{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "874ed62968b0bdda", "cert_id": 5563, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "FortiGate-VM 7.2/7.4", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-10-29", "validation_type": "Initial", "lab": "Lightship Security, Inc."}], "vendor_url": "http://www.fortinet.com", "vendor": "Fortinet, Inc.", "certificate_pdf_url": null, "module_type": "Software", "standard": "FIPS 140-3", "status": "active", "level": 1, "caveat": "When installed, initialized and configured as specified in Sections 2 and 11 of the Security Policy", "exceptions": ["Roles, services, and authentication: Level 3", "Physical security: N/A", "Non-invasive security: N/A", "Life-cycle assurance: Level 2"], "embodiment": "MultiChipStand", "description": "FortiGate-VM 7.2/7.4 is a software module designed to execute on a General Purpose Computer (GPC) hardware platform running the VMware hypervisor. The module provides integrated firewall, VPN, antivirus, antispam, intrusion prevention, content filtering, traffic shaping, and HA capabilities.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-10-28", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 1": 3, "level 1": 1}}, "fips_certlike": {"Certlike": {"HMAC-SHA-1": 6, "SHA2-256": 16, "SHA2-384": 7, "SHA2-512": 6, "SHA-1": 10, "SHA2-224": 5, "SHA3-256": 6, "SHA2- 256": 1, "SHA-2": 2, "AES-256": 4, "AES-128": 1, "AES-192": 1, "DRBG 256": 1, "DRBG 384": 1, "DRBG 128": 1}}, "vendor": {"Microsoft": {"Microsoft": 1}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-256": 4, "AES-128": 1, "AES-192": 1, "AES": 4}, "CAST": {"CAST": 34}}, "constructions": {"MAC": {"HMAC": 1}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 29}, "ECDSA": {"ECDSA": 36}}, "FF": {"DH": {"Diffie-Hellman": 5, "DHE": 1, "DH": 35}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 10}, "SHA2": {"SHA-2": 2}, "SHA3": {"SHA3-256": 6}}}, "crypto_scheme": {"MAC": {"MAC": 13}, "AEAD": {"AEAD": 1}}, "crypto_protocol": {"SSH": {"SSH": 35, "SSHv2": 1}, "TLS": {"SSL": {"SSL": 2}, "TLS": {"TLS 1.2": 18, "TLS v1.2": 2, "TLS v1.3": 2, "TLS 1.3": 18, "TLS": 23}}, "IKE": {"IKEv1": 9, "IKEv2": 11, "IKE": 35}, "IPsec": {"IPsec": 17}, "VPN": {"VPN": 17}}, "randomness": {"PRNG": {"DRBG": 37}, "RNG": {"RBG": 2}}, "cipher_mode": {"CBC": {"CBC": 14}, "GCM": {"GCM": 14}}, "ecc_curve": {"NIST": {"P-256": 12, "P-384": 10, "P-521": 10}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 15}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 15, "FIPS186-5": 17, "FIPS 186-5": 8, "FIPS 198-1": 5, "FIPS 180-4": 1, "FIPS 202": 1, "FIPS140-3": 1}, "NIST": {"SP 800-38A": 1, "SP 800-38D": 1, "SP 800-90A": 1, "SP 800-56A": 3, "SP 800-135": 5, "SP 800-186": 1}, "RFC": {"RFC7627": 1, "RFC 8446": 1, "RFC 4106": 1, "RFC 5282": 1, "RFC 7296": 1, "RFC 5647": 1}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 899701, "pdf_is_encrypted": false, "pdf_number_of_pages": 54, "/Producer": "Microsoft\u00ae Word for Microsoft 365", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20261022160839-04'00'", "/ModDate": "D:20261022160839-04'00'", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://blog.fortinet.com/", "https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/954635", "https://docs.fortinet.com/", "https://www.fortinet.com/contact", "https://www.fortinet.com/doc/legal/EULA.pdf", "https://wwww.fortiguard.com/", "https://video.fortinet.com/", "https://csrc.nist.gov/projects/cryptographic-module-validation-program", "https://www.fortinet.com/support-and-training/training.html", "https://training.fortinet.com/", "https://www.fortinet.com/products", "https://docs.fortinet.com/document/fortigate/7.2.8/cli-reference/84566/fortios-cli-reference", "https://docs.fortinet.com/document/fortigate/7.2.8/fortios-log-message-reference/524940/introduction", "https://support.fortinet.com/", "https://fortiguard.com/"]}}, "module_algorithms": {"_type": "Set", "elements": ["TLS v1.2 KDF RFC7627A6833", "ECDSA SigVer (FIPS186-5)A6833", "RSA SigGen (FIPS186-5)A6833", "HMAC-SHA2-256A6833", "SHA-1A6833", "SHA3-256A4977", "Safe Primes Key GenerationA6833", "SHA2-256A6833", "HMAC-SHA2-384A6833", "KAS-FFC-SSC Sp800-56Ar3A6833", "RSA SigVer (FIPS186-5)A6833", "SHA2-512A6833", "KDF IKEv1A6833", "KAS-ECC-SSC Sp800-56Ar3A6833", "KDF IKEv2A6833", "SHA2-224A6833", "SHA2-384A6833", "RSA KeyGen (FIPS186-5)A6833", "HMAC-SHA-1A6833", "AES-CBCA6833", "ECDSA KeyGen (FIPS186-5)A6833", "TLS v1.3 KDFA6833", "HMAC-SHA2-512A6833", "KDF SSHA6833", "AES-GCMA6833", "ECDSA SigGen (FIPS186-5)A6833", "Counter DRBGA6831", "HMAC-SHA2-224A6833"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A6832", "#A6833", "#A6831", "#A6800", "#A4977"]}, "is_br1_format": true, "br1_deviations": 2, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "1"}, {"section": "2", "title": "Cryptographic module specification", "level": "1"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "1"}, {"section": "4", "title": "Roles, services, and authentication", "level": "3"}, {"section": "5", "title": "Software/Firmware security", "level": "1"}, {"section": "6", "title": "Operational environment", "level": "1"}, {"section": "7", "title": "Physical security", "level": "N/A"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "1"}, {"section": "10", "title": "Self-tests", "level": "1"}, {"section": "11", "title": "Life-cycle assurance", "level": "2"}, {"section": "12", "title": "Mitigation of other attacks", "level": "1"}, {"section": "", "title": "Overall Level", "level": "1"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"packageFileName": "FGT_VM64-v7.2.8FIPS-CC-72-4-build9543- FORTINET.out", "swFwVersion": "FIPS-CC-72-4 (7.2)", "features": "", "integrityTest": "Signature verification"}, {"packageFileName": "FGT_VM64-v7.4.4FIPS-CC-74-2-build8537- FORTINET.out", "swFwVersion": "FIPS-CC-74-2 (7.4)", "features": "", "integrityTest": "Signature verification"}]}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "FortiOS", "hardwarePlatform": "PacStar 451", "processors": "Intel Xeon D- 1559", "paa_pai": "No", "hypervisorHostOs": "VMware ESXi 6.7", "version": "FIPS-CC-72-4 (7.2) FIPS-CC-74-2 (7.4)"}]}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "Amazon Linux 2027", "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)"}, {"operatingSystem": "Amazon Linux 2023", "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)"}, {"operatingSystem": "Amazon Linux 2", "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)"}, {"operatingSystem": "Azure Linux 3.0", "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)"}, {"operatingSystem": "Azure Local v12", "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)"}]}, "modes_of_operation": {"section": 2, "subsection": 4, "found": false, "entries": []}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A6800, A6831, A6832, A6833", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A6800, A6831, A6832, A6833", "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 16, 128, 136, 256, 264 AAD Length - AAD Length: 0, 128, 136, 256", "reference": "SP 800-38D"}, {"algorithm": "Counter DRBG", "cavpCertName": "A6800, A6831", "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0-256 Increment 256 Returned Bits - 256", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A6832, A6833", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - extra bits, testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A6832, A6833", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A6832, A6833", "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-5"}, {"algorithm": "HMAC-SHA-1", "cavpCertName": "A6832, A6833", "properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-224", "cavpCertName": "A6832, A6833", "properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A6832, A6833", "properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-384", "cavpCertName": "A6832, A6833", "properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-512", "cavpCertName": "A6832, A6833", "properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A6832, A6833", "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC-SSC Sp800-56Ar3", "cavpCertName": "A6832, A6833", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF IKEv1 (CVL)", "cavpCertName": "A6832, A6833", "properties": "Authentication Method - Digital Signature, Pre-shared Key, Public Key Encryption Initiator Nonce Length - Initiator Nonce Length: 64-2048 Increment 8 Responder Nonce Length - Responder Nonce Length: 64-2048 Increment 8 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224-8192 Increment 8 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512 Preshared Key Length - Preshared Key Length: 8-8192 Increment 8", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A6832, A6833", "properties": "Initiator Nonce Length - Initiator Nonce Length: 64-128 Increment 8 Responder Nonce Length - Responder Nonce Length: 64-128 Increment 8 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224-8192 Increment 8 Derived Keying Material Length - Derived Keying Material Length: 160-16384 Increment 8 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A6832, A6833", "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A6832, A6833", "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A6832, A6833", "properties": "Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A6832", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Public Exponent Mode - random Mask Function - MGF1", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A6833", "properties": "Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "Safe Primes Key Generation", "cavpCertName": "A6832, A6833", "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "cavpCertName": "A6832, A6833", "properties": "Message Length - Message Length: 0-65528 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA3-256", "cavpCertName": "A4977", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 202"}, {"algorithm": "TLS v1.2 KDF RFC7627 (CVL)", "cavpCertName": "A6832, A6833", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "TLS v1.3 KDF (CVL)", "cavpCertName": "A6832, A6833", "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE", "reference": "SP 800-135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": false, "entries": []}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "N/A", "logicalInterface": "Data Input", "data": "Network traffic, passwords, user data, new software images, configuration data, configuration file"}, {"physicalPort": "N/A", "logicalInterface": "Data Output", "data": "Network traffic, configuration file"}, {"physicalPort": "N/A", "logicalInterface": "Control Input", "data": "Commands"}, {"physicalPort": "N/A", "logicalInterface": "Status Output", "data": "Module status and configuration information"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "IPSec", "description": "Establishing a secure connection over IPSec", "mechanism": "KAS-IPSec", "strength": "1 in 5.2x10^33", "perMinute": "1 in 6.6x10^24"}, {"name": "Password", "description": "Username and password", "mechanism": "Operator authentication", "strength": "1 in 2.8x10^15", "perMinute": "1 in 111262"}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Admin", "type": "Identity", "operatorType": "CO", "authMethodList": "Password"}, {"name": "User", "type": "Identity", "operatorType": "User", "authMethodList": "None"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Add/delete operator", "description": "Add or delete operator account", "indicator": "System Logs", "inputs": "User data", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin - Crypto officer password: Z"}, {"name": "Authenticate to Module", "description": "Crypto Officer authenticates to the module over CLI/GUI", "indicator": "System Logs", "inputs": "Password", "outputs": "Status", "secFunImpl": "Operator authentication", "rolesSspAccess": "User - Crypto officer password: W"}, {"name": "Backup/restore configuration file", "description": "Backup/restore configuration file", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "Configuration backup", "rolesSspAccess": "Admin - Configuration encryption key: E - Configuration backup key: E - Crypto officer password: None"}, {"name": "Connect the module to remote FortiAnalyzer for transferring module's local logs to FortiAnalyzer using TLS", "description": "Connect to FortiAnalyzer for log transfer via OFTP over TLS", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "KAS-TLS12 Random number CKG", "rolesSspAccess": "Admin - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS-PMS: G,E,Z"}, {"name": "Name", "description": "Description", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP Access - TLS12-MS: G,E,Z - TLS-SAK: G - TLS-SEK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key: W,E,Z - DH-SS: G"}, {"name": "Connect to module remotely for web admin using SSH", "description": "The module offers authentication over console port", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "Entropy KAS-SSH Random number CKG", "rolesSspAccess": "- ECDH-SS: G - GCM-IV: G Admin - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - SSH-SS: G,E,Z - SSH-IK: G - SSH-EK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - SSH client public key: W,E,Z - SSH server public key: R - DH-SS: G - ECDH-SS: G"}, {"name": "Connect to module remotely for web admin using TLS 1.2", "description": "The module offers authentication over TLS 1.2", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "KAS-TLS12 Random number CKG", "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS13-HS: G,E,Z - TLS13-HTS: G,E,Z - TLS13-MS: G,E,Z - TLS13-TK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key: W,E,Z - TLS Server Public Key: R - DH-SS: G - ECDH-SS: G - GCM-IV: G"}, {"name": "Connect to module remotely for web admin using TLS 1.3", "description": "The module offers authentication over TLS 1.3", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "KAS-TLS13 Random number CKG", "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS-PMS: G,E,Z - TLS12-MS: G,E,Z - TLS-SAK: G - TLS-SEK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "W,E,Z - TLS Server Public Key: R"}, {"name": "Enable approved mode of operation (Console only)", "description": "Enable approved mode of operation", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "Configuration integrity", "rolesSspAccess": "Admin - Configuration integrity key: E"}, {"name": "Enable/disable alternating bypass mode", "description": "Configure the IPSec VPN policies", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "Configuration integrity", "rolesSspAccess": "Admin - Configuration integrity key: E"}, {"name": "Establish IPsec connection", "description": "Establish IPsec connection", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "KAS-IPSec Random number CKG", "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - IKE-PSK: G,E - SKEYID: G,E,Z - SKEYID_e: G - SKEYID_a: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - IKE RSA Peer Public key: W,E,Z - IKE ECDSA Peer Public Key: W,E,Z - SKEYSEED: G,E,Z - SK_a: G - SK_e: G - IKE RSA Public Key: R - IKE ECDSA Public Key: R"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- DH-SS: G - ECDH-SS: G"}, {"name": "Execute FIPS-CC on-demand self- tests (console only)", "description": "Execute self tests manually", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "SW Authentication", "rolesSspAccess": "Admin - Software update key: E"}, {"name": "Execute factory reset (disable approved mode, Console only)", "description": "Zeroise the module", "indicator": "System Reboot", "inputs": "Command", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Admin - Crypto officer password: Z - Configuration integrity key: Z - Configuration encryption key: Z - Configuration backup key: Z - Software update key: Z - IPSec Manual Authentication key: Z - IPsec Manual Encryption key: Z - IKE RSA Private Key: Z - IKE RSA Public Key: Z - IKE ECDSA Private Key: Z - IKE ECDSA Public Key: Z - HA Password: Z - HA Encryption key: Z - TLS Server Private Key: Z - TLS Server Public Key: Z - SSH server private key: Z - SSH server public key: Z"}, {"name": "Execute software update", "description": "Execute software update", "indicator": "System Logs", "inputs": "SW image", "outputs": "Status", "secFunImpl": "SW Authentication", "rolesSspAccess": "Admin - Software update key: E"}, {"name": "Format log disk (console only)", "description": "Format log disk", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Generate CSR", "description": "Generate certificate signing request", "indicator": "System Logs", "inputs": "Command", "outputs": "CSR", "secFunImpl": "ECDSA CSR RSA CSR Random number CKG", "rolesSspAccess": "Admin - IKE RSA Private Key: G,E - IKE RSA Public Key: G,R,E - IKE ECDSA Private Key: G,E - IKE ECDSA Public Key: G,R,E - DRBG Output: E"}, {"name": "Generate entropy", "description": "Generate entropy for seeding the DRBG (Cannot be operator invoked)", "indicator": "Implicit", "inputs": "Command", "outputs": "Entropy", "secFunImpl": "Entropy", "rolesSspAccess": "Unauthenticated - Entropy input: G"}, {"name": "Generate random number", "description": "Generate random number for other module service (Cannot be operator invoked)", "indicator": "Implicit", "inputs": "Entropy", "outputs": "Random number", "secFunImpl": "Random number", "rolesSspAccess": "Unauthenticated - Entropy input: E - DRBG Seed: G - DRBG V: G,E - DRBG Key: G,E - DRBG Output: G"}, {"name": "Modify operator preferences", "description": "Modify operator preferences", "indicator": "System Logs", "inputs": "User data", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Read log data", "description": "Read log data", "indicator": "System Logs", "inputs": "Command", "outputs": "Log data", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Read/set/delete/modify HA configuration", "description": "Configure the module's high availability ports", "indicator": "System Logs", "inputs": "Configuration data", "outputs": "Status", "secFunImpl": "Configuration integrity", "rolesSspAccess": "Admin - HA Password: W - HA Encryption key: W - Configuration integrity key: E"}, {"name": "Read/set/delete/modify IPSec/SSL VPN configuration", "description": "Configure the module's VPN", "indicator": "System Logs", "inputs": "Configuration data", "outputs": "Status", "secFunImpl": "Configuration integrity", "rolesSspAccess": "Admin - IPSec Manual Authentication key:"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "W - IPsec Manual Encryption key: W"}, {"name": "Read/set/delete/modify configuration", "description": "Configure the module", "indicator": "System Logs", "inputs": "Configuration data", "outputs": "Status", "secFunImpl": "Configuration integrity", "rolesSspAccess": "Admin"}, {"name": "Set/reset operator password", "description": "Sets or resets an operator password", "indicator": "System Logs", "inputs": "Command, password", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin - Crypto officer password: W"}, {"name": "Show approved mode enabled (console/cli only)", "description": "Display the module's mode", "indicator": "System Logs", "inputs": "Command", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Show system status", "description": "Show system status", "indicator": "Status displayed via CLI/GUI", "inputs": "Command", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Show version", "description": "Display the version of the module", "indicator": "Status displayed via CLI/GUI", "inputs": "Command", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Admin"}, {"name": "Traffic over HTTP", "description": "Traffic over HTTP", "indicator": "Implicit", "inputs": "HTTP request", "outputs": "HTTP data", "secFunImpl": "Transfer data with GCM Transfer data with CBC", "rolesSspAccess": "User - TLS-SAK: E - TLS-SEK: E - TLS13-TK: E - GCM-IV: E"}, {"name": "Traffic over IPsec", "description": "Traffic over IPsec", "indicator": "Implicit", "inputs": "Traffic data", "outputs": "Traffic data", "secFunImpl": "Transfer data with GCM Transfer data with CBC", "rolesSspAccess": "User - SKEYID_a: E - SKEYID_e: E - SK_a: E - SK_e: E - IPSec Manual Authentication key: E - IPsec Manual Encryption key: E - GCM-IV: E"}, {"name": "Traffic over SSH", "description": "Traffic over SSH", "indicator": "Implicit", "inputs": "SSH Command", "outputs": "Status", "secFunImpl": "Transfer data with GCM Transfer data with CBC", "rolesSspAccess": "Admin - SSH-IK: E - SSH-EK: E - GCM-IV: E"}, {"name": "Key encrypt", "description": "Encryption of the pre-shared key used for reestablishing IPSec tunnels. (Cannot be operator invoked)", "indicator": "Implicit", "inputs": "-", "outputs": "-", "secFunImpl": "Key encrypt", "rolesSspAccess": "User - Configuration encryption key: E - IKE-PSK: None"}, {"name": "Key decrypt", "description": "Decryption of static keys used for authentication in network protocols. Decryption of previously established IPSec pre shared key. (Cannot be operator invoked)", "indicator": "Implicit", "inputs": "-", "outputs": "-", "secFunImpl": "Key decrypt", "rolesSspAccess": "Admin - Configuration encryption key: E - IPSec Manual Authentication key: None - IKE-PSK: None - IKE RSA Private Key: None - IKE RSA Public Key: None - IKE ECDSA Private Key: None - IKE ECDSA Public Key: None - HA Encryption key: None - HA Password: None - SSH server private key: None - SSH server public key: None"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": false, "entries": []}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": false, "entries": []}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "Software image", "description": "Embedded in the software image", "persistance": "Static"}, {"name": "RAM", "description": "SRDAM of host device", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Public Key import", "source": "External network device", "dest": "RAM", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Password", "source": "External network device", "dest": "RAM", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Preloaded", "source": "Manufacturer", "dest": "Software image", "format": "Plaintext", "distribution": "N/A", "entry": "N/A", "sfiAlgo": ""}, {"name": "Public Key export", "source": "RAM", "dest": "External network device", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Auto", "description": "Automatic zeroisation of SSPs that are no longer needed.", "rationale": "Memory is overwritten with 0's", "operatorId": "N/A"}, {"method": "Reboot", "description": "Power-cycle the host device", "rationale": "All RAM is zeroised by a power-cycle.", "operatorId": "Unplugging the device"}, {"method": "Service", "description": "Invoking the service to zeroise all SSPs in persistent storage. Causes an automatic reboot of the host device that zeroises all SSPs in volatile memory.", "rationale": "The CLI command overwrites the storage location keys with 0's, making them irretrievable", "operatorId": "Issue the CLI command : execute erase-disk"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "Configuration integrity", "testProps": "HMAC-SHA2-256", "testMethod": "MAC", "type": "Critical Function", "indicator": "Console message", "details": "MAC verification"}, {"algorithmOrTest": "Software integrity", "testProps": "RSA 2048-bit, using SHA2-256", "testMethod": "SigVer", "type": "SW/FW Integrity", "indicator": "Console message", "details": "Signature verification"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES", "testProps": "AES-ECB, 128 bit", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Encrypt, decrypt", "condition": "On boot"}, {"algorithmOrTest": "AES-GCM", "testProps": "256-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Encrypt, decrypt", "condition": "On boot"}, {"algorithmOrTest": "DH key pairs", "testProps": "-", "testMethod": "PCT", "type": "PCT", "indicator": "Console message", "details": "Sign, verify", "condition": "On key generation"}, {"algorithmOrTest": "DRBG", "testProps": "AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Instantiate, generate, reseed", "condition": "On boot"}, {"algorithmOrTest": "EC DH key pairs", "testProps": "-", "testMethod": "PCT", "type": "PCT", "indicator": "Console message", "details": "Sign, verify, calculate public key", "condition": "On key generation"}, {"algorithmOrTest": "ECC-SSC", "testProps": "P-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Compute", "condition": "On boot"}, {"algorithmOrTest": "ECDSA", "testProps": "P-256, P-384, P-521", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Sign, verify", "condition": "On boot"}, {"algorithmOrTest": "ECDSA key pairs", "testProps": "-", "testMethod": "PCT", "type": "PCT", "indicator": "Console message", "details": "Sign verify, calculate public key", "condition": "On key generation"}, {"algorithmOrTest": "FFC-SSC", "testProps": "MODP-2048", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Compute", "condition": "On boot"}, {"algorithmOrTest": "Software load", "testProps": "RSA 2048-bit with SHA-1 or SHA2- 256", "testMethod": "SigVer", "type": "SW/FW Load", "indicator": "Console message", "details": "-", "condition": "On SW load"}, {"algorithmOrTest": "IKEv1 KDF", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Derive", "condition": "On boot"}, {"algorithmOrTest": "IKEv2 KDF", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Derive", "condition": "On boot"}, {"algorithmOrTest": "RSA", "testProps": "2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Sign, verify", "condition": "On boot"}, {"algorithmOrTest": "RSA key pairs", "testProps": "-", "testMethod": "PCT", "type": "PCT", "indicator": "Console message", "details": "Sign, verify, encrypt, decrypt", "condition": "On key generation"}, {"algorithmOrTest": "SHA-1", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Hash", "condition": "On boot"}, {"algorithmOrTest": "SHA-2", "testProps": "SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Hash", "condition": "On boot"}, {"algorithmOrTest": "SSH KDF", "testProps": "SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Derive", "condition": "On boot"}, {"algorithmOrTest": "TLS 1.2 KDF", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Derive", "condition": "On boot"}, {"algorithmOrTest": "TLS 1.3 KDF", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console message", "details": "Derive", "condition": "On boot"}, {"algorithmOrTest": "APT", "testProps": "Adaptive proportion test", "testMethod": "FDT", "type": "CAST", "indicator": "Module Halt", "details": "-", "condition": "On generation"}, {"algorithmOrTest": "RCT", "testProps": "Repetition count test", "testMethod": "FDT", "type": "CAST", "indicator": "Module Halt", "details": "-", "condition": "On generation"}, {"algorithmOrTest": "SHA3-256 (A4977)", "testProps": "SHA3-256", "testMethod": "KAT", "type": "CAST", "indicator": "Console Message", "details": "Hash", "condition": "On boot"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Error mode", "description": "All data output and cryptographic services are inhibited in the error state.", "conditions": "If any self- test fails", "recoveryMethod": "Power cycling", "indicator": "Self-tests failed Entering error mode... The system is going down NOW !! The system is halted"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["TLS v1.2 KDF RFC7627A6833", "ECDSA SigVer (FIPS186-5)A6833", "RSA SigGen (FIPS186-5)A6833", "HMAC-SHA2-256A6833", "SHA-1A6833", "#A6833", "SHA3-256A4977", "Safe Primes Key GenerationA6833", "SHA2-256A6833", "HMAC-SHA2-384A6833", "KAS-FFC-SSC Sp800-56Ar3A6833", "RSA SigVer (FIPS186-5)A6833", "SHA2-512A6833", "#A6831", "KDF IKEv1A6833", "KAS-ECC-SSC Sp800-56Ar3A6833", "KDF IKEv2A6833", "#A6800", "SHA2-224A6833", "SHA2-384A6833", "RSA KeyGen (FIPS186-5)A6833", "#A6832", "HMAC-SHA-1A6833", "ECDSA KeyGen (FIPS186-5)A6833", "AES-CBCA6833", "TLS v1.3 KDFA6833", "HMAC-SHA2-512A6833", "KDF SSHA6833", "AES-GCMA6833", "ECDSA SigGen (FIPS186-5)A6833", "Counter DRBGA6831", "#A4977", "HMAC-SHA2-224A6833"]}, "extracted_versions": {"_type": "Set", "elements": ["7.2", "7.4"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "c72708f22919ae34095d85c977c46263280b24391060fd7a25b57f07b0fe7657", "txt_hash": "29270200d9e1f6531cedcbb200bed955e52441acd9214ed8cf1452434ad1ce08", "json_hash": "f75065c812c906e5d2421a8b3e7cc208e5cdb91aa4fee965eb7193a03dbffc51"}}}