{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "81792906f17d7bc4", "cert_id": 5546, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "Crypto Module for Intel\u00ae Core Ultra Series 1 (Meteor Lake) Converged Security and Manageability Engine (CSME)", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-10-07", "validation_type": "Initial", "lab": "atsec information security corporation"}], "vendor_url": "http://www.intel.com", "vendor": "Intel Corporation", "certificate_pdf_url": null, "module_type": "Firmware-Hybrid", "standard": "FIPS 140-3", "status": "active", "level": 2, "caveat": "When operated in approved mode. When installed, initialized and configured as specified in Section 11.2 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs", "exceptions": ["Operational environment: N/A", "Non-invasive security: N/A"], "embodiment": "SingleChip", "description": "The Crypto Module for Intel\u00ae Core Ultra Series 1 (Meteor Lake) Converged Security and Manageability Engine (CSME) is a firmware-hybrid module. The module consists of both hardware and firmware. The hardware portion is the Converged Security Engine (CSE) and the firmware portion is the crypto driver process of the Manageability Engine (ME). The two portions form the cryptographic boundary and they combine as Converged Security and Manageability Engine (CSME) to perform cryptographic functions within the Meteor Point PCH applications executing on the CSME OS.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-10-06", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 2": 3, "level 2": 1}}, "fips_certlike": {"Certlike": {"HMAC-SHA-1": 10, "HMAC-SHA-256": 10, "HMAC-SHA512": 2, "HMAC-SHA-384": 2, "SHA2-256": 10, "SHA2-384": 6, "SHA2-224": 5, "SHA2-512": 6, "SHA-1": 15, "SHA-224": 3, "SHA-384": 3, "SHA- 512": 2, "SHA- 256": 1, "SHA1": 1, "SHA -1": 1, "SHA-256": 5, "SHA-512": 1, "RSA 1": 3, "PKCS#1": 4, "AES-256": 4}}, "vendor": {}, "eval_facility": {"atsec": {"atsec": 41}}, "symmetric_crypto": {"AES_competition": {"AES": {"AES": 36, "AES-256": 4}, "CAST": {"CAST": 53}}, "miscellaneous": {"SM4": {"SM4": 3}}, "constructions": {"MAC": {"HMAC": 27, "HMAC-SHA-256": 5, "HMAC-SHA-384": 1, "CBC-MAC": 2}}}, "asymmetric_crypto": {"RSA": {"RSA-OAEP": 4}, "ECC": {"ECDH": {"ECDHE": 5, "ECDH": 5}, "ECDSA": {"ECDSA": 55}, "ECC": {"ECC": 29}}, "FF": {"DH": {"Diffie-Hellman": 4}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 15, "SHA1": 1}, "SHA2": {"SHA-224": 3, "SHA-384": 3, "SHA-256": 5, "SHA-512": 1}}, "MD": {"MD5": {"MD5": 15}}}, "crypto_scheme": {"MAC": {"MAC": 21}, "KA": {"Key Agreement": 2}}, "crypto_protocol": {}, "randomness": {"PRNG": {"DRBG": 39}, "RNG": {"RBG": 3}}, "cipher_mode": {"ECB": {"ECB": 1}, "CTR": {"CTR": 1}, "GCM": {"GCM": 1}}, "ecc_curve": {"NIST": {"P-256": 24, "P-384": 18, "secp256k1": 3}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {"SCA": {"DPA": 2, "timing attacks": 2}}, "device_model": {}, "tee_name": {"AMD": {"PSP": 3}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 54, "FIPS PUB 140-3": 1, "FIPS 186-5": 8, "FIPS186-5": 23, "FIPS 198-1": 6, "FIPS 186-4": 1, "FIPS 180-4": 6, "FIPS 1403": 1}, "NIST": {"SP 800-38A": 5, "SP 800-38B": 1, "SP 800-38D": 3, "SP 800-90B": 3, "SP 800-90A": 6, "SP 800-56A": 1, "SP 800-108": 1, "SP 800-56B": 2, "NIST SP 800-90C": 1, "SP 800-90C": 5, "SP 800-56C": 5, "NIST SP 800-57": 1}, "PKCS": {"PKCS#1": 2}}, "javacard_version": {}, "javacard_api_const": {"curves": {"SM2": 7}}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 711917, "pdf_is_encrypted": false, "pdf_number_of_pages": 43, "/Author": "Nathan Glass", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20260928121421-04'00'", "/ModDate": "D:20260928121421-04'00'", "/Producer": "Microsoft\u00ae Word for Microsoft 365", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://platformsw.intel.com/"]}}, "module_algorithms": {"_type": "Set", "elements": ["SHA2-512A5442", "HMAC-SHA2-256A7742", "SHA2-256A7742", "ECDSA KeyVer (FIPS186-5)A5442", "SHA2-384A5442", "AES-ECBA5442", "ECDSA SigVer (FIPS186-5)A5442", "AES-CBCA5442", "KTS-IFCA5442", "SHA-1A5442", "SHA2-224A5442", "ECDSA KeyGen (FIPS186-5)A5442", "RSA Decryption Primitive Sp800-56Br2A5442", "RSA SigGen (FIPS186-5)A5442", "HMAC-SHA2-224A5442", "AES-CMACA5442", "KAS-ECC Sp800-56Ar3A5442", "HMAC-SHA-1A5442", "KDF SP800-108A5442", "RSA SigVer (FIPS186-5)A5442", "Conditioning Component AES-CBC-MAC SP800-90BA5254", "HMAC-SHA2-512A5442", "HMAC-SHA2-384A5442", "AES-GCMA5442", "AES-CFB128A5442", "AES-CTRA5442", "ECDSA SigGen (FIPS186-5)A5442", "RSA KeyGen (FIPS186-5)A5442", "Counter DRBGA5442", "AES-OFBA5442", "RSA Signature PrimitiveA5442"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A5254", "#A5442", "#A7742"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "2"}, {"section": "2", "title": "Cryptographic module specification", "level": "2"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "2"}, {"section": "4", "title": "Roles, services, and authentication", "level": "2"}, {"section": "5", "title": "Software/Firmware security", "level": "2"}, {"section": "6", "title": "Operational environment", "level": "N/A"}, {"section": "7", "title": "Physical security", "level": "2"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "2"}, {"section": "10", "title": "Self-tests", "level": "2"}, {"section": "11", "title": "Life-cycle assurance", "level": "2"}, {"section": "12", "title": "Mitigation of other attacks", "level": "2"}, {"section": "", "title": "Overall Level", "level": "2"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"packageFileName": "Intel\u00ae Converged Security and Manageability Engine Crypto Driver", "swFwVersion": "6.0.0.2", "features": "N/A", "integrityTest": "See section 5.1"}]}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"modelPartNum": "Meteor Lake SoC-M die", "hwVersion": "C0", "fwVersion": "N/A", "processors": "N/A", "features": "Offload and Cryptography Subsystem with CSME ROM"}]}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "Intel\u00ae CSME OS 18", "hardwarePlatform": "Intel Core Ultra Series 1 H", "processors": "Intel\u00ae Meteor Lake H CSME Controller", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "6.0.0.2"}, {"operatingSystem": "Intel\u00ae CSME OS 18", "hardwarePlatform": "Intel Core Ultra Series 1 U", "processors": "Intel\u00ae Meteor Lake H CSME Controller", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "6.0.0.2"}, {"operatingSystem": "Intel\u00ae CSME OS 18", "hardwarePlatform": "Intel Core Ultra Series 1 U T4", "processors": "Intel\u00ae Meteor Lake H CSME Controller", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "6.0.0.2"}]}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": true, "entries": [{"name": "Approved mode", "description": "only approved or allowed security functions with sufficient security strength can be used", "type": "Approved", "statusIndicator": "fips_indicator=FIPS_APPROVED_SEC_FUN"}, {"name": "Non-approved mode", "description": "only non-approved security functions can be used", "type": "Non- Approved", "statusIndicator": "fips_indicator=NULL"}]}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CFB128", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CMAC", "cavpCertName": "A5442", "properties": "Direction - Generation, Verification Key Length - 128, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 0-16384 Increment 8", "reference": "SP 800-38B"}, {"algorithm": "AES-CTR", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes", "reference": "SP 800-38A"}, {"algorithm": "AES-ECB", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96", "reference": "SP 800-38D"}, {"algorithm": "", "cavpCertName": "", "properties": "Payload Length - Payload Length: 8, 112, 128, 256 AAD Length - AAD Length: 16, 64, 128, 256", "reference": ""}, {"algorithm": "AES-OFB", "cavpCertName": "A5442", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800-38A"}, {"algorithm": "Conditioning Component AES-CBC-MAC SP800-90B", "cavpCertName": "A5254", "properties": "Key Length - 256 Payload Length - Payload Length: 512", "reference": "SP 800-90B"}, {"algorithm": "Counter DRBG", "cavpCertName": "A5254", "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0 Returned Bits - 128", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "Counter DRBG", "cavpCertName": "A5442", "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 128 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0 Returned Bits - 128", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS186- 5)", "cavpCertName": "A5442", "properties": "Curve - P-256, P-384 Secret Generation Mode - testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA KeyVer (FIPS186-5)", "cavpCertName": "A5442", "properties": "Curve - P-256, P-384", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A5442", "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A5442", "properties": "Component - No Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384", "reference": "FIPS 186-5"}, {"algorithm": "HMAC-SHA-1", "cavpCertName": "A5442", "properties": "MAC - MAC: 32, 48, 64 Key Length - Key Length: 8-4096 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-224", "cavpCertName": "A5442", "properties": "MAC - MAC: 32, 48, 64 Key Length - Key Length: 8-4096 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A5442", "properties": "MAC - MAC: 32, 48, 64 Key Length - Key Length: 8-4096 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A7742", "properties": "MAC - MAC: 256 Key Length - Key Length: 256", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-384", "cavpCertName": "A5442", "properties": "MAC - MAC: 32, 48, 64 Key Length - Key Length: 8-4096 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-512", "cavpCertName": "A5442", "properties": "MAC - MAC: 32, 48, 64 Key Length - Key Length: 8-4096 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC Sp800-56Ar3", "cavpCertName": "A5442", "properties": "Domain Parameter Generation Methods - P-256, P-384 Function - Full Validation, Key Pair Generation iutId - 1234567890abcdef Scheme - ephemeralUnified - KAS Role - Initiator, Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-224 Fixed Info Pattern - uPartyInfo||vPartyInfo||literal[0123456789abcdef] Fixed Info Encoding - Concatenation Key Length - 1024", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF SP800-108", "cavpCertName": "A5442", "properties": "KDF Mode - Counter MAC Mode - HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 Supported Lengths - Supported Lengths: 8-256 Increment 8 Fixed Data Order - Before Fixed Data Counter Length - 32 Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0", "reference": "SP 800-108 Rev. 1"}, {"algorithm": "KTS-IFC", "cavpCertName": "A5442", "properties": "Function - keyPairGen IUT ID - 0123456789abcdef Modulo - 2048, 3072, 4096 Key Generation Methods - rsakpg1-basic Fixed Public Exponent - 010001 Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method - Hash Algorithms - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Supports Null Associated Data - No Associated Data Pattern - uPartyInfo||vPartyInfo Associated Data Encoding - concatenation Key Length - 256", "reference": "SP 800-56B Rev. 2"}, {"algorithm": "RSA Decryption Primitive Sp800-56Br2 (CVL)", "cavpCertName": "A5442", "properties": "Modulo - 2048, 3072, 4096 Key Format - Standard Public Exponent Mode - fixed Fixed Public Exponent - 010001", "reference": "SP 800-56B Rev. 2"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A5442", "properties": "Key Generation Mode - probable Modulo - 2048, 3072 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No", "reference": "FIPS 186-5"}, {"algorithm": "", "cavpCertName": "", "properties": "Private Key Format - standard Public Exponent Mode - fixed", "reference": ""}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A5442", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1", "reference": "FIPS 186-5"}, {"algorithm": "RSA Signature Primitive (CVL)", "cavpCertName": "A5442", "properties": "Private Key Format - standard Public Exponent Mode - fixed Fixed Public Exponent - 010001", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A5442", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed", "reference": "FIPS 186-5"}, {"algorithm": "SHA-1", "cavpCertName": "A5442", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-224", "cavpCertName": "A5442", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A5442", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A7742", "properties": "Message Length - Message Length: 128-4096 Increment 128", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-384", "cavpCertName": "A5442", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A5442", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "Cryptographic Key Generation (CKG)", "algoPropList": "Key Type:asymmetric", "implName": "N/A", "reference": "Key Generation Compliant with SP 800-133Rev2 section 4 example 1"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "MD5", "use": "Message Digest generation using MD5 algorithm"}, {"name": "SM2", "use": "SM2 digital signature generation/verification"}, {"name": "SM3", "use": "SM3 message digest generation"}, {"name": "SM4", "use": "SM4 data encryption and decryption"}, {"name": "HMAC-MD5", "use": "HMAC-MD5 MAC generation"}, {"name": "ECC Commit Computation", "use": "ECC commit computation used in ECSCHNORR and ECDAA Signature Generation"}, {"name": "ECDAA", "use": "ECDAA digital signature generation/verification"}, {"name": "ECSCHNORR", "use": "ECSCHNORR digital signature generation/verification"}, {"name": "AES-GCM", "use": "AES-GCM data encryption using an externally generated IV"}, {"name": "HMAC", "use": "HMAC MAC generation using with keys less than 112 bits"}, {"name": "ECDSA", "use": "ECDSA key-pair generation using secp256k1 curve"}, {"name": "ECDHE Shared Secret Computation", "use": "ECDHE shared secret computation using brainpoolp384r1 curve"}, {"name": "RSA", "use": "RSA key-pair generation using 1024 bits modulus size; RSA digital signature generation using MD5, SM3 or SHA-1 hash algorithm; RSA digital signature verification using MD5 or SM3 hash algorithm; RSA key encapsulation and decapsulation using MD5 or SHA-1; RSA key encapsulation and decapsulation using 1024-bit modulus; RSA key decapsulation using 3072 or 4096-bit modulus"}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "SRAM", "logicalInterface": "Data Input", "data": "All data (except control data entered via the control input interface) that is input to and processed by a cryptographic module"}, {"physicalPort": "SRAM", "logicalInterface": "Data Output", "data": "All data (except status data output via the status output interface and control data output via the control output interface) that is output from a cryptographic module"}, {"physicalPort": "SRAM", "logicalInterface": "Control Input", "data": "Control data used to control the operation of a cryptographic module"}, {"physicalPort": "SRAM", "logicalInterface": "Status Output", "data": "All status data used to indicate the status of a cryptographic module"}, {"physicalPort": "Provided by the underlying SoC/PCH", "logicalInterface": "Power", "data": "External electrical power that is input to a cryptographic module"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "User Authentication", "description": "RSASSA-PSS signature algorithm with 3072-bit modulus", "mechanism": "RSA SigVer (FIPS186-5) (A5442)", "strength": "1/2^128", "perMinute": "Less than or equal to 2,400 * 1/2^128"}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "User Role", "type": "Role", "operatorType": "User", "authMethodList": "User Authentication"}, {"name": "Crypto Officer Role", "type": "Role", "operatorType": "Crypto Officer", "authMethodList": "None"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "AES data encryption", "description": "Data Encryption using Advanced Encryption Standard algorithm", "indicator": "1", "inputs": "Key and Plaintext Data", "outputs": "Ciphertext Data", "secFunImpl": "Unauthenticated AES Authenticated AES", "rolesSspAccess": "User Role - AES keys: W,E,Z"}, {"name": "AES data decryption", "description": "Data Decryption using Advanced Encryption Standard algorithm", "indicator": "1", "inputs": "Key and Ciphertext Data", "outputs": "Plaintext Data", "secFunImpl": "Unauthenticated AES Authenticated AES", "rolesSspAccess": "User Role - AES keys: W,E,Z"}, {"name": "AES message authentication code generation", "description": "Message Authentication Code Generation using Advanced Encryption Standard algorithm", "indicator": "1", "inputs": "Key and Message", "outputs": "Message Authentication Code", "secFunImpl": "AES Message Authentication Code", "rolesSspAccess": "User Role - AES keys: W,E,Z"}, {"name": "AES message authentication code verification", "description": "Message Authentication Code Verification using Advanced Encryption Standard algorithm", "indicator": "1", "inputs": "Key and Message Authentication Code", "outputs": "True or False", "secFunImpl": "AES Message Authentication Code", "rolesSspAccess": "User Role - AES keys: W,E,Z"}, {"name": "HMAC message authentication code generation", "description": "Message Authentication Code Generation using Hashed Message Authentication Code algorithm", "indicator": "1", "inputs": "Key and Message", "outputs": "Message Authentication Code", "secFunImpl": "HMAC", "rolesSspAccess": "User Role - HMAC keys: W,E,Z"}, {"name": "RSA key-pair generation", "description": "Asymmetric Key Pair Generation", "indicator": "1", "inputs": "Key Size", "outputs": "RSA Key Pair", "secFunImpl": "Counter DRBG RSA KeyGen", "rolesSspAccess": "User Role - Module generated RSA public key: G,R - Module generated RSA private key (Including intermediate keygen values): G"}, {"name": "RSA public key validation", "description": "Public Key Validation of RSA public key", "indicator": "1", "inputs": "RSA Public Key", "outputs": "True or False", "secFunImpl": "None", "rolesSspAccess": "User Role - RSA public key: W,E,Z"}, {"name": "RSA digital signature generation", "description": "Digital Signature Generation using RSA", "indicator": "1", "inputs": "RSA Private Key and Message", "outputs": "Digital Signature", "secFunImpl": "RSA SigGen", "rolesSspAccess": "User Role - RSA private key: W,E,Z"}, {"name": "RSA digital signature generation primitive", "description": "Digital Signature Generation on a pre- hashed message using RSA", "indicator": "1", "inputs": "RSA Private Key, Message and Digest", "outputs": "Digital Signature", "secFunImpl": "RSA Signature Primitive (CVL)", "rolesSspAccess": "User Role - RSA private key: W,E,Z"}, {"name": "RSA digital signature verification", "description": "Digital Signature Verification using RSA", "indicator": "1", "inputs": "RSA Public Key and Digital Signature", "outputs": "True or False", "secFunImpl": "RSA SigVer", "rolesSspAccess": "User Role - RSA public key: W,E,Z"}, {"name": "RSA digital signature verification (Legacy)", "description": "Digital Signature Verification using RSA for legacy use", "indicator": "1", "inputs": "RSA Public Key and Digital Signature", "outputs": "True or False", "secFunImpl": "RSA SigVer (Legacy)", "rolesSspAccess": "User Role - RSA public key: W,E,Z"}, {"name": "RSA encapsulation", "description": "Encapsulation using KTS-IFC", "indicator": "1", "inputs": "RSA Public Key and Plaintext Data", "outputs": "Ciphertext Data", "secFunImpl": "RSA encapsulation", "rolesSspAccess": "User Role - Module generated RSA private key (Including intermediate keygen values): E,Z"}, {"name": "RSA decapsulation", "description": "Decapsulation using KTS-IFC", "indicator": "1", "inputs": "RSA Private Key and Ciphertext Data", "outputs": "Plaintext Data", "secFunImpl": "RSA decapsulation", "rolesSspAccess": "User Role - RSA public key: W,E,Z"}, {"name": "RSA Decryption Primitive (CVL)", "description": "RSA decryption primitive as defined in SP800-56BRev2 Section 7.1.2.1", "indicator": "1", "inputs": "RSA Private Key and Encrypted Key", "outputs": "Plaintext Key", "secFunImpl": "RSA Decryption Primitive (CVL)", "rolesSspAccess": "User Role - RSA private key: W,E,Z"}, {"name": "ECDSA key-pair generation", "description": "Asymmetric Key Pair Generation", "indicator": "1", "inputs": "EC curve", "outputs": "ECDSA Key Pair", "secFunImpl": "Counter DRBG ECDSA KeyGen", "rolesSspAccess": "User Role - ECDSA/ECDH (ECC) public key (including intermediate"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "keygen values): G,R - ECDSA/ECDH (ECC) private key (including intermediate keygen values): G,R"}, {"name": "ECDSA public key validation", "description": "Public Key Validation of ECDSA public key", "indicator": "1", "inputs": "ECDSA Public Key", "outputs": "True or False", "secFunImpl": "ECDSA KeyVer", "rolesSspAccess": "User Role - ECDSA/ECDH (ECC) public key (including intermediate keygen values): W,E,Z"}, {"name": "ECDSA digital signature generation", "description": "Digital Signature Generation using ECDSA", "indicator": "1", "inputs": "ECDSA Private Key and Message", "outputs": "Digital Signature", "secFunImpl": "ECDSA SigGen", "rolesSspAccess": "User Role - ECDSA/ECDH (ECC) private key (including intermediate keygen values): W,E,Z"}, {"name": "ECDSA digital signature verification", "description": "Digital Signature Verification using ECDSA", "indicator": "1", "inputs": "ECDSA Public Key and Digital Signature", "outputs": "True or False", "secFunImpl": "ECDSA SigVer", "rolesSspAccess": "User Role - ECDSA/ECDH (ECC) public key (including intermediate keygen values): W,E,Z"}, {"name": "ECDH key agreement", "description": "Diffie-Hellman Key Agreement using Elliptic Curve Cryptography", "indicator": "1", "inputs": "EC Curve, Party U's ephemeral private key, and Party V's ephemeral public key", "outputs": "Derived Key", "secFunImpl": "KAS-ECC", "rolesSspAccess": "User Role - ECDSA/ECDH (ECC) public key (including intermediate keygen values): W,E - ECDSA/ECDH (ECC) private key (including intermediate keygen values): W,E - Shared Secret: G - SP 800-56C KDF derived key: G,R,Z"}, {"name": "SHS message digest generation", "description": "Message Digest Generation using Secure Hash Standard algorithm", "indicator": "1", "inputs": "Message", "outputs": "Message Digest", "secFunImpl": "SHS", "rolesSspAccess": "User Role"}, {"name": "Random Number Generation", "description": "Deterministic Random Number Generation", "indicator": "1", "inputs": "Entropy input string and nonce", "outputs": "Random Numbers", "secFunImpl": "Counter DRBG", "rolesSspAccess": "User Role - Entropy Input String: W,E,Z - DRBG Seed: W,E,Z - DRBG internal state: (V and Key values): W,E,Z"}, {"name": "Key Derivation", "description": "Derive key using KBKDF in counter mode", "indicator": "1", "inputs": "Key Derivation Key", "outputs": "Derived Key", "secFunImpl": "KBKDF", "rolesSspAccess": "User Role - KBKDF key derivation key: W,E,Z - KBKDF derived key: R,W,E,Z"}, {"name": "Show Module Version", "description": "Output Module Name and Module Hardware and Firmware Version Numbers", "indicator": "N/A", "inputs": "None", "outputs": "Module Base Name + Module Version Number", "secFunImpl": "None", "rolesSspAccess": "Unauthenticated"}, {"name": "Show Status", "description": "Outputs Operational/Error Status of the module as well as the approved status indicator for the last command executed", "indicator": "N/A", "inputs": "None", "outputs": "Operational status, Error status, Approved Service Indicator", "secFunImpl": "None", "rolesSspAccess": "Unauthenticated"}, {"name": "On Demand Self-Test (Pre- operational Integrity Test and Conditional Algorithm Self- Test)", "description": "Performs On Demand Self- Test", "indicator": "N/A", "inputs": "None", "outputs": "Pass/Fail status", "secFunImpl": "Unauthenticated AES AES Message Authentication Code Authenticated AES Counter DRBG ECDSA KeyGen ECDSA SigGen ECDSA SigVer HMAC KAS-ECC KBKDF RSA encapsulation RSA decapsulation RSA KeyGen RSA SigGen RSA SigVer SHS ICV HMAC", "rolesSspAccess": "User Role - ICV HMAC Key: E"}, {"name": "Zeroization", "description": "Zeroizes all CSPs", "indicator": "N/A", "inputs": "None", "outputs": "None", "secFunImpl": "None", "rolesSspAccess": "User Role - AES keys: Z - HMAC keys: Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- Module generated RSA public key: Z - Module generated RSA private key (Including intermediate keygen values): Z - RSA public key: Z - RSA private key: Z - ECDSA/ECDH (ECC) public key (including intermediate keygen values): Z - ECDSA/ECDH (ECC) private key (including intermediate keygen values): Z - Shared Secret: Z - SP 800-56C KDF derived key: Z - KBKDF key derivation key: Z - KBKDF derived key: Z - Entropy Input String: Z - DRBG Seed: Z - DRBG internal state: (V and Key values): Z"}, {"name": "Module Initialization", "description": "Configure BIOS to Initialize in FIPS Validated Configuration", "indicator": "N/A", "inputs": "BIOS settings", "outputs": "None", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer Role"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "Data Encryption using AES-GCM with externally generated IV", "description": "Data Encryption using AES-GCM with externally generated IV", "alg_accessed": "AES-GCM", "role": "User"}, {"name": "Data Encryption and Decryption using SM4", "description": "Data Encryption and Decryption using SM4", "alg_accessed": "SM4", "role": "User"}, {"name": "Message digests using MD5 or SM3", "description": "Message digests using MD5 or SM3", "alg_accessed": "MD5 SM3", "role": "User"}, {"name": "MAC generation using HMAC-MD5", "description": "MAC generation using HMAC- MD5", "alg_accessed": "HMAC-MD5", "role": "User"}, {"name": "MAC generation using less than 112 bits HMAC key", "description": "MAC generation using less than 112 bits HMAC key", "alg_accessed": "HMAC", "role": "User"}, {"name": "Key generation using RSA with 1024 bits modulus size", "description": "Key generation using RSA with 1024 bits modulus size", "alg_accessed": "RSA", "role": "User"}, {"name": "Key generation using ECDSA using secp256k1 curve", "description": "Key generation using ECDSA using secp256k1 curve", "alg_accessed": "ECDSA", "role": "User"}, {"name": "Digital signature generation using RSA with MD5, SM3 or SHA-1 for any modulus size", "description": "Digital signature generation using RSA with MD5, SM3 or SHA-1 for any modulus size", "alg_accessed": "RSA", "role": "User"}, {"name": "Digital signature verification using RSA with MD5, or SM3 for any modulus size", "description": "Digital signature verification using RSA with MD5, or SM3 for any modulus size", "alg_accessed": "RSA", "role": "User"}, {"name": "Digital signature generation using ECSCHNORR, ECDAA, or SM2 algorithm", "description": "Digital signature generation using ECSCHNORR, ECDAA, or SM2 algorithm", "alg_accessed": "SM2 ECDAA ECSCHNORR", "role": "User"}, {"name": "Digital signature verification using ECSCHNORR, ECDAA, or SM2 algorithm", "description": "Digital signature verification using ECSCHNORR, ECDAA, or SM2 algorithm", "alg_accessed": "SM2 ECDAA ECSCHNORR", "role": "User"}, {"name": "Key Transport (key encapsulation and decapsulation) using RSA-OAEP with MD5 or SHA-1", "description": "Key Transport (key encapsulation and decapsulation) using RSA-OAEP with MD5 or SHA-1", "alg_accessed": "RSA", "role": "User"}, {"name": "Key Transport (key encapsulation and decapsulation) using RSA-OAEP with 1024-bit modulus", "description": "Key Transport (key encapsulation and decapsulation) using RSA-OAEP with 1024-bit modulus", "alg_accessed": "RSA", "role": "User"}, {"name": "Key Transport (key decapsulation) using RSA- OAEP with 3072 or 4096-bit modulus", "description": "Key Transport (key decapsulation) using RSA- OAEP with 3072 or 4096-bit modulus", "alg_accessed": "RSA", "role": "User"}, {"name": "Shared secret computation using ECDHE with brainpoolp384r1 curve", "description": "Shared secret computation using ECDHE with brainpoolp384r1 curve", "alg_accessed": "ECDHE Shared Secret Computation", "role": "User"}, {"name": "ECC Commit Computation using ECSCHNORR and ECDAA (used in ECSCHNORR and ECDAA Signature Generation)", "description": "ECC Commit Computation using ECSCHNORR and ECDAA (used in ECSCHNORR and ECDAA Signature Generation)", "alg_accessed": "ECC Commit Computation ECDAA ECSCHNORR", "role": "User"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": true, "entries": [{"mechanism": "Hard tamper-evident coating", "inspectFreq": "Determined by the operator", "inspectGuidance": "Observe the coating surrounding the chip for any signs of damage"}]}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "RAM", "description": "Stored as plaintext", "persistance": "Static"}, {"name": "OCS ROM", "description": "Obfuscated in ROM", "persistance": "Static"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "API input parameters", "source": "External Source", "dest": "RAM", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}, {"name": "API output parameters", "source": "RAM", "dest": "External Source", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Power Cycling", "description": "Powers down RAM", "rationale": "Power to RAM is lost causing all values stored in memory to be zeroized.", "operatorId": "Invoked after device shut down"}, {"method": "Automatic Zeroization", "description": "Performed at the end of every service utilizing SSPs", "rationale": "Overwrites memory occupied by keys with \"zeros\" before de-allocating the memory.", "operatorId": "Automatically by the module"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "HMAC-SHA2-256 (A7742)", "testProps": "HMAC-SHA2-256 with 256- bit key", "testMethod": "Message Authentication Code (MAC)", "type": "SW/FW Integrity", "indicator": "Successful boot", "details": "Performed on system startup"}, {"algorithmOrTest": "RSA SigVer (FIPS186-5) (A5442)", "testProps": "PSS, 3072 modulus and SHA2-384 message digest", "testMethod": "Digital Signature Verification", "type": "SW/FW Integrity", "indicator": "Successful boot", "details": "Performed on system startup"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES-ECB (A5442)", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Encryption", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "AES-ECB (A5442)", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Decryption", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "AES-GCM (A5442)", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Encryption", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "AES-CMAC (A5442)", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Signature Generation (Encryption)", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "HMAC-SHA-1 (A5442)", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message authentication", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "HMAC-SHA2-256 (A5442)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message authentication", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "HMAC-SHA2-512 (A5442)", "testProps": "SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message authentication", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "SHA-1 (A5442)", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message Digest", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "SHA2-256 (A5442)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message Digest", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "SHA2-512 (A5442)", "testProps": "SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message Digest", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A5442)", "testProps": "P-256 curve and SHA-256 message digest", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Digital Signature Generation", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A5442)", "testProps": "P-256 curve and SHA-256 message digest", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Digital Signature Verification", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "Counter DRBG (A5442)", "testProps": "256-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "SP 800-90Ar1 health test per section 11.3 (instantiate, generate, reseed)", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "RSA SigGen (FIPS186-5) (A5442)", "testProps": "PKCS#1 v1.5, 2048 modulus and SHA-256 message digest", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Digital Signature Generation", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "RSA SigVer (FIPS186-5) (A5442)", "testProps": "PKCS#1 v1.5, 2048 modulus and SHA-256 message digest", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Digital Signature Verification", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "KTS-IFC (A5442)", "testProps": "2048 modulus", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Encryption/Decryption", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "KDF SP800-108 (A5442)", "testProps": "HMAC-SHA2-384", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Key Derivation", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "KAS-ECC Sp800- 56Ar3 (A5442)", "testProps": "P-256 curve, One- Step KDF using HMAC-SHA-384", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Shared Secret Computation and Key Derivation", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A5442)", "testProps": "P-256, P-384", "testMethod": "PCT", "type": "PCT", "indicator": "Key pair returned to caller", "details": "Key Generation", "condition": "Performed every time ECC key pair is generated"}, {"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A5442)", "testProps": "2048 modulus", "testMethod": "PCT", "type": "PCT", "indicator": "Key pair returned to caller", "details": "Key Generation", "condition": "Performed every time RSA key pair is generated"}, {"algorithmOrTest": "HMAC-SHA2-256 (A7742)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Message authentication", "condition": "Prior to using ICV HMAC"}, {"algorithmOrTest": "Counter DRBG (A5254)", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module is operational", "details": "Deterministic Random Bit Generation", "condition": "Upon first invocation of service that uses the algorithm"}, {"algorithmOrTest": "ESV - Repetition Count Test (Startup)", "testProps": "Startup test with 1024 samples; Cutoff value = 161", "testMethod": "fault- detection test", "type": "CAST", "indicator": "Module is operational", "details": "Entropy Health Test", "condition": "Boot Up"}, {"algorithmOrTest": "Entropy - Repetition Count Test (Continuous)", "testProps": "Cutoff value = 161", "testMethod": "fault- detection test", "type": "CAST", "indicator": "Module is operational", "details": "Entropy Health Test", "condition": "Upon seeding or reseeding the SP 800-90A DRBG"}, {"algorithmOrTest": "Entropy - Adaptive Proportion Test (Startup)", "testProps": "Startup test with 1024 samples; Cutoff value = 938", "testMethod": "fault- detection test", "type": "CAST", "indicator": "Module is operational", "details": "Entropy Health Test", "condition": "Boot Up"}, {"algorithmOrTest": "Entropy - Adaptive Proportion Test (Continuous)", "testProps": "Cutoff value = 938", "testMethod": "fault- detection test", "type": "CAST", "indicator": "Module is operational", "details": "Entropy Health Test", "condition": "Upon seeding or reseeding the SP 800-90A DRBG"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Error State", "description": "No further communication is possible with the module until the module is reset.", "conditions": "Pre-operational firmware integrity test failure Conditional self-test failures other than PCT", "recoveryMethod": "Device reset", "indicator": "An error code is provided"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["SHA2-512A5442", "HMAC-SHA2-256A7742", "SHA2-256A7742", "ECDSA KeyVer (FIPS186-5)A5442", "SHA2-384A5442", "AES-ECBA5442", "#A7742", "ECDSA SigVer (FIPS186-5)A5442", "RSA Signature PrimitiveA5442", "AES-CBCA5442", "KTS-IFCA5442", "SHA-1A5442", "SHA2-224A5442", "ECDSA KeyGen (FIPS186-5)A5442", "#A5254", "RSA Decryption Primitive Sp800-56Br2A5442", "#A5442", "HMAC-SHA2-224A5442", "AES-CMACA5442", "KAS-ECC Sp800-56Ar3A5442", "HMAC-SHA-1A5442", "KDF SP800-108A5442", "RSA SigVer (FIPS186-5)A5442", "Conditioning Component AES-CBC-MAC SP800-90BA5254", "HMAC-SHA2-512A5442", "HMAC-SHA2-384A5442", "AES-GCMA5442", "AES-CFB128A5442", "AES-CTRA5442", "ECDSA SigGen (FIPS186-5)A5442", "RSA KeyGen (FIPS186-5)A5442", "Counter DRBGA5442", "AES-OFBA5442", "RSA SigGen (FIPS186-5)A5442"]}, "extracted_versions": {"_type": "Set", "elements": ["1"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "840c7efcdab4fa8b9ca9bbe4da6f40855bac7c49198c314df67dedc4f3b210dd", "txt_hash": "f5b46e170b1f3b3923649de2ed02b99ec1c5c1f578a9411fd55b931d7416ee4e", "json_hash": "0c5e3a84c5896eef39b5ea4cd9897b3e2b57cc71fe7c9570866e86d943e2e3e6"}}}