{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "869ab3d281360254", "cert_id": 5548, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "wolfCrypt", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-10-09", "validation_type": "Initial", "lab": "AEGISOLVE, Inc."}], "vendor_url": "http://www.wolfssl.com", "vendor": "wolfSSL Inc.", "certificate_pdf_url": null, "module_type": "Software", "standard": "FIPS 140-3", "status": "active", "level": 1, "caveat": "When operated in approved mode. No assurance of the minimum strength of generated SSPs (e.g., keys). No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs", "exceptions": ["Physical security: N/A", "Non-invasive security: N/A", "Mitigation of other attacks: N/A"], "embodiment": "MultiChipStand", "description": "wolfCrypt module is a comprehensive suite of FIPS Approved algorithms. All key sizes and modes have been implemented to allow flexibility and efficiency.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-10-08", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 1": 2}}, "fips_certlike": {"Certlike": {"HMAC- SHA256": 2, "HMAC-SHA-1": 4, "HMAC- SHA-1": 2, "HMAC- SHA1": 2, "HMAC- SHA224": 1, "HMAC- SHA384": 1, "HMAC- SHA512": 1, "SHA3": 1, "SHA256": 7, "SHA2-224": 5, "SHA2-256": 17, "SHA2-384": 6, "SHA2-512": 9, "SHA3-224": 3, "SHA3- 256": 8, "SHA3-384": 3, "SHA3-512": 3, "SHA-1": 5, "SHA2- 384": 2, "SHA-2": 1, "SHA-3": 1, "SHA2- 224": 1, "SHA2- 256": 6, "SHA3- 224": 3, "SHA3- 384": 3, "SHA3- 512": 3, "SHA- 256": 1, "SHA1": 4, "SHA224": 2, "SHA2- 512": 2, "SHA384": 2, "SHA512": 2, "SHA3-256": 1, "AES-128": 1, "AES-192": 1, "AES-256": 1}}, "vendor": {"NXP": {"NXP": 6}, "Samsung": {"Samsung": 4}, "Qualcomm": {"Qualcomm": 4}, "Broadcom": {"Broadcom": 5}, "Microsoft": {"Microsoft": 1}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES": 12, "AES-128": 1, "AES-192": 1, "AES-256": 1, "AES-": 38}, "CAST": {"CAST": 54}}, "constructions": {"MAC": {"HMAC": 6, "CMAC": 12}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 5}, "ECDSA": {"ECDSA": 34}, "ECC": {"ECC": 11}}, "FF": {"DH": {"Diffie-Hellman": 1, "DHE": 2, "DH": 8}, "DSA": {"DSA": 2}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 5, "SHA1": 4}, "SHA2": {"SHA256": 7, "SHA224": 2, "SHA384": 2, "SHA512": 2, "SHA-2": 1}, "SHA3": {"SHA3": 1, "SHA3-224": 3, "SHA3-384": 3, "SHA3-512": 3, "SHA-3": 1, "SHA3-256": 1}}}, "crypto_scheme": {"MAC": {"MAC": 13}, "KA": {"Key Agreement": 3}, "AEAD": {"AEAD": 1}}, "crypto_protocol": {"SSH": {"SSH": 11}, "TLS": {"TLS": {"TLSv1.2": 3, "TLS": 10, "TLS v1.2": 6, "TLS v1.3": 6, "TLS 1.2": 1, "TLSv1.3": 2}}}, "randomness": {"PRNG": {"DRBG": 31}, "RNG": {"RNG": 1, "RBG": 3}}, "cipher_mode": {"ECB": {"ECB": 4}, "CBC": {"CBC": 7}, "CTR": {"CTR": 4}, "OFB": {"OFB": 4}, "GCM": {"GCM": 19}, "CCM": {"CCM": 7}}, "ecc_curve": {"NIST": {"P-224": 8, "P-256": 12, "P-384": 10, "P-521": 24}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {"wolfSSL": {"wolfSSL": 112}}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 4}, "IBM": {"SSC": 10}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 15, "FIPS 186-4": 2, "FIPS186-4": 2, "FIPS186-5": 18, "FIPS 186-5": 7, "FIPS 198-1": 5, "FIPS 180-4": 1, "FIPS 202": 1, "FIPS18": 12}, "NIST": {"NIST SP 800-90A": 1, "NIST SP 800-56A": 1, "NIST SP 800-56C": 1, "NIST SP 800-135": 1, "NIST SP 800-140D": 1, "NIST SP 800-131A": 1, "NIST SP 800-56B": 1, "SP 800-38A": 2, "SP 800-38C": 1, "SP 800-38B": 1, "SP 800-38D": 3, "SP 800-90A": 1, "SP 800-56A": 2, "SP 800-135": 5, "SP 800-56B": 1, "NIST SP 800-38C": 1}, "RFC": {"RFC7627": 2, "RFC762": 1, "RFC76": 1}, "ISO": {"ISO/IEC 24759": 2, "ISO/IEC 19790-2012": 1, "ISO/IEC 19790:2012": 4}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 814101, "pdf_is_encrypted": false, "pdf_number_of_pages": 51, "/Producer": "Microsoft\u00ae Word for Microsoft 365", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20261006070502-04'00'", "/ModDate": "D:20261006070502-04'00'", "pdf_hyperlinks": {"_type": "Set", "elements": ["http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf", "https://www.wolfssl.com/", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf", "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar2.pdf", "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf", "https://csrc.nist.gov/publications/detail/sp/800-56b/rev-2/final", "https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf", "http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf", "https://csrc.nist.gov/publications/detail/sp/800-135/rev-1/final", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf", "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Dr2.pdf"]}}, "module_algorithms": {"_type": "Set", "elements": ["RSA SigVer (FIPS186-5)A7470", "HMAC-SHA2-256A7470", "SHA2-512A7470", "RSA Decryption Primitive Sp800-56Br2A7470", "HMAC-SHA2-224A7470", "SHA2-384A7470", "ECDSA SigVer (FIPS186-5)A7470", "RSA KeyGen (FIPS186-5)A7470", "AES-CBCA7470", "HMAC-SHA-1A7470", "TLS v1.3 KDFA7470", "KAS-ECC-SSC Sp800-56Ar3A7470", "AES-CCMA7470", "DSA KeyGen (FIPS186-4)A7470", "SHA3-256A7470", "SHA3-224A7470", "AES-ECBA7470", "ECDSA KeyGen (FIPS186-5)A7470", "HMAC-SHA3-256A7470", "SHA2-256A7470", "AES-GMACA7470", "RSA SigGen (FIPS186-5)A7470", "SHA-1A7470", "KDF TLSA7470", "TLS v1.2 KDF RFC7627A7470", "HMAC-SHA2-384A7470", "KDF SSHA7470", "SHA2-224A7470", "KAS-FFC-SSC Sp800-56Ar3A7470", "Hash DRBGA7470", "HMAC-SHA3-512A7470", "ECDSA SigGen (FIPS186-5)A7470", "AES-OFBA7470", "HMAC-SHA3-224A7470", "SHA3-512A7470", "ECDSA KeyVer (FIPS186-5)A7470", "AES-CMACA7470", "AES-GCMA7470", "SHA3-384A7470", "HMAC-SHA3-384A7470", "HMAC-SHA2-512A7470", "AES-CTRA7470"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A7470"]}, "is_br1_format": true, "br1_deviations": 3, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "1"}, {"section": "2", "title": "Cryptographic module specification", "level": "1"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "1"}, {"section": "4", "title": "Roles, services, and authentication", "level": "1"}, {"section": "5", "title": "Software/Firmware security", "level": "1"}, {"section": "6", "title": "Operational environment", "level": "1"}, {"section": "7", "title": "Physical security", "level": "N/A"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "1"}, {"section": "10", "title": "Self-tests", "level": "1"}, {"section": "11", "title": "Life-cycle assurance", "level": "1"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "1"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"packageFileName": "wolfssl-x.x.x-commercial- fipsv5.2.3.7z", "swFwVersion": "v5.2.3", "features": "FIPS 140-3 module and SSL/TLS library", "integrityTest": "HMAC- SHA256"}]}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "Janteq Zynq Linux 5.4", "hardwarePlatform": "AviTr3", "processors": "Xilinx Zynq- 7000 SoC", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq Zynq Linux 5.4", "hardwarePlatform": "AviTr3", "processors": "Xilinx Zynq- 7000 SoC", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq Zynq Linux 4.19", "hardwarePlatform": "Bronte3", "processors": "Xilinx Zynq Ultrascale+", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq Zynq Linux 4.19", "hardwarePlatform": "Bronte3", "processors": "Xilinx Zynq Ultrascale+", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq Ambarella S5L Linux 4.9", "hardwarePlatform": "Maximo", "processors": "Ambarella S5L SoC", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq Ambarella S5L Linux 4.9", "hardwarePlatform": "Maximo", "processors": "Ambarella S5L SoC", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq iMX8QM Linux 5.4", "hardwarePlatform": "FLIP2", "processors": "i.MX8 Quad Max SoC", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Janteq iMX8QM Linux 5.4", "hardwarePlatform": "FLIP2", "processors": "i.MX8 Quad Max SoC", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "FreeRTOS v10.4", "hardwarePlatform": "Harman CE-REL8 Universal Control Extender", "processors": "NXP i.MX RT1051", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 5.15", "hardwarePlatform": "Harman N3322D Video encoder/decoder", "processors": "MTK MT8395", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Android 14", "hardwarePlatform": "Samsung Galaxy S21", "processors": "Qualcomm SM8350 Snapdragon", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Android 14", "hardwarePlatform": "Samsung Galaxy S21", "processors": "Qualcomm SM8350 Snapdragon", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "SEL Switch", "processors": "Xilinx Zynq Ultrascale+", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "SEL-2740", "processors": "Altera SoC FPGA", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 5.15", "hardwarePlatform": "731 Series Advanced Ventilator", "processors": "i.MX6UL", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Debian 12.5", "hardwarePlatform": "Broadcom Symantec Privileged Access Manager", "processors": "Intel Xeon CPU E3-1275 v6 @ 3.80GHz", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Ubuntu 22.04", "hardwarePlatform": "secureWISE Cloud Chassis", "processors": "Intel Xeon E5-2697 v3", "paa_pai": "No", "hypervisorHostOs": "VMWare ESXi 7.0.3", "version": "v5.2.3"}, {"operatingSystem": "Nucleus 3.0 version 2013.08.1", "hardwarePlatform": "XL200P Radio", "processors": "Freescale Vybrid VF500", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Yocto 4.0-r7 (kirkstone)", "hardwarePlatform": "Claria Plus", "processors": "STM32MP15 7", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "ZOLL Zenix Communications Module", "processors": "Freescale i.MX7 Dual ARM Cortex- A7", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "ZOLL Zenix Communications Module", "processors": "Freescale i.MX7 Dual ARM Cortex- A7", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 4.9 Kernel", "hardwarePlatform": "HP PN 3PZ95-60002", "processors": "ARM Cortex- A72", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 4.9 Kernel", "hardwarePlatform": "HP PN 3PZ95-60002", "processors": "ARM Cortex- A72", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 4.9 Kernel", "hardwarePlatform": "HP PN 6QN27- 60001A", "processors": "ARM Cortex- A53", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 4.9 Kernel", "hardwarePlatform": "HP PN 6QN27- 60001A", "processors": "ARM Cortex- A53", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Microsoft Windows CE 6.0", "hardwarePlatform": "HP Color LaserJet Enterprise M553", "processors": "ARM Cortex- A8", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "RHEL 8.10", "hardwarePlatform": "Dell R660", "processors": "Intel Xeon Gold 6526Y @ 2.80GHz", "paa_pai": "No", "hypervisorHostOs": "qemu-kvm 6.2 on RHEL 8.10", "version": "v5.2.3"}, {"operatingSystem": "RHEL 8.10", "hardwarePlatform": "Dell R660", "processors": "Intel Xeon Gold 6526Y @ 2.80GHz", "paa_pai": "Yes", "hypervisorHostOs": "qemu-kvm 6.2 on RHEL 8.10", "version": "v5.2.3"}, {"operatingSystem": "Windows 11 Pro", "hardwarePlatform": "Dell Precision 3570", "processors": "Intel Core i7- 1255U @ 1.70Ghz", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Windows 11 Pro", "hardwarePlatform": "Dell Precision 3570", "processors": "Intel Core i7- 1255U @ 1.70Ghz", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Android 13", "hardwarePlatform": "Samsung Galaxy S23", "processors": "Qualcomm Snapdragon 8 Gen 2 (SoC)", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Android 13", "hardwarePlatform": "Samsung Galaxy S23", "processors": "Qualcomm Snapdragon 8 Gen 2 (SoC)", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "iOS 17.3", "hardwarePlatform": "iPhone 14", "processors": "Apple A15 Bionic", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "iOS 17.3", "hardwarePlatform": "iPhone 14", "processors": "Apple A15 Bionic", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 5.4", "hardwarePlatform": "Lenovo XClarity Controller", "processors": "Dual ARM Cortex A7", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 5.4", "hardwarePlatform": "Lenovo XClarity Controller", "processors": "Dual ARM Cortex A7", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "Lenovo XClarity Controller", "processors": "Dual ARM Cortex A7", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "Lenovo XClarity Controller", "processors": "Dual ARM Cortex A7", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Android 11", "hardwarePlatform": "PD470", "processors": "MTK MT6762", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 4.14", "hardwarePlatform": "Mesh Rider Radios", "processors": "MIPS 24Kc V7.4", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Ubuntu 20.04.6", "hardwarePlatform": "Single Board Computer (SBC), GW7101-01", "processors": "NXP i.MX8M", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "UEFI Specification Version 2.3.1 (32-bit)", "hardwarePlatform": "Dell Venue 8 Pro", "processors": "Intel Atom Processor Z3745D", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "UEFI Specification Version 2.6.0 (64-bit)", "hardwarePlatform": "Dell Latitude 7480", "processors": "Intel Core i5- 7300U", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "UEFI Specification Version 2.6.0 (64-bit)", "hardwarePlatform": "Dell Latitude 7480", "processors": "Intel Core i5- 7300U", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 5.15 Yocto (Kirkstone)", "hardwarePlatform": "FXR90", "processors": "NXP i.MX8M Mini Quad Cortex-A53", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "QNX 6.6", "hardwarePlatform": "LIFEPAK monitor/defibrillator(s )", "processors": "NXP i.MX6", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Windows Server 2022", "hardwarePlatform": "PowerEdge R660 Rack Server", "processors": "Intel Xeon Gold 6414U CPU", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Cesium 2.93", "hardwarePlatform": "Claria Plus", "processors": "STM32H753", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 5.10", "hardwarePlatform": "HP Color LaserJet Enterprise 6700", "processors": "ARM Cortex- A72", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 5.10", "hardwarePlatform": "HP Color LaserJet Enterprise 6700", "processors": "ARM Cortex- A72", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 5.10", "hardwarePlatform": "HP Color LaserJet Enterprise 5700", "processors": "ARM Cortex- A53", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "HP Imaging & Printing Linux 5.10", "hardwarePlatform": "HP Color LaserJet Enterprise 5700", "processors": "ARM Cortex- A53", "paa_pai": "Yes", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux 6.6", "hardwarePlatform": "Forward Edge-AI Isidore Quantum", "processors": "NXP LS1012", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Debian GNU/Linux 8 (jessie)", "hardwarePlatform": "Corning 1LAN- SDDP-48P-U Edgecore Cloud and Data Center Switch", "processors": "Broadcom BCM56771", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux IPHO00559B2 3 3.4", "hardwarePlatform": "Corning 1LAN- SDAN-7290 GPON ONT", "processors": "Broadcom BCM6838", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Linux IPHO00550F2 2 4.1", "hardwarePlatform": "Corning 1LAN- SDAN-7691 XGS- PON ONT", "processors": "Broadcom BCM6858", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Debian GNU/Linux 8 (jessie)", "hardwarePlatform": "Corning 1LAN- SDDP-24POE", "processors": "Broadcom BCM5634", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}, {"operatingSystem": "Digi Embedded Yocto 5.0", "hardwarePlatform": "ConnectCore 6UL", "processors": "NXP i.mx6UL", "paa_pai": "No", "hypervisorHostOs": "", "version": "v5.2.3"}]}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": false, "entries": []}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC, AES-ECB, AES-OFB", "cavpCertName": "A7470", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CCM", "cavpCertName": "A7470", "properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96", "reference": "SP 800-38C"}, {"algorithm": "", "cavpCertName": "", "properties": "IV Length - IV Length: 56, 64, 72, 80, 88, 96 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-8192 Increment 8", "reference": ""}, {"algorithm": "AES-CMAC", "cavpCertName": "A7470", "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 32-128 Increment 32 Message Length - Message Length: 0- 16384 Increment 128", "reference": "SP 800-38B"}, {"algorithm": "AES-CTR", "cavpCertName": "A7470", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes", "reference": "SP 800-38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A7470", "properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal IV Generation Mode - 8.2.1, 8.2.2 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 96 IV Length - IV Length: 64-128 Increment 32 Payload Length - Payload Length: 128-512 Increment 128 AAD Length - AAD Length: 128-512 Increment 128", "reference": "SP 800-38D"}, {"algorithm": "AES-GMAC", "cavpCertName": "A7470", "properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal IV Generation Mode - 8.2.1, 8.2.2 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 96 IV Length - IV Length: 64-128 Increment 32 AAD Length - AAD Length: 128-512 Increment 128", "reference": "SP 800-38D"}, {"algorithm": "DSA KeyGen (FIPS186-4)", "cavpCertName": "A7470", "properties": "L - 2048 N - 256", "reference": "FIPS 186-4"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A7470", "properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - extra bits", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA KeyVer (FIPS186-5)", "cavpCertName": "A7470", "properties": "Curve - P-224, P-256, P-384, P-521", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A7470", "properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256,", "reference": "FIPS 186-5"}, {"algorithm": "", "cavpCertName": "", "properties": "SHA2-384, SHA2-512, SHA3-224, SHA3- 256, SHA3-384, SHA3-512 Component - No", "reference": ""}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A7470", "properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3- 256, SHA3-384, SHA3-512", "reference": "FIPS 186-5"}, {"algorithm": "Hash DRBG", "cavpCertName": "A7470", "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - SHA2-256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0, 0 Additional Input - Additional Input: 0, 0 Returned Bits - 1024", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "HMAC-SHA-1", "cavpCertName": "A7470", "properties": "MAC - MAC: 160 Key Length - Key Length: 112-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-224, HMAC-SHA3-224", "cavpCertName": "A7470", "properties": "MAC - MAC: 224 Key Length - Key Length: 112-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256, HMAC-SHA3-256", "cavpCertName": "A7470", "properties": "MAC - MAC: 256 Key Length - Key Length: 112-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-384, HMAC-SHA3-384", "cavpCertName": "A7470", "properties": "MAC - MAC: 384 Key Length - Key Length: 112-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-512, HMAC-SHA3-512", "cavpCertName": "A7470", "properties": "MAC - MAC: 512 Key Length - Key Length: 112-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A7470", "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Hash Function Z - SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC-SSC Sp800-56Ar3", "cavpCertName": "A7470", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 Hash Function Z - SHA2-512 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A7470", "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF TLS (CVL)", "cavpCertName": "A7470", "properties": "TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "RSA Decryption Primitive Sp800-56Br2 (CVL)", "cavpCertName": "A7470", "properties": "Modulo - 2048, 3072, 4096 Key Format - Standard Public Exponent Mode - random", "reference": "SP 800-56B Rev. 2"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A7470", "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Info Generated By Server - Yes Private Key Format - standard Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A7470", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - MGF1", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A7470", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - MGF1 Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512", "cavpCertName": "A7470", "properties": "Message Length - Message Length: 0- 65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA3-224, SHA3- 256, SHA3-384, SHA3-512", "cavpCertName": "A7470", "properties": "Message Length - Message Length: 0- 65536 Increment 8", "reference": "FIPS 202"}, {"algorithm": "TLS v1.2 KDF RFC7627 (CVL)", "cavpCertName": "A7470", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "TLS v1.3 KDF (CVL)", "cavpCertName": "A7470", "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK- DHE", "reference": "SP 800-135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG- 1", "algoPropList": "Key Type:Symmetric and Asymmetric", "implName": "N/A", "reference": "SP800-133r2 Section 4, example 1"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "AES- GCM", "use": "Non-approved and not-allowed when the IV length is less than 96 bits."}, {"name": "ECDSA", "use": "Non-approved and not-allowed when the hashlen (Verify) and inlen (Sign) are less than WC_MIN_DIGEST_SIZE or the ECC public key imported to the module exceeds P-521."}, {"name": "AES- CMAC", "use": "Non-approved and not-allowed when the cumulative input size exceeds 2^(32) -1, the CMAC tag length is less than 64-bits, or the CMAC tag length is greater than 128-bits."}, {"name": "AES- CCM", "use": "Non-approved and not-allowed when the payload meets or exceeds 2^(8q) bytes."}, {"name": "DH", "use": "Non-approved and not-allowed when the private key length is less than 2048-bits or if it exceeds 8192-bits."}, {"name": "RSA", "use": "Non-approved and not-allowed when the public exponent \"e\" is less than 65537."}, {"name": "ECDH", "use": "Non-approved and not-allowed when the ECC public key imported to the module exceeds P-521."}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "N/A", "logicalInterface": "Control Input", "data": "API entry point: stack frame including non-sensitive parameters"}, {"physicalPort": "N/A", "logicalInterface": "Control Output", "data": "API call parameters passed by reference for structures allocated by wolfCrypt"}, {"physicalPort": "N/A", "logicalInterface": "Data Input", "data": "API call parameters passed by reference or value for cryptographic service input"}, {"physicalPort": "N/A", "logicalInterface": "Data Output", "data": "API call parameters passed by reference for cryptographic service output"}, {"physicalPort": "N/A", "logicalInterface": "Status Output", "data": "API return value: enumerated status resulting from call execution"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": false, "entries": []}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "CO", "type": "Role", "operatorType": "CO", "authMethodList": ""}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Digital Signatu re", "description": "Generate or verify digital signature s.", "indicator": "Successful completion of the service (status code >= 0). For ECDSA, Non- approved and not- allowed when the hashlen (Verify) and inlen (Sign) are less than WC_MIN_DIGEST _SIZE or the ECC public key imported to the module exceeds", "inputs": "Sign: Key Struct (DS_SGK ); message; Verify: signature value; flags; sizes.", "outputs": "Sign: Status return; Signature value. Verify: Status return;", "secFunImpl": "RSA Digital Signature Generatio n RSA Digital Signature Verificatio n ECDSA Digital Signature", "rolesSspAccess": "CO - DS_SGK: W,E,Z - DS_SVK: W,E,Z"}, {"name": "Generat e Key Pair", "description": "Generate asymmetr ic key pairs.", "indicator": "P-521. Successful completion of the service (status code >= 0). For DH, Non-approved and not-allowed when the private key length is less than 2048-bits or if it exceeds 8192- bits. For RSA, Non-approved and not-allowed when the public exponent \"e\" is less than 65537.", "inputs": "FFC, ECC: curve identifier; RSA: modulous size;", "outputs": "Status return; Key structure (GKP_Priv ate)", "secFunImpl": "RSA Asymmetri c Key-Pair Generatio n ECDSA Key-Pair Generatio n", "rolesSspAccess": "CO - GKP_Priv ate: G,R,Z - GKP_Pub lic: G,R,Z"}, {"name": "Key Agreem ent", "description": "DH key agreemen t primitives.", "indicator": "Successful completion of the service (status code >= 0). For ECDH, Non- approved and not- allowed when the ECC public key imported to the module exceeds P-521.", "inputs": "Key structures (KAS_Pri vate and KAS_Publ ic); flags;", "outputs": "Status return; KAS_SSC;", "secFunImpl": "KAS-SSC with KDF", "rolesSspAccess": "CO - KAS_Priv ate: W,E,Z - KAS_Publ ic: W,E,Z - KAS_SS C: G,R,Z"}, {"name": "Key Derivati on", "description": "Derive keying material from a", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "KAS_SS C; flags;", "outputs": "Status return; KD_DKM;", "secFunImpl": "KAS-SSC with KDF Key-based Derivation Functions", "rolesSspAccess": "CO - KAS_SS C: R,E,Z"}, {"name": "", "description": "shared secret", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": ""}, {"name": "Keyed Hash", "description": "Generate or verify message integrity", "indicator": "Successful completion of the service (status code >= 0). For AES-CMAC, Non- approved and not- allowed when the cumulative input size exceeds 2^(32) -1, the CMAC tag length is less than 64- bits, or the CMAC tag length is greater than 128- bits.", "inputs": "KH_Key", "outputs": "Status return; Tag value;", "secFunImpl": "Message Authentica tion Auth Block Cipher", "rolesSspAccess": "CO - KH_Key: W,E - AES GCM IV: W,E"}, {"name": "Messag e Digest", "description": "Generate a message digest", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "Message; flags;", "outputs": "Status return; Hash value;", "secFunImpl": "Secure Hash", "rolesSspAccess": "CO"}, {"name": "Rando m", "description": "Generate random bits using the DRBG", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "DRBG structure (Internal State containing secret(s) C and V); Seed", "outputs": "Status return; Random Value;", "secFunImpl": "DRBG", "rolesSspAccess": "CO - Seed: W,E,Z - Internal State: G,E - Secret C: G,E - Secret V: G,E - Entropy Input String: W,E,Z"}, {"name": "Self-test", "description": "Perform the designate d self- test.", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "Flags", "outputs": "Status return", "secFunImpl": "Message Authentica tion", "rolesSspAccess": "CO - MOD_INT : G,Z - coreKey: E"}, {"name": "Show Status", "description": "Provide Module status", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "None", "outputs": "Status return", "secFunImpl": "None", "rolesSspAccess": "CO"}, {"name": "Symmet ric cipher", "description": "Encrypt or Decrypt data, including AEAD modes (CCM, GCM)", "indicator": "Successful completion of the service (status code >= 0). For AES-GCM, Non- approved and not- allowed when the IV length is less than 96 bits. For AES-CCM, Non- approved and not- allowed when the payload meets or exceeds 2^(8q) bytes.", "inputs": "SC_EDK; flags;", "outputs": "Status return. Plaintext or ciphertext data;", "secFunImpl": "Symmetric Key Generatio n Auth Block Cipher UnAuth Block Cipher", "rolesSspAccess": "CO - SC_EDK: E,W - AES GCM IV: W,E"}, {"name": "Zeroise", "description": "FreeRng_ fips destroys RNG CSPs. All functions zeroise CSPs using function ForceZer o (overwriti ng with zeros) within the function scope after use. Caller stack cleanup is the duty of the applicatio n. Restarting the general- purpose computer clears all CSPs in RAM.", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "DRBG struct (RBG State) or other structures containing SSPs", "outputs": "Status return", "secFunImpl": "None", "rolesSspAccess": "CO - DS_SGK: Z - GKP_Priv ate: Z - KAS_Priv ate: Z - KAS_SS C: Z - KD_DKM: Z - KH_Key: Z - Seed: Z - Internal State: Z - Secret C: Z - Secret V: Z - SC_EDK: Z - Entropy Input String: Z - AES GCM IV: Z"}, {"name": "Show Version", "description": "Provide Module Version", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "None", "outputs": "Plaintext containing the module version", "secFunImpl": "None", "rolesSspAccess": "CO"}, {"name": "RSA Primitiv e Service", "description": "Perform RSA Decryptio n Primitive", "indicator": "Successful completion of the service (status code >= 0)", "inputs": "Key, DRBG, buffers with data and sizes", "outputs": "buffers with data and size", "secFunImpl": "RSA Primitive", "rolesSspAccess": "CO - DS_SGK: W,E,Z"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "Digital Signature", "description": "For ECDSA, Non-approved and not-allowed when the hashlen (Verify) and inlen (Sign) are less than WC_MIN_DIGEST_SIZE or the ECC public key imported to the module exceeds P-521.", "alg_accessed": "ECDSA", "role": "CO"}, {"name": "Generate Key Pair", "description": "For DH, Non-approved and not-allowed when the private key length is less than 2048-bits or if it exceeds 8192- bits. For RSA, Non-approved and not-allowed when the public exponent \"e\" is less than 65537.", "alg_accessed": "DH RSA", "role": "CO"}, {"name": "Key Agreement", "description": "For ECDH, Non-approved and not-allowed when the ECC public key imported to the module exceeds P-521.", "alg_accessed": "ECDH", "role": "CO"}, {"name": "Keyed Hash", "description": "For AES-CMAC, Non-approved and not-allowed when the cumulative input size exceeds 2^(32) -1, the CMAC tag length is less than 64-bits, or the CMAC tag length is greater than 128-bits.", "alg_accessed": "AES-CMAC", "role": "CO"}, {"name": "Symmetric cipher", "description": "For AES-GCM, Non-approved and not-allowed when the IV length is less than 96 bits. For AES-CCM, Non- approved and not-allowed when the payload meets or exceeds 2^(8q) bytes.", "alg_accessed": "AES-GCM AES-CCM", "role": "CO"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": false, "entries": []}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "S1", "description": "RAM (Memory)", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "IE1", "source": "EXT: Call stack (API) input parameters", "dest": "INT", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "IE2", "source": "INT: Call stack (API) output parameters", "dest": "EXT", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "IE3", "source": "EXT: Loaded from external entropy source", "dest": "INT", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Z1", "description": "cleared immediately after use", "rationale": "Module does not store SSPs persistently", "operatorId": "Zeroise"}, {"method": "Z2", "description": "Per ISO/IEC 19790:2012 section 7.9.7, parameters used solely for self-test purposes in 7.10 need not meet zeroisation requirements", "rationale": "FIPS 140-3 IG 9.7.B", "operatorId": ""}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "HMAC- SHA2-256", "testProps": "hash type: SHA256, key length: 32-bytes.", "testMethod": "KAT", "type": "SW/FW Integrity", "indicator": "FIPS_MODE_NORMAL or FIPS_MODE_FAILED", "details": "MAC"}, {"algorithmOrTest": "", "testProps": "Please note this is the module integrity test", "testMethod": "", "type": "", "indicator": "", "details": ""}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES- CBC Encrypt (A7470)", "testProps": "key length: 32-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Encrypt", "condition": "Before first use of algorithm( s) AES- ECB, AES- CBC, AES- CTR, AES- OFB, AES- GCM, AES- GMAC, AES- CCM or AES- CMAC"}, {"algorithmOrTest": "AES- CBC Decrypt (A7470)", "testProps": "key length: 32-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Decrypt", "condition": "Before first use of algorithm( s) AES- ECB,"}, {"algorithmOrTest": "Algorit hm or Test", "testProps": "Test Properties", "testMethod": "Test Meth od", "type": "Test Typ e", "indicator": "Indicator", "details": "Details", "condition": "Conditio ns AES- CBC, AES- CTR, AES- OFB, AES- GCM,"}, {"algorithmOrTest": "AES- GCM Encrypt (A7470)", "testProps": "key length: 32-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Encrypt", "condition": "AES- GMAC, AES- CCM or AES- CMAC Before first use of algorithm( s) AES- GCM or AES- GMAC"}, {"algorithmOrTest": "AES- GCM Decrypt (A7470)", "testProps": "key length: 32-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Decrypt", "condition": "Before first use of algorithm( s) AES- GCM or AES- GMAC"}, {"algorithmOrTest": "HMAC- SHA-1 (A7470)", "testProps": "hash type: SHA1; key length: 20- bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "MAC", "condition": "Before first use of algorithm( s) SHA1 or HMAC- SHA1"}, {"algorithmOrTest": "HMAC- SHA2- 256 (A7470)", "testProps": "hash type: SHA256; key length: 20-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "MAC", "condition": "Before first use of algorithm( s) SHA224, SHA256, HMAC- SHA224"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": "or HMAC- SHA256"}, {"algorithmOrTest": "HMAC- SHA2- 512 (A7470)", "testProps": "hash type: SHA2-512, key length: 20-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "MAC", "condition": "Before first use of algorithm( s) SHA384, SHA512, HMAC- SHA384 or HMAC- SHA512"}, {"algorithmOrTest": "HMAC- SHA3- 256 (A7470)", "testProps": "hash type: SHA3-256, key length: 64-bytes", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "MAC", "condition": "Before first use of algorithm( s) SHA3- 224, SHA3- 256, SHA3- 384 or SHA3- 512, HMAC- SHA3- 224, HMAC- SHA3- 256, HMAC- SHA3- 384 or HMAC- SHA3- 512"}, {"algorithmOrTest": "RSA SigGen (FIPS18 6-5) (A7470)", "testProps": "RSA- PKCSv1.5, hash type: SHA256; key length: 2048-bits", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Sign", "condition": "Before first use of algorithm( s) RSA (PKCSv1. 5) or RSA"}, {"algorithmOrTest": "RSA SigVer", "testProps": "RSA- PKCSv1.5,", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or", "details": "Verify", "condition": "(PSS) Before first use"}, {"algorithmOrTest": "(FIPS18 6-5) (A7470)", "testProps": "hash type: SHA256, key length: 2048-bits", "testMethod": "", "type": "", "indicator": "FIPS_CAST_STATE_FAI LURE", "details": "", "condition": "of algorithm( s) RSA (PKCSv1. 5) or RSA (PSS)"}, {"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A7470)", "testProps": "hashType: SHA2-256; curve: P-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Computatio n Shared Secret Z", "condition": "Before first use of algorithm( s) ECC for shared secret generatio n"}, {"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A7470)", "testProps": "hashType: SHA2-256; keySize: 2048-bit;", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Computatio n Shared Secret Z", "condition": "Before first use of algorithm( s) FFC for shared secret generatio n"}, {"algorithmOrTest": "ECDSA SigGen (FIPS18 6-5) (A7470)", "testProps": "curve: P256; hashType: SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Sign", "condition": "Before first use of algorithm( s) ECDSA"}, {"algorithmOrTest": "ECDSA SigVer (FIPS18 6-5) (A7470)", "testProps": "curve: P256; hashType: SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Verify", "condition": "Before first use of algorithm( s) ECDSA"}, {"algorithmOrTest": "TLS v1.2 KDF RFC76 27 (A7470)", "testProps": "HMAC- SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Derive Keying Material", "condition": "Before first use of TLSv1.2 KDF"}, {"algorithmOrTest": "TLS v1.3 KDF (A7470)", "testProps": "HMAC- SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Derive Keying Material", "condition": "Before first use of TLSv1.3 KDF"}, {"algorithmOrTest": "KDF SSH (A7470)", "testProps": "hashType: SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Derive Keying Material", "condition": "Before first use of KDF SSH"}, {"algorithmOrTest": "RSA PCT", "testProps": "key size: 2048,3072,4 096", "testMethod": "PCT", "type": "PCT", "indicator": "Service is successful or an error code RSA_KEY_PAIR_E", "details": "Sign/Verify", "condition": "Invoked automatic ally during generate key pair service"}, {"algorithmOrTest": "ECC- PCT", "testProps": "curve size: 224, 256, 384, 521", "testMethod": "PCT", "type": "PCT", "indicator": "Service is successful or an error code ECC_PCT_E", "details": "Sign/Verify", "condition": "Invoked automatic ally during generate key pair service"}, {"algorithmOrTest": "DH- PCT", "testProps": "key size: 2048, 3072, 4096", "testMethod": "PCT", "type": "PCT", "indicator": "Service is successful or an error code MP_CMP_E", "details": "Modulus Exponentia tion", "condition": "Invoked automatic ally during generate key pair service"}, {"algorithmOrTest": "Hash DRBG (A7470)", "testProps": "DRBG mode: SHA2-256", "testMethod": "KAT", "type": "CAS T", "indicator": "FIPS_CAST_STATE_SU CCESS or FIPS_CAST_STATE_FAI LURE", "details": "Health-Test with sub- elements: Instantiate, Generate, Reseed", "condition": "Before first use of algorithm( s) DBRG or Immediat ely upon registerin g an external entropy source with the module"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "FIPS_MODE_FAILED", "description": "Module has failed its software integrity check", "conditions": "HMAC- SHA2- 256 CAST Failure Module Integrity Check", "recoveryMethod": "Power Cycle", "indicator": "fipsModeId set to FIPS_MODE_FAILED (3)"}, {"name": "FIPS_CAST_STATE_F AILURE", "description": "One or more algorithm(s) are no longer usable and the module mode is set to FIPS_MODE_DEG RADED (2)", "conditions": "Failure AES- CBC AES- GCM HMAC- SHA1 HMAC- SHA2- 256 HMAC- SHA2- 512 HMAC- SHA3- 256 RSA- PKCSv1 .5 DRBG ECC Diffie- Hellman FFC Diffie-", "recoveryMethod": "Power Cycle", "indicator": "One or more algorithms CAST status values set to FIPS_CAST_STATE_F AILURE (3)"}, {"name": "", "description": "", "conditions": "Hellman ECDSA TLSv1.2 KDF TLSv1.3 KDF KDF SSH", "recoveryMethod": "", "indicator": ""}, {"name": "FIPS_MODE_DEGRA DED", "description": "One or more of the CASTS have failed anytime following a successful power on and integrity check. Upon entering this mode the module will automatically run all CASTS prior to the operational use of any cryptographic algorithm.", "conditions": "Any CAST Failure", "recoveryMethod": "Power Cycle", "indicator": "fipsModeId set to FIPS_MODE_DEGRA DED (2)"}, {"name": "RSA_KEY_PAIR_E", "description": "RSA Pairwise Consistency Test Failure", "conditions": "RSA- PCT", "recoveryMethod": "Manual self- test service call or power cycle", "indicator": "RSA_KEY_PAIR_E (- 262)"}, {"name": "ECC_PCT_E", "description": "ECC Pairwise Consistency Test Failure", "conditions": "ECC- PCT", "recoveryMethod": "Manual self- test service call or power cycle", "indicator": "ECC_PCT_E (-286)"}, {"name": "MP_CMP_E", "description": "DH Pairwise Consistency Test Failure", "conditions": "DH-PCT", "recoveryMethod": "Manual self- test service call or power cycle", "indicator": "MP_CMP_E (-120)"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["RSA SigVer (FIPS186-5)A7470", "HMAC-SHA2-256A7470", "SHA2-512A7470", "RSA Decryption Primitive Sp800-56Br2A7470", "HMAC-SHA2-224A7470", "SHA2-384A7470", "ECDSA SigVer (FIPS186-5)A7470", "RSA KeyGen (FIPS186-5)A7470", "AES-CBCA7470", "HMAC-SHA-1A7470", "TLS v1.3 KDFA7470", "KAS-ECC-SSC Sp800-56Ar3A7470", "AES-CCMA7470", "DSA KeyGen (FIPS186-4)A7470", "SHA3-256A7470", "SHA3-224A7470", "AES-ECBA7470", "ECDSA KeyGen (FIPS186-5)A7470", "HMAC-SHA3-256A7470", "SHA2-256A7470", "AES-GMACA7470", "RSA SigGen (FIPS186-5)A7470", "SHA-1A7470", "KDF TLSA7470", "TLS v1.2 KDF RFC7627A7470", "#A7470", "HMAC-SHA2-384A7470", "KDF SSHA7470", "SHA2-224A7470", "KAS-FFC-SSC Sp800-56Ar3A7470", "Hash DRBGA7470", "HMAC-SHA3-512A7470", "ECDSA SigGen (FIPS186-5)A7470", "AES-OFBA7470", "HMAC-SHA3-224A7470", "SHA3-512A7470", "ECDSA KeyVer (FIPS186-5)A7470", "AES-CMACA7470", "AES-GCMA7470", "SHA3-384A7470", "HMAC-SHA3-384A7470", "HMAC-SHA2-512A7470", "AES-CTRA7470"]}, "extracted_versions": {"_type": "Set", "elements": ["-"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "cba4816ca1dc0e8928dee51c5d084f946f9307dcd3112f9106f75d685e0c8ee6", "txt_hash": "adc1a616ef841d3a1c977ebf2cc1c7972ccc038f6f18aafa2ac6657f48abd792", "json_hash": "73f76953a249d1eed0a5f33d3ee19e87465a44eda343e0fb07215122f3f5ebb5"}}}