This page was not yet optimized for use on mobile devices.
Sansec HSM Cryptographic Module
Certificate details
| Certificate ID | #5503 |
|---|---|
| Status | active |
| Validation dates | 25.08.2026 |
| Sunset date | 24-08-2031 |
| Standard | FIPS 140-3 |
| Security level | 3 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode and installed, initialized and configured as specified in Section 11.1 Installation, Initialization, and Startup Procedures of the Security Policy |
| Exceptions |
|
| Description | The Sansec HSM Cryptographic Module is a multi-chip standalone hardware cryptographic module that provides core functions such as device management, key management, and cryptographic services. The module delivers key storage and cryptographic services to external applications through virtual security modules (VSMs), including data encryption, data decryption, signature generation, signature verification, message digest, message authentication code (MAC), and random number generation. |
| Vendor | Sansec Technology Co., Ltd. http://en.sansec.com.cn |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES, AES-128, AES-192, AES-, CAST, DES, Triple-DES, TDEA, SM4, HMAC, CMAC, CBC-MACAsymmetric Algorithms
RSA 2048, RSA-OAEP, ECDH, ECDSA, ECIES, ECC, DSAPost-quantum Algorithms
ML-DSA, ML-KEM, SLH-DSA, SLHDSA, MLDSA, MLKEM, PQCHash functions
SHA-1, SHA2, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHA-3, PBKDFSchemes
MAC, KEM, Key Exchange, Key AgreementProtocols
TLS v1.2, TLS, TLS 1.2Randomness
DRBG, RNG, RBGLibraries
OpenSSLElliptic Curves
P-224, P-256, P-384, P-521, P-192, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1, brainpoolP224t1, brainpoolP256t1, brainpoolP320t1, brainpoolP384t1, brainpoolP512t1Block cipher modes
ECB, CBC, CTR, CFB, OFB, GCM, CCM, XTSTLS cipher suites
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384JavaCard API constants
SM2Trusted Execution Environments
PSP, SSCSecurity level
Level 3Standards
FIPS 140-3, FIPS PUB 140-3, FIPS186-5, FIPS 186-5, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 204, FIPS 203, FIPS 180-4, FIPS 202, FIPS 205, FIPS140-3, FIPS PUB 202, SP 800-227, SP 800-135, NIST SP 800-57, SP 800-90B, PKCS 1, PKCS#12, RFC7627, ISO/IEC14888-, ISO/IEC10118-, ISO/IEC18033-3, ISO/IEC 19790, ISO/IEC 24759Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5503,
"dgst": "80ccd59a719f2767",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"RSA SigVer (FIPS186-5)A6703",
"SHA3-384A6703",
"ECDSA SigGen (FIPS186-5)A6703",
"SHA2-224A6703",
"AES-XTS Testing Revision 2.0A6703",
"ML-DSA SigVerA6703",
"SHA2-384A6703",
"HMAC-SHA2-512A6703",
"HMAC-SHA3-512A6703",
"KAS-ECC-SSC Sp800-56Ar3A6703",
"ML-DSA KeyGenA6703",
"#A6703",
"SHA3-224A6703",
"ML-DSA SigGenA6703",
"AES-CCMA6703",
"SHA3-256A6704",
"ECDSA KeyVer (FIPS186-5)A6703",
"Hash DRBGA6703",
"AES-CFB128A6703",
"AES-OFBA6703",
"AES-CMACA6703",
"AES-CBCA6703",
"HMAC-SHA3-384A6703",
"HMAC-SHA2-256A6703",
"ECDSA KeyGen (FIPS186-5)A6703",
"SLH-DSA SigVerA6703",
"HMAC-SHA2-224A6703",
"Counter DRBGA6703",
"HMAC-SHA3-256A6703",
"ECDSA SigVer (FIPS186-4)A6703",
"RSA SigVer (FIPS186-4)A6703",
"ML-KEM KeyGenA6703",
"AES-CTRA6703",
"AES-CFB8A6703",
"RSA KeyGen (FIPS186-5)A6703",
"SHA2-512A6703",
"KTS-IFCA6703",
"KDF SP800-108A6703",
"HMAC-SHA2-384A6703",
"SHAKE-256A6703",
"AES-GCMA6703",
"RSA SigGen (FIPS186-5)A6703",
"SLH-DSA KeyGenA6703",
"TLS v1.2 KDF RFC7627A6703",
"SHAKE-128A6703",
"SHA3-512A6703",
"SHA-1A6703",
"AES-CFB1A6703",
"SHA2-256A6703",
"SLH-DSA SigGenA6703",
"AES-ECBA6703",
"#A6704",
"ECDSA SigVer (FIPS186-5)A6703",
"HMAC-SHA-1A6703",
"ML-KEM EncapDecapA6703",
"HMAC-SHA3-224A6703"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A6703",
"properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56-104 Increment 8 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-256 Increment 8",
"reference": "SP 800- 38C"
},
{
"algorithm": "AES-CFB1",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A6703",
"properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 0-16384 Increment 8",
"reference": "SP 800- 38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - No Counter Tests Performed - No",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 8-65536 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8",
"reference": "SP 800- 38D"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800- 38A"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A6703",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 128-65536 Increment 128 Tweak Mode - Hex Data Unit Length Matches Payload Length - Yes",
"reference": "SP 800- 38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A6703",
"properties": "Prediction Resistance - Yes Supports Reseed - No",
"reference": "SP 800- 90A Rev. 1"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Mode - AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0 Returned Bits - 256",
"reference": ""
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Curve - P-224, P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3- 512 Component - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A6703",
"properties": "Curve - P-192, P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A6703",
"properties": "Prediction Resistance - Yes Supports Reseed - No Mode - SHA3-256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0 Additional Input - Additional Input: 0 Returned Bits - 256",
"reference": "SP 800- 90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 160 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 224 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 256 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 384 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 512 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 224",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 224 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 256",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 256 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 384",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 384 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 512",
"cavpCertName": "A6703",
"properties": "MAC - MAC: 512 Key Length - Key Length: 128-256 Increment 64",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC- SSC Sp800- 56Ar3",
"cavpCertName": "A6703",
"properties": "Domain Parameter Generation Methods - P-256, P- 384, P-521 Hash Function Z - SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800- 56A Rev. 3"
},
{
"algorithm": "KDF SP800- 108",
"cavpCertName": "A6703",
"properties": "KDF Mode - Counter MAC Mode - HMAC-SHA2-256 Supported Lengths - Supported Lengths: 256 Fixed Data Order - Before Fixed Data Counter Length - 32 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
"reference": "SP 800- 108 Rev. 1"
},
{
"algorithm": "KTS-IFC",
"cavpCertName": "A6703",
"properties": "Function - keyPairGen IUT ID - 1234567890ABCDEF Modulo - 2048 Key Generation Methods - rsakpg1-crt Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA2-256 Supports Null Associated Data - Yes Associated Data Pattern - uPartyInfo||vPartyInfo Associated Data Encoding - concatenation Key Length - 512",
"reference": "SP 800- 56B Rev. 2"
},
{
"algorithm": "ML-DSA KeyGen",
"cavpCertName": "A6703",
"properties": "Parameter Sets - ML-DSA-44, ML-DSA-65, ML-DSA- 87",
"reference": "FIPS 204"
},
{
"algorithm": "ML-DSA SigGen",
"cavpCertName": "A6703",
"properties": "Signature Interfaces - external Pre Hash - preHash, pure Deterministic - No, Yes External Mu - No Parameter Sets - ML-DSA-44, ML-DSA-65, ML-DSA- 87 Message Length - Message Length: 8-65536 Increment 8 Hash Algorithms - SHA2-512 Context Length - Context Length: 0",
"reference": "FIPS 204"
},
{
"algorithm": "ML-DSA SigVer",
"cavpCertName": "A6703",
"properties": "Signature Interfaces - external Pre Hash - preHash, pure",
"reference": "FIPS 204"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "External Mu - No Parameter Sets - ML-DSA-44, ML-DSA-65, ML-DSA- 87 Message Length - Message Length: 8-65536 Increment 8 Hash Algorithms - SHA2-512 Context Length - Context Length: 0",
"reference": ""
},
{
"algorithm": "ML-KEM EncapDecap",
"cavpCertName": "A6703",
"properties": "Parameter Sets - ML-KEM-1024, ML-KEM-512, ML- KEM-768 Functions - Decapsulation, Encapsulation",
"reference": "FIPS 203"
},
{
"algorithm": "ML-KEM KeyGen",
"cavpCertName": "A6703",
"properties": "Parameter Sets - ML-KEM-1024, ML-KEM-512, ML- KEM-768",
"reference": "FIPS 203"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Key Generation Mode - probableWithProbableAux Modulo - 2048, 3072, 4096 p mod 8 - 1 Primality Tests - 2powSecStr q mod 8 - 1 Fixed Public Exponent - 010001 Info Generated By Server - Yes Private Key Format - crt Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A6703",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Fixed",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6703",
"properties": "Fixed Public Exponent - 010001 Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 160, 8-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 224, 8-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 256, 8-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 384, 8-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 512, 8-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 8-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 8-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A6704",
"properties": "Message Length - Message Length: 8-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 8-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A6703",
"properties": "Message Length - Message Length: 8-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-128",
"cavpCertName": "A6703",
"properties": "Supports Bit-Oriented Messages - Yes Supports Empty Message - No Supports Bit-Oriented Output - Yes Output Length - Output Length: 16-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-256",
"cavpCertName": "A6703",
"properties": "Supports Bit-Oriented Messages - Yes Supports Empty Message - No Supports Bit-Oriented Output - Yes Output Length - Output Length: 16-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SLH-DSA KeyGen",
"cavpCertName": "A6703",
"properties": "Parameter Sets - SLH-DSA-SHA2-128f, SLH-DSA- SHA2-128s, SLH-DSA-SHA2-192f, SLH-DSA-SHA2- 192s, SLH-DSA-SHA2-256f, SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-128f, SLH-DSA-SHAKE-128s, SLH-DSA-SHAKE-192f, SLH-DSA-SHAKE-192s, SLH-DSA-SHAKE-256f, SLH-DSA-SHAKE-256s",
"reference": "FIPS 205"
},
{
"algorithm": "SLH-DSA SigGen",
"cavpCertName": "A6703",
"properties": "Deterministic - No, Yes Signature Interfaces - external Pre Hash - preHash, pure Parameter Sets - SLH-DSA-SHA2-128f, SLH-DSA- SHA2-128s, SLH-DSA-SHA2-192f, SLH-DSA-SHA2- 192s, SLH-DSA-SHA2-256f, SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-128f, SLH-DSA-SHAKE-128s, SLH-DSA-SHAKE-192f, SLH-DSA-SHAKE-192s, SLH-DSA-SHAKE-256f, SLH-DSA-SHAKE-256s Message Length - Message Length: 8-65536 Increment 8 Hash Algorithms - SHA2-512, SHAKE-256 Context Length - Context Length: 0-8 Increment 8",
"reference": "FIPS 205"
},
{
"algorithm": "SLH-DSA SigVer",
"cavpCertName": "A6703",
"properties": "Signature Interfaces - external Pre Hash - preHash, pure Parameter Sets - SLH-DSA-SHA2-128f, SLH-DSA- SHA2-128s, SLH-DSA-SHA2-192f, SLH-DSA-SHA2- 192s, SLH-DSA-SHA2-256f, SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-128f, SLH-DSA-SHAKE-128s, SLH-DSA-SHAKE-192f, SLH-DSA-SHAKE-192s,",
"reference": "FIPS 205"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "SLH-DSA-SHAKE-256f, SLH-DSA-SHAKE-256s Message Length - Message Length: 8-65536 Increment 8 Hash Algorithms - SHA2-512, SHAKE-256 Context Length - Context Length: 0-8 Increment 8",
"reference": ""
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A6703",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 512-1024 Increment 8",
"reference": "SP 800- 135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Show module\u0027s VSM versioning informatio n. Success: navigated Info page. to Device",
"indicator": "Successfully to the Device Error Failed navigate to the Info page.",
"inputs": "N/A",
"name": "View device informatio n (Show Version)",
"outputs": "sPn, msg, sManufacturer, nVersion, sHn, nSystemVersion, sDn, hardareVersion, sSn, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Show module\u0027s VSM running status informatio n. Success: navigated status Failed to Service",
"indicator": "Successfully to the Service page. Error navigate to the status page.",
"inputs": "N/A",
"name": "View device operating informatio n (Show Status)",
"outputs": "msg, serviceStatus, currentCount, run, isRun, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Show module\u0027s FIPS mode (\"approve d mode\" or \"non-",
"indicator": "Success: Successfully navigated to the Set Approved mode page. Error Failed to navigate to the Set Approved mode page.",
"inputs": "N/A",
"name": "View approved mode",
"outputs": "deviceType, msg, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "approved mode\").",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Set module into approved or non- approved mode.",
"indicator": "Success: Config Approved mode successfully. Please log in to the system again or Config non-Approved mode successfully. Please log in to the system again. Error: Management operation failed.",
"inputs": "fType",
"name": "Set approved mode",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - SPK: Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z - User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z - User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Crypto Officer RSA public key: Z - TLS-Host- Pub: Z - TLS-Host-Priv: Z - TLS-SENC: E",
"secFunImpl": ""
},
{
"description": "Start pre- operation al and conditiona l self-tests of VSM",
"indicator": "Success: Device self- test Log refreshed successfully. Error Management operation failed.",
"inputs": "N/A",
"name": "Self-test",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "view self- test log informatio n.",
"indicator": "Success: Successfully view self-test log information. Error Failed to view self-test log information.",
"inputs": "N/A",
"name": "View selftest log",
"outputs": "File stream",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "download self-test error log informatio n.",
"indicator": "Success: Successfully download self-test error log. Error Management operation failed.",
"inputs": "N/A",
"name": "Download selftest log",
"outputs": "fileName, success, fileCode, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Show Administr ator and Operator\u0027s managem ent logs",
"indicator": "Success: Successfully Show Administrator and Operator\u0027s management logs. Error Management operation failed.",
"inputs": "N/A",
"name": "View managem ent logs",
"outputs": "code, data:msg, ipAddress, operateType, id, audited, createTimeS, operator, count",
"rolesSspAccess": "Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Audit managem ent logs",
"indicator": "Success: Audit log successfully. Error: Management operation failed",
"inputs": "id",
"name": "audit managem ent log",
"outputs": "msg, status",
"rolesSspAccess": "Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Export managem ent logs",
"indicator": "Success: Export management log successful Error: Management operation failed",
"inputs": "N/A",
"name": "export managem ent log",
"outputs": "file stream",
"rolesSspAccess": "Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Show current id\u0027s auth login status.",
"indicator": "Success: Successfully navigated to the User login page Error: Failed to navigate to the User login page.",
"inputs": "N/A",
"name": "View login status",
"outputs": "msg, ManagerExist, OperatorCount, OperatorPINExist, OperatorLogonStat us, auditor, spkFlag, InitState, ManagerCount, AuditorLogon, ReserveStates, AuditorExist, OperatorLogon, AuditorCount, ManagerLogon, OperatorExistStatu s, OperatorExist, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "CO auth Login",
"indicator": "Success: No.1 Auditor/Operator/Admini strator remote login succeeded. Error:Failure in vsm",
"inputs": "userValue, signData",
"name": "User login",
"outputs": "status",
"rolesSspAccess": "Administrator - DRBG-EI: E,G - DRBG-State: E,G - DRBG-Seed: E,G",
"secFunImpl": "RSASigVer RBG Entropy Entropy Conditioner TLS-AES-"
},
{
"description": "",
"indicator": "Crypto Officer authentication",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Crypto Officer RSA public key: E - TLS-SENC: E Auditor - DRBG-EI: E,G - DRBG-State: E,G - DRBG-Seed: E,G - Crypto Officer RSA public key: E - TLS-SENC: E Operator - DRBG-EI: E,G - DRBG-State: E,G - DRBG-Seed: E,G - Crypto Officer RSA public key: E - TLS-SENC: E",
"secFunImpl": "Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "CO auth Logout",
"indicator": "Suceess: Logout {Auditor/Operator/Admin istrator} successfully.",
"inputs": "nSel",
"name": "User logout",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Modify CO usb- token PIN",
"indicator": "Success: PIN changed successfully. Error: Management operation failed",
"inputs": "oldPin,newPin,pinType",
"name": "Modify USB token PIN",
"outputs": "status, value",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES-"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "Decrypt- GCM"
},
{
"description": "Add a new administra tor CO",
"indicator": "Success: Remote add No.{index} Administrator succeeded. Error: Management operation failed",
"inputs": "updateFlag, step, pubkeyStr, pubkeyIdStr, usrValue, addType",
"name": "Add administra tor",
"outputs": "msg, usrId, status",
"rolesSspAccess": "Administrator - Crypto Officer RSA public key: W - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete an administra tor CO",
"indicator": "Success: Delete the administrator success. Error: Mangement opration failed",
"inputs": "unMgrNo",
"name": "Delete administra tor",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Add a new operator CO",
"indicator": "Success Remote add No.1 Operator succeeded. Error Mangement opration failed",
"inputs": "updateFlag, step, pubkeyStr, pubkeyIdStr, usrValue, addType",
"name": "Add operator",
"outputs": "msg,usrId,status",
"rolesSspAccess": "Administrator - Crypto Officer RSA public key: W - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete an operator CO",
"indicator": "Success Delete the operator successfully. Error Mangement opration failed",
"inputs": "nSel",
"name": "delete operator",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Add a new auditor CO",
"indicator": "Success Remote add No.1 Auditor succeeded. Error Mangement opration failed",
"inputs": "updateFlag, step, pubkeyStr, usrValue, addType",
"name": "Add auditor",
"outputs": "msg, usrId, status",
"rolesSspAccess": "Administrator - Crypto Officer RSA public key: W - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete an auditor CO",
"indicator": "Success Delete the auditor successfully. Error Mangement opration failed",
"inputs": "nSel",
"name": "delete auditor",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Clear all permissio n informatio n and key informatio n stored in the VSM. use DRBG generate System Protection Key during VSM initializatio n",
"indicator": "Success: Initialize the hsm successfully. Error: Management operation failed",
"inputs": "N/A",
"name": "VSM initializatio n",
"outputs": "status, spk components",
"rolesSspAccess": "Administrator - SPK: G,R,Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z - User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z - User AES-192 keys: Z",
"secFunImpl": "KTS-RSA- Encap SymKeyGe n RBG Entropy Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User AES-256 keys: Z - User HMAC keys: Z - Crypto Officer RSA public key: E,Z - TLS-Host-Priv: Z - TLS-Host- Pub: Z - DRBG-EI: G,E - DRBG-Seed: G,E - DRBG-State: G,E - TLS-SENC: E",
"secFunImpl": ""
},
{
"description": "Import System Protection Key during CO login after the VSM restarts",
"indicator": "Success Import spk Successful. Error Management operation failed",
"inputs": "spk components",
"name": "Import System Protection Key",
"outputs": "status",
"rolesSspAccess": "Administrator - SPK: W,E - TLS-Host- Pub: R - TLS-Host-Priv: E - TLS-SENC: E",
"secFunImpl": "KTS-RSA- Decap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM AES Decryption"
},
{
"description": "Generate Local Master Key (LMK) Use DRBG",
"indicator": "Success Generate LMK successfully. Error Management operation failed",
"inputs": "N/A",
"name": "Generate Local Master Key (LMK)",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - Root LMK: G,E - LMK: G,E - SPK: E - DRBG-EI: E - DRBG-Seed:",
"secFunImpl": "SymKeyGe n KBKDF AES Encryption RBG Entropy"
},
{
"description": "and KBKDF",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "View LMK check value",
"indicator": "Success Successfully navigated to the LMK management page. Error Failed to navigate to the LMK management page.",
"inputs": "index",
"name": "View LMK check value",
"outputs": "msg, operationMsg, logMsg, status",
"rolesSspAccess": "Administrator - LMK: E - TLS-SENC: E Auditor - LMK: E - TLS-SENC: E Operator - LMK: E - TLS-SENC: E",
"secFunImpl": "AES Encryption TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate RSA key pair Use DRBG",
"indicator": "Success Generate {index} key pair successfully. Error Management operation failed",
"inputs": "algorithm=RSA, index, length, usage, curetype Command and parameters",
"name": "Generate RSA key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User RSA- priv: G - User RSA- pub: G - SPK: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "RSAKeyGe n Entropy RBG AES Encryption Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete RSA key pair",
"indicator": "Success Delete {index} key pair successfully.",
"inputs": "algorithm=RSA, index, usage",
"name": "Delete RSA key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User RSA- priv: Z",
"secFunImpl": "TLS-AES- Encrypt- GCM"
},
{
"description": "",
"indicator": "Error Management operation failed",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User RSA- pub: Z - TLS-SENC: E",
"secFunImpl": "TLS-AES- Decrypt- GCM"
},
{
"description": "View RSA key status",
"indicator": "Success Successfully navigated to the RSA key management page. Error Failed to navigate to the RSA key management page.",
"inputs": "algorithm=RSA",
"name": "View RSA key status",
"outputs": "msg, code, data:index, level, model, count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate ECDSA key pair Use DRBG",
"indicator": "Success Generate {index} key pair successfully. Error Management operation failed",
"inputs": "algorithm=ECC, index, length, usage, curetype",
"name": "Generate ECDSA key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User ECDSA- priv: G - User ECDSA- pub: G - SPK: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "ECDSAKey Gen Entropy RBG AES Encryption Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete ECDSA key pair",
"indicator": "Success: Delete {index} key pair successfully. Error: Management operation failed.",
"inputs": "algorithm=ECC, index, usage",
"name": "Delete ECDSA key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User ECDSA- priv: Z - User ECDSA- pub: Z - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "View ECDSA key status",
"indicator": "Success: Successfully navigated to the ECDSA key status page. Error: Failed to navigate to the",
"inputs": "algorithm=ECC",
"name": "View ECDSA key status",
"outputs": "msg, code, data:cureType, index, level, model, count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES-"
},
{
"description": "",
"indicator": "ECDSA key status page.",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "Decrypt- GCM"
},
{
"description": "Generate ML-DSA or ML- KEM key or SLH- DSA pair Use DRBG. The key is not output and stays inside the module.",
"indicator": "Success: Generate {index} key pair successfully. Error: Management operation failed.",
"inputs": "index, algorithm, level, slh_mode, hash_mode",
"name": "Generate PQC key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User MLDSA- priv: G - User MLDSA- pub: G - User MLKEM- priv: G - User MLKEM- pub: G - User SLHDSA-priv: G - User SLHDSA-pub: G - SPK: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - ML-DSA seed: G,E - ML-KEM seed: G,E - TLS-SENC: E",
"secFunImpl": "AES Encryption TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM Entropy Conditioner Entropy RBG ML-DSA KeyGen ML-KEM KeyGen SLH-DSA KeyGen"
},
{
"description": "Delete ML-DSA or ML- KEM or SLH-DSA key pair",
"indicator": "Success: Delete {index} key pair successfully. Error: Management operation failed.",
"inputs": "algorithm=PQC, index",
"name": "Delete PQC key pair",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User MLDSA- priv: Z - User MLKEM- priv: Z - User",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "SLHDSA-priv: Z - User MLDSA- pub: Z - User MLKEM- pub: Z - User SLHDSA-pub: Z - TLS-SENC: E",
"secFunImpl": ""
},
{
"description": "View PQC key status",
"indicator": "Success: Successfully navigated to the PQC key status page. Error: Failed to navigate to the PQC key status page.",
"inputs": "algorithm=PQC",
"name": "View PQC key status",
"outputs": "msg, code, data:algorithm, index, level, model, count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E Administrator",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate symmetric key for AES Use DRBG",
"indicator": "Success: Successfully generated {index} sysmmetric key. Error: Management operation failed.",
"inputs": "keyIndex, keyLength, algorithm",
"name": "Generate symmetric key",
"outputs": "msg, status",
"rolesSspAccess": "- User AES-128 keys: G - User AES-192 keys: G - User AES-256 keys: G - User HMAC keys: G - SPK: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E",
"secFunImpl": "SymKeyGe n AES Encryption RBG Entropy Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete symmetric key for AES",
"indicator": "Success: Delete {index} symmetric key successfully. Error:",
"inputs": "index",
"name": "Delete symmetric key",
"outputs": "msg, status",
"rolesSspAccess": "Administrator - User AES-128 keys: Z - User AES-192",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES-"
},
{
"description": "",
"indicator": "Management operation failed.",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "keys: Z - User AES-256 keys: Z - User HMAC keys: Z - TLS-SENC: E",
"secFunImpl": "Decrypt- GCM"
},
{
"description": "View symmetric key status",
"indicator": "Success: Successfully navigated to the symmetric key status page. Error: Failed to navigate to the symmetric key status page.",
"inputs": "N/A",
"name": "View symmetric key status",
"outputs": "msg, code,data:index, length, serialNumber, tag, usage, count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "View symmetric key check value",
"indicator": "Success: Successfully show check value. Error: Failed to show check value.",
"inputs": "index",
"name": "View symmetric key check value",
"outputs": "verifyValue, msg, status",
"rolesSspAccess": "Administrator - User AES-128 keys: E - User AES-192 keys: E - User AES-256 keys: E - TLS-SENC: E Auditor - User AES-128 keys: E - User AES-192 keys: E - User AES-256 keys: E - TLS-SENC: E Operator - User AES-128 keys: E - User AES-192 keys: E",
"secFunImpl": "AES Encryption TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Backup cryptogra phic module",
"indicator": "Success: Successfully download backup file. Error: Management operation failed.",
"inputs": "part, usrValue; FileStr, envelope, partInfo, type; bacType, alg, index; methodtoken",
"name": "Backup cryptogra phic module",
"outputs": "envBase64, msg, status; encStr,status; msg, status; FileStream",
"rolesSspAccess": "keys: E - TLS-SENC: E Administrator - Backup key: G,R,E,Z - Backup file: R,Z - Crypto Officer RSA public key: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E",
"secFunImpl": "AES Encryption TLS-AES- Encrypt- GCM KTS-RSA- Encap SymKeyGe n RBG Entropy Entropy Conditioner TLS-AES- Decrypt- GCM"
},
{
"description": "Restore cryptogra phic module",
"indicator": "Success: Recover the key successfully.Delete the recovery file successfully. Error: Management operation failed.",
"inputs": "File Stream; restoreType; FileStr; FileStr,envelope,partIn fo,type; Part,envBase64; restoreTypestartIndex",
"name": "Restore cryptogra phic module",
"outputs": "msg, partCount, status; msg, status; msg, pukBase64_4,pukB ase64, status; encStr,status; encStr,status; msg, pukBase64, status; msg, status",
"rolesSspAccess": "Administrator - Backup key: W,E,Z - Backup file: W,Z - TLS-Host- Pub: R - TLS-Host-Priv: E - TLS-SENC: E",
"secFunImpl": "AES Decryption TLS-AES- Decrypt- GCM KTS-RSA- Decap TLS-AES- Encrypt- GCM"
},
{
"description": "View service running status",
"indicator": "Success: Successfully navigated to the service status page. Error: Failed to navigate to the service status page.",
"inputs": "N/A",
"name": "View service status (Show Status)",
"outputs": "msg, serviceStatus, currentCount, run, isRun, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES-"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "Decrypt- GCM"
},
{
"description": "View service configurati on parameter s",
"indicator": "Success: Successfully navigated to the service configuration page. Error: Failed to navigate to the service configuration page.",
"inputs": "N/A",
"name": "View service configurati on",
"outputs": "sslmode, msg, nSessionTimeout, nOnboot, nMaxConcurrent, sslalgorithm, nPort, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Modify service configurati on parameter s",
"indicator": "Success: Start the service successfully. Error: Management operation failed.",
"inputs": "nPort, nSessionTimeout, nOnboot, nMaxConcurrent, sslmode, sslalgorithm",
"name": "Modify service configurati on",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "View ip white-list",
"indicator": "Success: Successfully navigated to the Whitelist management page. Error: Failed to navigate to the Whitelist management page.",
"inputs": "N/A",
"name": "View white list",
"outputs": "msg, code, data:count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Add ip white-list",
"indicator": "Success: Add in the white list successfully. Error: Management operation failed",
"inputs": "family=ipv4, address, port",
"name": "Add white list",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "delete ip white-list",
"indicator": "Success: Delete in the white list successfully. Error: Management operation failed",
"inputs": "Addres, family=IPv4",
"name": "Delete white list",
"outputs": "msgstatus",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "View the CN of client certificate s that allow access to cryptogra phic devices",
"indicator": "Success: Successfully navigated to the CN item management page. Error: Failed to navigate to the CN item management page. N/A",
"inputs": "",
"name": "View CN item",
"outputs": "msg, code,data:count, status",
"rolesSspAccess": "Administrator - TLS-SENC: E Auditor - TLS-SENC: E Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Add the CN of client certificate s that allow access to cryptogra phic devices",
"indicator": "Success Add CN item successfully Error: Management operation failed",
"inputs": "CNInfo",
"name": "CN item configurati on",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Delete the CN of client certificate s that allow access to cryptogra phic devices",
"indicator": "Success Successfully delete CN item Error: Management operation failed",
"inputs": "name",
"name": "Delete CN item",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Start service",
"indicator": "Success: Start the service successfully. Error: Management operation failed",
"inputs": "N/A",
"name": "Start service",
"outputs": "msg, status",
"rolesSspAccess": "Operator - hmackey_mast erkey: E",
"secFunImpl": "KBKDF TLS-AES- Encrypt- GCM"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- hmackey for KTS-AES: G - TLS-SENC: E",
"secFunImpl": "TLS-AES- Decrypt- GCM"
},
{
"description": "Restart service",
"indicator": "Success Start the service successfully. Error: Management operation failed",
"inputs": "N/A",
"name": "Restart service",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Stop service",
"indicator": "Success Start the service successfully. Error: Management operation failed",
"inputs": "N/A",
"name": "Stop service",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate certificate request using TLS keypair",
"indicator": "Successoperation_succ essful Error: Management operation failed",
"inputs": "commonName, organizationName, unitName, localityName, provinceName, countryName, keyAlgorithm, keySize",
"name": "Generate TLS certificate request",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-Host-Priv: G,E - TLS-Host- Pub: G - SPK: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "RSAKeyGe n AES Encryption RSASigGe n RBG Entropy Entropy Conditioner TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Update TLS and",
"indicator": "Success Service_restart_in_prog",
"inputs": "Ca cert, Server cert,",
"name": "update TLS certificate",
"outputs": "msg, status",
"rolesSspAccess": "Operator - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM"
},
{
"description": "root certificate",
"indicator": "ress Error Management operation failed",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "TLS-AES- Decrypt- GCM"
},
{
"description": "VSM managem ent ervice web login",
"indicator": "Success: Login successfully. Error: Management operation failed",
"inputs": "Password - NOT a FIPS Password",
"name": "mgt login",
"outputs": "status",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "VSM managem ent ervice web logout",
"indicator": "Success: Logout successfully.",
"inputs": "N/A",
"name": "mgt logout",
"outputs": "status",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Display module\u0027s host hsm version, network, vsm list info",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "chsm info",
"name": "Display host hsm informatio n (Show Version)",
"outputs": "id, version, productName, productModel, hardwareVersion, ip, ntpaddr, ntpsyncperiod, imageuploadurl, syslogurl, vsmids, netaddr, dnslist, extensions",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Modify host hsm network configurati on",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "chsm network name, ip, mask, gateway",
"name": "Modify host hsm network configurati on",
"outputs": "status, message",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Start pre- operation al self- tests of host/hsm.",
"indicator": "Status: result 1-error, result 0-success.",
"inputs": "selfCheck",
"name": "start self- test",
"outputs": "The result of command \u0027selfCheck\u0027",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Modify vsm",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm network vsmId, ip, mask, gateway",
"name": "Modify vsm",
"outputs": "status, message",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "network configurati on",
"indicator": "",
"inputs": "",
"name": "network configurati on",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "View vsm info",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm info vsmId",
"name": "view vsm info",
"outputs": "status, msg ,result",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Start vsm",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm start vsmId",
"name": "Start vsm",
"outputs": "status, message",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Stop vsm",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm stop vsmId",
"name": "Stop vsm",
"outputs": "status, message",
"rolesSspAccess": "Unauthenticate d - SPK: Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z - User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z - hmackey for KTS-AES: Z - DRBG-EI: Z - DRBG-Seed: Z - DRBG-State: Z - TLS-MS: Z - TLS-SENC: Z - TLS-SMAC: Z",
"secFunImpl": ""
},
{
"description": "Create vsm",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm create vsmType vsmVer",
"name": "Create vsm",
"outputs": "status, message, vsmId",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Delete vsm",
"indicator": "Status: 4**/5**-error, 200-success.",
"inputs": "vsm delete vsmId",
"name": "Delete vsm",
"outputs": "status, message",
"rolesSspAccess": "Unauthenticate d - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z - User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z - hmackey_mast erkey: Z - Crypto Officer RSA public key: Z - TLS-Host-Priv: Z - TLS-Host-",
"secFunImpl": ""
},
{
"description": "Generate key using DRBG",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: A0, Mode, Key type, Key Scheme",
"name": "Key generatio n",
"outputs": "Key, keyHmac, Key check value",
"rolesSspAccess": "Pub: Z User Application - User AES-128 keys: G,R - User AES-192 keys: G,R - User AES-256 keys: G,R",
"secFunImpl": "SymKeyGe n KTS-AES- Wrap RBG Entropy Entropy Conditioner"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User HMAC keys: G,R - LMK: E - hmackey for KTS-AES: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Encrypt data using a symmetric key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: DF,Algorithm flag, Mode flag, Key Type, Key, keyHmac, Key 2, Key2Hmac, Padding mode, IV, Data length, Data,",
"name": "Data encryption",
"outputs": "Cipher data length, Cipher data",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "AES Encryption AES Encryption- XTS KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Decrypt data using a symmetric key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code:DH, Algorithm flag, Mode flag, Key Type, Key, keyHmac, Key 2, Key2Hmac, Padding mode, IV, Data length, Data,",
"name": "Data decryption",
"outputs": "Plain data length, Plain data",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for",
"secFunImpl": "AES Decryption AES Decryption- XTS KTS-AES- UnWrap TLS-AES- Encrypt- GCM"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KTS-AES: E - TLS-SENC: E",
"secFunImpl": "TLS-AES- Decrypt- GCM"
},
{
"description": "Encrypt data using AES-GCM",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TO, Algorithm flag, Mode flag, Key Type, Key, tag length, AAD Length, AAD, Data Length, Data",
"name": "AES GCM Data encryption",
"outputs": "Cipher data length, Cipher data, tag length, Tag, IV Length, Iv",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "AES Encryption- Auth KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Decrypt data using AES-GCM",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TP, Algorithm flag, Mode flag, Key Type, Key, IV length, IV, AAD Length, AAD, tag length, Tag, Cipher data length, Cipher data",
"name": "AES GCM Data decryption",
"outputs": "Authentication status, Data Length, Data",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "AES Decryption- Auth KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Decrypt data using AES-CCM",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TS, Algorithm flag, Mode flag, Key Type, Key, Nonce length, Nonce, Adata length, Adata, TagLen, Tag, Cipher",
"name": "AES CCM Data decryption",
"outputs": "Authentication status, Plain data length, Plain data",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256",
"secFunImpl": "AES Decryption- Auth KTS-AES- UnWrap TLS-AES- Encrypt-"
},
{
"description": "",
"indicator": "",
"inputs": "data length, Cipher data",
"name": "",
"outputs": "",
"rolesSspAccess": "keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Encrypt data using AES-CCM",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TR, Algorithm flag, Mode flag, Key Type, Key, Nonce Length, Nonce, Adata Length, Adata, Payload data length, Payload data",
"name": "AES CCM Data encryption",
"outputs": "Cipher data length, Cipher data, tag length, Tag",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "AES Encryption- Auth KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate and verify CMAC",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TQ,Mode, Algorithm flag, Key type, Key, CMAC length, Mac, Data length, Data",
"name": "CMAC generatio n and verificatio n",
"outputs": "CMAC Length, CMAC",
"rolesSspAccess": "User Application - User AES-128 keys: E,W - User AES-192 keys: E,W - User AES-256 keys: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "AES-CMAC KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Genarate HMAC",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: XE, Algorithm type, Key type, Key, Data length, Data,",
"name": "HMAC generatio n",
"outputs": "HMAC Length, HMAC",
"rolesSspAccess": "User Application - LMK: E - hmackey for KTS-AES: E",
"secFunImpl": "HMACGen KTS-AES- UnWrap TLS-AES- Encrypt-"
},
{
"description": "Generate RSA key pair",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: EI, Key type, Key length, Public key encoding, Public exponent length, Public exponent,",
"name": "RSA key pair generatio n",
"outputs": "Public key, Secret key length, Secret key, keyHmac",
"rolesSspAccess": "keys: E,W - TLS-SENC: E User Application - User RSA- priv: G,R - User RSA- pub: G,R - LMK: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E",
"secFunImpl": "TLS-AES- Decrypt- GCM RSAKeyGe n KTS-AES- Wrap TLS-AES- Encrypt- GCM RBG Entropy Entropy Conditioner TLS-AES- Decrypt- GCM"
},
{
"description": "Export RSA public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: EJ, Key index",
"name": "RSA public key export",
"outputs": "Public key",
"rolesSspAccess": "User Application - User RSA- pub: R - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Encrypt data using RSA public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: ER, Algorithm Identifiers, Pad Mode, Data length, Message data, Delimiter, Key index, Public key",
"name": "RSA public key encryption",
"outputs": "Encrypted data length, Encrypted data",
"rolesSspAccess": "User Application - User RSA- pub: E,W - TLS-SENC: E",
"secFunImpl": "KTS-RSA- Encap TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Decrypt data using RSA private key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: EP, Algorithm Identifiers, Pad Mode, Data length, Message data, Delimiter, Key index, Private key length, Private key",
"name": "RSA private key decryption",
"outputs": "Decrypted data length, Decrypted data",
"rolesSspAccess": "User Application - User RSA- priv: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "KTS-RSA- Decap KTS-AES- UnWrap TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Generate signature for data",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: EW, HASH Algorithm Identifiers, Signature Algorithm Identifiers, Padding mode, Data length, Message data, Delimiter, Key index, Private key length, Private key",
"name": "RSA digital signature generatio n",
"outputs": "Signature data length, Signature data",
"rolesSspAccess": "User Application - User RSA- priv: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "RSASigGe n KTS-AES- UnWrap TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Signature verificatio n",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: EY, HASH Algorithm Identifiers, Signature Algorithm Identifiers, Pad mode,saltlen, Signature data length, Signature data, Delimiter, Data length, Message data, Delimiter, Key index, Public key",
"name": "RSA digital signature verificatio n",
"outputs": "Error code",
"rolesSspAccess": "User Application - User RSA- pub: E,W - TLS-SENC: E",
"secFunImpl": "RSASigVer TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Generate ECDSA key pair",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TA, Curve flag, Modulus length",
"name": "ECDSA key pair",
"outputs": "Public key length, Public key, Secret",
"rolesSspAccess": "User Application - User ECDSA-",
"secFunImpl": "ECDSAKey Gen Entropy"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "generatio n",
"outputs": "key length, Secret key, keyHmac",
"rolesSspAccess": "priv: G,R - User ECDSA- pub: G,R - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E",
"secFunImpl": "RBG KTS-AES- Wrap TLS-AES- Encrypt- GCM Entropy Conditioner TLS-AES- Decrypt- GCM"
},
{
"description": "Export ECDSA public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TH, Key index",
"name": "ECDSA public key export",
"outputs": "Curve flag, Key Bite Length, Public key length, Public key",
"rolesSspAccess": "User Application - User ECDSA- pub: R - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate signature for data",
"indicator": "Data out-success. No data output-error",
"inputs": "Command doce:TB, HASH Flag, Data block length, Data, End message delimiter, Key index, Curve flag, Modulus length, Private key cipher length, Private Key",
"name": "ECDSA digital signature generatio n",
"outputs": "Signature data length, Signature data",
"rolesSspAccess": "User Application - User ECDSA- priv: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "ECDSASig Gen KTS-AES- UnWrap TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Signature verificatio n",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TC, HASH flag, Signature length, Signature, Delimiter, Data length, Message data, Delimiter, Key index,",
"name": "ECDSA digital signature verificatio n",
"outputs": "Error code",
"rolesSspAccess": "User Application - User ECDSA- pub: E,W - TLS-SENC: E",
"secFunImpl": "ECDSASig Ver TLS-AES- Decrypt- GCM TLS-AES-"
},
{
"description": "",
"indicator": "",
"inputs": "Curve flag, Modulus length, Public key length, Public key",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Encrypt- GCM"
},
{
"description": "Generate ML-DSA key pair",
"indicator": "Data out-success. No data output-error",
"inputs": "None",
"name": "ML-DSA key pair generatio n",
"outputs": "Public key and private key",
"rolesSspAccess": "User Application - User MLDSA- priv: G,R - User MLDSA- pub: G,R - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E - ML-DSA seed: G,E",
"secFunImpl": "KTS-AES- Wrap ML-DSA KeyGen TLS-AES- Encrypt- GCM RBG Entropy Entropy Conditioner TLS-AES- Decrypt- GCM"
},
{
"description": "Export ML-DSA public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TJ, Key index",
"name": "ML-DSA public key export",
"outputs": "level flag, Public key length, Public key",
"rolesSspAccess": "User Application - User MLDSA- pub: R - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate signature for data",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TK, Hash Flag, Data length, Message data, Delimiter, Key index, Level flag, Private key length, Private key",
"name": "ML-DSA digital signature generatio n (external function)",
"outputs": "Signature data length, Signature data",
"rolesSspAccess": "User Application - User MLDSA- priv: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E",
"secFunImpl": "ML-DSA SigGen External Pure ML-DSA SigGen External Pre-hash"
},
{
"description": "Signature verificatio n",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TL, Hash flag, Signature data length, Signature data, Delimiter, Data length, Message data, Delimiter, Key index, level flag, Public key length, Public key",
"name": "ML-DSA digital signature verificatio n (external function)",
"outputs": "Valid/invalid result",
"rolesSspAccess": "User Application - User MLDSA- pub: E,W - TLS-SENC: E",
"secFunImpl": "Decrypt- GCM ML-DSA SigVer External Pure ML-DSA SigVer External Pre-hash TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Generate ML-KEM key pair",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TU, level flag",
"name": "ML-KEM key pair generatio n",
"outputs": "Public key length, Public key, Secret key length, Secret key, keyHmac",
"rolesSspAccess": "User Application - User MLKEM- priv: G,R - User MLKEM- pub: G,R - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed:",
"secFunImpl": "KTS-AES- Wrap ML-KEM KeyGen TLS-AES- Encrypt- GCM RBG Entropy Entropy Conditioner TLS-AES-"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - DRBG-State: E - ML-KEM seed: E - ML-KEM shared secret key: E",
"secFunImpl": "Decrypt- GCM"
},
{
"description": "Export ML-KEM public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TV, Key index",
"name": "ML-KEM public key export",
"outputs": "level flag, Public key length, Public key",
"rolesSspAccess": "User Application - User MLKEM- pub: R - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Key encapsula tion",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TW, Data length, Message data, Delimiter, Key index, level flag, Public key length, Public key",
"name": "ML-KEM encapsula tion",
"outputs": "Encrypted data length, Encrypted data, Shared Key length, Shared Key, ciphertext",
"rolesSspAccess": "User Application - User MLKEM- pub: E,W - hmackey for KTS-AES: E - TLS-SENC: E - ML-KEM shared secret key: G,R",
"secFunImpl": "TLS-AES- Decrypt- GCM ML-KEM encapsulati on TLS-AES- Encrypt- GCM KTS-AES- Wrap"
},
{
"description": "Key decapsula tion",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: TX, Data length, Message data, Delimiter, Key index, level flag, Private key length, Private key, ciphertext",
"name": "ML-KEM decapsula tion",
"outputs": "Shared Key length, Shared Key",
"rolesSspAccess": "User Application - User MLKEM- priv: E,W - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E - ML-KEM",
"secFunImpl": "KTS-AES- UnWrap KTS-AES- Wrap ML-KEM decapsulati on TLS-AES- Encrypt-"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "shared secret key: G,R",
"secFunImpl": "GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Use DRBG generate SLH-DSA key pair",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: YA, mode, level flag, Hash mode",
"name": "SLH-DSA key pair generatio n",
"outputs": "Public key length, Public key, Secret key length, Secret key, keyHmac",
"rolesSspAccess": "User Application - User SLHDSA-priv: G,R - User SLHDSA-pub: G,R - LMK: E - hmackey for KTS-AES: E - TLS-SENC: E - DRBG-EI: E - DRBG-Seed: E - DRBG-State: E",
"secFunImpl": "KTS-AES- Wrap SLH-DSA KeyGen TLS-AES- Encrypt- GCM RBG Entropy Entropy Conditioner TLS-AES- Decrypt- GCM"
},
{
"description": "Export SLH-DSA public key",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: YB, Key index",
"name": "SLH -DSA public key export",
"outputs": "level flag, Public key length, Public key, Error code",
"rolesSspAccess": "User Application - User SLHDSA-pub: R - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate signature for data",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: YC, Hash Flag, Data length, Message data, Delimiter, Key index, Level flag, Private key length, Private key",
"name": "SLH -DSA digital signature generatio n",
"outputs": "Signature data length, Signature data",
"rolesSspAccess": "User Application - User SLHDSA-priv: E,W - LMK: E - hmackey for",
"secFunImpl": "KTS-AES- UnWrap SLH-DSA SigGen External Pure SLH-DSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KTS-AES: E - TLS-SENC: E",
"secFunImpl": "SigGen External Pre-hash TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Signature verificatio n",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: YD, Hash flag, Signature data length, Signature data, DelimiterData length, Message data, Delimiter, Key index, level flag, Public key length, Public key",
"name": "SLH -DSA digital signature verificatio n",
"outputs": "Error code",
"rolesSspAccess": "User Application - User SLHDSA-pub: E,W - TLS-SENC: E",
"secFunImpl": "SLH-DSA SigVer External Pure SLH-DSA SigVer External Pre-hash TLS-AES- Decrypt- GCM TLS-AES- Encrypt- GCM"
},
{
"description": "Generate hash for data",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code:3C, Hash identifier, Data length, Message data, User ID, length, User ID, Encoded, Public key",
"name": "Message digest",
"outputs": "Hash value",
"rolesSspAccess": "User Application - TLS-SENC: E",
"secFunImpl": "Hash TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Generate random data with DRBG",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: DR, Length",
"name": "Random number generatio n",
"outputs": "Random number",
"rolesSspAccess": "User Application - DRBG-EI: E - DRBG-Seed:",
"secFunImpl": "RBG Entropy Entropy Conditioner"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - DRBG-State: E - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "Get info for approved or non- approved mode",
"indicator": "Data out-success. No data output-error",
"inputs": "Command code: XA, flag:0",
"name": "Get FIPS status (Show Status)",
"outputs": "Status: 1: approved, 2: non- approved",
"rolesSspAccess": "User Application - TLS-SENC: E",
"secFunImpl": "TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM"
},
{
"description": "User applicatio n connect service and certAuth login",
"indicator": "No data output-error",
"inputs": "vsm ip, port, client pfx file, CA certificate, cipher suites",
"name": "tls connect",
"outputs": "sockfd, ssl handle",
"rolesSspAccess": "- TLS-ECDH- Priv: G,E,Z - TLS-ECDH- Pub: G,R,W,E,Z - TLS-PMS: G,E,Z - TLS-MS: G,E - TLS-SENC: G,E - TLS-SMAC: G,E - TLS-Host-Priv: E - TLS-Host- Pub: E - DRBG-EI: G - DRBG-Seed: G - DRBG-State: G",
"secFunImpl": "KAS-ECC TLSKDF TLS-HMAC TLS-AES- Encrypt- GCM TLS-AES- Decrypt- GCM ECDSAKey Gen RSASigGe n RSASigVer RBG Entropy Entropy Conditioner"
},
{
"description": "Descripti on",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "",
"secFunImpl": "SSP Access"
},
{
"description": "User applicatio n disconnec t service and certAuth logout",
"indicator": "N/A sockfd, ssl",
"inputs": "handle",
"name": "tls disconnec t",
"outputs": "N/A",
"rolesSspAccess": "",
"secFunImpl": "User Application - TLS-MS: Z - TLS-SENC: Z - TLS-SMAC: Z - DRBG-EI: Z - DRBG-Seed: Z - DRBG-State: Z"
},
{
"description": "Check hard disk write and read, control hard disk status LED",
"indicator": "Disk status LED (the 5th from front panel\u0027s left) blink",
"inputs": "Read and write signal",
"name": "check hard disk rw status",
"outputs": "LED status",
"rolesSspAccess": "",
"secFunImpl": "Unauthenticate d"
},
{
"description": "Check service running status, control service status LED",
"indicator": "service status LED (the 2nd from front panel\u0027s left) green/red",
"inputs": "Service path",
"name": "check service status (Show Status)",
"outputs": "Running status",
"rolesSspAccess": "",
"secFunImpl": "Unauthenticate d"
},
{
"description": "Check protection card status, control card status LED",
"indicator": "card status LED (the 1st from front panel\u0027s left) green/red",
"inputs": "Card info",
"name": "check card status (Show Status)",
"outputs": "Card status",
"rolesSspAccess": "",
"secFunImpl": "Unauthenticate d"
},
{
"description": "Check tamper status, control zeroized",
"indicator": "card status LED (the 1st from front panel\u0027s left) red-success.",
"inputs": "voltage signal",
"name": "check tamper status",
"outputs": "Zeroized card status/shutdown",
"rolesSspAccess": "Unauthenticate d - SPK: Z - DRBG-EI: Z - DRBG-Seed: Z - DRBG-State: Z - TLS-MS: Z - TLS-SENC: Z - TLS-SMAC: Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z - User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "keys: Z - User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z - hmackey for KTS-AES: Z",
"secFunImpl": ""
},
{
"description": "Check manual destructio n status, control zeroized",
"indicator": "card status LED (the 1st from front panel\u0027s left) red-success.",
"inputs": "voltage signal",
"name": "check manual destructio n status",
"outputs": "Zeroized card status/shutdown",
"rolesSspAccess": "Unauthenticate d - SPK: Z - DRBG-EI: Z - DRBG-Seed: Z - DRBG-State: Z - TLS-MS: Z - TLS-SENC: Z - TLS-SMAC: Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z - User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z - hmackey for KTS-AES: Z",
"secFunImpl": ""
},
{
"description": "Check self-test status, control service stop,start and poweroff.",
"indicator": "service status LED (the 2nd from front panel\u0027s left) green/red",
"inputs": "Self-test log path",
"name": "check self-test status",
"outputs": "Service stop/start result",
"rolesSspAccess": "Unauthenticate d",
"secFunImpl": "None"
},
{
"description": "Check temperatu re sensor, control module power off",
"indicator": "poweroff",
"inputs": "temperature value",
"name": "check temperatu re status",
"outputs": "Poweroff result",
"rolesSspAccess": "Unauthenticate d - SPK: Z - DRBG-EI: Z - DRBG-Seed: Z - DRBG-State: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS-MS: Z - TLS-SENC: Z - TLS-SMAC: Z - Root LMK: Z - LMK: Z - User RSA- priv: Z - User RSA- pub: Z - User ECDSA- priv: Z - User ECDSA- pub: Z - User MLDSA- priv: Z - User MLDSA- pub: Z - User MLKEM- priv: Z - User MLKEM- pub: Z - User SLHDSA-priv: Z - User SLHDSA-pub: Z - User AES-128 keys: Z - User AES-192 keys: Z - User AES-256 keys: Z - User HMAC keys: Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "Identity-based - The module uses a role selection mechanism, identifying roles and identities by obtaining an ID and type.",
"mechanism": "Challenge- response mechanism (RBG, RSASigVer) with the user\u0027s credentials (a 2048-bit RSA key pair (Cert #A6703) stored in the user\u0027s USB token).",
"name": "TokenAuthenticationMethod",
"perMinute": "The probability of successful authentication by guessing the private key is 2^-112 10^-33. The module performs RSA- 2048 signature verification internally, with each verification taking approximately 1ms (in practice, it may take longer). Since concurrent authentication is not supported, the maximum number of attempts per minute is capped at 60,000. Hence, the probability of success per minute is: 60000*2^-112 10^-29.",
"strength": "2048-bit RSA key pair. According to [SP800- 57],such a key provides a security strength of 112 bits. 2^-112 10^-33"
},
{
"description": "Identity-based - The module uses certificate CN and challenge- response",
"mechanism": "Challenge- response mechanism with the standard TLS protocol",
"name": "CertAuthenticationMethod",
"perMinute": "The module performs RSA- 2048 signature verification internally, with each",
"strength": "2048-bit RSA key pair. According to [SP800- 57],such a"
},
{
"description": "mechanism for user role authentication. (All certificates are issued by trusted Certificate Authorities).",
"mechanism": "(RBG, RSASigGen, RSASigVer) and user\u0027s credentials (a 2048-bit RSA key pair (Cert #A6703) stored in the user\u0027s PKCS#12 (pfx) file).",
"name": "",
"perMinute": "verification taking approximately 1ms (in practice, it may take longer). The maximum number of attempts per minute is capped at 60,000. The probability of success per minute is: 60000*2^-112 10^-29.",
"strength": "key provides a security strength of 112 bits. 2^-112 10^-33"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "ENT",
"condition": "When entropy is requested",
"details": "An RCT and APT as specified in [90B] section 4.4 are executed before generation of the DRBG entropy input",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "SP 800-90B Health-Test",
"testProps": "RCT and APT",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Hash_DRBG - SHA3- 256 instantiation, generate, KATs performed before the first random data generation.",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "Hash_DRBG using SHA3-256 with PR",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES-256 CTR_DRBG, instantiation, generate, KATs performed before the first random data generation.",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "CTR_DRBG using AES-256, without DF",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES ECB encrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES ECB decryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES ECB decrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CBC encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CBC encrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CBC decryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CBC decrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CTR encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CTR encrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CTR decryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CTR decrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CCM encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CCM encrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CCM decryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CCM decrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES GCM Authenticated encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES GCM encrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES GCM Authenticated decryption",
"indicator": "LCD shows Success or Failure",
"testMethod": "KAT",
"testProps": "AES GCM decrypt with 128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Code/Error log also show info.",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES-CMAC (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES CMAC Message Authenticated",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES CMAC with 128- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Key Uniqueness",
"condition": "After key generation and before XTS encryption",
"details": "Generate two 128bits keys and Compare Key1Key2",
"indicator": "Error log show info",
"testMethod": "Comparison Test",
"testProps": "Generate two 128bits keys and compare",
"type": "Critical Function"
},
{
"algorithmOrTest": "AES-XTS (A6703) encrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES XTS encryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES XTS with two 128- bit keys, encryption",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS (A6703) decrypt",
"condition": "Bootup/When a periodic interval is reached",
"details": "AES XTS decryption",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES XTS with two 128- bit keys, decryption",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Code/Error log also show info.",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SHA2-384 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-224 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA3-224",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA3-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-384 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA3-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-512 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Digest",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA3-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "HMAC-SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 224 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "HMAC-SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "HMAC-SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "HMAC-SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Message Authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "HMAC-SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature generation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ECDSA with P-256 and SHA2-512, signature generation",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature verification",
"indicator": "LCD shows Success or Failure",
"testMethod": "KAT",
"testProps": "ECDSA with P-256 and SHA2-512, signature verification",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Code/Error log also show info.",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature generation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "RSA PSS with 2048-bit key and SHA2-256, signature generation",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "RSA PSS with 2048-bit key and SHA2-256, signature verification",
"type": "CAST"
},
{
"algorithmOrTest": "ML-DSA SigGen (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature generation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ML-DSA (ML-DSA-44) with SHA2-512, signature generation",
"type": "CAST"
},
{
"algorithmOrTest": "ML-DSA SigVer (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ML-DSA (ML-DSA-44) with SHA2-512, signature verification",
"type": "CAST"
},
{
"algorithmOrTest": "ML-KEM KeyGen (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "ML-KEM keypair generation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ML-KEM-512 keypair generation",
"type": "CAST"
},
{
"algorithmOrTest": "ML-KEM EncapDecap (A6703) Encap",
"condition": "Bootup/When a periodic interval is reached",
"details": "Key encapsulation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ML-KEM(ML-KEM-512) with encapsulation",
"type": "CAST"
},
{
"algorithmOrTest": "ML-KEM EncapDecap (A6703) Decap",
"condition": "Bootup/When a periodic interval is reached",
"details": "Key decapsulation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "ML-KEM(ML-KEM-512) with decapsulation",
"type": "CAST"
},
{
"algorithmOrTest": "SLH-DSA SigGen (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature generation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SLH-DSA(SLH-DSA- SHAKE-128s) with SHAKE-256 and SLH- DSA(SLH-DSA-SHA2- 128s) with SHA2-512, signature generation",
"type": "CAST"
},
{
"algorithmOrTest": "SLH-DSA SigVer (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Signature verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SLH-DSA(SLH-DSA- SHAKE-128s) with SHAKE-256 and SLH- DSA(SLH-DSA-SHA2- 128s) with SHA2-512, signature verification",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-RSA Encap",
"condition": "Bootup/When a periodic interval is reached",
"details": "2048-bit RSA-OAEP encryption with SHA2- 256",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "RSA with 2048-bit key encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-RSA Decap",
"condition": "Bootup/When a periodic interval is reached",
"details": "2048-bit RSA-OAEP decrypt with SHA2- 256",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "RSA with 2048-bit key decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800- 108 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "KBKDF with HMAC- SHA2-256 as PRF options",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "Counter mode with HMAC-SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-AES ECB and HMAC",
"condition": "Bootup/When a periodic interval is reached",
"details": "Key Transport with 256bit AES-ECB encryption and HMAC-SHA2-256 authentication",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "AES-ECB and HMAC",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "Key Agreement with P-256, P-384, P-521, SHA2-256 Shared Secret Calculation",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "Shared Secret Calculation",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A6703)",
"condition": "Bootup/When a periodic interval is reached",
"details": "TLS 1.2 KDF (Revision RFC7627) with SHA2-256 as PRF",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "TLS 1.2",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) PCT",
"condition": "On generation",
"details": "Key pairs generation for signature generation, verification, and KAS",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "PCT",
"testProps": "PCT using SHA2-256, signature generation and verification",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) PCT",
"condition": "On generation",
"details": "Key pairs generation for signature generation and verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "PCT",
"testProps": "PCT using SHA2-256, signature generation and verification. PCT using public key encryption and private key decryption.",
"type": "PCT"
},
{
"algorithmOrTest": "ML-DSA KeyGen PCT",
"condition": "On generation",
"details": "Key pairs generation for signature generation and verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "PCT",
"testProps": "PCT using SHA2-512, signature generation and verification",
"type": "PCT"
},
{
"algorithmOrTest": "ML-KEM KeyGen PCT",
"condition": "On generation",
"details": "Key pairs generation for encapsulation and decapsulation.",
"indicator": "LCD shows Success or Failure",
"testMethod": "PCT",
"testProps": "PCT using encapsulation and decapsulation",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Code/Error log also show info.",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SLH-DSA KeyGen PCT",
"condition": "On generation",
"details": "Key pairs generation for signature generation and verification",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "PCT",
"testProps": "PCT using SHA2-512, signature generation and verification",
"type": "PCT"
},
{
"algorithmOrTest": "SLH-DSA KeyGen CAST with SHA2",
"condition": "Bootup/When a periodic interval is reached",
"details": "SLH-DSA KeyGen KAT using SHA2",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA2-128",
"type": "CAST"
},
{
"algorithmOrTest": "SLH-DSA KeyGen CAST with SHAKE",
"condition": "Bootup/When a periodic interval is reached",
"details": "SLH-DSA KeyGen KAT using SHAKE",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHAKE-128",
"type": "CAST"
},
{
"algorithmOrTest": "ML-DSA KeyGen KAT",
"condition": "LCD shows Success or Failure Code/Error log also show info.",
"details": "ML-DSA KeyGen KAT using SHA2",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "The Module enters the Integrity error state",
"description": "The Module fails the firmware integrity pre- operational self-test.",
"indicator": "LCD Outputs status: \"[alg]:crc32][result]:[1]\"indicates Integrity error; \"[alg]:crc32][result]:[0]\"indicates Integrity success.",
"name": "Integrity Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ENT error state",
"description": "The Module fails in ENT RCT and APT in pre- operational or conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:ENT][result]:[1]\"indicates ENT error; \"[alg]:ENT][result]:[0]\"indicates ENT success.",
"name": "ENT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the AES error state",
"description": "The Module fails in one of the AES KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:AES][result]:[1]\"indicates AES error; \"[alg]:AES][result]:[0]\"indicates AES success.",
"name": "AES Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the RSA error state",
"description": "The Module fails in one of the RSA KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:RSA][result]:[1]\"indicates RSA error; \"[alg]:RSA][result]:[0]\"indicates RSA success.",
"name": "RSA Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ECDSA error state",
"description": "The Module fails in one of the ECDSA KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:ECDSA][result]:[1]\"indicat es ECDSA error; \"[alg]:ECDSA][result]:[0]\"indicat es ECDSA success.",
"name": "ECDSA Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ML-DSA error state",
"description": "The Module fails in one of the ML- DSA KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:ML- DSA][result]:[1]\"indicates ML- DSA error; \"[alg]:ML- DSA][result]:[0]\"indicates ML- DSA success.",
"name": "ML-DSA Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ML-KEM error state",
"description": "The Module fails in one of the ML- KEM KATs in",
"indicator": "LCD Outputs status: \"[alg]:ML- KEM][result]:[1]\"indicates ML- KEM error; \"[alg]:ML- KEM][result]:[0]\"indicates ML- KEM success.",
"name": "ML-KEM Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "",
"description": "conditional self-test.",
"indicator": "",
"name": "",
"recoveryMethod": ""
},
{
"conditions": "The Module enters the SLH-DSA error state",
"description": "The Module fails in one of the SLH- DSA KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:SLHDSA][result]:[1]\"indica tes SLHDSA error; \"[alg]:SLHDSA][result]:[0]\"indica tes SLHDSA success.",
"name": "SLH-DSA Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the SHS error state",
"description": "The Module fails in one of the SHS KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:HASH][result]:[1]\"indicates HASH error; \"[alg]:HASH][result]:[0]\"indicates HASH success.",
"name": "HASH Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the HMAC error state",
"description": "The Module fails in one of the HMAC KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:HMAC][result]:[1]\"indicate s HMAC error; \"[alg]:HMAC][result]:[0]\"indicate s HMAC success.",
"name": "HMAC Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the KBKDF error state",
"description": "The Module fails in one of the KBKDF KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:KBKDF][result]:[1]\"indicate s KBKDF error; \"[alg]:KBKDF][result]:[0]\"indicate s KBKDF success.",
"name": "KBKDF Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the KTS-RSA error state",
"description": "The Module fails in one of the KTS- IFC KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:KTS- RSA][result]:[1]\"indicates KTS- RSA error; \"[alg]:KTS- RSA][result]:[0]\"indicates KTS- RSA success.",
"name": "KTS-RSA Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the KTS-AES error state",
"description": "The Module fails in one of the KTS- AES KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:KTS- AES][result]:[1]\"indicates KTS- AES error; \"[alg]:KTS- AES][result]:[0]\"indicates KTS- AES success.",
"name": "KTS-AES Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the KAS-SSC error state",
"description": "The Module fails in one of the KAS- SSC KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:KAS- SSC][result]:[1]\"indicates KAS- SSC error; \"[alg]:KAS- SSC][result]:[0]\"indicates KAS- SSC success.",
"name": "KAS-SSC Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the TLS KDF error state",
"description": "The Module fails in one of the TLS KDF KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:TLS- KDF][result]:[1]\"indicates TLS- KDF error; \"[alg]:TLS- KDF][result]:[0]\"indicates TLS- KDF success.",
"name": "TLS-KDF Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the DRBG error state",
"description": "The Module fails in one of the DRBG KATs in conditional self-test.",
"indicator": "LCD Outputs status: \"[alg]:DRBG][result]:[1]\"indicate s SRBG error; \"[alg]:DRBG][result]:[0]\"indicate s DRBG success.",
"name": "Random Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the RSA PCT error state",
"description": "The Module fails in the PCT performed after a RSA key generation",
"indicator": "Outputs status of RSA PCT error, otherwise it indicates successful completion by RSA PCT success.",
"name": "RSA PCT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ECDSA PCT error state",
"description": "The Module fails in the PCT performed after an ECDSA key generation.",
"indicator": "Return 1 indicates ECDSA PCT error, return 0 indicates ECDSA PCT success.",
"name": "ECDSA PCT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ML-DSA PCT error state",
"description": "The Module fails in the PCT performed after an ML- DSA key generation.",
"indicator": "Return 1 indicates MLDSA PCT error, return 0 indicates MLDSA PCT success.",
"name": "ML-DSA PCT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the ML-KEM PCT error state",
"description": "The Module fails in the PCT performed after an ML- KEM key generation.",
"indicator": "Return 1 indicates MLKEM PCT error, return 0 indicates MLKEM PCT success.",
"name": "ML-KEM PCT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "The Module enters the SLH-DSA PCT error state",
"description": "The Module fails in the PCT performed after an SLH-DSA",
"indicator": "Return 1 indicates SLHDSA PCT error, return 0 indicates SLHDSA PCT success.",
"name": "SLH-DSA PCT Error",
"recoveryMethod": "Reboot/Pow er cycle the module"
},
{
"conditions": "",
"description": "key generation.",
"indicator": "",
"name": "",
"recoveryMethod": ""
},
{
"conditions": "The Module enters the VSM initialization error state",
"description": "The Module fails in VSM initialization",
"indicator": "VSM management service Outputs status of initialization error, otherwise it indicates successful completion by initialization success.",
"name": "VSM initialization Error",
"recoveryMethod": "Reinitialize VSM"
},
{
"conditions": "The Module enters the CO authenticatio n error state",
"description": "The Module fails in VSM CO authenticatio n",
"indicator": "VSM management service Outputs status of authentication error, otherwise it indicates successful completion by authentication success.",
"name": "CO authenticatio n error",
"recoveryMethod": "Re- authenticate"
},
{
"conditions": "The Module enters the vsm csp entry error state",
"description": "The Module fails in entry csp to VSM.",
"indicator": "VSM management service Outputs status of csp entry error, otherwise it indicates successful completion by csp entry success.",
"name": "vsm csp entry error",
"recoveryMethod": "Re-entry"
},
{
"conditions": "The Module enters the vsm cryptographi c service error state",
"description": "The Module fails in VSM calling cryptographi c service in user state",
"indicator": "No data outputs when cryptographic service error and record log, otherwise it return data when success.",
"name": "vsm calling cryptographi c service error",
"recoveryMethod": "Re-calling cryptographi c service"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "monthly",
"inspectGuidance": "Look for signs of tampering. If tampering is suspected, then the module must be removed from service.",
"mechanism": "Tamper- Evident Seals"
},
{
"inspectFreq": "monthly",
"inspectGuidance": "The module includes a tamper detection and response circuitry in the event the enclosure is ever opened. When the chassis cover is opened, the tamper switch is triggered, SPK in card is zeroized, and then the module power off, Z1 power-off zeroing was triggered simultaneously, zeroizing unprotected SSPs stored in the RAM. After the module restarts, all VSM service cannot be started.",
"mechanism": "Tamper- Response switch"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Enter this mode either after first- time use and initialization, or after switching and initializing via the VSM management program by selecting \"Set Approved Mode\". The current mode status can be viewed in the VSM management service or cryptographic service. When the module is running in approved mode of operation, only approved services are available.",
"name": "approved mode",
"statusIndicator": "The module uses a global indicator for that supports approved services in an approved manner or non- approved services in a non- approved manner. Explicitly indicate the current mode status using static code. The user will know that the Module is in approved mode or non-approved mode by: 1) Using the \"view approved mode\" function in the management console. It will show \"approved mode\" or \"non- approved mode\". 2) By external entities (e.g., user applications) that connect through the network, using the service \"Get FIPS status \". The indicator of approved mode is obtained by using the \u0027Get FIPS status\u0027 service. The \u0027Status\u0027 field of the \u0027Get FIPS status\u0027 service indicates the mode. The value of the parameter \u0027Status\u0027 passed into the call specifies the mode.",
"type": "Approved"
},
{
"description": "",
"name": "",
"statusIndicator": "The following values are allowed for the parameter: 1 - approved mode.",
"type": ""
},
{
"description": "Enter this mode after switching and initializing by selecting \"Set non-approved Mode\" through the VSM management program. The current mode status can be viewed in the VSM management service or cryptographic service. Once the mode is switched, the module will compulsorily perform the initialization operation to ensure that the SSPs are not shared between approved and non-approved mode of operation. NOTE: All non-approved services are only available in non- approved mode. NOTE: All services included in SP section 4.3 Approved Services and Approved SSPs in SP section 9.4 SSPs are available in non- approved mode. These services are considered non-approved services.",
"name": "non- approved mode",
"statusIndicator": "The module uses a global indicator for that supports approved services in an approved manner or non- approved services in a non- approved manner. Explicitly indicate the current mode status using static code. The user will know that the Module is in approved mode or non-approved mode by: 1) Using the \"view approved mode\" function in the management console. It will show \"approved mode\" or \"non- approved mode\". 2) By external entities (e.g., user applications) that connect through the network, using the service \"Get FIPS status \". The indicator of approved mode is obtained by using the \u0027Get FIPS status\u0027 service. The \u0027Status\u0027 field of the \u0027Get FIPS status\u0027 service indicates the mode. The value of the parameter \u0027Status\u0027 passed into the call specifies the mode. The following values are allowed for the parameter: 2 - non- approved mode.",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric Curve Type:secp256k1 (128-bits)",
"implName": "csmsc1",
"name": "ECDSA_secp256K1",
"reference": "IG C.A SP800-186 H.2"
},
{
"algoPropList": "Key Type:Asymmetric Curve Type:brainpoolP224r1 (112- bits), brainpoolP256r1 (128-bits), brainpoolP320r1 (160-bits), brainpoolP384r1 (192-bits), brainpoolP512r1 (256-bits), brainpoolP224t1 (112-bits), brainpoolP256t1 (128-bits), brainpoolP320t1 (160-bits), brainpoolP384t1 (192-bits), brainpoolP512t1 (256-bits)",
"implName": "csmsc1",
"name": "ECDSA_Brainpool",
"reference": "IG C.A SP800-186 H.1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "SM2 [ISO/IEC14888- 3:2018]",
"use": "keySize:256 bit, function: Key Pair Generation, Signature Generation and Signature Verification, Data Encryption and Decryption"
},
{
"name": "SM3 [ISO/IEC10118- 3:2018]",
"use": "Message Digest"
},
{
"name": "SM4 [ISO/IEC18033-3]",
"use": "ECB/CBC keySize:128 bit, function: keygen, Data Encryption and Decryption"
},
{
"name": "Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"use": "ECB, CBC, OFB, CFB1, CFB8, CFB64, CMAC key sizes 128/192 bits (effective security strength is 112bits), function: keygen, Data Encryption and Decryption, CMAC Generation and Verification"
},
{
"name": "DSA [FIPS 186-4]",
"use": "L=1024, N=160 L=2048, N=224 L=2048, N=256 L=3072, N=256 function: Key Pair Generation\\Signature Generation\\Signature Verification"
},
{
"name": "RSA [FIPS 186-4]",
"use": "keySize:1024 bits. Function: Key Generation, Signature Generation"
},
{
"name": "ECIES",
"use": "P192/224/256/384/521, brainpoolP224/256/320/384/512r1, brainpoolP224/256/320/384/512t1 Elliptic Curve Integrated Encryption Scheme function: Data Encryption and Decryption"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Use DRBG generate SM2 key pair through the management program",
"name": "Generate SM2 key pair",
"role": "Administrator"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Delete SM2 key pair through the management program",
"name": "Delete SM2 key pair",
"role": "Administrator"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "View SM2 key status through the management program",
"name": "View SM2 key status",
"role": "Administrator, Auditor, Operator"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "Use DRBG generate symmetric key for SM4\\Triple- DES through the management program",
"name": "Generate symmetric key",
"role": "Administrator"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "Delete symmetric key for SM4\\Triple-DE through the management program",
"name": "Delete symmetric key",
"role": "Administrator"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "View symmetric key status through the management program",
"name": "View symmetric key status",
"role": "Administrator, Auditor, Operator"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "View symmetric key check value through the management program",
"name": "View symmetric key check value",
"role": "Administrator, Auditor, Operator"
},
{
"alg_accessed": "RSA [FIPS 186-4]",
"description": "Use DRBG generate RSA key pair through the management program",
"name": "Generate RSA key pair",
"role": "Administrator"
},
{
"alg_accessed": "RSA [FIPS 186-4]",
"description": "Delete RSA key pair through the management program",
"name": "Delete RSA key pair",
"role": "Administrator"
},
{
"alg_accessed": "RSA [FIPS 186-4]",
"description": "View RSA key status through the management program",
"name": "View RSA key status",
"role": "Administrator, Auditor, Operator"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "Use DRBG generate DSA key pair through the management program",
"name": "Generate DSA key pair",
"role": "Administrator"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "Delete DSA key pair through the management program",
"name": "Delete DSA key pair",
"role": "Administrator"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "View DSA key status through the management program",
"name": "View DSA key status",
"role": "Administrator, Auditor, Operator"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "Symmetric key generation for SM4\\ Triple-DES through the cryptographic service",
"name": "Key generation",
"role": "User Application"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "Encrypt data through the cryptographic service",
"name": "Data encryption",
"role": "User Application"
},
{
"alg_accessed": "SM4 [ISO/IEC18033-3] Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "Decrypt data through the cryptographic service",
"name": "Data decryption",
"role": "User Application"
},
{
"alg_accessed": "Triple-DES [SP800-67] [SP800-38A] [SP800- 38B]",
"description": "CMAC through the cryptographic service",
"name": "CMAC generation and verification",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Generate SM2 key pair through the cryptographic service",
"name": "SM2 key pair generation",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Export SM2 public key through the cryptographic service",
"name": "SM2 public key export",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "SM2 public key encrypt data through the cryptographic service",
"name": "SM2 public key encryption",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "SM2 private key decrypt data through the cryptographic service",
"name": "SM2 private key decryption",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Generate SM2 signature through the cryptographic service",
"name": "SM2 digital signature generation",
"role": "User Application"
},
{
"alg_accessed": "SM2 [ISO/IEC14888- 3:2018]",
"description": "Verify SM2 signature through the cryptographic service",
"name": "SM2 digital signature verification",
"role": "User Application"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "Generate DSA key pair through the cryptographic service",
"name": "DSA key pair generation",
"role": "User Application"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "Generate DSA signature through the cryptographic service",
"name": "DSA digital signature generation",
"role": "User Application"
},
{
"alg_accessed": "DSA [FIPS 186-4]",
"description": "Verify DSA signature through the cryptographic service",
"name": "DSA digital signature verification",
"role": "User Application"
},
{
"alg_accessed": "RSA [FIPS 186-4]",
"description": "Generate RSA key pair through the cryptographic service",
"name": "RSA key pair generation",
"role": "User Application"
},
{
"alg_accessed": "RSA [FIPS 186-4]",
"description": "Generate RSA signature through the cryptographic service",
"name": "RSA digital signature generation",
"role": "User Application"
},
{
"alg_accessed": "SM3 [ISO/IEC10118- 3:2018]",
"description": "SM3 digest through the cryptographic service",
"name": "Message digest",
"role": "User Application"
},
{
"alg_accessed": "ECIES",
"description": "ECIES public key encrypt data through the cryptographic service",
"name": "ECIES public key encryption",
"role": "User Application"
},
{
"alg_accessed": "ECIES",
"description": "ECIES private key decrypt data through the cryptographic service",
"name": "ECIES private key decryption",
"role": "User Application"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Machine Power On/Power Off",
"logicalInterface": "Control Input",
"physicalPort": "Power switch button"
},
{
"data": "Redundant power supply units, Power Input",
"logicalInterface": "Power",
"physicalPort": "Power inlet ports"
},
{
"data": "Show error state, processor info, network info, OS info.",
"logicalInterface": "Status Output",
"physicalPort": "LCD"
},
{
"data": "Show the working status of the Cryptographic Card",
"logicalInterface": "Status Output",
"physicalPort": "Cryptographic Card LED"
},
{
"data": "Show the working status of the machine",
"logicalInterface": "Status Output",
"physicalPort": "Machine working status LED"
},
{
"data": "Show the working status of the network interface, such as LAN1 and LAN2",
"logicalInterface": "Status Output",
"physicalPort": "Network Interface LED"
},
{
"data": "Show the working status of the hard disk",
"logicalInterface": "Status Output",
"physicalPort": "HDD status LED"
},
{
"data": "System power-on",
"logicalInterface": "Status Output",
"physicalPort": "Power On LED"
},
{
"data": "Input data: raw data, ciphertext or signature data, encryption key and other key management data, status information from external sources, other input data. Output data: raw data, ciphertext data and digital signatures, encryption key and other key management data, and other information output from the module after processing or storage Status out: Success or error status out.",
"logicalInterface": "Data Input Data Output Status Output",
"physicalPort": "Ethernet (RJ-45 ports/LC fiber ports)"
},
{
"data": "Serial management instruction; Management port",
"logicalInterface": "Control Input",
"physicalPort": "RS232"
},
{
"data": "Control signal",
"logicalInterface": "Control Input",
"physicalPort": "Active key destruction switch"
},
{
"data": "Display the startup status of the module",
"logicalInterface": "Status Output",
"physicalPort": "VGA"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "TokenAuthenticationMethod",
"name": "Administrator",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "TokenAuthenticationMethod",
"name": "Auditor",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "TokenAuthenticationMethod",
"name": "Operator",
"operatorType": "CO",
"type": "Identity"
},
{
"authMethodList": "CertAuthenticationMethod",
"name": "User Application",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "3",
"section": "1",
"title": "General"
},
{
"level": "3",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "3",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "3",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "3",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "3",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "3",
"section": "10",
"title": "Self-tests"
},
{
"level": "3",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "3",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Firmware integrity",
"details": "Executed on the whole HSM firmwares stored in HSM disk.",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "EDC",
"testProps": "CRC-32",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Firmware integrity_VSM",
"details": "Executed on the whole vsm firmwares stored in vsm disk.",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "EDC",
"testProps": "CRC-32",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "ENT_VSM",
"details": "An RCT and APT as specified in [90B] section 4.4 are executed before generation of the DRBG entropy input. (Note:HSM does not include ENT self-test)",
"indicator": "LCD shows Success or Failure Code/Error log also show info.",
"testMethod": "SP 800- 90B Health- Test",
"testProps": "RCT and APT",
"type": "Critical Function"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "System Memory (S1)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input unwrapped by AES KW (IO1)",
"sfiAlgo": "KTS-AES- UnWrap",
"source": "Application Software (outside)"
},
{
"dest": "Application Software (outside)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output wrapped by AES KW (IO2)",
"sfiAlgo": "KTS-AES- Wrap",
"source": "System Memory (S1)"
},
{
"dest": "System Memory (S1)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input decapsulated by RSA (IO3)",
"sfiAlgo": "KTS-RSA- Decap",
"source": "Application Software (outside)"
},
{
"dest": "Application Software (outside)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output encapsulated by RSA (IO4)",
"sfiAlgo": "KTS-RSA- Encap",
"source": "System Memory (S1)"
},
{
"dest": "Disk Drive (S4)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input unwrapped",
"sfiAlgo": "TLS-AES- Decrypt- GCM",
"source": "Application Software (outside)"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "by AES (IO5- 1)",
"sfiAlgo": "",
"source": ""
},
{
"dest": "Disk Drive (S5)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input unwrapped by AES (IO5- 2)",
"sfiAlgo": "TLS-AES- Decrypt- GCM",
"source": "Application Software (outside)"
},
{
"dest": "System Memory (S1)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input unwrapped by AES (IO5- 3)",
"sfiAlgo": "TLS-AES- Decrypt- GCM",
"source": "Application Software (outside)"
},
{
"dest": "Application Software (outside)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output wrapped by AES (IO6-1)",
"sfiAlgo": "TLS-AES- Encrypt- GCM",
"source": "Disk Drive (S4)"
},
{
"dest": "Application Software (outside)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output wrapped by AES (IO6-2)",
"sfiAlgo": "TLS-AES- Encrypt- GCM",
"source": "Disk Drive (S5)"
},
{
"dest": "Application Software (outside)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output wrapped by AES (IO6-3)",
"sfiAlgo": "TLS-AES- Encrypt- GCM",
"source": "System Memory (S1)"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroized that SSPs stored in volatile memory (RAM) and in card when the module is powered off. This can be triggered simultaneously by the shutdown operation in Z5 or stopping VSM in HSM.",
"method": "Z1",
"operatorId": "CO starts or stops the module",
"rationale": "Zeroized by Module power cycle or hard reset. by overwriting the storage of keys and CSPs (in card and in RAM) with \"zeros\"."
},
{
"description": "Zeroized when the module is switched from non-approved mode to approved mode, or vice versa.",
"method": "Z2",
"operatorId": "Adm role can change approved mode",
"rationale": "Zeroized by the \"Set Approved mode\" service by overwriting the storage of keys and CSPs (in disk, in card and in RAM) with \"zeros\"."
},
{
"description": "A user with the Administrator role can completely erase the contents of the module.",
"method": "Z3",
"operatorId": "Adm role can perform the initialization operation",
"rationale": "Zeroized by the \"zeroization\" service by overwriting the storage of keys and CSPs (in disk, in card and in RAM) with \"zeros\"."
},
{
"description": "A management service that performs the deletion of keys (such as deleting a specific key).",
"method": "Z4",
"operatorId": "Adm role can perform the deletion operation",
"rationale": "Zeroized when Crypto Officer deletes the key (user keys in disk and in RAM) through key management services. with \"zeros\" Delete RSA key pair, Delete ECDSA key pair, Delete PQC key pair, Delete symmetric key."
},
{
"description": "Zeroized when the tamper or key destruction switch is triggered, and then shutdown the module.",
"method": "Z5",
"operatorId": "N/A",
"rationale": "Zeroized when tamper detected, or key destruction switch activated. overwriting CSPs in protection card with \"zeros\",delete logfile and database tables."
},
{
"description": "Zeroized backup key in RAM; zeroized and delete backup file.\"",
"method": "Z6",
"operatorId": "Adm role can perform the backup/restore operation",
"rationale": "Zeroized when backup or restore keys finished, overwriting the backup key and backup file with \"zeros."
},
{
"description": "Zeroized TLS session key in RAM when close session. When zero function in OpenSSL does not provide a return status, if no error occurs when the function is called, it indicates that the zeroization operation was successful.",
"method": "Z7",
"operatorId": "N/A",
"rationale": "Zeroized when TLS session is terminated, overwriting with \"zeros\"."
},
{
"description": "Zeroized in RAM. When zero function in OpenSSL does not provide a return status, if no error occurs when the function is called, it indicates that the zeroization operation was successful.",
"method": "Z8",
"operatorId": "N/A",
"rationale": "Zeroized by OpenSSL internal methods (uninstantiate, free, cleanse) when no longer used, overwriting with \"zeros\"."
},
{
"description": "Zeroized SPK stored in protection card.",
"method": "Z9",
"operatorId": "Adm role can perform the operation",
"rationale": "Zeroized by DeleteSPK function, overwriting with \"zeros\"."
},
{
"description": "Zeroized the VSM disk file first, then removing the file.",
"method": "Z10",
"operatorId": "N/A",
"rationale": "Zeroized by deleting VSM (user keys in disk) in HSM with \"zeros\"."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Stored in module\u0027s volatile memory (RAM) in plain text.",
"name": "System Memory (S1)",
"persistance": "Dynamic"
},
{
"description": "Stored in Hard Drive Disk encrypted with the System Protection Key (SPK), algorithm is AES ECB with 256 bits (CAVP cert: #A6703).",
"name": "Disk Drive (S2)",
"persistance": "Static"
},
{
"description": "Stored in Protection Card\u0027s volatile memory (RAM) in plain text.",
"name": "Protection Card (S3)",
"persistance": "Dynamic"
},
{
"description": "Stored in Hard Drive Disk in plain text.",
"name": "Disk Drive (S4)",
"persistance": "Static"
},
{
"description": "Temporarily stored in Hard Drive Disk encrypted with Backup key, algorithm is AES ECB (CAVP cert: #A6703).",
"name": "Disk Drive (S5)",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "V4.5.2",
"hwVersion": "V4.5",
"modelPartNum": "Model: Sansec HSM Cryptographic Module Part Number(s): HI74S62- 2410",
"processors": "Intel Xeon Gold 5218"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type: Asymmetric and Symmetric",
"implName": "N/A",
"name": "CKG",
"reference": "SP800-133rev2 Section 4 Example 1 and IG D.H"
},
{
"algoPropList": "Key Type: Symmetric",
"implName": "N/A",
"name": "CKG- XTS",
"reference": "SP800-133rev2 Sections 6.3 #2 and IG C.I"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 2
},
"ECDH": {
"ECDH": 5
},
"ECDSA": {
"ECDSA": 46
},
"ECIES": {
"ECIES": 8
}
},
"FF": {
"DSA": {
"DSA": 30
}
},
"RSA": {
"RSA 2048": 1,
"RSA-OAEP": 2
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 6
},
"CCM": {
"CCM": 8
},
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 5
},
"ECB": {
"ECB": 9
},
"GCM": {
"GCM": 195
},
"OFB": {
"OFB": 2
},
"XTS": {
"XTS": 14
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 3
}
},
"crypto_protocol": {
"TLS": {
"TLS": {
"TLS": 38,
"TLS 1.2": 3,
"TLS v1.2": 23
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 7
},
"KEM": {
"KEM": 12
},
"KEX": {
"Key Exchange": 1
},
"MAC": {
"MAC": 17
}
},
"device_model": {},
"ecc_curve": {
"Brainpool": {
"brainpoolP224t1": 1,
"brainpoolP256r1": 1,
"brainpoolP256t1": 1,
"brainpoolP320r1": 1,
"brainpoolP320t1": 1,
"brainpoolP384r1": 1,
"brainpoolP384t1": 1,
"brainpoolP512r1": 1,
"brainpoolP512t1": 1
},
"NIST": {
"P-192": 2,
"P-224": 14,
"P-256": 26,
"P-384": 20,
"P-521": 22
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#2": 1
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 1,
"AES 256": 1,
"AES-128": 22,
"AES-192": 22,
"AES-256": 24,
"DSA-87": 4,
"HMAC-SHA-1": 8,
"PKCS 1": 1,
"PKCS#12": 2,
"RSA 2048": 1,
"SHA-1": 6,
"SHA-3": 1,
"SHA2": 4,
"SHA2- 256": 2,
"SHA2-224": 8,
"SHA2-256": 17,
"SHA2-384": 9,
"SHA2-512": 21,
"SHA3- 256": 1,
"SHA3- 512": 2,
"SHA3-224": 6,
"SHA3-256": 10,
"SHA3-384": 6,
"SHA3-512": 4
}
},
"fips_security_level": {
"Level": {
"Level 3": 3
}
},
"hash_function": {
"PBKDF": {
"PBKDF": 1
},
"SHA": {
"SHA1": {
"SHA-1": 6
},
"SHA2": {
"SHA2": 4
},
"SHA3": {
"SHA-3": 1,
"SHA3-224": 6,
"SHA3-256": 10,
"SHA3-384": 6,
"SHA3-512": 4
}
}
},
"ic_data_group": {},
"javacard_api_const": {
"curves": {
"SM2": 29
}
},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {
"FIPS": {
"ML-DSA": 57,
"ML-KEM": 57,
"MLDSA": 2,
"MLKEM": 2,
"SLH-DSA": 49,
"SLHDSA": 4
},
"PQC": {
"PQC": 8
}
},
"randomness": {
"PRNG": {
"DRBG": 28
},
"RNG": {
"RBG": 27,
"RNG": 1
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 11,
"FIPS 180-4": 5,
"FIPS 186-4": 15,
"FIPS 186-5": 8,
"FIPS 198-1": 9,
"FIPS 202": 7,
"FIPS 203": 2,
"FIPS 204": 3,
"FIPS 205": 3,
"FIPS PUB 140-3": 2,
"FIPS PUB 202": 1,
"FIPS140-3": 2,
"FIPS186-4": 3,
"FIPS186-5": 20
},
"ISO": {
"ISO/IEC 19790": 2,
"ISO/IEC 24759": 2,
"ISO/IEC10118-": 2,
"ISO/IEC14888-": 10,
"ISO/IEC18033-3": 8
},
"NIST": {
"NIST SP 800-57": 1,
"SP 800-135": 8,
"SP 800-227": 1,
"SP 800-90B": 3
},
"PKCS": {
"PKCS 1": 1,
"PKCS#12": 1
},
"RFC": {
"RFC7627": 4
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 147,
"AES-": 1,
"AES-128": 22,
"AES-192": 22,
"AES-256": 24
},
"CAST": {
"CAST": 105
}
},
"DES": {
"3DES": {
"TDEA": 1,
"Triple-DES": 11
},
"DES": {
"DES": 1
}
},
"constructions": {
"MAC": {
"CBC-MAC": 1,
"CMAC": 13,
"HMAC": 33
}
},
"miscellaneous": {
"SM4": {
"SM4": 9
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 8
}
},
"tls_cipher_suite": {
"TLS": {
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 4,
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 4,
"TLS_RSA_WITH_AES_128_GCM_SHA256": 4,
"TLS_RSA_WITH_AES_256_GCM_SHA384": 4
}
},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"RSA SigVer (FIPS186-5)A6703",
"SHA3-384A6703",
"ECDSA SigGen (FIPS186-5)A6703",
"SHA2-224A6703",
"AES-XTS Testing Revision 2.0A6703",
"ML-DSA SigVerA6703",
"SHA2-384A6703",
"HMAC-SHA2-512A6703",
"HMAC-SHA3-512A6703",
"KAS-ECC-SSC Sp800-56Ar3A6703",
"ML-DSA KeyGenA6703",
"SHA3-224A6703",
"ML-DSA SigGenA6703",
"AES-CCMA6703",
"SHA3-256A6704",
"ECDSA KeyVer (FIPS186-5)A6703",
"Hash DRBGA6703",
"AES-CFB128A6703",
"AES-OFBA6703",
"AES-CMACA6703",
"AES-CBCA6703",
"HMAC-SHA3-384A6703",
"HMAC-SHA2-256A6703",
"ECDSA KeyGen (FIPS186-5)A6703",
"SLH-DSA SigVerA6703",
"HMAC-SHA2-224A6703",
"Counter DRBGA6703",
"HMAC-SHA3-256A6703",
"ECDSA SigVer (FIPS186-4)A6703",
"RSA SigVer (FIPS186-4)A6703",
"ML-KEM KeyGenA6703",
"AES-CTRA6703",
"AES-CFB8A6703",
"RSA KeyGen (FIPS186-5)A6703",
"SHA2-512A6703",
"KTS-IFCA6703",
"KDF SP800-108A6703",
"HMAC-SHA2-384A6703",
"SHAKE-256A6703",
"AES-GCMA6703",
"RSA SigGen (FIPS186-5)A6703",
"SLH-DSA KeyGenA6703",
"TLS v1.2 KDF RFC7627A6703",
"SHAKE-128A6703",
"SHA3-512A6703",
"SHA-1A6703",
"AES-CFB1A6703",
"SHA2-256A6703",
"SLH-DSA SigGenA6703",
"AES-ECBA6703",
"ECDSA SigVer (FIPS186-5)A6703",
"HMAC-SHA-1A6703",
"ML-KEM EncapDecapA6703",
"HMAC-SHA3-224A6703"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6703",
"#A6704"
]
},
"policy_metadata": {
"/CreationDate": "D:20260817094552-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260817094552-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1659913,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 124
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "b7f3548077165b00a97b512c34e8e86a3c79063b21a319a75137162951d9a3f6",
"source_hash": "cbe743ef05f4ca67e4eeecde2a1a824fb4e5436e521f1531d8bdd4da0f876f71",
"txt_hash": "6cec03a77903f76cb23c993b76b345492eeded3452cb14da303cfc5dcc44e462"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode and installed, initialized and configured as specified in Section 11.1 Installation, Initialization, and Startup Procedures of the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
"date_sunset": "2031-08-24",
"description": "The Sansec HSM Cryptographic Module is a multi-chip standalone hardware cryptographic module that provides core functions such as device management, key management, and cryptographic services. The module delivers key storage and cryptographic services to external applications through virtual security modules (VSMs), including data encryption, data decryption, signature generation, signature verification, message digest, message authentication code (MAC), and random number generation.",
"embodiment": "MultiChipStand",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 3,
"mentioned_certs": {},
"module_name": "Sansec HSM Cryptographic Module",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-08-25",
"lab": "atsec information security corporation",
"validation_type": "Initial"
}
],
"vendor": "Sansec Technology Co., Ltd.",
"vendor_url": "http://en.sansec.com.cn"
}
}