This page was not yet optimized for use on mobile devices.
Oracle Linux 9 GnuTLS Cryptographic Module
Known vulnerabilities detected
Our automated heuristics have identified vulnerabilities that may be associated with this certificate. See the CVEs section for details.Certificate details
| Certificate ID | #5037 |
|---|---|
| Status | active |
| Validation dates | 03.07.2025 , 22.09.2025 |
| Sunset date | 02-07-2030 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Caveat | When operated in approved mode and installed, initialized and configured as specified in Section 11.1 of the Security Policy. |
| Exceptions |
|
| Vendor | Oracle Corporation http://www.oracle.com |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-256, Twofish, Serpent, CAST, RC2, RC4, DES, Triple-DES, ChaCha20, Salsa20, Poly1305, Blowfish, Camellia, SEED, HMAC, HMAC-SHA-256, CMACAsymmetric Algorithms
ECDH, ECDSA, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA-256, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHA-3, MD4, MD5, PBKDF2, PBKDFSchemes
MAC, Key Exchange, Key AgreementProtocols
TLS, TLS v1.2, TLS 1.2, TLS 1.3, TLSv1.2, TLSv1.3, IKERandomness
DRBG, RNG, RBGLibraries
GnuTLSElliptic Curves
P-256, P-384, P-521, P-224, Curve P-256Block cipher modes
ECB, CBC, CTR, CFB, GCM, CCM, XTSTLS cipher suites
TLS_DH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DH_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_PSK_WITH_AES_128_CBC_SHA, TLS_PSK_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DH_RSA_WITH_AES_128_GCM_SHA256, TLS_DH_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_CCM, TLS_DHE_RSA_WITH_AES_256_CCM, TLS_DHE_RSA_WITH_AES_128_CCM_8, TLS_DHE_RSA_WITH_AES_256_CCM_8Trusted Execution Environments
PSP, SSCSecurity level
Level 1Standards
FIPS 140-3, FIPS PUB 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS 202, FIPS 186-5, FIPS 197, SP 800-132, SP 800-38A, SP 800-38C, SP 800-38B, SP 800-38D, SP 800-38E, SP 800-90A, SP 800-56A, SP 800-56C, SP 800-135, SP 800-90B, SP 800-140B, PKCS 1, PKCS#1, RFC7627, RFC 5288, RFC8446, RFC3268, RFC5246, RFC4279, RFC5288, RFC4492, RFC5289, RFC6655, RFC 3526, RFC 7919, RFC 8446Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.CPE matches
CVE matches
| ID | Links | Severity | CVSS Score | Published on |
|---|---|---|---|---|
| Base score | ||||
| CVE-2022-21505 | MEDIUM | 6.7 | 24.12.2024 | |
| CVE-2023-22024 | MEDIUM | 5.5 | 20.09.2023 | |
| CVE-2025-4598 | MEDIUM | 4.7 | 30.05.2025 |
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5037,
"dgst": "78c549f9e428652c",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"SHA3-224A4753",
"SHA2-384A4755",
"SHA-1A4755",
"PBKDFA4751",
"#A4743",
"#A4748",
"#A4747",
"#A4755",
"#A4751",
"HMAC-SHA2-224A4755",
"#A4744",
"#A4753",
"#A4750",
"ECDSA SigVer (FIPS186-4)A4751",
"RSA KeyGen (FIPS186-4)A4751",
"AES-XTS Testing Revision 2.0A4752",
"AES-CMACA4751",
"#A4754",
"SHA2-256A4755",
"#A4749",
"KAS-FFC-SSC Sp800-56Ar3A4751",
"#A4745",
"AES-GMACA4751",
"AES-CCMA4755",
"AES-CBCA4755",
"SHA2-224A4755",
"RSA SigVer (FIPS186-4)A4751",
"ECDSA KeyGen (FIPS186-4)A4751",
"HMAC-SHA2-512A4755",
"#A4746",
"HMAC-SHA-1A4755",
"SHA2-512A4755",
"#A4752",
"KAS-ECC-SSC Sp800-56Ar3A4751",
"AES-ECBA4751",
"SHA3-512A4753",
"Safe Primes Key GenerationA4751",
"AES-GCMA4755",
"RSA SigGen (FIPS186-4)A4751",
"Counter DRBGA4751",
"SHA3-256A4753",
"ECDSA KeyVer (FIPS186-4)A4751",
"KDA HKDF Sp800-56Cr1A4750",
"TLS v1.2 KDF RFC7627A4751",
"AES-CFB8A4754",
"HMAC-SHA2-384A4755",
"ECDSA SigGen (FIPS186-4)A4751",
"SHA3-384A4753",
"HMAC-SHA2-256A4755"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"9"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": {
"_type": "Set",
"elements": [
"CVE-2025-4598",
"CVE-2023-22024",
"CVE-2022-21505"
]
},
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4743",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4744",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4745",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4746",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4751",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4755",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A4743",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A4755",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A4748",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A4749",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A4754",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A4743",
"properties": "Direction - Generation, Verification Key Length - 128, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A4746",
"properties": "Direction - Generation, Verification Key Length - 128, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A4751",
"properties": "Direction - Generation, Verification Key Length - 128, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A4751",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4743",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4744",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4745",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4746",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4751",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4755",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GMAC",
"cavpCertName": "A4751",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A4752",
"properties": "-",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A4751",
"properties": "Prediction Resistance - No Mode - AES-256 Derivation Function Enabled - No",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Component - No Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Component - No Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4746",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4751",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4755",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A4746",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A4751",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A4755",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4746",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4751",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4755",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A4746",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A4751",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A4755",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A4746",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A4751",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A4755",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800- 56Ar3",
"cavpCertName": "A4751",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800- 56Ar3",
"cavpCertName": "A4751",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem -",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDA HKDF Sp800- 56Cr1",
"cavpCertName": "A4750",
"properties": "Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224-65336 Increment 8 HMAC Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "PBKDF",
"cavpCertName": "A4751",
"properties": "Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1",
"reference": "SP 800-132"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Key Generation Mode - B.3.2 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A4751",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A4751",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4746",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4751",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4755",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A4746",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A4751",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A4755",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4746",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4751",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4755",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4746",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4751",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4755",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4746",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4751",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4755",
"properties": "Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A4747",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A4753",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A4747",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A4753",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A4747",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A4753",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A4747",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A4753",
"properties": "-",
"reference": "FIPS 202"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A4751",
"properties": "-",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Compute a message digest",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Message",
"name": "Message Digest",
"outputs": "Digest value",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Hashes"
},
{
"description": "Encrypt a plaintext",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, plaintext",
"name": "Encryption",
"outputs": "Ciphertext",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES-CBC AES-CFB8 AES-XTS AES-ECB"
},
{
"description": "Decrypt a ciphertext",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, ciphertext",
"name": "Decryption",
"outputs": "Plaintext",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES-CBC AES-CFB8 AES-XTS AES-ECB"
},
{
"description": "Authenticated Decryption",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES key, IV, MAC tag, ciphertext",
"name": "Authenticated Decryption",
"outputs": "Plaintext or failure",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES CCM (Authenticated Encryption/Decryption) AES GCM (Authenticated Encryption/Decryption)"
},
{
"description": "Authenticated Encryption",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, IV, plaintext",
"name": "Authenticated Encryption",
"outputs": "Ciphertext, MAC tag",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES CCM (Authenticated Encryption/Decryption) AES GCM (Authenticated Encryption/Decryption)"
},
{
"description": "Message Authentication",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, message",
"name": "AES Message Authentication",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES-CMAC AES-GMAC"
},
{
"description": "Message Authentication",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "HMAC Key, message",
"name": "HMAC Message Authentication",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - HMAC Key: W,E",
"secFunImpl": "HMAC"
},
{
"description": "Compute a shared secret",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "EC Private Key, EC Public Key",
"name": "ECDH Shared Secret Computation",
"outputs": "Shared secret",
"rolesSspAccess": "Crypto Officer - EC Private Key: W,E - EC Public Key: W,E - Shared Secret: G,R",
"secFunImpl": "KAS-ECC-SSC"
},
{
"description": "Derive a key",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Shared Secret",
"name": "Key Derivation",
"outputs": "HKDF derived key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - TLS Pre- Master Secret: W,E - TLS Master Secret: W,E - TLS Derived",
"secFunImpl": "HKDF Key Derivation TLS 1.2 Key Derivation"
},
{
"description": "Derive a key from a password",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Password",
"name": "Password-Based Key Derivation",
"outputs": "PBKDF derived key",
"rolesSspAccess": "Crypto Officer - Password: W,E - PBKDF Derived Key: G,R",
"secFunImpl": "Password-based Key Derivation"
},
{
"description": "Key Pair Generation",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "DH Group",
"name": "DH Key Pair Generation",
"outputs": "Module generated DH private key, Module generated DH public key",
"rolesSspAccess": "Crypto Officer - Module Generated DH Public Key: G,R - Module Generated DH Private Key: G,R - Intermediate Key Generation Value: G",
"secFunImpl": "Safe Primes Key Generation"
},
{
"description": "Key Pair Generation",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Curve",
"name": "EC Key Pair Generation",
"outputs": "Module generated EC private key, Module generated EC public key",
"rolesSspAccess": "Crypto Officer - Module Generated EC Public Key: G,R - Module Generated EC Private Key: G,R - Intermediate Key Generation",
"secFunImpl": "ECDSA Key Generation"
},
{
"description": "Key Pair Generation",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Modulus",
"name": "RSA Key Pair Generation",
"outputs": "Module generated RSA private key, Module generated RSA public key",
"rolesSspAccess": "Crypto Officer - Module Generated RSA Private Key: G,R - Module Generated RSA Public Key: G,R - Intermediate Key Generation",
"secFunImpl": "RSA Key Generation"
},
{
"description": "Verify an EC public key",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "EC public key",
"name": "Public Key Verification",
"outputs": "Return codes/log messages",
"rolesSspAccess": "Crypto Officer - EC Private Key: W,E - EC Public Key: W,E",
"secFunImpl": "ECDSA Key Verification"
},
{
"description": "Wrap a key",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, key to be wrapped",
"name": "Key Wrapping",
"outputs": "Wrapped key",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES CCM (Key Wrapping/Unwrapping) AES CBC with HMAC AES GCM (Key Wrapping/Unwrapping)"
},
{
"description": "Unwrap a key",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "AES Key, key to be unwrapped",
"name": "Key Unwrapping",
"outputs": "Unwrapped key",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "AES CCM (Key Wrapping/Unwrapping) AES CBC with HMAC AES GCM (Key Wrapping/Unwrapping)"
},
{
"description": "Generate random bytes",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Output length",
"name": "Random Number Generation",
"outputs": "Random bytes",
"rolesSspAccess": "Crypto Officer - Entropy Input: W,E - DRBG Seed: G,E - Internal State (V, Key): G,E",
"secFunImpl": "Counter DRBG"
},
{
"description": "Verify a digital signature",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Message, EC Public Key or RSA Public Key, signature, hash algorithm",
"name": "Signature Verification",
"outputs": "Pass/fail",
"rolesSspAccess": "Crypto Officer - EC Public Key: W,E - RSA Public Key: W,E",
"secFunImpl": "ECDSA Signature Verification RSA Signature Verification"
},
{
"description": "Signature Generation",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Message, EC Private Key or RSA Private Key, hash algorithm",
"name": "Signature Generation",
"outputs": "Signature",
"rolesSspAccess": "Crypto Officer - EC Private Key: W,E - RSA Private Key: W,E",
"secFunImpl": "ECDSA Signature Generation RSA Signature Generation"
},
{
"description": "Return the module name and version information",
"indicator": "None",
"inputs": "N/A",
"name": "Show Version",
"outputs": "Module name and version",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Return the module status",
"indicator": "None",
"inputs": "N/A",
"name": "Show Status",
"outputs": "Module status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform the CASTs and integrity tests",
"indicator": "None",
"inputs": "N/A",
"name": "Self-Test",
"outputs": "Pass/Fail",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "KAS-ECC-SSC KAS-FFC-SSC AES CCM (Key Wrapping/Unwrapping) AES GCM (Key Wrapping/Unwrapping) AES-CBC AES-CMAC HMAC Hashes AES-CFB8 AES-XTS AES-GMAC Counter DRBG ECDSA Signature Generation ECDSA Key Generation ECDSA Signature Verification RSA Signature Generation RSA Key Generation RSA Signature Verification Safe Primes Key Generation HKDF Key Derivation Password-based Key Derivation TLS 1.2 Key Derivation AES-ECB AES CCM (Authenticated Encryption/Decryption)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "AES GCM (Authenticated Encryption/Decryption)"
},
{
"description": "Zeroize all SSPs",
"indicator": "None",
"inputs": "Any SSP",
"name": "Zeroization",
"outputs": "N/A",
"rolesSspAccess": "Crypto Officer - Module- generated AES Key: Z - AES Key: Z - Module- generated HMAC Key: Z - HMAC Key: Z - Shared Secret: Z - Password: Z - Entropy Input: Z - DRBG Seed: Z - Internal State (V, Key): Z - DH Public Key: Z - DH Private Key: Z - Module Generated DH Public Key: Z - Module Generated DH Private Key: Z - EC Private Key: Z - EC Public Key: Z - Module Generated EC Private Key: Z - Module Generated EC Public Key: Z - RSA Private Key: Z - RSA Public Key: Z - Module Generated RSA Private Key: Z - Module Generated RSA Public Key: Z - Intermediate Key Generation Value: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Derived Secret: Z",
"secFunImpl": "None"
},
{
"description": "Provide supported cipher suites in approved mode",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "Cipher-suites, Digital Certificate, Public and Private Keys, Application Data",
"name": "Transport Layer Security (TLS) Network Protocol",
"outputs": "Return codes and/or log messages, Application data",
"rolesSspAccess": "Crypto Officer - AES Key: W,E - HMAC Key: W,E - RSA Public Key: W,E - RSA Private Key: W,E - EC Public Key: W,E - EC Private Key: W,E - Module Generated DH Public Key: G,E - Module Generated DH Private Key: G,E - Module Generated EC Private Key: G,E - Module Generated EC Public Key: G,E - TLS Master Secret: G,E - TLS Pre- Master Secret: G,E - TLS Derived Secret: G,R - HKDF Derived Key: G,R",
"secFunImpl": "AES CBC with HMAC AES-CBC Hashes ECDSA Signature Generation ECDSA Key Generation ECDSA Signature Verification ECDSA Key Verification RSA Signature Generation RSA Signature Verification Safe Primes Key Generation TLS Handshake AES CCM (Authenticated Encryption/Decryption) AES GCM (Authenticated Encryption/Decryption)"
},
{
"description": "Generate a key",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "N/A",
"name": "Symmetric Key Generation",
"outputs": "Module generated AES key, Module generated HMAC key",
"rolesSspAccess": "Crypto Officer - Module- generated AES Key: G,R - Module- generated HMAC Key: G,R",
"secFunImpl": "Symmetric Key Generation with Counter DRBG"
},
{
"description": "Compute a shared secret",
"indicator": "GNUTLS_FIPS140_OP_APPROVED",
"inputs": "DH Public Key, DH Private Key",
"name": "DH Shared Secret Computation",
"outputs": "Shared secret",
"rolesSspAccess": "Crypto Officer - DH Public Key: W,E - DH Private Key: W,E - Shared Secret: G,R",
"secFunImpl": "KAS-FFC-SSC"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-4) (A4751)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Successful key generation",
"testMethod": "Signature generation and Signature verification",
"testProps": "SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-4) (A4751)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Successful key generation",
"testMethod": "Signature generation and Signature verification",
"testProps": "SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "Safe Primes Key Generation (A4751)",
"condition": "Key pair generation",
"details": "PCT according to section 5.6.2.1.4 of [SP800-56Ar3]",
"indicator": "Successful key generation",
"testMethod": "Diffie-Hellman key generation",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "SHA3-224 (A4747)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-224",
"testProps": "SHA3-224",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-224 (A4753)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-224",
"testProps": "SHA3-224",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4743)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4744)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4745)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4746)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4751)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A4755)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CBC",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CFB8 (A4748)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CFB8",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CFB8 (A4749)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CFB8",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CFB8 (A4754)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for CFB8",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4743)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4744)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4745)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4746)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4751)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A4755)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for GCM",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A4752)",
"condition": "Module initialization",
"details": "Encryption/Decryption",
"indicator": "Module is operational and services are available for use",
"testMethod": "Encrypt/Decrypt KAT for XTS",
"testProps": "256-bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "KDA HKDF Sp800-56Cr1 (A4750)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT with HMAC-SHA2-256 for HKDF",
"testProps": "HMAC-SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A4751)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module is operational and",
"testMethod": "KAT with HMAC-SHA2-256 for TLS 1.2 KDF",
"testProps": "HMAC-SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "services are available for use",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "PBKDF (A4751)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT with HMAC-SHA2-256 for PBKDF",
"testProps": "HMAC-SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A4751)",
"condition": "Module initialization",
"details": "KAT CTR_DRBG with AES with 256-bit keys without DF, without PR; Health tests",
"indicator": "Module is operational and services are available for use",
"testMethod": "CTR_DRBG with AES without DF, without PR KAT; SP800- 90Ar1 Section 11.3 Health Test",
"testProps": "256-bit key; Health tests",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A4751)",
"condition": "Module initialization",
"details": "Shared Secret Computation",
"indicator": "Module is operational and services are available for use",
"testMethod": "Primitive \"Z\" computation KAT",
"testProps": "3072-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A4751)",
"condition": "Module initialization",
"details": "Shared Secret Computation",
"indicator": "Module is operational and services are available for use",
"testMethod": "Primitive \"Z\" computation KAT",
"testProps": "Curve P-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-4) (A4751)",
"condition": "Module initialization",
"details": "Signature Generation",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT ECDSA with P-256 using SHA2-256",
"testProps": "Curve P-256 and SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-4) (A4751)",
"condition": "Module initialization",
"details": "Signature Verification",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT ECDSA with P-256 using SHA2-256",
"testProps": "Curve P-256 and SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A4746)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 128-bit key",
"testProps": "128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A4751)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 128-bit key",
"testProps": "128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A4755)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 128-bit key",
"testProps": "128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-4) (A4751)",
"condition": "Module initialization",
"details": "Signature generation",
"indicator": "Module is operational and services are available for use",
"testMethod": "RSA KAT with PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A4751)",
"condition": "Module initialization",
"details": "Signature verification",
"indicator": "Module is operational and services are available for use",
"testMethod": "RSA KAT with PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A4746)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A4751)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A4755)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A4746)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A4751)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A4755)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A4746)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A4751)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A4755)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A4746)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A4751)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A4755)",
"condition": "Module initialization",
"details": "MAC",
"indicator": "Module is operational and services are available for use",
"testMethod": "HMAC KAT with 160-bit key",
"testProps": "160-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A4747)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-256",
"testProps": "SHA3-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A4753)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-256",
"testProps": "SHA3-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-384 (A4747)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-384",
"testProps": "SHA3-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-384 (A4753)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-384",
"testProps": "SHA3-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-512 (A4747)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and services are available for use",
"testMethod": "KAT SHA3-512",
"testProps": "SHA3-512",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-512 (A4753)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module is operational and",
"testMethod": "KAT SHA3-512",
"testProps": "SHA3-512",
"type": "CAST"
},
{
"algorithmOrTest": "Algorithm or",
"condition": "Conditions",
"details": "Details",
"indicator": "Indicator",
"testMethod": "Test Method",
"testProps": "Test",
"type": "Test"
},
{
"algorithmOrTest": "Test",
"condition": "",
"details": "",
"indicator": "services are",
"testMethod": "",
"testProps": "Properties",
"type": "Type"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "When the Pre- Operational Self- Test or a CAST fails When a PCT fails Crypto operations requested in the Error state",
"description": "The module stops functioning and ends the Application process",
"indicator": "GNUTLS_E_SELF_TEST_ERROR (-400); GNUTLS_E_RANDOM_FAILED (-206); GNUTLS_E_PK_GENERATION_ERROR (-403); GNUTLS_E_LIB_IN_ERROR_STATE (-402)",
"name": "Error",
"recoveryMethod": "The module must be restarted and successfully perform the pre-operational self-test and the CASTs to recover from these errors."
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Automatically entered whenever an approved service is requested",
"name": "Approved mode",
"statusIndicator": "Equivalent to the indicator of the requested service as defined in section 4.3",
"type": "Approved"
},
{
"description": "Automatically entered whenever a non-approved service is requested",
"name": "Non-approved mode",
"statusIndicator": "Equivalent to the indicator of the requested service as defined in section 4.3",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "Blowfish",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "Camellia",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "CAST",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "ChaCha20",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "Chacha20 and Poly1305",
"use": "Authenticated Encryption; Authenticated Decryption"
},
{
"name": "CMAC with Triple-DES",
"use": "Message Authentication Code (MAC)"
},
{
"name": "DES",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "Diffie-Hellman using keys generated with domain parameters other than safe primes",
"use": "Shared Secret Computation"
},
{
"name": "DSA",
"use": "Key Generation; Domain Parameter Generation; Digital Signature Generation; Digital Signature Verification"
},
{
"name": "ECDSA with curves not listed in the Approved Algorithms Table",
"use": "Key Generation; Public Key Verification"
},
{
"name": "ECDSA with curves/hash functions not listed in the Approved Algorithms Table",
"use": "Digital Signature Generation; Digital Signature Verification"
},
{
"name": "EC Diffie-Hellman with curves not listed in the Approved Algorithms Table",
"use": "Shared Secret Computation"
},
{
"name": "GMAC with keys not listed in the Approved Algorithms Table",
"use": "Message Authentication Code (MAC)"
},
{
"name": "GOST",
"use": "Symmetric Encryption; Symmetric Decryption; Message Digest"
},
{
"name": "HMAC with keys smaller than 112-bit",
"use": "Message Authentication Code (MAC)"
},
{
"name": "HMAC with GOST",
"use": "Message Authentication Code (MAC)"
},
{
"name": "MD2, MD4, MD5",
"use": "Message Digest; Message Authentication Code (MAC)"
},
{
"name": "PBKDF with non-approved message digest algorithms or using input parameters not meeting requirements stated in section 2.7",
"use": "Key Derivation"
},
{
"name": "RC2, RC4",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "RMD160",
"use": "Message Digest; Message Authentication Code (MAC)"
},
{
"name": "RSA with keys smaller than 2048 bits.",
"use": "Key Generation"
},
{
"name": "RSA with keys smaller than 2048 bits and/or hash functions not listed in the Approved Algorithms Table",
"use": "Digital Signature Generation; Digital Signature Verification"
},
{
"name": "RSA encryption and decryption with any key sizes",
"use": "Key Encapsulation; Key Un-encapsulation"
},
{
"name": "Salsa20",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "SEED",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "Serpent",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "SRP",
"use": "Key Agreement"
},
{
"name": "STREEBOG",
"use": "Message Digest; Message Authentication Code (MAC)"
},
{
"name": "Triple-DES",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "Twofish",
"use": "Symmetric Encryption; Symmetric Decryption"
},
{
"name": "UMAC",
"use": "Message Authentication Code (MAC)"
},
{
"name": "Yarrow",
"use": "Random Number Generation"
},
{
"name": "DRBG generation of keys smaller than 112 bits",
"use": "Random Number Generation"
},
{
"name": "Non-supported cipher suites (see Appendix A for the complete list of valid cipher suites)",
"use": "Transport Layer Security (TLS) network protocol"
},
{
"name": "AES GCM with keys not listed in the Approved Algorithms Table",
"use": "Authenticated Encryption; Authenticated Decryption"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "DRBG generation of keys smaller than 112 bits",
"description": "Generate symmetric key other than AES and HMAC keys",
"name": "Symmetric Key Generation",
"role": "CO"
},
{
"alg_accessed": "Blowfish Camellia CAST ChaCha20 DES GOST RC2, RC4 Salsa20 SEED Serpent Triple-DES Twofish",
"description": "Compute the cipher for encryption and decryption",
"name": "Symmetric Encryption/Decryption",
"role": "CO"
},
{
"alg_accessed": "DSA ECDSA with curves not listed in the Approved Algorithms Table RSA with keys smaller than 2048 bits.",
"description": "Generate RSA, DSA, and ECDSA key pairs",
"name": "Asymmetric Key Generation",
"role": "CO"
},
{
"alg_accessed": "DSA ECDSA with curves/hash functions not listed in the Approved Algorithms Table RSA with keys smaller than 2048 bits and/or hash functions not listed in the Approved Algorithms Table",
"description": "Sign RSA, DSA, and ECDSA signatures",
"name": "Digital Signature Generation",
"role": "CO"
},
{
"alg_accessed": "DSA ECDSA with curves/hash functions not listed in the Approved Algorithms Table RSA with keys smaller than 2048 bits and/or hash functions not listed in the Approved Algorithms Table",
"description": "Verify RSA, DSA, and ECDSA signatures",
"name": "Digital Signature Verification",
"role": "CO"
},
{
"alg_accessed": "MD2, MD4, MD5 RMD160 STREEBOG",
"description": "Compute message digest",
"name": "Message Digest",
"role": "CO"
},
{
"alg_accessed": "CMAC with Triple-DES GMAC with keys not listed in the Approved Algorithms Table HMAC with keys smaller than 112-bit HMAC with GOST UMAC",
"description": "Compute MAC",
"name": "Message Authentication Code (MAC)",
"role": "CO"
},
{
"alg_accessed": "RSA encryption and decryption with any key sizes",
"description": "Perform RSA key encapsulation/un-encapsulation",
"name": "Key Encapsulation/Un- encapsulation",
"role": "CO"
},
{
"alg_accessed": "PBKDF with non-approved message digest algorithms or using input parameters not meeting requirements stated in section 2.7",
"description": "Perform key derivation",
"name": "Key Derivation",
"role": "CO"
},
{
"alg_accessed": "Non-supported cipher suites (see Appendix A for the complete list of valid cipher suites)",
"description": "Provide non-supported cipher suites",
"name": "Transport Layer Security (TLS) network protocol",
"role": "CO"
},
{
"alg_accessed": "Yarrow DRBG generation of keys smaller than 112 bits",
"description": "Generate random numbers",
"name": "Random Number Generation",
"role": "CO"
},
{
"alg_accessed": "SRP",
"description": "Perform key agreement",
"name": "Key Agreement",
"role": "CO"
},
{
"alg_accessed": "Chacha20 and Poly1305 AES GCM with keys not listed in the Approved Algorithms Table",
"description": "Perform authenticated encryption or decryption",
"name": "Authenticated Encryption/Decryption",
"role": "CO"
},
{
"alg_accessed": "Diffie-Hellman using keys generated with domain parameters other than safe primes EC Diffie-Hellman with curves not listed in the Approved Algorithms Table",
"description": "Perform shared secret computation",
"name": "Shared Secret Computation",
"role": "CO"
},
{
"alg_accessed": "ECDSA with curves not listed in the Approved Algorithms Table",
"description": "Verify ECDSA public keys",
"name": "Public Key Verification",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "API input parameters, kernel I/O network or files on filesystem, TLS protocol input messages.",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "API output parameters, kernel I/O network or files on filesystem, TLS protocol output messages.",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API function calls, API input parameters for control.",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "API return codes, API output parameters for status output.",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC-SHA2-256 (A4746)",
"details": "Integrity test for libgnutls.so.30, libnettle.so.8, libhogweed.so.6, libgmp.so.10",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message Authentication",
"testProps": "256-bit key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A4751)",
"details": "Integrity test for libgnutls.so.30, libnettle.so.8, libhogweed.so.6, libgmp.so.10",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message Authentication",
"testProps": "256-bit key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A4755)",
"details": "Integrity test for libgnutls.so.30, libnettle.so.8, libhogweed.so.6, libgmp.so.10",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message Authentication",
"testProps": "256-bit key",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Cryptographic module",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API input parameters",
"sfiAlgo": "",
"source": "Operating calling application (TOEPP)"
},
{
"dest": "Operator calling application (TOEPP)",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API output parameters",
"sfiAlgo": "",
"source": "Cryptographic module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroizes the SSPs referenced. In the function name",
"method": "Free Cipher Handle",
"operatorId": "By calling the appropriate zeroization functions: AES Key: gnutls_cipher_deinit(); AES Key: gnutls_aead_cipher_deinit(); HMAC Key: gnutls_hmac_deinit(); RSA Public and Private Keys: gnutls_privkey_deinit(), gnutls_x509_privkey_deinit(), gnutls_rsa_params_deinit(); ECDSA Public and Private Keys: gnutls_privkey_deinit(), gnutls_x509_privkey_deinit(), gnutls_rsa_params_deinit(); Diffie-Hellman Public and Private Keys: gnutls_dh_params_deinit(); TLS Pre-master Secret: gnutls_deinit(); TLS Master Secret: gnutls_deinit(); TLS Derived Secret: gnutls_deinit(); Diffie-Hellman Public and Private Keys: gnutls_pk_params_clear(); EC Diffie-Hellman Public and Private Keys: gnutls_pk_params_clear(); Diffie-Hellman Shared Secret: zeroize key(); EC Diffie-Hellman Shared Secret: zeroize key(); All SSPs: gnutls_global_deinit()",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
},
{
"description": "De-allocates the volatile memory used to store SSPs",
"method": "Module Reset",
"operatorId": "By unloading and reloading the module.",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable"
},
{
"description": "Automatically zeroized by the module when no longer needed",
"method": "Automatic",
"operatorId": "N/A",
"rationale": "Automatically zeroized by the module when no longer needed"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs.",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libgnutls.so.30; libnettle.so.8; libhogweed.so.6; libgmp.so.10 (statically linked to libgnutls); libgnutls.so.30.hmac on ORACLE SERVER X9-2c with Intel(R) Xeon(R) Platinum 8358",
"swFwVersion": "3.7.6-39e2433a29b33b55"
},
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libgnutls.so.30; libnettle.so.8; libhogweed.so.6; libgmp.so.10 (statically linked to libgnutls); libgnutls.so.30.hmac on ORACLE SERVER E4-2c with AMD EPYC 7J13",
"swFwVersion": "3.7.6-39e2433a29b33b55"
},
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libgnutls.so.30; libnettle.so.8; libhogweed.so.6; libgmp.so.10 (statically linked to libgnutls); libgnutls.so.30.hmac on ORACLE SERVER A1-2c with Ampere(R) Altra(R) Q80-30",
"swFwVersion": "3.7.6-39e2433a29b33b55"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "ORACLE SERVER X9-2c",
"hypervisorHostOs": "KVM on Oracle Linux 8",
"operatingSystem": "Oracle Linux 9",
"paa_pai": "Yes",
"processors": "Intel(R) Xeon(R) Platinum 8358",
"version": "3.7.6-39e2433a29b33b55"
},
{
"hardwarePlatform": "ORACLE SERVER E4-2c",
"hypervisorHostOs": "KVM on Oracle Linux 8",
"operatingSystem": "Oracle Linux 9",
"paa_pai": "Yes",
"processors": "AMD EPYC 7J13",
"version": "3.7.6-39e2433a29b33b55"
},
{
"hardwarePlatform": "ORACLE SERVER A1-2c",
"hypervisorHostOs": "KVM on Oracle Linux 8",
"operatingSystem": "Oracle Linux 9",
"paa_pai": "Yes",
"processors": "Ampere(R) Altra(R) Q80-30",
"version": "3.7.6-39e2433a29b33b55"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric RSA (asymmetric):2048, 3072, 4096 bits with 112, 128, 149 bits of key strength. ECDSA (asymmetric):P-224, P-256, P 384, P-521 elliptic curves with 112-256 bits of key strength Safe Primes (asymmetric):ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 2048, 3072, 4096, 6144, 8192- bit keys (112-200 bits of key strength) CTR_DRBG (symmetric):112-256 bit keys (112-256 bits of strength)",
"implName": "N/A",
"name": "CKG",
"reference": "SP 800-133r2 section 4 example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "Oracle X Series Servers",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Oracle E Series Servers",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Oracle A Series Servers",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Marvell T93 LiquidIO III (ARM v8.x) SmartNIC",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Pensando DSC-200-R (ARM v8.x) SmartNIC",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Marvell Liquid IO II (MIPS64) SmartNIC",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Nvidia Bluefield-3 (ARM v8.x) SmartNIC",
"operatingSystem": "Oracle Linux 9"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 1
},
"ECDH": {
"ECDH": 3
},
"ECDSA": {
"ECDSA": 54
}
},
"FF": {
"DH": {
"DH": 41,
"Diffie-Hellman": 14
},
"DSA": {
"DSA": 7
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 18
},
"CCM": {
"CCM": 13
},
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 2
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 36
},
"XTS": {
"XTS": 11
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"GnuTLS": {
"GnuTLS": 56
}
},
"crypto_protocol": {
"IKE": {
"IKE": 1
},
"TLS": {
"TLS": {
"TLS": 57,
"TLS 1.2": 11,
"TLS 1.3": 5,
"TLS v1.2": 5,
"TLSv1.2": 1,
"TLSv1.3": 1
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 3
},
"KEX": {
"Key Exchange": 1
},
"MAC": {
"MAC": 38
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"Curve P-256": 3,
"P-224": 12,
"P-256": 43,
"P-384": 18,
"P-521": 32
}
},
"eval_facility": {
"atsec": {
"atsec": 3
}
},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 2,
"AES-256": 3,
"HMAC-SHA-1": 18,
"HMAC-SHA-256": 6,
"PKCS 1": 2,
"PKCS#1": 10,
"SHA-1": 4,
"SHA-256": 4,
"SHA-3": 1,
"SHA2- 256": 4,
"SHA2-224": 4,
"SHA2-256": 14,
"SHA2-384": 8,
"SHA2-512": 8,
"SHA3-224": 12,
"SHA3-256": 12,
"SHA3-384": 12,
"SHA3-512": 12
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"MD": {
"MD4": {
"MD4": 2
},
"MD5": {
"MD5": 2
}
},
"PBKDF": {
"PBKDF": 17,
"PBKDF2": 5
},
"SHA": {
"SHA1": {
"SHA-1": 4
},
"SHA2": {
"SHA-256": 4
},
"SHA3": {
"SHA-3": 1,
"SHA3-224": 12,
"SHA3-256": 12,
"SHA3-384": 12,
"SHA3-512": 12
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 38
},
"RNG": {
"RBG": 2,
"RNG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 11,
"FIPS 180-4": 16,
"FIPS 186-4": 10,
"FIPS 186-5": 2,
"FIPS 197": 1,
"FIPS 198-1": 16,
"FIPS 202": 9,
"FIPS PUB 140-3": 2,
"FIPS186-4": 26
},
"NIST": {
"SP 800-132": 6,
"SP 800-135": 1,
"SP 800-140B": 1,
"SP 800-38A": 11,
"SP 800-38B": 4,
"SP 800-38C": 3,
"SP 800-38D": 8,
"SP 800-38E": 3,
"SP 800-56A": 3,
"SP 800-56C": 1,
"SP 800-90A": 1,
"SP 800-90B": 1
},
"PKCS": {
"PKCS 1": 2,
"PKCS#1": 5
},
"RFC": {
"RFC 3526": 1,
"RFC 5288": 2,
"RFC 7919": 1,
"RFC 8446": 1,
"RFC3268": 4,
"RFC4279": 2,
"RFC4492": 8,
"RFC5246": 4,
"RFC5288": 4,
"RFC5289": 16,
"RFC6655": 4,
"RFC7627": 3,
"RFC8446": 6
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 79,
"AES-256": 3
},
"CAST": {
"CAST": 102
},
"RC": {
"RC2": 2,
"RC4": 2
},
"Serpent": {
"Serpent": 2
},
"Twofish": {
"Twofish": 2
}
},
"DES": {
"3DES": {
"Triple-DES": 4
},
"DES": {
"DES": 2
}
},
"constructions": {
"MAC": {
"CMAC": 4,
"HMAC": 68,
"HMAC-SHA-256": 3
}
},
"djb": {
"ChaCha": {
"ChaCha20": 2
},
"Poly": {
"Poly1305": 2
},
"Salsa": {
"Salsa20": 2
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 2
},
"Camellia": {
"Camellia": 2
},
"SEED": {
"SEED": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 6
},
"IBM": {
"SSC": 3
}
},
"tls_cipher_suite": {
"TLS": {
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA": 1,
"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_DHE_RSA_WITH_AES_128_CCM": 1,
"TLS_DHE_RSA_WITH_AES_128_CCM_8": 1,
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA": 1,
"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256": 1,
"TLS_DHE_RSA_WITH_AES_256_CCM": 1,
"TLS_DHE_RSA_WITH_AES_256_CCM_8": 1,
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_DH_RSA_WITH_AES_128_CBC_SHA": 1,
"TLS_DH_RSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_DH_RSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_DH_RSA_WITH_AES_256_CBC_SHA": 1,
"TLS_DH_RSA_WITH_AES_256_CBC_SHA256": 1,
"TLS_DH_RSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": 1,
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": 1,
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA": 1,
"TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA": 1,
"TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDH_RSA_WITH_AES_128_CBC_SHA": 1,
"TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDH_RSA_WITH_AES_256_CBC_SHA": 1,
"TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_PSK_WITH_AES_128_CBC_SHA": 1,
"TLS_PSK_WITH_AES_256_CBC_SHA": 1
}
},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"SHA3-224A4753",
"SHA2-384A4755",
"SHA-1A4755",
"PBKDFA4751",
"HMAC-SHA2-224A4755",
"ECDSA SigVer (FIPS186-4)A4751",
"RSA KeyGen (FIPS186-4)A4751",
"AES-XTS Testing Revision 2.0A4752",
"AES-CMACA4751",
"SHA2-256A4755",
"KAS-FFC-SSC Sp800-56Ar3A4751",
"AES-GMACA4751",
"AES-CCMA4755",
"AES-CBCA4755",
"SHA2-224A4755",
"RSA SigVer (FIPS186-4)A4751",
"ECDSA KeyGen (FIPS186-4)A4751",
"HMAC-SHA2-512A4755",
"HMAC-SHA-1A4755",
"SHA2-512A4755",
"KAS-ECC-SSC Sp800-56Ar3A4751",
"AES-ECBA4751",
"SHA3-512A4753",
"Safe Primes Key GenerationA4751",
"AES-GCMA4755",
"RSA SigGen (FIPS186-4)A4751",
"Counter DRBGA4751",
"SHA3-256A4753",
"ECDSA KeyVer (FIPS186-4)A4751",
"KDA HKDF Sp800-56Cr1A4750",
"TLS v1.2 KDF RFC7627A4751",
"AES-CFB8A4754",
"HMAC-SHA2-384A4755",
"ECDSA SigGen (FIPS186-4)A4751",
"SHA3-384A4753",
"HMAC-SHA2-256A4755"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4746",
"#A4754",
"#A4749",
"#A4743",
"#A4748",
"#A4752",
"#A4747",
"#A4745",
"#A4755",
"#A4751",
"#A4744",
"#A4753",
"#A4750"
]
},
"policy_metadata": {
"/Author": "",
"/Category": "",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20250922112458-04\u002700\u0027",
"/Creator": "Acrobat PDFMaker 25 for Word",
"/Keywords": "",
"/Manager": "",
"/ModDate": "D:20250922112631-04\u002700\u0027",
"/ModuleName": "Oracle 9 GnuTLS Cryptographic Module",
"/Producer": "Adobe PDF Library 25.1.51",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 690151,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf",
"https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
"https://www.ietf.org/rfc/rfc3447.txt",
"https://www.ietf.org/rfc/rfc7919.txt",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
"https://www.oracle.com/",
"https://www.ietf.org/rfc/rfc5288.txt",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf",
"https://www.ietf.org/rfc/rfc3526.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr1.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf",
"https://docs.oracle.com/en/operating-systems/oracle-linux/9/fips/about_fips_1403.html#about-fips-140-3",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
"https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf",
"https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
"https://www.ietf.org/rfc/rfc8446.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 51
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "b6b33697c2fb1a1112d18198bb783f6ca4c3b5521a7b278fdfda5fa159461de6",
"source_hash": "fa70d5dec89345fb6a7ae13a0a37a2a54c178e6163433f5c4aa085856f818715",
"txt_hash": "db4f8dcff97c806cb524cbc47ec7d87b543066fc420c4bd7e39cff5619bd0cd2"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode and installed, initialized and configured as specified in Section 11.1 of the Security Policy.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2025_110825_0311.pdf",
"date_sunset": "2030-07-02",
"description": null,
"embodiment": "Multi-Chip Stand Alone",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Oracle Linux 9 GnuTLS Cryptographic Module",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-07-03",
"lab": "atsec information security corporation",
"validation_type": "Initial"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-09-22",
"lab": "atsec information security corporation",
"validation_type": "Update"
}
],
"vendor": "Oracle Corporation",
"vendor_url": "http://www.oracle.com"
}
}