A } | RFC4492 | | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA | { 0xC0, 0x0E } | RFC4492 | | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA | { 0xC0, 0x0F } | RFC4492 | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 99 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Cipher Suite | ID | Reference | |-----------------------------------------|----------------|-------------| | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | { 0xC0, 0x13 } | RFC4492 | | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | { 0xC0, 0x14 } | RFC4492 | | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | { 0xC0, 0x23 } | RFC5289 | | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | { 0xC0, 0x24 } | RFC5289 | | TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 | { 0xC0, 0x25 } | RFC5289 | | TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 | { 0xC0, 0x26 } | RFC5289 | | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | { 0xC0, 0x27 } | RFC5289 | | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | { 0xC0, 0x28 } | RFC5289 | | TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 | { 0xC0, 0x29 } | RFC5289 | | TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 | { 0xC0, 0x2A } | RFC5289 | | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | { 0xC0, 0x2B } | RFC5289 | | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | { 0xC0, 0x2C } | RFC5289 | | TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 | { 0xC0, 0x2D } | RFC5289 | | TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 | { 0xC0, 0x2E } | RFC5289 | | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | { 0xC0, 0x2F } | RFC5289 | | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | { 0xC0, 0x30 } | RFC5289 | | TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 | { 0xC0, 0x31 } | RFC5289 | | TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 | { 0xC0, 0x32 } | RFC5289 | | TLS_DHE_RSA_WITH_AES_128_CCM | { 0xC0, 0x9E } | RFC6655 | | TLS_DHE_RSA_WITH_AES_256_CCM | { 0xC0, 0x9F } | RFC6655 | | TLS_DHE_RSA_WITH_AES_128_CCM_8 | { 0xC0, 0xA2 } | RFC6655 | | TLS_DHE_RSA_WITH_AES_256_CCM_8 | { 0xC0, 0xA3 } | RFC6655 | | TLS_AES_128_GCM_SHA256 | { 0x13, 0x01 } | RFC8446 | | TLS_AES_256_GCM_SHA384 | { 0x13, 0x02 } | RFC8446 | | TLS_AES_128_CCM_SHA256 | { 0x13, 0x04 } | RFC8446 | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 100 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | Cipher Suite | ID | Reference | |--------------------------|----------------|-------------| | TLS_AES_128_CCM_8_SHA256 | { 0x13, 0x05 } | RFC8446 | Page 101 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 102 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## Appendix B. Glossary and Abbreviations | AES | Advanced Encryption Standard | |-------|----------------------------------------------------------------| | API | Application Programming Interface | | CAST | Cryptographic Algorithm Self-Test | | CAVP | Cryptographic Algorithm Validation Program | | CBC | Cipher Block Chaining | | CCM | Counter with Cipher Block Chaining-Message Authentication Code | | CFB | Cipher Feedback | | CKG | Cryptographic Key Generation | | CMAC | Cipher-based Message Authentication Code | | CMVP | Cryptographic Module Validation Program | | CSP | Critical Security Parameter | | CTR | Counter | | CVL | Component Validation List | | DH | Diffie-Hellman | | DRBG | Deterministic Random Bit Generator | | ECB | Electronic Code Book | | ECC | Elliptic Curve Cryptography | | ECDH | Elliptic Curve Diffie-Hellman | | ECDSA | Elliptic Curve Digital Signature Algorithm | | EdDSA | Edwards-Curve Digital Signature Algorithm | | EVP | Envelope | | FFC | Finite Field Cryptography | | FIPS | Federal Information Processing Standards | | GCM | Galois Counter Mode | | GMAC | Galois Counter Mode Message Authentication Code | | HKDF | HMAC-based Key Derivation Function | | HMAC | Keyed-Hash Message Authentication Code | | IKE | Internet Key Exchange | | KAS | Key Agreement Scheme | | KAT | Known Answer Test | | KDA | Key Derivation Algorithm | | KDF | Key Derivation Function | | KTS | Key Transport Scheme | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 103 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | KW | Key Wrap | |--------|-----------------------------------------------------------| | KWP | Key Wrap with Padding | | MAC | Message Authentication Code | | NIST | National Institute of Science and Technology | | OFB | Output Feedback | | PAA | Processor Algorithm Acceleration | | PAI | Processor Algorithm Implementation | | PCT | Pair-wise Consistency Test | | PBKDF2 | Password-based Key Derivation Function v2 | | PKCS | Public Key Cryptography Standard | | PRF | Pseudo-Random Function | | PSP | Public Security Parameter | | PSS | Probabilistic Signature Scheme | | RSA | Rivest, Shamir, Adleman | | SHA | Secure Hash Algorithm | | SSC | Shared Secret Computation | | SSH | Secure Shell | | SSP | Sensitive Security Parameter | | TLS | Transport Layer Security | | XOF | Extendable Output Function | | XTS | XEX-based Tweaked-codebook mode with cipher text Stealing | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 104 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy ## Appendix C. References FIPS 140-3 FIPS PUB 140-3 - Security Requirements for Cryptographic Modules March 2019 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program 23 October 2024 https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation- program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf ###### FIPS 180-4 Secure Hash Standard (SHS) August 2015 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf ###### FIPS 186-5 Digital Signature Standard (DSS) February 2023 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf ###### FIPS 197 Advanced Encryption Standard November 2001 https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf ###### FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions August 2015 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 105 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | RFC 3268 | Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS) June 2002 | |------------|-------------------------------------------------------------------------------------------------------------------------------------| | RFC 3526 | More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE) May 2003 https://www.ietf.org/rfc/rfc3526.txt | | RFC 4279 | Pre-Shared Key Ciphersuites for Transport Layer Security (TLS) December 2005 https://www.rfc-editor.org/rfc/rfc4279.txt | | RFC 4492 | Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) May 2006 | | RFC 5246 | The Transport Layer Security (TLS) Protocol Version 1.2 August 2008 | | RFC 5288 | AES Galois Counter Mode (GCM) Cipher Suites for TLS August 2008 https://www.rfc-editor.org/rfc/rfc5246.txt | | RFC 5289 | TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM) August 2008 | https://www.ietf.org/rfc/rfc5289.txt © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 106 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | RFC 6655 | AES-CCM Cipher Suites for Transport Layer Security (TLS) July 2012 https://www.rfc-editor.org/rfc/rfc6655.txt | |--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | RFC 7919 | Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS) August 2016 | | RFC 8446 | The Transport Layer Security (TLS) Protocol Version 1.3 August 2018 https://www.ietf.org/rfc/rfc8446.txt | | SP 800-140B Rev. 1 | NIST Special Publication 800-140B - CMVP Security Policy Requirements October 2024 https://csrc.nist.gov/projects/cmvp/sp800-140b | | SP 800-38A | Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf | | SP 800-38B | Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 | | SP 800-38C | Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality July 2007 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 107 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | SP 800-38D | Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 | |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SP 800-38E | Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38e.pdf | | SP 800-38F | Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf | | SP 800-52 Rev. 2 | Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations August 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf | | SP 800-56A Rev. 3 | Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf | | SP 800-56C Rev. 2 | Recommendation for Key-Derivation Methods in Key-Establishment Schemes August 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf | | SP 800-90A Rev. 1 | Recommendation for Random Number Generation Using Deterministic Random Bit Generators | © 2025 Ctrl IQ, Inc./atsec information security corporation. This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 108 of 109 Rocky Linux 8 OpenSSL Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy | SP 800-90B | Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf | |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | SP 800-131A Rev. 2 | Transitioning the Use of Cryptographic Algorithms and Key Lengths March 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf | | SP 800-132 | Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf | | SP 800-133 Rev. 2 | Recommendation for Cryptographic Key Generation June 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf | | SP 800-135 Rev. 1 | Recommendation for Existing Application-Specific Key Derivation Functions December 2011 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf | This document can be reproduced and distributed only whole and intact, including this copyright notice. Page 109 of 109