This page was not yet optimized for use on mobile devices.
Palo Alto Networks SD-WAN ION Core Crypto Module
Certificate details
| Certificate ID | #5392 |
|---|---|
| Status | active |
| Validation dates | 10.07.2026 |
| Sunset date | 07-07-2029 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in section 11.1 of the Security Policy and operated in approved mode |
| Exceptions |
|
| Description | The Palo Alto Networks SD-WAN ION Core Crypto Module is utilized in hardware and software ION form factors. These enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of your WAN. |
| Vendor | Palo Alto Networks, Inc. http://www.paloaltonetworks.com |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES, AES-, CAST, HMAC, CBC-MACAsymmetric Algorithms
ECDH, ECDHE, ECDSA, Diffie-Hellman, DSAHash functions
SHA-1, SHA1Schemes
MACProtocols
SSH, SSHv2, TLS, TLSv1.2, TLS v1.2, IKEv2Randomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, P-224, Curve P-256Block cipher modes
CTR, GCMTrusted Execution Environments
PSP, SSCSecurity level
Level 1Standards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-90B, PKCS 1, RFC 5288Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5392,
"dgst": "6da233543753c62b",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"KDF TLSA3572",
"KDF SNMPA3566",
"RSA SigGen (FIPS186-4)A3566",
"Counter DRBGA3566",
"HMAC-SHA2-512A3572",
"KAS-ECC-SSC Sp800-56Ar3A3572",
"AES-CTRA3566",
"SHA2-256A3572",
"AES-CBCA3572",
"AES-CFB128A3566",
"HMAC DRBGA3572",
"HMAC-SHA2-256A3572",
"HMAC-SHA2-384A3572",
"HMAC-SHA-1A3566",
"SHA-1A3566",
"AES-ECBA3566",
"KDF SSHA3566",
"KDF IKEv2A3566",
"SHA2-384A3572",
"#A3572",
"RSA KeyGen (FIPS186-4)A3566",
"SHA2-512A3572",
"ECDSA SigGen (FIPS186-4)A3566",
"ECDSA KeyGen (FIPS186-4)A3566",
"#A3566",
"RSA SigVer (FIPS186-4)A3572",
"AES-GCMA3572",
"ECDSA SigVer (FIPS186-4)A3566"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A3566",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A3566",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3566",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3566",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3566",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3566",
"properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 128, Additional Input: 256, Additional Input: 320, Additional Input: 384 Entropy Input - Entropy Input: 128, Entropy Input: 192,",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Entropy Input: 256, Entropy Input: 320, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128, Nonce: 64 Personalization String Length - Personalization String Length: 128, Personalization String Length: 256, Personalization String Length: 320, Personalization String Length: 384 Returned Bits - 1152, 448, 768, 832, 896, 960",
"reference": ""
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Extra Bits, Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3566",
"properties": "MAC - MAC: 80-160 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3566",
"properties": "MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3566",
"properties": "MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3566",
"properties": "MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC- SSC Sp800- 56Ar3",
"cavpCertName": "A3566",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P- 521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A3566",
"properties": "Initiator Nonce Length - Initiator Nonce Length: 512 Responder Nonce Length - Responder Nonce Length: 512 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 1056-3072 Increment 8 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A3566",
"properties": "Password Length - Password Length: 64, 2048 Engine ID - 00100020003000400050, 12345678901234567890",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A3566",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF TLS (CVL)",
"cavpCertName": "A3566",
"properties": "TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Key Generation Mode - B.3.3 Modulo - 2048, 3072 Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Random Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3566",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3566",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3566",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3566",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3566",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3572",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3572",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96, 1024 Payload Length - Payload Length: 64-256 Increment 8 AAD Length - AAD Length: 0, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A3572",
"properties": "Prediction Resistance - Yes Supports Reseed - No Mode - SHA2-512 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 256 Additional Input - Additional Input: 256 Returned Bits - 896",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3572",
"properties": "MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A3572",
"properties": "MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A3572",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF TLS (CVL)",
"cavpCertName": "A3572",
"properties": "TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3572",
"properties": "Signature Type - PKCS 1.5 Modulo - 2048",
"reference": "FIPS 186-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3572",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3572",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3572",
"properties": "MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1120 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3572",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Initiate and run the pre- operational self-tests",
"indicator": "None",
"inputs": "Command to trigger self-test",
"name": "Self-Test",
"outputs": "Status of the self-test results",
"rolesSspAccess": "Crypto Officer Unauthenticat ed",
"secFunImpl": "None"
},
{
"description": "Zeroize all unprotecte d SSPs stored in the module",
"indicator": "None",
"inputs": "Command to initiate the SSPs zeroization",
"name": "Zeroization",
"outputs": "Status of the SSPs zeroization",
"rolesSspAccess": "Crypto Officer - CTR DRBG Entropy Input: Z - CTR DRBG Seed: Z - CTR DRBG Internal State (V, Key): Z - HMAC DRBG Entropy Input: Z - HMAC",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "DRBG Seed: Z - HMAC DRBG Internal State (V, Key): Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS ECDHE Private Key: Z - TLS ECDHE Public Key: Z - Peer TLS ECDHE Public Key: Z - TLS ECDHE Shared Secret: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authentication Key: Z - IPSec/IKEv2 Pre-Shared Secret: Z - IPSec/IKEv2 RSA Private Key: Z - IPSec/IKEv2 RSA Public Key: Z - IPSec/IKEv2 ECDHE Private Key: Z - IPSec/IKEv2 ECDHE Public Key: Z - Peer IPSec/IKEv2 ECDHE Public Key: Z - IPSec/IKEv2 ECDHE Shared Secret: Z - SKEYSEED: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPSec/IKEv2 Session Encryption Key: Z - IPSec/IKEv2 Session Authentication Key: Z - SNMPv3 Authentication Secret: Z - SNMPv3 Session Encryption Key: Z - SNMPv3 Session Authentication Key: Z - SSH ECDHE Private Key: Z - SSH ECDHE Public Key: Z - Peer SSH ECDHE Public Key: Z - SSH ECDHE Shared Secret: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authentication Key: Z",
"secFunImpl": ""
},
{
"description": "Provides the module\u0027s name/ID and versions",
"indicator": "None",
"inputs": "Command to show version",
"name": "Show Version",
"outputs": "Module\u0027s name/ID and versions",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Provides the module\u0027s current status and information",
"indicator": "None",
"inputs": "Command to show status",
"name": "Show Status",
"outputs": "Module\u0027s status information",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform the module\u0027s network configuratio n",
"indicator": "Global indicator and configuratio n logs",
"inputs": "Commands to configure the module",
"name": "Configure Network",
"outputs": "Status of the completion of network related configuratio n",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Create a secure SSHv2 channel",
"indicator": "Global indicator and SSH connection log message",
"inputs": "Commands to configure SSHv2",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completion of SSHv2 configuratio n",
"rolesSspAccess": "Crypto Officer - SSH ECDSA Private Key: G,W - SSH ECDSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E",
"secFunImpl": "ECDSA KeyGen DRBG Function"
},
{
"description": "Negotiation and encrypted data transport via SSH",
"indicator": "Global indicator and SSH connection log message",
"inputs": "Initiate SSHv2 tunnel establishme nt request",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 tunnel establishme nt",
"rolesSspAccess": "Crypto Officer - SSH ECDHE Private Key: G,W,E - SSH ECDHE Public Key: G,R,W - Peer SSH ECDHE Public Key: W,E - SSH ECDHE Shared Secret: G,W,E - SSH ECDSA Private Key: E - SSH ECDSA Public Key: R - SSH Session Encryption Key: G,W,E - SSH Session Authentication Key: G,W,E - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E",
"secFunImpl": "KAS-ECC- KeyGen (SSHv2) KAS-ECC (SSHv2) ECDSA SigGen ECDSA SigVer Block Cipher (SSHv2) MAC (SSHv2) DRBG Function SSHv2 Keying Materials Developmen t"
},
{
"description": "Create a secure TLSv1.2 channel",
"indicator": "Global Indicator and TLS success log message",
"inputs": "Commands to configure TLSv1.2",
"name": "Configure TLSv1.2 Function",
"outputs": "Status of the completion of TLSv1.2 configuratio n",
"rolesSspAccess": "Crypto Officer - TLS RSA Private Key: G,W - TLS RSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E",
"secFunImpl": "RSA KeyGen DRBG Function"
},
{
"description": "Negotiation and encrypted data transport via TLS",
"indicator": "Global indicator and TLS success log message",
"inputs": "Initiate TLSv1.2 tunnel establishme nt request",
"name": "Run TLSv1.2 Function",
"outputs": "Status of TLSv1.2 tunnel establishme nt",
"rolesSspAccess": "Crypto Officer - TLS RSA Private Key: E - TLS RSA Public Key: R - TLS ECDHE Private Key: G,W,E - TLS ECDHE Public Key: G,R,W - Peer TLS ECDHE Public Key: W,E - TLS ECDHE Shared Secret: G,W,E - TLS Master Secret: G,W,E - TLS Session Encryption Key: G,W,E - TLS Session Authentication Key: G,W,E - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E - HMAC DRBG Entropy Input: E - HMAC DRBG Seed:",
"secFunImpl": "KAS-ECC- KeyGen (TLSv1.2) KAS-ECC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) RSA SigGen RSA SigVer (TLSv1.2) Block Cipher (TLSv1.2) MAC (TLSv1.2) DRBG Function TLSv1.2 Keying Materials Developmen t"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - HMAC DRBG Internal State (V, Key): E",
"secFunImpl": ""
},
{
"description": "Create a secure SNMPv3 channel",
"indicator": "Global indicator and SNMPv3 success log message",
"inputs": "Commands to configure SNMPv3",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completion of SNMPv3 configuratio n",
"rolesSspAccess": "Crypto Officer - SNMPv3 Authentication Secret: W",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM)"
},
{
"description": "Negotiation and encrypted data transport via SNMPv3",
"indicator": "Global indicator and SNMPv3 success log message",
"inputs": "Initiate SNMPv3 tunnel establishme nt request",
"name": "Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel establishme nt",
"rolesSspAccess": "Crypto Officer - SNMPv3 Authentication Secret: E - SNMPv3 Session Encryption Key: G,W,E - SNMPv3 Session Authentication",
"secFunImpl": "Block Cipher (SNMPv3) MAC (SNMPv3) SNMPv3 Keying Materials Developmen t"
},
{
"description": "Create IPSec/IKEv 2 tunnel",
"indicator": "Global indicator and IPSec/IKEv 2 success log message",
"inputs": "Commands to configure IPSec/IKEv2",
"name": "Configure IPSec/IKEv 2 Function",
"outputs": "Status of the completion of IPSec/IKEv2 configuratio n",
"rolesSspAccess": "Crypto Officer - IPSec/IKEv2 Pre-Shared Secret: W - IPSec/IKEv2 RSA Private Key: G,W - IPSec/IKEv2 RSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E",
"secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) RSA KeyGen DRBG Function"
},
{
"description": "Negotiation and encrypted data transport via IPSec/IKEv 2",
"indicator": "Global indicator and IPSec/IKEv 2 success log message",
"inputs": "Initiate IPSec/IKEv2 tunnel establishme nt request",
"name": "Run IPSec/IKEv 2 Function",
"outputs": "Status of IPSec/IKEv2 tunnel establishme nt",
"rolesSspAccess": "Crypto Officer - IPSec/IKEv2 Pre-Shared Secret: E - IPSec/IKEv2 RSA Private Key: E - IPSec/IKEv2 RSA Public Key: R",
"secFunImpl": "KAS-ECC- KeyGen (IPSec/IKEv 2) KAS-ECC (IPSec/IKEv 2) RSA SigGen RSA SigVer (IPSec/IKEv"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPSec/IKEv2 ECDHE Private Key: G,W,E - IPSec/IKEv2 ECDHE Public Key: G,R,W - Peer IPSec/IKEv2 ECDHE Public Key: W,E - IPSec/IKEv2 ECDHE Shared Secret: G,W,E - SKEYSEED: G,W,E - IPSec/IKEv2 Session Encryption Key: G,W,E - IPSec/IKEv2 Session Authentication Key: G,W,E - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E",
"secFunImpl": "2) Block Cipher (IPSec/IKEv 2) MAC (IPSec/IKEv 2) DRBG Function IPSec/IKEv2 Keying Materials Developmen t"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A3566)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A3566)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Encrypt KAT (A3566)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Decrypt KAT (A3566)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A3572)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A3572)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Encrypt KAT (A3572)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Decrypt KAT (A3572)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate KAT (A3566)",
"condition": "Power Up",
"details": "Instantiate",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Generate KAT (A3566)",
"condition": "Power Up",
"details": "Generate",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Reseed KAT (A3566)",
"condition": "Power Up",
"details": "Reseed",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen KAT (A3566)",
"condition": "Power Up",
"details": "Sign",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-224 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer KAT (A3566)",
"condition": "Power Up",
"details": "Verify",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-224 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG Instantiate KAT (A3572)",
"condition": "Power Up",
"details": "Instantiate KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG Reseed KAT (A3572)",
"condition": "Power Up",
"details": "Reseed KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG Generate KAT (A3572)",
"condition": "Power Up",
"details": "Generate KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A3572)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A3572)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 KAT (A3566)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 KAT (A3572)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Curve P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF TLS KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SNMP KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF TLS KAT (A3572)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen KAT (A3566)",
"condition": "Power Up",
"details": "Sign",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer KAT (A3566)",
"condition": "Power Up",
"details": "Verify",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer KAT (A3572)",
"condition": "Power Up",
"details": "Verify",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 KAT (A3566)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen PCT (A3566)",
"condition": "Performs on newly generated keypairs before first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P-256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen PCT (A3566)",
"condition": "Performs on newly generated keypairs before first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC KeyGen PCT (A3566)",
"condition": "Performs on newly generated key pairs before first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P-256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC KeyGen PCT (A3572)",
"condition": "Performs on newly generated keypairs before first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P-256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "Entropy 90B Start-up Repetition Count Test (RCT)",
"condition": "Power Up",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetition Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Start-up Adaptive Proportion Test (APT)",
"condition": "Power Up",
"details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environmental change affecting the noise source",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportion Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RPT)",
"condition": "Entropy data is generatd from the Entropy Source - Continuous",
"details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetition Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90B Continuous Adaptive Proportions Test (APT)",
"condition": "Entropy data is generated from the Entropy Source - Continuous",
"details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environmental change affecting the noise source",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportions Test",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Failed Pre-Operational Software Integrity Test Failed Conditional CAST Failed Conditional PCT Failed SP 800-90B Entropy Source Start-up/Continuous health tests",
"description": "In the Error State, no cryptographic services are provided and the data output is prohibited",
"indicator": "System Halt",
"name": "Error State",
"recoveryMethod": "Reboot the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module has one approved mode of operation and is always in approved mode after initialization",
"name": "Approved Mode",
"statusIndicator": "Device Mode: \"fips\" output after following initialization steps in section 11.1",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "API input parameters for data",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "API output parameters for data",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API function calls",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "N/A",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Return values and/or log messages",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Software Integrity Test",
"details": "Hash Comparison",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC-SHA2- 256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "HDD within TOEPP",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside of the module\u0027s boundary)"
},
{
"dest": "External (Outside of the module\u0027s boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "HDD within TOEPP"
},
{
"dest": "HDD within TOEPP",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Password/Secret Input via TLSv1.2 decrypted by AES and HMAC",
"sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
"source": "External (Outside of the module\u0027s boundary)"
},
{
"dest": "HDD within TOEPP",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Password/Secret Input via TLSv1.2 decrypted by AES- GCM",
"sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
"source": "External (Outside of the module\u0027s boundary)"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service",
"method": "Zeroization Command",
"operatorId": "\"Disable System\" command",
"rationale": "The zeroization command will erase all SSPs stored in the RAM or in the HDD within the TOEPP."
},
{
"description": "Zeroization upon session termination",
"method": "Session Termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Operator powers the module off",
"method": "Power Down",
"operatorId": "\"Debug reboot\" command or unplugging the module",
"rationale": "Powering off the module will erase all SSPs stored in the RAM within the TOEPP."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile Memory",
"name": "DRAM within TOEPP",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile Memory",
"name": "HDD within TOEPP",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "ION 1200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-NA",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-NA",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-ROW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-ROW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-5G-WW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-C-5G-WW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-NA",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-NA",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-ROW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-ROW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-5G-WW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 1200-S-C-5G-WW",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3436L",
"version": "1.0"
},
{
"hardwarePlatform": "ION 3200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C3558R",
"version": "1.0"
},
{
"hardwarePlatform": "ION 3200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C3558R",
"version": "1.0"
},
{
"hardwarePlatform": "ION 5200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom C5325",
"version": "1.0"
},
{
"hardwarePlatform": "ION 5200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom C5325",
"version": "1.0"
},
{
"hardwarePlatform": "ION 9200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "Yes",
"processors": "Intel Atom P5362",
"version": "1.0"
},
{
"hardwarePlatform": "ION 9200",
"hypervisorHostOs": "",
"operatingSystem": "ION 6.1",
"paa_pai": "No",
"processors": "Intel Atom P5362",
"version": "1.0"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG from CTR DRBG",
"reference": "SP 800-133r2 Section 4, example 1"
},
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG from HMAC DRBG",
"reference": "SP 800-133r2 Section 4, example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "Dependent on Provider",
"operatingSystem": "AWS"
},
{
"hardwarePlatform": "Dependent on Provider",
"operatingSystem": "Azure"
},
{
"hardwarePlatform": "Dependent on Provider",
"operatingSystem": "Google Cloud"
},
{
"hardwarePlatform": "Dependent on Provider",
"operatingSystem": "OCI"
},
{
"hardwarePlatform": "GPC",
"operatingSystem": "ION 7108V"
},
{
"hardwarePlatform": "GPC",
"operatingSystem": "ION 3108V"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 1,
"ECDHE": 57
},
"ECDSA": {
"ECDSA": 35
}
},
"FF": {
"DH": {
"Diffie-Hellman": 2
},
"DSA": {
"DSA": 3
}
}
},
"certification_process": {},
"cipher_mode": {
"CTR": {
"CTR": 37
},
"GCM": {
"GCM": 9
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKEv2": 3
},
"SSH": {
"SSH": 51,
"SSHv2": 43
},
"TLS": {
"TLS": {
"TLS": 69,
"TLS v1.2": 1,
"TLSv1.2": 60
}
}
},
"crypto_scheme": {
"MAC": {
"MAC": 25
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"Curve P-256": 5,
"P-224": 8,
"P-256": 43,
"P-384": 12,
"P-521": 8
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 3,
"AES-128": 2,
"AES-128/192/256": 1,
"AES-192": 2,
"AES-256": 5,
"AES-GCM 128 and 256": 1,
"DRBG 256": 2,
"HMAC- SHA1": 1,
"HMAC-SHA-1": 6,
"PKCS 1": 3,
"SHA-1": 7,
"SHA1": 1,
"SHA2- 256": 7,
"SHA2-256": 13,
"SHA2-384": 9,
"SHA2-512": 12,
"SHA2512": 1
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 7,
"SHA1": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 85
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 8,
"FIPS 180-4": 7,
"FIPS 186-4": 9,
"FIPS 198-1": 7,
"FIPS186-4": 14
},
"NIST": {
"SP 800-135": 5,
"SP 800-38A": 5,
"SP 800-38D": 2,
"SP 800-56A": 2,
"SP 800-90A": 2,
"SP 800-90B": 1
},
"PKCS": {
"PKCS 1": 3
},
"RFC": {
"RFC 5288": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 11,
"AES-": 9,
"AES-128": 2,
"AES-192": 2,
"AES-256": 5
},
"CAST": {
"CAST": 75
}
},
"constructions": {
"MAC": {
"CBC-MAC": 2,
"HMAC": 37
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 3
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"KDF TLSA3572",
"KDF SNMPA3566",
"RSA SigGen (FIPS186-4)A3566",
"Counter DRBGA3566",
"HMAC-SHA2-512A3572",
"KAS-ECC-SSC Sp800-56Ar3A3572",
"AES-CTRA3566",
"SHA2-256A3572",
"AES-CBCA3572",
"AES-CFB128A3566",
"HMAC DRBGA3572",
"HMAC-SHA2-256A3572",
"HMAC-SHA2-384A3572",
"HMAC-SHA-1A3566",
"SHA-1A3566",
"AES-ECBA3566",
"KDF SSHA3566",
"KDF IKEv2A3566",
"SHA2-384A3572",
"RSA KeyGen (FIPS186-4)A3566",
"SHA2-512A3572",
"ECDSA SigGen (FIPS186-4)A3566",
"ECDSA KeyGen (FIPS186-4)A3566",
"RSA SigVer (FIPS186-4)A3572",
"AES-GCMA3572",
"ECDSA SigVer (FIPS186-4)A3566"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3566",
"#A3572"
]
},
"policy_metadata": {
"/CreationDate": "D:20260710120708-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260710120708-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 845215,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"http://www.paloaltonetworks.com/",
"https://docs.paloaltonetworks.com/",
"about:blank"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 42
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "33a2fc5b1d33a90290e6347adbb02b96f137744f1f9248e477f3ce8aebb96fc1",
"source_hash": "44c7940f2b66977374b08e877cbcddcc831e825e4e7db93123f9ea7fe9ca7e98",
"txt_hash": "f23b8847ec1aa563e371c51b3cad8e297949ee7916f3fa4dab4f9505c6048789"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in section 11.1 of the Security Policy and operated in approved mode",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
"date_sunset": "2029-07-07",
"description": "The Palo Alto Networks SD-WAN ION Core Crypto Module is utilized in hardware and software ION form factors. These enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of your WAN.",
"embodiment": "MultiChipStand",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Palo Alto Networks SD-WAN ION Core Crypto Module",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-07-10",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Palo Alto Networks, Inc.",
"vendor_url": "http://www.paloaltonetworks.com"
}
}