This page was not yet optimized for use on mobile devices.
nShield 5s Hardware Security Module
Certificate details
| Certificate ID | #5329 |
|---|---|
| Status | active |
| Validation dates | 15.06.2026 , 22.06.2026 , 29.06.2026 , 26.08.2026 , 11.09.2026 |
| Sunset date | 18-08-2029 |
| Standard | FIPS 140-3 |
| Security level | 3 |
| Type | Hardware |
| Embodiment | MultiChipEmbed |
| Caveat | When installed, initialized and configured as specified in Section 11.3 of the Security Policy |
| Exceptions |
|
| Vendor | Entrust Corporation http://www.entrust.com |
| Lab | Lightship Security, Inc. |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES, AES256, AES-, CAST, HMAC, CMACAsymmetric Algorithms
RSA-OAEP, ECDH, ECDSA, ECC, DSAHash functions
SHA-1, SHA256, SHA-256, SHA2, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHA-3Schemes
MAC, Key Agreement, Key agreement, KAProtocols
SSH, SSHv2Randomness
DRBG, RBGElliptic Curves
P-224, P-256, P-384, P-521, P-192, curve P-521, B-233, B-283, B-409, B-571, K-233, K-283, K-409, B-163, K-163, K-571Block cipher modes
ECB, CTR, GCMTrusted Execution Environments
PSPVendor
NXPSecurity level
Level 3, level 3Standards
FIPS 140-3, FIPS 1403, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS 202, SP 800-38F, SP 800-133, SP 800-90B, PKCS 1, ISO/IEC 19790Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5329,
"dgst": "7385cae611099e13",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA3707",
"SHA-1A3707",
"ECDSA SigVer (FIPS186-4)A3707",
"KMAC-256A3707",
"ECDSA KeyVer (FIPS186-4)A3707",
"RSA SigGen (FIPS186-4)A3707",
"ECDSA KeyGen (FIPS186-4)A3707",
"KDF SP800-108A3707",
"#A2404",
"AES-KWPA3707",
"AES-CTRA3706",
"Safe Primes Key GenerationA3707",
"RSA SigVer (FIPS186-4)A6385",
"Hash DRBGA3707",
"SHA3-512A3707",
"#A3706",
"#A3707",
"KTS-IFCA3707",
"SHA2-256A6385",
"AES-CMACA3707",
"RSA KeyGen (FIPS186-4)A3707",
"HMAC-SHA3-224A3707",
"KAS-ECC-SSC Sp800-56Ar3A3706",
"HMAC-SHA3-256A3707",
"DSA PQGGen (FIPS186-4)A3707",
"SHA3-224A3707",
"KMAC-128A3707",
"SHA2-224A3707",
"HMAC-SHA-1A3707",
"HMAC-SHA2-384A3707",
"SHA3-384A3707",
"HMAC-SHA2-224A3707",
"KDF SSHA3706",
"AES-GCMA3707",
"AES-KWA3707",
"DSA SigVer (FIPS186-4)A3707",
"HMAC-SHA3-512A3707",
"DSA KeyGen (FIPS186-4)A3707",
"KAS-FFC Sp800-56Ar3A3707",
"AES-CBCA3707",
"HMAC-SHA2-512A3707",
"DSA PQGVer (FIPS186-4)A3707",
"SHA3-256A3707",
"DSA SigGen (FIPS186-4)A3707",
"HMAC-SHA2-256A3707",
"SHA2-384A3707",
"ECDSA SigGen (FIPS186-4)A3707",
"KAS-ECC Sp800-56Ar3A3707",
"#A6385",
"SHA2-512A3707",
"AES-ECBA3707",
"HMAC-SHA3-384A3707"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Show Module\u0027s Versioning Information service. This command prints out the contents of the board-id rom file and a number of flags that indicate which other setup subcomman ds have been previously executed as determined by the existence or non- existence of the relevant files in long- term storage. It also prints out the tag and value pairs of any",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "setup info (Show Version)",
"outputs": "versioning informati on, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "options set with the setopt subcomman d.",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Performs zeroisation of unprotected SSPs and returns the module to factory state.",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "setup factorystate",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KRESET: Z,G - KSESSION_SSH : E - KSSH_SETUP: G - KSSH_SSHAD MIN: G - KSSH_NCORE: G - KSSH_MONIT OR: G - KSSH_UPDATE R: G - KSSH_LAUNCH ER: G - DRBG-1 entropy input: E - DRBG-1 seed, Internal State: C and V values: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on Platform RBG"
},
{
"description": "Returns the system date and time.",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "setup gettime",
"outputs": "time, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Sets the system date and time.",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "setup settime",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Loads the client public key in the module, that will be used to authenticat e the requester of a particular service",
"indicator": "return status code 0",
"inputs": "Input arguments, service, SSH client public key",
"name": "sshadmin set",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - KSSH_CLIENT pub: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Obtains the client public key for the service given",
"indicator": "return status code 0",
"inputs": "Input arguments, service",
"name": "sshadmin list",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - KSSH_CLIENT pub: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Obtains the server public key for the service given",
"indicator": "return status code 0",
"inputs": "Input arguments, service",
"name": "sshadmin get- serverkey",
"outputs": "SSH server public key, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - KSSH_NCORE pub: R - KSSH_UPDATE R pub: R - KSSH_SETUP pub: R - KSSH_LAUNCH ER pub: R - KSSH_SSHAD",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "MIN pub: R - KSSH_MONIT OR pub: R",
"secFunImpl": ""
},
{
"description": "This is a Show Module\u0027s Versioning Information service. Obtains the version number of the HSM firmware",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "updater info (Show Version)",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Transmits a file (intended to be an npkg upgrade file) to the HSM.",
"indicator": "return status code 0",
"inputs": "input arguments, fw update file",
"name": "updater receive",
"outputs": "fw update file info, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Verifies that a file on the HSM filesystem is a valid npkg upgrade file and, if so loads the file onto its flash partition",
"indicator": "return status code 0",
"inputs": "Input arguments, fw update file info",
"name": "updater load",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - NPSK pub: E,W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Sets the minimum VSN",
"indicator": "return status code 0",
"inputs": "input arguments, vsn",
"name": "updater setminvsn",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Obtains the log of the system",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "monitor getlog",
"outputs": "logs, return",
"rolesSspAccess": "Platform Crypto Officer (PCO) -",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib:"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "status code",
"rolesSspAccess": "KSESSION_SSH : E",
"secFunImpl": "Message Authenticati on"
},
{
"description": "Clears the log of the system",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "monitor clearlog",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Obtains the environmen tal statistics",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "monitor getenvstats",
"outputs": "env data, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Initiates and establishes an ssh connection to a service",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "start connection",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KUSER_SSH: E - KSSH_SETUP: E - KSSH_UPDATE R: E - KSSH_SSHAD MIN: E - KSSH_LAUNCH ER: E - KSSH_MONIT OR: E - KSSH_CLIENT pub: E User Client (UC) - KCONTAINERS SH: E - KSSH_NCORE:",
"secFunImpl": "SSH lib: Digital Signature SSH lib: Key Agreement SSH lib: Message digest Platform RBG"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - KSSH_CLIENT pub: E",
"secFunImpl": ""
},
{
"description": "IP address discovery service",
"indicator": "return status code 0",
"inputs": "input arguments",
"name": "discovery python- zeroconf",
"outputs": "IP address, return status code",
"rolesSspAccess": "Unauthenticat ed",
"secFunImpl": ""
},
{
"description": "Reboots the HSM and runs the self-tests",
"indicator": "n/a",
"inputs": "n/a",
"name": "reboot (Self test)",
"outputs": "n/a",
"rolesSspAccess": "Unauthenticat ed - KRESET: E - KUSER_SSH: G,E - KCONTAINER: G,E - KCONTAINERS SH: G,E",
"secFunImpl": "Bootloader: Digital signature verification nCore lib: FW integrity"
},
{
"description": "Uploads a file to the launcher service for temporary storage.",
"indicator": "return status code 0",
"inputs": "Input arguments, file",
"name": "launcher receive",
"outputs": "file id, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Creates a SEE machine container from a received file, after successfully being validated",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher create machine",
"outputs": "uuid, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - DSK pub: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Digital signature"
},
{
"description": "Lists SEE machines along with their current states.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher list",
"outputs": "machine list, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Authenticati on"
},
{
"description": "Starts a SEE machine after successfully being validated.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher start",
"outputs": "ip, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - DSK pub: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Digital signature"
},
{
"description": "Stops a SEE machine.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher stop",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Deletes a SEE machine.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher destroy",
"outputs": "return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Managemen t of the SEE machine signing certificates.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher ids commands",
"outputs": "output argument s, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E - DSK pub: R,W,E - ESK pub: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Digital signature"
},
{
"description": "Managemen t of the SEE machine logs.",
"indicator": "return status code 0",
"inputs": "Input arguments",
"name": "launcher see-log commands",
"outputs": "output argument s, return status code",
"rolesSspAccess": "Platform Crypto Officer (PCO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Authenticati on"
},
{
"description": "Performs an operation on a large integer",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Big number operation",
"outputs": "operation result, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Creates a Key blob containing the key",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Make blob",
"outputs": "key blob, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - BLOBKE: R - BLOBKM: R - KA: R - KRE_BLOBKEY: R - KR: R - KM: R - KNSO: R - LTX: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Key Blobs"
},
{
"description": "Provides a bulk processing channel for crypto operations",
"indicator": "return status OK",
"inputs": "input arguments, data",
"name": "nCoreAPI Bulk channel",
"outputs": "operation result, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Symmetric Ciphers nCore lib: Message authenticati on nCore lib: Digital signature"
},
{
"description": "Determines whether the ACL associated with a key allows a specific operator defined action",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Check user action",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KNSO: R - KA: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Clears all keys, tokens and shares in RAM and causes the module to reboot",
"indicator": "return status OK",
"inputs": "input arguments, module mode",
"name": "nCoreAPI Clear unit",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: Z - KR: Z - IMPATHKE: Z - IMPATHKM: Z - RAKME: Z - RAKMA: Z",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Allows a key to be stored internally as a Module key (KM) value",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Set module key",
"outputs": "return status code",
"rolesSspAccess": "nShield Security Officer (NSO) - KSESSION_SSH : E - KM: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Secure hashing"
},
{
"description": "Deletes the KM with a given KM hash value from non- volatile memory",
"indicator": "return status OK",
"inputs": "input arguments, key hash",
"name": "nCoreAPI Remove module key",
"outputs": "return status code",
"rolesSspAccess": "nShield Security Officer (NSO) - KSESSION_SSH : E - KM: Z",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Creates a second instance of a key with the same ACL",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Duplicate key handle",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": ": E - KA: R",
"secFunImpl": "Authenticati on"
},
{
"description": "Feature enabling service",
"indicator": "return status OK",
"inputs": "input arguments, features",
"name": "nCoreAPI Enable feature",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Data encryption",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, key handle, plaintext data, iv",
"name": "nCoreAPI Encryption",
"outputs": "encrypted data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Symmetric Ciphers"
},
{
"description": "Data decryption",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, key handle, encrypted data",
"name": "nCoreAPI Decryption",
"outputs": "decrypted data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Symmetric Ciphers"
},
{
"description": "Removes a file or a share from a smartcard or softcard",
"indicator": "return status OK",
"inputs": "input arguments, slot, file info",
"name": "nCoreAPI Erase from smartcard /softcard",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Formats a smartcard or a softcard",
"indicator": "return status OK",
"inputs": "input arguments, slot",
"name": "nCoreAPI Format token",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Authenticati on"
},
{
"description": "Performs file operations in the module",
"indicator": "return status OK",
"inputs": "input arguments, file info, operation",
"name": "nCoreAPI File operations",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Causes the module to enter a failure state",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Force module to fail",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Generates a random prime",
"indicator": "return status OK",
"inputs": "input arguments, length",
"name": "nCoreAPI Generate prime number",
"outputs": "Bignumbe r, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - DRBG-2 entropy input: E - DRBG-2 seed, Internal State: C and V values: E - DRBG-1 entropy input: E - DRBG-1 seed, Internal State: C and V values: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCoreAPI RBG"
},
{
"description": "Generates a random number from the Approved RBG",
"indicator": "return status OK",
"inputs": "input arguments, length",
"name": "nCoreAPI Random number",
"outputs": "random bytes, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - DRBG-2 entropy input: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG-2 seed, Internal State: C and V values: E - DRBG-1 entropy input: E - DRBG-1 seed, Internal State: C and V values: E",
"secFunImpl": "nCoreAPI RBG"
},
{
"description": "Get the ACL of a given key",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Get ACL",
"outputs": "acl, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get the application data field from a key",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Get application data",
"outputs": "applicatio n data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get a random challenge that can be used in fresh certificates",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get challenge",
"outputs": "nonce, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - DRBG-2 entropy input: E - DRBG-2 seed, Internal State: C and V values: E - DRBG-1 entropy input: E - DRBG-1 seed, Internal State:",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCoreAPI RBG"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "C and V values: E",
"secFunImpl": ""
},
{
"description": "Get a handle to the Module Long Term (KLF2) public key",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get KLF2",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get the type, length and hash of a key",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Get key information",
"outputs": "key info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Secure hashing"
},
{
"description": "Get a handle to the KML public key",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get module signing key",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KML: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get the list of slots that are available from the module",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get list of slot in the module",
"outputs": "slot info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get information about a Logical Token: hash, state and number of shares",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Get logical token info",
"outputs": "logical token info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - LTX: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib:"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Secure hashing"
},
{
"description": "Get the list of the hashes of all module keys and the KNSO",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get list of module keys",
"outputs": "hash of KNSO (HKNSO), hash of module keys, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KM: R - KNSO: R - HKNSO: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Secure hashing"
},
{
"description": "Returns unsigned data about the current state of the module",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get module state",
"outputs": "module attributes , return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get the current time from the module Real Time Clock",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get real time clock",
"outputs": "time, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get the Share\u0027s ACL",
"indicator": "return status OK",
"inputs": "input arguments, slot",
"name": "nCoreAPI Get Share access control list",
"outputs": "acl, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: E - SHAREKM: E - KM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Get information about shares and files on a Smartcard that has been",
"indicator": "return status OK",
"inputs": "input arguments, slot",
"name": "nCoreAPI Get slot information",
"outputs": "smartcard info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "inserted in a module slot",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Get a ticket (an invariant identifier) for a key",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Get ticket",
"outputs": "ticket, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Causes the nCore API service in the pre- initialization state to enter the initialization state. When the module enters the initialization state, it erases all Module keys (KM), the module\u0027s signing key (KML), and the hash of the Security Officer\u0027s keys, HKNSO. It then generates a new KML and KM",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Initialize unit",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: Z,G - KRE_BLOBKEY: Z,G - KR: Z,G - KM: Z,G - KAL: Z,G - KML: Z,G - KNSO: Z,G - HKNSO: Z,G - LTX: Z,G - DRBG-2 entropy input: E - DRBG-2 seed, Internal State: C and V values: E - DRBG-1 entropy input: E - DRBG-1 seed, Internal State: C and V values: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Secure hashing nCore lib: Asymmetric key generation nCoreAPI RBG"
},
{
"description": "Allocates memory on the module that is used to store the",
"indicator": "return status OK",
"inputs": "input arguments, slot",
"name": "nCoreAPI Insert Softcard",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) -",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "logical token share and other data objects.",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KSESSION_SSH : E",
"secFunImpl": "Authenticati on"
},
{
"description": "Removes a Softcard from the module. It returns the updated shares and deletes them from the module\u0027s memory.",
"indicator": "return status OK",
"inputs": "input arguments, slot",
"name": "nCoreAPI Remove Softcard",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Support for Impath channel. Requires Feature Enabled",
"indicator": "return status OK",
"inputs": "input arguments, data",
"name": "nCoreAPI Impath channel",
"outputs": "data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - IMPATHKE: G,E - IMPATHKM: G,E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Impath session key establishme nt nCore lib: Impath messaging"
},
{
"description": "Generates a cryptograph ic key of a given type with a specified ACL. It returns a handle to the key. Optionally, it returns a KML signed",
"indicator": "return status OK",
"inputs": "input arguments, key params, acl, app data",
"name": "nCoreAPI Key generation",
"outputs": "key handle, key generatio n cert, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: G - KML: E - DRBG-2 entropy input: E - DRBG-2 seed, Internal State: C and V values:",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Asymmetric key generation nCoreAPI RBG"
},
{
"description": "certificate with the hash of the key and its ACL information",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - DRBG-1 entropy input: E - DRBG-1 seed, Internal State: C and V values: E",
"secFunImpl": "nCore lib: Digital signature"
},
{
"description": "Loads a plain text key into the module. If the module is initialized in approved mode, this service is available for public keys only.",
"indicator": "return status OK",
"inputs": "input arguments, wrapped key, acl, app data",
"name": "nCoreAPI Key import",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Performs key wrapping, unwrapping, transport, exchange and derivation",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, key handles",
"name": "nCoreAPI Derive key",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: R,W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Key wrapping nCore lib: Key establishme nt nCore lib: Key transport nCore lib: KDFs"
},
{
"description": "Load a Key blob into the module. It returns a handle to",
"indicator": "return status OK",
"inputs": "input arguments, blob data",
"name": "nCoreAPI Load blob",
"outputs": "key handle, return",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "the key suitable for use with module services",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "status code",
"rolesSspAccess": "- KA: W - KRE_BLOBKEY: W - KR: W - KM: W - KNSO: W - BLOBKE: E - BLOBKM: E",
"secFunImpl": "Authenticati on nCore lib: Key Blobs"
},
{
"description": "Initiates loading a Logical Token from Shares, which can be loaded with the Read Share command.",
"indicator": "return status OK",
"inputs": "input arguments, logical token hash",
"name": "nCoreAPI Load logical token",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Creates a new Logical Token with given properties and secret sharing parameters",
"indicator": "return status OK",
"inputs": "input arguments, hash of km",
"name": "nCoreAPI Generate logical token",
"outputs": "logical token hash, key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KM: E - LTX: G",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCoreAPI RBG"
},
{
"description": "Computes the cryptograph ic hash of a given message",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, data to be hashed",
"name": "nCoreAPI Message digest",
"outputs": "hashed data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Secure hashing"
},
{
"description": "Performs modular exponentiati on on",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Modular exponentiati on",
"outputs": "operation result, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "supplied values",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Authenticati on"
},
{
"description": "Reports detailed hardware information",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Module hardware information",
"outputs": "hw info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "No operation",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI No operation",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Updates the passphrase of a Share",
"indicator": "return status OK",
"inputs": "input arguments,sl ot, old pin, new pin",
"name": "nCoreAPI Change Share passphrase",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: G,E,R - SHAREKM: G,E,R - KM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Key Blobs"
},
{
"description": "Allocation in NVRAM",
"indicator": "return status OK",
"inputs": "input arguments, file info, acl",
"name": "nCoreAPI NVRAM allocate",
"outputs": "return status code",
"rolesSspAccess": "nShield Security Officer (NSO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Deallocation from NVRAM",
"indicator": "return status OK",
"inputs": "input arguments, filename",
"name": "nCoreAPI NVRAM free",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Returns a list of files in NVRAM",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Operation on NVM list",
"outputs": "files info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Operation on an NVRAM file",
"indicator": "return status OK",
"inputs": "input arguments, filename, operation",
"name": "nCoreAPI Operation on NVM files",
"outputs": "operation result, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Exports a key in plain text. In approved mode, only public keys can be exported",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Key export",
"outputs": "wrapped key, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: R",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Reads data from a file on a Smartcard or Softcard.",
"indicator": "return status OK",
"inputs": "input arguments, file info, slot",
"name": "nCoreAPI Read file",
"outputs": "file data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Reads a share from a Smartcard or Softcard. Once a quorum of shares have been loaded, the module reassembles the Logical Token.",
"indicator": "return status OK",
"inputs": "input arguments, slot, key handle",
"name": "nCoreAPI Read share",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: G,E,R - SHAREKM: G,E,R - LTX: G - KM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Smartcard shares"
},
{
"description": "Reads a Share and encrypts it with the Impath session keys for transmissio n to the peer module",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Send Share to remote slot",
"outputs": "encrypted share, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: G,E,R - SHAREKM: G,E,R - IMPATHKE: E - IMPATHKM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Smartcard shares nCore lib: Impath messaging"
},
{
"description": "",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Receive Share from remote slot",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: W - SHAREKM: W - IMPATHKE: E - IMPATHKM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Key Blobs nCore lib: Impath messaging"
},
{
"description": "Gets a handle in the current name space for the object referred to by a ticket created by Get Ticket.",
"indicator": "return status OK",
"inputs": "input arguments, ticket",
"name": "nCoreAPI Redeem ticket",
"outputs": "key handle, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Provides remote presentatio n of Smartcards using a secure channel between the",
"indicator": "return status OK",
"inputs": "input arguments, APDU payload",
"name": "nCoreAPI Remote administrati on",
"outputs": "APDU payload, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - RAKME: G,E - RAKMA: G,E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Remote"
},
{
"description": "module and the Smartcard",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- KWARN pub: E",
"secFunImpl": "Admin session key establishme nt nCore lib: Remote Admin messaging"
},
{
"description": "Remove handle to an object in RAM. If the current handle is the only one remaining, the object is zeroised from RAM",
"indicator": "return status OK",
"inputs": "input arguments, key handle",
"name": "nCoreAPI Destroy",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: Z - LTX: Z",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Reports the values of the statistics tree",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Report stats",
"outputs": "statistics, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Report status information",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI New Enquiry (Show Status)",
"outputs": "status and versioning info, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Replaces the ACL of a given key with a new ACL",
"indicator": "return status OK",
"inputs": "input arguments, key handle, acl",
"name": "nCoreAPI Set ACL",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Writes the application information field of a key",
"indicator": "return status OK",
"inputs": "input arguments, key handle, app data",
"name": "nCoreAPI Set app data",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Sets the NSO key hash and which permissions require a Delegation Certificate",
"indicator": "return status OK",
"inputs": "input arguments, hash of KNSO (HKNSO), permissions",
"name": "nCoreAPI Set NSO permissions",
"outputs": "return status code",
"rolesSspAccess": "nShield Security Officer (NSO) - KSESSION_SSH : E - HKNSO: W",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Generate a digital signature or MAC value",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, key handle, data to be signed",
"name": "nCoreAPI Signature generation",
"outputs": "signed data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KA: E - KNSO: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Digital signature nCore lib: Message authenticati on"
},
{
"description": "Returns a signed certificate that contains data about the current configuratio n of the module",
"indicator": "return status OK",
"inputs": "input arguments",
"name": "nCoreAPI Sign module state",
"outputs": "certificate , return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - KML: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Digital signature"
},
{
"description": "Verifies a digital signature or MAC value",
"indicator": "return status OK",
"inputs": "input arguments, mechanism, key handle,",
"name": "nCoreAPI Signature verification",
"outputs": "return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message"
},
{
"description": "",
"indicator": "",
"inputs": "data to be verified",
"name": "",
"outputs": "",
"rolesSspAccess": ": E - KA: E",
"secFunImpl": "Authenticati on nCore lib: Digital signature nCore lib: Message authenticati on"
},
{
"description": "Writes a file to a Smartcard or Softcard",
"indicator": "return status OK",
"inputs": "input arguments, file info, slot, data",
"name": "nCoreAPI Write file",
"outputs": "return status code",
"rolesSspAccess": "nShield Security Officer (NSO) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
},
{
"description": "Writes a Share to a Smartcard or Softcard",
"indicator": "return status OK",
"inputs": "input arguments, file info, slot",
"name": "nCoreAPI Write share",
"outputs": "data, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E - SHAREKE: G,E - SHAREKM: G,E - LTX: E - KM: E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on nCore lib: Smartcard shares"
},
{
"description": "Opens a connection from the nCoreAPI service to the SEE machine",
"indicator": "return status OK",
"inputs": "input arguments, uuid",
"name": "nCoreAPI SEE connection",
"outputs": "world id, return status code",
"rolesSspAccess": "User Client (UC) - KSESSION_SSH : E",
"secFunImpl": "SSH lib: Symmetric Ciphers SSH lib: Message Authenticati on"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "ECDSA client key identity- based authentication",
"mechanism": "SSH lib: Digital Signature",
"name": "SSH authentication",
"perMinute": "The module can process around 2^20 commands per minute. This gives a probability of success in a one minute period of 2^-108, which is less than one in 100,000.",
"strength": "This results in a security strength of 128 bits. A random authentication attempt gives is a probability of success of 2^ -128, which is less than one in 1,000,000."
},
{
"description": "Smartcard identity-based authentication",
"mechanism": "nCore lib: Smartcard shares",
"name": "Smartcard authentication",
"perMinute": "The module can process around 2^20 commands per minute. This gives a probability of success in a one minute period of 2^-236, which is less than 10^-5 , which is less than one in 100,000.",
"strength": "A logical token share stored in a Smartcard or Softcard is encrypted and MAC\u0027ed. An attacker would need to guess the encrypted share value and the associated MAC in order to be able to load a valid Logical token share into the module. This requires, as a minimum, guessing a 256-bit HMAC- SHA256 value, which gives a security strength of 256 bits. A random authentication attempt gives is a probability of success of 2^ -256 , which is less than one in 1,000,000."
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "SP 800-90B health tests (APT, RCT)",
"condition": "Continuous",
"details": "SP 800-90B Section 4",
"indicator": "Successful initialization of the module",
"testMethod": "-",
"testProps": "-",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: DSA keyGen",
"condition": "Key generation",
"details": "Signature generation and verification",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "2048 bits",
"type": "PCT"
},
{
"algorithmOrTest": "nCore lib: ECDSA keyGen",
"condition": "Key generation",
"details": "Signature generation and verification",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "P-224",
"type": "PCT"
},
{
"algorithmOrTest": "nCore lib: RSA keyGen",
"condition": "Key generation",
"details": "Key generation",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "2048 bits",
"type": "PCT"
},
{
"algorithmOrTest": "nCore lib: Safe prime keyGen",
"condition": "Safe prime generation",
"details": "Safe prime generation and verification",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "MODP-2048",
"type": "PCT"
},
{
"algorithmOrTest": "Firmware load test",
"condition": "Upgrading firmware",
"details": "Firmware load test",
"indicator": "n/a",
"testMethod": "Load Test",
"testProps": "ECDSA sigVer, P-521",
"type": "SW/FW Load"
},
{
"algorithmOrTest": "nCore lib: AES-ECB",
"condition": "Module Initialization",
"details": "encrypt/decrypt",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "128, 192, 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: AES-CMAC",
"condition": "Module Initialization",
"details": "MAC generation and verification",
"indicator": "Successful initialization",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "of the module",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "nCore lib: HMAC",
"condition": "Module Initialization",
"details": "MAC generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "HMAC with SHA-1, SHA2- 224, SHA2- 256, SHA2- 384, SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: SHA-1",
"condition": "Module Initialization",
"details": "",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: SHA-3",
"condition": "Module Initialization",
"details": "",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "SHA3-224, SHA3-256, SHA3-384, SHA3-512",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: RSASSA- PKCS-v1_5",
"condition": "Module Initialization",
"details": "Signature generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "2048 bits, SHA2",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: RSA-OAEP",
"condition": "Module Initialization",
"details": "encrypt/decrypt",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "2048 bits",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: DSA",
"condition": "Module Initialization",
"details": "Signature generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "2048 bits, SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: ECDSA",
"condition": "Module Initialization",
"details": "Signature generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "P-224, B-233",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: Pair-Wise Consistency test",
"condition": "Key generation",
"details": "",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: KAS-FFC",
"condition": "Module Initialization",
"details": "Shared secret computation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "MODP-2048, MODP-3072",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: KAS-ECC",
"condition": "Module Initialization",
"details": "Shared secret computation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "P-224, B-233",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: One-step KDF",
"condition": "Module Initialization",
"details": "Key derivation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "SHA2-256 aux function",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: Two-step KDF",
"condition": "Module Initialization",
"details": "Key derivation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "HMAC-SHA2- 256 aux function",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: KBKDF",
"condition": "Module Initialization",
"details": "Key derivation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "Counter KDF with CMAC- AES256",
"type": "CAST"
},
{
"algorithmOrTest": "nCore lib: DRBG",
"condition": "Module Initialization",
"details": "Key derivation",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "Instantiate, reseed, generate as per SP 800- 90Arev1 section 11.3",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: AES- GCM",
"condition": "Module Initialization",
"details": "encrypt/decrypt",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: AES- CTR",
"condition": "Module Initialization",
"details": "encrypt/decrypt",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: HMAC",
"condition": "Module Initialization",
"details": "MAC generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "HMAC-SHA2- 256 and HMAC-SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: KAS ECC",
"condition": "Module Initialization",
"details": "MAC generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "ECDH P-256 shared secret computation",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: ECDSA",
"condition": "Module Initialization",
"details": "Signature generation and verification",
"indicator": "Successful initialization",
"testMethod": "KAT",
"testProps": "Sign/Verify P- 256 and P- 521",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "of the module",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SSH lib: SSH KDF",
"condition": "Module Initialization",
"details": "MAC generation and verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "",
"type": "CAST"
},
{
"algorithmOrTest": "SSH lib: ECDH PCT",
"condition": "Key generation",
"details": "",
"indicator": "n/a",
"testMethod": "PCT",
"testProps": "",
"type": "CAST"
},
{
"algorithmOrTest": "Bootloader: RSASSA- PKCS-v1_5",
"condition": "Module Initialization",
"details": "Signature verification",
"indicator": "Successful initialization of the module",
"testMethod": "KAT",
"testProps": "4096 bits, SHA2-256",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "POST or CAST failure",
"description": "The module\u0027s error state.",
"indicator": "Status LED",
"name": "Error",
"recoveryMethod": "Reboot Module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Monthly",
"inspectGuidance": "The module should be inspected periodically for evidence of tamper attempts, including the entire enclosure including the epoxy resin security coating for obvious signs of damage",
"mechanism": "Hard and opaque epoxy potting"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [],
"found": false,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "nCoreAPI, SSHAdmin, updater, setup, monitor, launcher, discovery, reboot, start connection",
"logicalInterface": "Data Input Data Output Control Input Status Output Power",
"physicalPort": "PCIe bus"
},
{
"data": "APDU commands",
"logicalInterface": "Data Output",
"physicalPort": "Smartcard reader serial port"
},
{
"data": "n/a",
"logicalInterface": "Control Input",
"physicalPort": "Status LED"
},
{
"data": "n/a",
"logicalInterface": "Status Output",
"physicalPort": "Recovery button"
},
{
"data": "n/a",
"logicalInterface": "Power",
"physicalPort": "Battery"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [],
"found": false,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "3",
"section": "1",
"title": "General"
},
{
"level": "3",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "3",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "3",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "3",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "3",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "3",
"section": "10",
"title": "Self-tests"
},
{
"level": "3",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "3",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS 186- 4)",
"details": "Verify",
"indicator": "status output",
"testMethod": "Signature verification",
"testProps": "4096 bit",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS 186-4)",
"details": "Verify",
"indicator": "status output",
"testMethod": "Signature verification",
"testProps": "P-521",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Key blob load",
"sfiAlgo": "nCore lib: Key Blobs",
"source": "External"
},
{
"dest": "External",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Key blob make",
"sfiAlgo": "nCore lib: Key Blobs",
"source": "RAM"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Logical token load",
"sfiAlgo": "nCore lib: Smartcard shares",
"source": "External"
},
{
"dest": "External",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Logical token create",
"sfiAlgo": "nCore lib: Smartcard shares",
"source": "RAM"
},
{
"dest": "Flash",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "SSH client key load",
"sfiAlgo": "",
"source": "External"
},
{
"dest": "Flash",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "FW keys load",
"sfiAlgo": "nCore lib: FW integrity",
"source": "External"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "setup factorystate command zeroises all unprotected SSPs",
"method": "Factory Reset",
"operatorId": "Operator Initiated",
"rationale": "All unprotected SSPs are zeroised, overwritten with zeroes"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Flash memory",
"name": "Flash",
"persistance": "Static"
},
{
"description": "Ferroelectic RAM",
"name": "FRAM",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "PCIe form factor",
"fwVersion": "primary: 13.4.5, recovery: 13.2.4, uboot: 1.1.0, 1.4.1, 14.2.2",
"hwVersion": "PCB Assembly Part Number: PCA10005-01, PCB Assembly Revision: 03, 04",
"modelPartNum": "nShield 5s F3 (nC5536E)",
"processors": "NXP QorIQ T1042 with cryptographic acceleration"
},
{
"features": "PCIe form factor identical to the nShield 5s F3 (nC5536E), embedded inside the nShield 5c or the nShield HSMi network appliances",
"fwVersion": "primary: 13.4.5, recovery: 13.2.4, uboot: 1.1.0, 1.4.1, 14.2.2",
"hwVersion": "PCB Assembly Part Number: PCA10005-01, PCB Assembly Revision: 03, 04",
"modelPartNum": "nShield 5s for nShield 5c and for nShield HSMi (nC5536N)",
"processors": "NXP QorIQ T1042 with cryptographic acceleration"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key type:Symmetric",
"implName": "n/a",
"name": "CKG",
"reference": "SP800-133r2 section 4/example1 and section 6.1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 4
},
"ECDH": {
"ECDH": 3
},
"ECDSA": {
"ECDSA": 59
}
},
"FF": {
"DSA": {
"DSA": 20
}
},
"RSA": {
"RSA-OAEP": 1
}
},
"certification_process": {},
"cipher_mode": {
"CTR": {
"CTR": 1
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 3
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"SSH": {
"SSH": 249,
"SSHv2": 1
}
},
"crypto_scheme": {
"KA": {
"KA": 2,
"Key Agreement": 3,
"Key agreement": 4
},
"MAC": {
"MAC": 34
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"B-163": 2,
"B-233": 7,
"B-283": 5,
"B-409": 4,
"B-571": 5,
"K-163": 2,
"K-233": 5,
"K-283": 3,
"K-409": 5,
"K-571": 3,
"P-192": 6,
"P-224": 16,
"P-256": 44,
"P-384": 10,
"P-521": 27,
"curve P-521": 1
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 4,
"AES- CTR 128": 1,
"AES- GCM 128": 1,
"AES-128": 1,
"AES-CMAC 128": 1,
"AES256": 1,
"DRBG-1": 16,
"DRBG-2": 14,
"DSA 2048": 1,
"HMAC- SHA256": 1,
"HMAC-SHA- 1": 2,
"PKCS 1": 4,
"SHA-1": 8,
"SHA-256": 1,
"SHA-3": 2,
"SHA2": 1,
"SHA2- 224": 1,
"SHA2- 256": 1,
"SHA2- 384": 1,
"SHA2- 512": 2,
"SHA2-224": 15,
"SHA2-256": 23,
"SHA2-384": 7,
"SHA2-512": 10,
"SHA256": 1,
"SHA3-224": 5,
"SHA3-256": 6,
"SHA3-384": 6,
"SHA3-512": 6
}
},
"fips_security_level": {
"Level": {
"Level 3": 2,
"level 3": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 8
},
"SHA2": {
"SHA-256": 1,
"SHA2": 1,
"SHA256": 1
},
"SHA3": {
"SHA-3": 2,
"SHA3-224": 5,
"SHA3-256": 6,
"SHA3-384": 6,
"SHA3-512": 6
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 14
},
"RNG": {
"RBG": 32
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 78,
"FIPS 1403": 1,
"FIPS 180-4": 9,
"FIPS 186-4": 19,
"FIPS 198-1": 10,
"FIPS 202": 4,
"FIPS186-4": 34
},
"ISO": {
"ISO/IEC 19790": 2
},
"NIST": {
"SP 800-133": 1,
"SP 800-38F": 2,
"SP 800-90B": 3
},
"PKCS": {
"PKCS 1": 4
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 10,
"AES-": 4,
"AES-128": 1,
"AES256": 1
},
"CAST": {
"CAST": 51
}
},
"constructions": {
"MAC": {
"CMAC": 2,
"HMAC": 7
}
}
},
"tee_name": {
"AMD": {
"PSP": 12
}
},
"tls_cipher_suite": {},
"vendor": {
"NXP": {
"NXP": 2
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA3707",
"SHA-1A3707",
"ECDSA SigVer (FIPS186-4)A3707",
"KMAC-256A3707",
"ECDSA KeyVer (FIPS186-4)A3707",
"RSA SigGen (FIPS186-4)A3707",
"ECDSA KeyGen (FIPS186-4)A3707",
"KDF SP800-108A3707",
"AES-KWPA3707",
"AES-CTRA3706",
"Safe Primes Key GenerationA3707",
"RSA SigVer (FIPS186-4)A6385",
"Hash DRBGA3707",
"SHA3-512A3707",
"KTS-IFCA3707",
"SHA2-256A6385",
"AES-CMACA3707",
"RSA KeyGen (FIPS186-4)A3707",
"HMAC-SHA3-224A3707",
"KAS-ECC-SSC Sp800-56Ar3A3706",
"HMAC-SHA3-256A3707",
"DSA PQGGen (FIPS186-4)A3707",
"SHA3-224A3707",
"KMAC-128A3707",
"SHA2-224A3707",
"HMAC-SHA-1A3707",
"HMAC-SHA2-384A3707",
"SHA3-384A3707",
"HMAC-SHA2-224A3707",
"KDF SSHA3706",
"AES-GCMA3707",
"AES-KWA3707",
"DSA SigVer (FIPS186-4)A3707",
"HMAC-SHA3-512A3707",
"DSA KeyGen (FIPS186-4)A3707",
"KAS-FFC Sp800-56Ar3A3707",
"AES-CBCA3707",
"HMAC-SHA2-512A3707",
"DSA PQGVer (FIPS186-4)A3707",
"SHA3-256A3707",
"DSA SigGen (FIPS186-4)A3707",
"HMAC-SHA2-256A3707",
"SHA2-384A3707",
"ECDSA SigGen (FIPS186-4)A3707",
"KAS-ECC Sp800-56Ar3A3707",
"SHA2-512A3707",
"AES-ECBA3707",
"HMAC-SHA3-384A3707"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3706",
"#A6385",
"#A2404",
"#A3707"
]
},
"policy_metadata": {
"/Author": "jjing",
"/CreationDate": "D:20260911153905-04\u002700\u0027",
"/Creator": "PScript5.dll Version 5.2.2",
"/ModDate": "D:20260911153905-04\u002700\u0027",
"/Producer": "Acrobat Distiller 26.0 (Windows)",
"/Title": "Microsoft Word - TID-32-B643-VUP-IS-2609111249_140sp.docx",
"pdf_file_size_bytes": 746761,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 73
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "43d2ea650386c70ae855d86239451a989b166ce54c7360dd36e52732f2e2d756",
"source_hash": "f92fbb78cab45bef2df9f4e34fa8175822e164d3b7ceffee465ade8b8a46c099",
"txt_hash": "b2e800f81e2208c0940e2170862b0628c3ca6c0fff1b5b5804c2b2d01bc641e9"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section 11.3 of the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
"date_sunset": "2029-08-18",
"description": null,
"embodiment": "MultiChipEmbed",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 3,
"mentioned_certs": {},
"module_name": "nShield 5s Hardware Security Module",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-15",
"lab": "Lightship Security, Inc.",
"validation_type": "Initial"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-22",
"lab": "Lightship Security, Inc.",
"validation_type": "Update"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-29",
"lab": "Lightship Security, Inc.",
"validation_type": "Update"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-08-26",
"lab": "Lightship Security, Inc.",
"validation_type": "Update"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-11",
"lab": "Lightship Security, Inc.",
"validation_type": "Update"
}
],
"vendor": "Entrust Corporation",
"vendor_url": "http://www.entrust.com"
}
}