Cisco Adaptive Security Appliance on 4K/9K Cryptographic Module

Certificate details

Certificate ID #5287
Status active
Validation dates 22.05.2026
Sunset date 21-05-2031
Standard FIPS 140-3
Security level 1
Type Hardware
Embodiment MultiChipEmbed
Caveat When operated in approved mode and installed, initialized and configured as specified in Section 11 of the Security Policy.
Exceptions
  • Roles, services, and authentication: Level 3
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description Cisco Adaptive Security Appliance on 4K/9K Cryptographic Module is an integrated network security system providing enterprise-class firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications, HTTPS/TLSv1.2, SSHv2, IPsec/IKEv2, SNMPv3 and Cryptographic Cipher Suite B using the ASA Cryptographic Module.
Vendor Cisco Systems, Inc. http://www.cisco.com
Lab Gossamer Security Solutions
Algorithms
  • AES-CBCC1026
  • AES-GCMC1026
  • Counter DRBGA4446
  • ECDSA KeyGen (FIPS186-4)A4446
  • ECDSA SigGen (FIPS186-4)A4446
  • ECDSA SigVer (FIPS186-4)A4446
  • HMAC-SHA-1C1026
  • HMAC-SHA2-224A4446
  • HMAC-SHA2-256C1026
  • HMAC-SHA2-384C1026
  • HMAC-SHA2-512C1026
  • KAS-ECC-SSC Sp800-56Ar3A4446
  • KAS-FFC-SSC Sp800-56Ar3A4446
  • KDF IKEv2A4446
  • KDF SNMPA4446
  • KDF SSHA4446
  • RSA KeyGen (FIPS186-4)A4446
  • RSA SigGen (FIPS186-4)A4446
  • RSA SigVer (FIPS186-4)A4446
  • Safe Primes Key GenerationA4446
  • SHA-1C1026
  • SHA2-224A4446
  • SHA2-256C1026
  • SHA2-384C1026
  • SHA2-512C1026
  • TLS v1.2 KDF RFC7627A4446
References

This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES-128, AES-192, AES-256, AES, AES-, CAST, 3DES, HMAC
Asymmetric Algorithms
RSA 2048, ECDH, ECDHE, ECDSA, ECC, Diffie-Hellman, DH, DSA
Hash functions
SHA-1, SHA3-256
Schemes
MAC
Protocols
SSHv2, SSH, TLS v1.2, TLSv1.2, TLSv1.3, TLS, IKEv2, IKE, IPsec, VPN
Randomness
DRBG, RBG
Elliptic Curves
P-256, P-384, P-521, secp256r1, secp384r1, secp521r1
Block cipher modes
GCM

Trusted Execution Environments
PSP, SSC
Vendor
Cisco Systems, Inc, Cisco

Security level
Level 1
Certification process
out of scope, fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation, Table 2 above. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configure

Cross-references

Incoming
  • 5472 - active - Cisco ASA FX-OS on 4K/9K Cryptographic Module
Author JustinBettencourt
Creation date D:20260522064728-04'00'
Modification date D:20260522064728-04'00'
Pages 74
Creator Microsoft® Word for Microsoft 365
Producer Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

Cross-references

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5287,
  "dgst": "8c525f93672f3080",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "KDF SSHA4446",
        "ECDSA SigVer (FIPS186-4)A4446",
        "HMAC-SHA2-256C1026",
        "KAS-FFC-SSC Sp800-56Ar3A4446",
        "Counter DRBGA4446",
        "SHA2-224A4446",
        "Safe Primes Key GenerationA4446",
        "RSA SigGen (FIPS186-4)A4446",
        "#C1026",
        "HMAC-SHA2-384C1026",
        "#A4446",
        "HMAC-SHA2-224A4446",
        "ECDSA SigGen (FIPS186-4)A4446",
        "RSA SigVer (FIPS186-4)A4446",
        "RSA KeyGen (FIPS186-4)A4446",
        "TLS v1.2 KDF RFC7627A4446",
        "AES-CBCC1026",
        "SHA2-384C1026",
        "SHA2-256C1026",
        "KDF IKEv2A4446",
        "ECDSA KeyGen (FIPS186-4)A4446",
        "SHA2-512C1026",
        "KDF SNMPA4446",
        "AES-GCMC1026",
        "HMAC-SHA-1C1026",
        "KAS-ECC-SSC Sp800-56Ar3A4446",
        "SHA-1C1026",
        "HMAC-SHA2-512C1026"
      ]
    },
    "cpe_matches": {
      "_type": "Set",
      "elements": [
        "cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*",
        "cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*"
      ]
    },
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": {
        "_type": "Set",
        "elements": [
          "5472"
        ]
      },
      "directly_referencing": null,
      "indirectly_referenced_by": {
        "_type": "Set",
        "elements": [
          "5472"
        ]
      },
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": {
        "_type": "Set",
        "elements": [
          "5472"
        ]
      },
      "directly_referencing": null,
      "indirectly_referenced_by": {
        "_type": "Set",
        "elements": [
          "5472"
        ]
      },
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A4446",
            "properties": "Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A4446",
            "properties": "Key Length - 128, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A4446",
            "properties": "Prediction Resistance - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A4446",
            "properties": "Key Length - Key Length: 256-448 Increment 8, Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 224",
            "cavpCertName": "A4446",
            "properties": "Key Length - Key Length: 256-448 Increment 8, Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "A4446",
            "properties": "Key Length - Key Length: 256-448 Increment 8, Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "A4446",
            "properties": "Key Length - Key Length: 256-448 Increment 8, Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "A4446",
            "properties": "Key Length - Key Length: 256-448 Increment 8, Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A4446",
            "properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-FFC-SSC Sp800-56Ar3",
            "cavpCertName": "A4446",
            "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF IKEv2 (CVL)",
            "cavpCertName": "A4446",
            "properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SNMP (CVL)",
            "cavpCertName": "A4446",
            "properties": "Password Length - Password Length: 256, 64",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A4446",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096 Hash Algorithm - SHA2-256 Private Key Format - Standard",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigGen (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A4446",
            "properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "Safe Primes Key Generation",
            "cavpCertName": "A4446",
            "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, modp-2048, modp-3072, modp- 4096",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A4446",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-224",
            "cavpCertName": "A4446",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A4446",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A4446",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A4446",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
            "cavpCertName": "A4446",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "C1026",
            "properties": "Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "C1026",
            "properties": "Key Length - 128, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "C1026",
            "properties": "-",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "C1026",
            "properties": "-",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "C1026",
            "properties": "-",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "C1026",
            "properties": "-",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "C1026",
            "properties": "Message Length - Message Length: 0-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "C1026",
            "properties": "Message Length - Message Length: 0-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "C1026",
            "properties": "Message Length - Message Length: 0-102400 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "C1026",
            "properties": "Message Length - Message Length: 0-102400 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Provide Module\u0027s current status (return codes and/or syslog messages )",
            "indicator": "N/A",
            "inputs": "Command used to show Module\u0027s Status",
            "name": "Show Status",
            "outputs": "Module\u0027s Operation al Status",
            "rolesSspAccess": "Crypto Officer User",
            "secFunImpl": "None"
          },
          {
            "description": "Provide Module\u0027s name and version informatio n",
            "indicator": "N/A",
            "inputs": "Command to show version",
            "name": "Show Version",
            "outputs": "Module\u0027s ID and versioning informatio n",
            "rolesSspAccess": "Crypto Officer User",
            "secFunImpl": "None"
          },
          {
            "description": "Perform Self-Tests (Pre- operation al self-test and Condition al Self- Tests)",
            "indicator": "N/A",
            "inputs": "Command to trigger Self-Test",
            "name": "Perform Self-Tests",
            "outputs": "Status of the self- tests results",
            "rolesSspAccess": "Crypto Officer User Unauthentic ated",
            "secFunImpl": "None"
          },
          {
            "description": "Perform Zeroizatio n",
            "indicator": "N/A",
            "inputs": "Command to zeroize the module",
            "name": "Perform Zeroizatio n",
            "outputs": "Status of the SSPs zeroizatio n",
            "rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - Counter DRBG",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Seed: Z - Counter DRBG Internal State V: Z - Counter DRBG Key: Z - User Password: Z - Crypto Officer Password: Z - Firmware Load Test Key: Z - SSH DH Private Key: Z - SSH DH Public Key: Z - SSH Peer DH Public Key: Z - SSH DH Shared Secret: Z - SSH ECDH Private Key: Z - SSH ECDH Public Key: Z - SSH Peer ECDH Public Key: Z - SSH ECDH Shared Secret: Z - SSH RSA Private Key:",
            "secFunImpl": ""
          },
          {
            "description": "Descripti on",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Access Z - SSH RSA Public Key: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authenticati on Key: Z - TLS DH Private Key: Z - TLS DH Public Key: Z - TLS Peer DH Public Key: Z - TLS DH Shared Secret: Z - TLS ECDH Private Key: Z - TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z",
            "secFunImpl": ""
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- TLS ECDSA Private Key: Z - TLS ECDSA Public Key: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authenticati on Key: Z - IPSec/IKE DH Private Key: Z - IPSec/IKE DH Public Key: Z - IPSec/IKE Peer DH Public Key: Z - IPSec/IKE DH Shared Secret: Z - IPSec/IKE ECDH Private Key: Z - IPSec/IKE ECDH Public Key: Z - IPSec/IKE Peer ECDH",
            "secFunImpl": ""
          },
          {
            "description": "Descripti",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security"
          },
          {
            "description": "on",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Public Key: Z - IPSec/IKE ECDH Shared Secret: Z - IPSec/IKE ECDSA Private Key: Z - IPSec/IKE ECDSA Public Key: Z - IPSec/IKE RSA Private Key: Z - IPSec/IKE RSA Public Key: Z - IPSec/IKE Pre-shared Secret: Z - SKEYSEED : Z - IPSec/IKE Session Encryption Key: Z - IPSec/IKE Authenticati on Key: Z - SNMPv3 Shared Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticati on Key: Z",
            "secFunImpl": "Functions"
          },
          {
            "description": "Sets configurati on of the systems",
            "indicator": "N/A",
            "inputs": "Command s to configure the network",
            "name": "Configure Network",
            "outputs": "Status of the completio n of network",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "configurati on status",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Manage User Account",
            "indicator": "N/A",
            "inputs": "Command s to create User account",
            "name": "Account Managem ent",
            "outputs": "Account status",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "CO Role Authentic ation",
            "indicator": "N/A",
            "inputs": "CO Authentic ation Request",
            "name": "Crypto Officer Authentic ation",
            "outputs": "Status of the CO authentica tion",
            "rolesSspAccess": "Crypto Officer - Crypto Officer Password: W,Z",
            "secFunImpl": "None"
          },
          {
            "description": "User Role Authentic ation",
            "indicator": "N/A",
            "inputs": "User role authentica tion request",
            "name": "User Authentic ation",
            "outputs": "Status of the User role authentica tion",
            "rolesSspAccess": "User - User Password: W,Z",
            "secFunImpl": "None"
          },
          {
            "description": "Sets the Bypass capability",
            "indicator": "N/A",
            "inputs": "CLI Bypass command s",
            "name": "Configure Bypass Capability",
            "outputs": "Status of the completio n of Bypass capability configurati on",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Configure SSHv2 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and SSHv2 configura tion success status message",
            "inputs": "Command s to configure SSHv2",
            "name": "Configure SSHv2 Function",
            "outputs": "Status of the completio n of the SSHv2 configurati on",
            "rolesSspAccess": "Crypto Officer - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter",
            "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "DRBG Internal State V: W,E - Counter DRBG Key: W,E",
            "secFunImpl": ""
          },
          {
            "description": "Configure HTTPS over TLSv1.2 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and HTTPS over TLSv1.2 configura tion success status message",
            "inputs": "Command s to configure TLSv1.2",
            "name": "Configure HTTPS over TLSv1.2 Function",
            "outputs": "Status of the completio n of TLSv1.2 configurati on",
            "rolesSspAccess": "Crypto Officer - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E",
            "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function"
          },
          {
            "description": "Configure IPSec/IKE v2 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" with IPsec/IK Ev2 configura tion",
            "inputs": "Command s to configure IPsec/IKE v2",
            "name": "Configure IPsec/IKE v2 Function",
            "outputs": "Status of the completio n of IPsec/IKE v2 configurati on",
            "rolesSspAccess": "Crypto Officer - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE",
            "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen"
          },
          {
            "description": "",
            "indicator": "success status message",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E Crypto",
            "secFunImpl": "(SSHv2, TLSv1.2, IKEv2) ECDSA KeyGen (SSHv2, TLSv1.2 and IKEv2) DRBG Function"
          },
          {
            "description": "Configure SNMPv3 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and SNMPv3 configura tion success status message",
            "inputs": "Command s to configure SNMPv3",
            "name": "Configure SNMPv3 Function",
            "outputs": "Status of the completio n of SNMPv3 configurati on",
            "rolesSspAccess": "Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E",
            "secFunImpl": "KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)"
          },
          {
            "description": "Execute SSHv2 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and successf ul SSHv2 log message",
            "inputs": "Initiate SSHv2 tunnel establish ment",
            "name": "Run SSHv2 Function",
            "outputs": "Status of SSHv2 tunnel establish ment",
            "rolesSspAccess": "Crypto Officer - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E - SSH DH",
            "secFunImpl": "KAS-ECC- KeyGen (SSHv2) KAS-FFC- KeyGen (SSHv2) KAS-ECC (SSHv2) KAS-FFC (SSHv2) KTS (SSHv2 with AES and"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA Public Key: W,E - SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter",
            "secFunImpl": "HMAC) KTS (SSHv2 with AES-GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (SSHv2) Session Authentication (SSHv2) SSHv2 Keying Materials Development DRBG Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "DRBG Internal State V: W,E - Counter DRBG Key: W,E User - SSH DH Private Key: W,E - SSH DH Public Key: W,E - SSH Peer DH Public Key: W,E - SSH DH Shared Secret: W,E - SSH ECDH Private Key: W,E - SSH ECDH Public Key: W,E - SSH Peer ECDH Public Key: W,E - SSH ECDH Shared Secret: W,E - SSH RSA Private Key: W,E - SSH RSA Public Key: W,E - SSH ECDSA Private Key: W,E - SSH ECDSA",
            "secFunImpl": ""
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Public Key: W,E - SSH Session Encryption Key: W,E - SSH Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key:",
            "secFunImpl": ""
          },
          {
            "description": "Execute HTTPS over TLSv1.2 function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and successf ul HTTPS over TLSv1.2 log message",
            "inputs": "Initiate TLSv1.2 tunnel establish ment request",
            "name": "Run HTTPS over TLSv1.2 Function",
            "outputs": "Status of TLSv1.2 tunnel establish ment",
            "rolesSspAccess": "W,E Crypto Officer - TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer",
            "secFunImpl": "KAS-ECC- KeyGen (TLSv1.2) KAS-FFC- KeyGen (TLSv1.2) KAS-ECC (TLSv1.2) KAS-FFC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES-GCM) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2)"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - TLS Master Secret: W,E - TLS Session Encryption Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E User",
            "secFunImpl": "RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (TLSv1.2) Session Authentication (TLSv1.2) TLSv1.2 Keying Materials Development DRBG Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- TLS DH Private Key: W,E - TLS DH Public Key: W,E - TLS Peer DH Public Key: W,E - TLS DH Shared Secret: W,E - TLS ECDH Private Key: W,E - TLS ECDH Public Key: W,E - TLS Peer ECDH Public Key: W,E - TLS ECDH Shared Secret: W,E - TLS ECDSA Private Key: W,E - TLS ECDSA Public Key: W,E - TLS RSA Private Key: W,E - TLS RSA Public Key: W,E - TLS Master Secret: W,E - TLS Session Encryption",
            "secFunImpl": ""
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Key: W,E - TLS Session Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E",
            "secFunImpl": ""
          },
          {
            "description": "Execute IPsec/IKE v2 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and succesful IPsec/IK Ev2 log message",
            "inputs": "Initiate IPsec/IKE v2 tunnel establish ment request",
            "name": "Run IPSec/IKE v2 Function",
            "outputs": "Status of IPSec/IKE v2 tunnel establish ment",
            "rolesSspAccess": "Crypto Officer - IPSec/IKE DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE",
            "secFunImpl": "KAS-ECC- KeyGen (IKEv2) KAS-FFC- KeyGen (IKEv2) KAS-ECC (IKEv2) KAS-FFC (IKEv2) RSA SigGen (SSHv2, TLSv1.2, IKEv2) ECDSA SigGen (SSHv2, TLSv1.2 and IKEv2) RSA SigVer (SSHv2, TLSv1.2, and IKEv2) ECDSA SigVer (SSHv2, TLSv1.2, and IKEv2) Session Encryption/Decr yption (IPSec/IKE)"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "ECDH Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED : W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E User - IPSec/IKE",
            "secFunImpl": "Session Authentication (IPSec/IKEv2) IPSec/IKEv2 Keying Materials Development DRBG Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "DH Private Key: W,E - IPSec/IKE DH Public Key: W,E - IPSec/IKE Peer DH Public Key: W,E - IPSec/IKE DH Shared Secret: W,E - IPSec/IKE ECDH Private Key: W,E - IPSec/IKE ECDH Public Key: W,E - IPSec/IKE Peer ECDH Public Key: W,E - IPSec/IKE ECDH Shared Secret: W,E - IPSec/IKE ECDSA Private Key: W,E - IPSec/IKE ECDSA Public Key: W,E - IPSec/IKE RSA Private Key: W,E - IPSec/IKE RSA Public Key: W,E - IPSec/IKE Pre-shared Secret: W,E - SKEYSEED",
            "secFunImpl": ""
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": ": W,E - IPSec/IKE Session Encryption Key: W,E - IPSec/IKE Authenticati on Key: W,E - DRBG Entropy Input: W,E - Counter DRBG Seed: W,E - Counter DRBG Internal State V: W,E - Counter DRBG Key: W,E",
            "secFunImpl": ""
          },
          {
            "description": "Execute SNMPv3 Function",
            "indicator": "Status Mode Indicator \"FIPS is currently enabled\" and successf ul SNMPv3 log message",
            "inputs": "Initiate SNMPv3 tunnel establish ment request",
            "name": "Run SNMPv3 Function",
            "outputs": "Status of SNMPv3 tunnel establish ment",
            "rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E User - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption Key: W,E - SNMPv3 Authenticati on Key: W,E",
            "secFunImpl": "Session Encryption/Decr yption (SNMPv3) Session Authentication (SNMPv3) SNMPv3 Keying Materials Development"
          },
          {
            "description": "Execute the",
            "indicator": "Successf ul",
            "inputs": "Command s to load",
            "name": "Firmware Load Test",
            "outputs": "Outcome of the",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "Firmware Load Test"
          },
          {
            "description": "Firmware Load Test",
            "indicator": "Firmware Loading status message",
            "inputs": "new firmware image",
            "name": "",
            "outputs": "Firmware Load Test",
            "rolesSspAccess": "- Firmware Load Test Key: R",
            "secFunImpl": ""
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The minimum length is eight (8) characters (94 possible characters). The configuration supports at most ten failed attempts to authenticate in a one- minute period.",
            "mechanism": "Password Based",
            "name": "Password",
            "perMinute": "The probability of successfully authenticating to the module within one minute is 10/(94^8), which is less than 1/100,000.",
            "strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000."
          },
          {
            "description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest",
            "mechanism": "RSA SigVer (FIPS186-4) (A4446)",
            "name": "RSA- Based Certificate",
            "perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details.",
            "strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details."
          },
          {
            "description": "can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than",
            "mechanism": "",
            "name": "",
            "perMinute": "",
            "strength": ""
          },
          {
            "description": "1/100,000. The modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
            "mechanism": "ECDSA SigVer (FIPS186-4) (A4446)",
            "name": "ECDSA- Based Certificate",
            "perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details.",
            "strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. Please refer to Description section in this table for more details."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-CBC Encrypt KAT (A4446)",
            "condition": "Power Up",
            "details": "Encrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC Decrypt KAT (A4446)",
            "condition": "Power Up",
            "details": "Decrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4446)",
            "condition": "Power Up",
            "details": "Authenticat ed Encrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4446)",
            "condition": "Power Up",
            "details": "Authenticat ed Decrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG Instantiate/Generate/Res eed KAT (A4446)",
            "condition": "Power Up",
            "details": "Instantiate, Generate, and Reseed KATs",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186-4) KAT (A4446)",
            "condition": "Power Up",
            "details": "ECDSA SigGen KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256 curve with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186-4) KAT (A4446)",
            "condition": "Power Up",
            "details": "ECDSA SigVer KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256 curve with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA-1 KAT (A4446)",
            "condition": "Power Up",
            "details": "HMAC- SHA-1",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA-1",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-256 KAT (A4446)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-256",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-384 KAT (A4446)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-384",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-512 KAT (A4446)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-512",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A4446)",
            "condition": "Power Up",
            "details": "Primitive Z KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256 Curve",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A4446)",
            "condition": "Power Up",
            "details": "Primitive Z KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "MODP- 2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigGen (FIPS186- 4) KAT (A4446)",
            "condition": "Power Up",
            "details": "RSA SigGen KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "2048 bit modulus with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-4) KAT (A4446)",
            "condition": "Power Up",
            "details": "RSA SigVer KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "2048 bit modulus with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF IKEv2 KAT (A4446)",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SNMP KAT (A4446)",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SSH KAT (A4446)",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A4446)",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA-1 KAT (A4446)",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC Encrypt KAT (C1026)",
            "condition": "Power Up",
            "details": "Encrypt KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC Decrypt KAT (C1026)",
            "condition": "Power Up",
            "details": "Decrypt KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (C1026)",
            "condition": "Power Up",
            "details": "Encrypt KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (C1026)",
            "condition": "Power Up",
            "details": "Decrypt KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA-1 KAT (C1026)",
            "condition": "Power Up",
            "details": "HMAC- SHA-1",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA-1",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-256 KAT (C1026)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-256",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-384 KAT (C1026)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-384",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-512 KAT (C1026)",
            "condition": "Power Up",
            "details": "HMAC- SHA2-512",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2- 512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-4) PCT (A4446)",
            "condition": "Performs all required",
            "details": "ECDSA",
            "indicator": "Module is in",
            "testMethod": "PCT",
            "testProps": "N/A",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "",
            "condition": "pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
            "details": "",
            "indicator": "normal state",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "RSA KeyGen (FIPS186- 4) PCT (A4446)",
            "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
            "details": "RSA",
            "indicator": "Module is in normal state",
            "testMethod": "PCT",
            "testProps": "N/A",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A4446)",
            "condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "PCT",
            "testProps": "N/A",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A4446)",
            "condition": "Performs all required pair-wise consisten cy tests on the newly",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "PCT",
            "testProps": "N/A",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "",
            "condition": "generated key pairs before the first operation al use.",
            "details": "",
            "indicator": "",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "Firmware Load Test",
            "condition": "When firmware has been uploaded to the module",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "HMAC- SHA2- 512",
            "type": "SW/F W Load"
          },
          {
            "algorithmOrTest": "Conditional Bypass",
            "condition": "Performs conditiona l bypass test before first operation al use of bypass",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "N/A",
            "testProps": "N/A",
            "type": "Bypas s"
          },
          {
            "algorithmOrTest": "Entropy 90B Start-up Repetition Count Test (RCT)",
            "condition": "Power up",
            "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time",
            "indicator": "Module is in normal state",
            "testMethod": "RCT",
            "testProps": "Repetitio n Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Start-up Adaptive Proportion Test (APT)",
            "condition": "Power up",
            "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment",
            "indicator": "Module is in normal state",
            "testMethod": "APT",
            "testProps": "Adaptive Proportio n Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "",
            "condition": "",
            "details": "al change affecting the noise source",
            "indicator": "",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Repetition Count Test (RCT)",
            "condition": "Entropy data is generated from the Entropy Source - Continuou s",
            "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \"stuck\" on a single output value for a long period of time",
            "indicator": "Module is in normal state",
            "testMethod": "RCT",
            "testProps": "Repetitio n Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Continuous Adaptive Proportion Test (APT)",
            "condition": "Entropy data is generated from the Entropy Source - Continuou s",
            "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environment al change affecting the noise source",
            "indicator": "Module is in normal state",
            "testMethod": "APT",
            "testProps": "Adaptive Proportio n Test",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Self-test failure",
            "description": "If self-test tests fail, the module is put into an error state",
            "indicator": "System Halt",
            "name": "Error State",
            "recoveryMethod": "Reboot the module"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "N/A",
            "inspectGuidance": "N/A",
            "mechanism": "Production-grade components with standard passivation"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "The module as recommended by Cisco is configured to have the Approved Mode enabled. In the Approved Mode, only Approved algorithms can be configured.",
            "name": "Approved Mode of Operation",
            "statusIndicator": "Approved mode indicator: \"FIPS is currently enabled.\"",
            "type": "Approved"
          },
          {
            "description": "The module is configured to have the Approved Mode disabled (Which is not recommended by Cisco). In the Non- Approved Mode, both Non-Approved and Approved algorithms can be configured.",
            "name": "Non- Approved Mode of Operation",
            "statusIndicator": "Non-Approved mode indicator: \"FIPS is currently disabled.\"",
            "type": "Non- Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [
          {
            "name": "3DES",
            "use": "Used for symmetric encryption in SSHv2, TLSv1, TLSv1.2, IPsec/IKEv2, and SNMPv3"
          },
          {
            "name": "ChaCha20- poly1305",
            "use": "Used for authenticated symmetric encryption in SSHv2, and TLSv1.3"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [
          {
            "alg_accessed": "3DES ChaCha20- poly1305",
            "description": "Run SSHv2 using non-approved algorithms. Non- Approved mode indicator \"FIPS is currently disabled\" and successful SSHv2 log message demonstrates the non-approved service",
            "name": "SSHv2",
            "role": "Crypto Officer, User"
          },
          {
            "alg_accessed": "3DES",
            "description": "Run TLSv1 in the non-approved mode using non- approved algorithms. Non-Approved mode indicator \"FIPS is currently disabled\" and successful TLSv1 log message demonstrates the non-approved service",
            "name": "TLSv1",
            "role": "Crypto Officer, User"
          },
          {
            "alg_accessed": "3DES",
            "description": "Run TLSv1.2 using non-approved algorithms. Non- Approved mode indicator \"FIPS is currently disabled\" and successful TLSv1.2 log message demonstrates the non-approved service",
            "name": "TLSv1.2",
            "role": "Crypto Officer, User"
          },
          {
            "alg_accessed": "ChaCha20- poly1305",
            "description": "Run TLSv1.3 in the non-approved mode using non- approved algorithms. Non-Approved mode indicator \"FIPS is currently disabled\" and successful TLSv1.3 log message demonstrates the non-approved service",
            "name": "TLSv1.3",
            "role": "Crypto Officer, User"
          },
          {
            "alg_accessed": "3DES",
            "description": "Run IPsec/IKEv2 using non-approved algorithms. Non-Approved mode indicator \"FIPS is currently disabled\" and successful IPsec/IKEv2 log message demonstrates the non-approved service",
            "name": "IPsec/IKEv2",
            "role": "Crypto Officer, User"
          },
          {
            "alg_accessed": "3DES",
            "description": "Run SNMPv3 using non-approved algorithms. Non-Approved mode indicator \"FIPS is currently disabled\" and successful SNMPv3 log message demonstrates the non-approved service",
            "name": "SNMPv3",
            "role": "Crypto Officer, User"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
            "logicalInterface": "Data Input",
            "physicalPort": "SFP Ethernet Ports, PCI port"
          },
          {
            "data": "Data output from the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
            "logicalInterface": "Data Output",
            "physicalPort": "SFP Ethernet Ports, PCI port"
          },
          {
            "data": "Control Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, SNMPv3 and IPsec/IKEv2 service data.",
            "logicalInterface": "Control Input",
            "physicalPort": "SFP Ethernet Ports, PCI port"
          },
          {
            "data": "Status Information output from the module.",
            "logicalInterface": "Status Output",
            "physicalPort": "SFP Ethernet Ports, PCI port, LED"
          },
          {
            "data": "N/A",
            "logicalInterface": "Control Output",
            "physicalPort": "N/A"
          },
          {
            "data": "Provide the power supply to the module.",
            "logicalInterface": "Power",
            "physicalPort": "Power Interface"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "1",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-4) (A4446)",
            "details": "RSA SigVer",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "RSA SigVer 2048 bits with SHA2-512",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Pre-Operational Bypass Test",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "N/A",
            "testProps": "N/A",
            "type": "Bypass"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Peer Public Key Input",
            "sfiAlgo": "",
            "source": "External (Outside of the Module\u0027s Boundary )"
          },
          {
            "dest": "External (Outside",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Module Public Key Output",
            "sfiAlgo": "",
            "source": "Module"
          },
          {
            "dest": "of the Module\u0027s Boundary )",
            "distribution": "",
            "entry": "",
            "format": "",
            "name": "",
            "sfiAlgo": "",
            "source": ""
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via SSHv2 encrypted by AES and HMAC",
            "sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
            "source": "External (Outside of the Module\u0027s Boundary )"
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via SSHv2 encrypted by AES-GCM",
            "sfiAlgo": "KTS (SSHv2 with AES- GCM)",
            "source": "External (Outside of the Module\u0027s Boundary )"
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC",
            "sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
            "source": "External (Outside of the Module\u0027s Boundary )"
          },
          {
            "dest": "Module",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via TLSv1.2 encrypted by AES-GCM",
            "sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
            "source": "External (Outside of the Module\u0027s Boundary )"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "CO issues zeroization service",
            "method": "Zeroization Command",
            "operatorId": "\u0027configure factory-default\u0027 command",
            "rationale": "The zeroization command will erase all SSPs stored in the DRAM or in the Flash of the module."
          },
          {
            "description": "Zeroization upon session termination",
            "method": "Session termination",
            "operatorId": "Terminate session",
            "rationale": "Session termination will automatically zeroize all session based temporary SSPs"
          },
          {
            "description": "Zeroization upon rebooting the module",
            "method": "Reboot",
            "operatorId": "Reboot",
            "rationale": "Reboot to zeroize all temporary SSPs stored in Module\u0027s DRAM"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Volatile Memory",
            "name": "DRAM",
            "persistance": "Dynamic"
          },
          {
            "description": "Non-Volatile Memory",
            "name": "Flash",
            "persistance": "Static"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR4K-SM- 12S",
            "modelPartNum": "FPR 4112",
            "processors": "Intel Xeon Silver 4116 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR4K-SM- 24S",
            "modelPartNum": "FPR 4115",
            "processors": "Intel Xeon Silver 4116 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR4K-SM- 32S",
            "modelPartNum": "FPR 4125",
            "processors": "Intel Xeon Gold 6130T (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR4K-SM- 44S",
            "modelPartNum": "FPR 4145",
            "processors": "Intel Xeon Gold 6152 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR9K-SM- 40",
            "modelPartNum": "FPR 9300 SM-40",
            "processors": "Intel Xeon Gold 6138T (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR9K-SM- 48",
            "modelPartNum": "FPR 9300 SM-48",
            "processors": "Intel Xeon Platinum 8160 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          },
          {
            "features": "N/A",
            "fwVersion": "9.20",
            "hwVersion": "FPR9K-SM- 56",
            "modelPartNum": "FPR 9300 SM-56",
            "processors": "Intel Xeon Platinum 8176 (Skylake) \u0026 NITROX-V, Marvell Semiconductor, NITROX"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per sections 4 and 5 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG (A4446)"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 3
          },
          "ECDH": {
            "ECDH": 90,
            "ECDHE": 1
          },
          "ECDSA": {
            "ECDSA": 84
          }
        },
        "FF": {
          "DH": {
            "DH": 87,
            "Diffie-Hellman": 1
          },
          "DSA": {
            "DSA": 3
          }
        },
        "RSA": {
          "RSA 2048": 3
        }
      },
      "certification_process": {
        "OutOfScope": {
          "Table 2 above. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. The Crypto Officer must configure": 1,
          "fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation": 1,
          "out of scope": 2
        }
      },
      "cipher_mode": {
        "GCM": {
          "GCM": 8
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "IKE": {
          "IKE": 4,
          "IKEv2": 75
        },
        "IPsec": {
          "IPsec": 1
        },
        "SSH": {
          "SSH": 125,
          "SSHv2": 128
        },
        "TLS": {
          "TLS": {
            "TLS": 129,
            "TLS v1.2": 7,
            "TLSv1.2": 131,
            "TLSv1.3": 4
          }
        },
        "VPN": {
          "VPN": 6
        }
      },
      "crypto_scheme": {
        "MAC": {
          "MAC": 5
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 38,
          "P-384": 36,
          "P-521": 32,
          "secp256r1": 2,
          "secp384r1": 2,
          "secp521r1": 2
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#1": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 1,
          "AES-128": 3,
          "AES-128/192/256": 1,
          "AES-192": 2,
          "AES-256": 2,
          "DRBG 384": 1,
          "HMAC- SHA-1": 2,
          "HMAC-SHA-1": 12,
          "HMACSHA-1": 1,
          "PKCS 1": 3,
          "RSA 2048": 3,
          "SHA-1": 11,
          "SHA2- 256": 7,
          "SHA2- 384": 4,
          "SHA2- 512": 4,
          "SHA2-224": 4,
          "SHA2-256": 8,
          "SHA2-384": 6,
          "SHA2-512": 9,
          "SHA3-256": 1
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 2
        }
      },
      "hash_function": {
        "SHA": {
          "SHA1": {
            "SHA-1": 11
          },
          "SHA3": {
            "SHA3-256": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 88
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 8,
          "FIPS 180-4": 9,
          "FIPS 186-4": 8,
          "FIPS 198-1": 9,
          "FIPS186-4": 25
        },
        "ISO": {
          "ISO/IEC 19790": 2
        },
        "NIST": {
          "SP 800-135": 4,
          "SP 800-140": 1,
          "SP 800-38A": 2,
          "SP 800-38D": 2,
          "SP 800-52": 1,
          "SP 800-56A": 3,
          "SP 800-90A": 1
        },
        "PKCS": {
          "PKCS 1": 2
        },
        "RFC": {
          "RFC 3526": 2,
          "RFC 4419": 2,
          "RFC 4492": 1,
          "RFC 5288": 1,
          "RFC 5647": 4,
          "RFC 5903": 1,
          "RFC 7296": 1,
          "RFC 7919": 2,
          "RFC7627": 3
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 30,
            "AES-": 4,
            "AES-128": 3,
            "AES-192": 2,
            "AES-256": 2
          },
          "CAST": {
            "CAST": 64
          }
        },
        "DES": {
          "3DES": {
            "3DES": 6
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 26
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 18
        },
        "IBM": {
          "SSC": 6
        }
      },
      "tls_cipher_suite": {},
      "vendor": {
        "Cisco": {
          "Cisco": 14,
          "Cisco Systems, Inc": 78
        }
      },
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "KDF SSHA4446",
        "ECDSA SigVer (FIPS186-4)A4446",
        "HMAC-SHA2-256C1026",
        "KAS-FFC-SSC Sp800-56Ar3A4446",
        "Counter DRBGA4446",
        "SHA2-224A4446",
        "Safe Primes Key GenerationA4446",
        "RSA SigGen (FIPS186-4)A4446",
        "HMAC-SHA2-384C1026",
        "HMAC-SHA2-224A4446",
        "ECDSA SigGen (FIPS186-4)A4446",
        "RSA SigVer (FIPS186-4)A4446",
        "RSA KeyGen (FIPS186-4)A4446",
        "TLS v1.2 KDF RFC7627A4446",
        "AES-CBCC1026",
        "SHA2-384C1026",
        "SHA2-256C1026",
        "KDF IKEv2A4446",
        "ECDSA KeyGen (FIPS186-4)A4446",
        "SHA2-512C1026",
        "KDF SNMPA4446",
        "AES-GCMC1026",
        "HMAC-SHA-1C1026",
        "KAS-ECC-SSC Sp800-56Ar3A4446",
        "SHA-1C1026",
        "HMAC-SHA2-512C1026"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A4446",
        "#C1026"
      ]
    },
    "policy_metadata": {
      "/Author": "JustinBettencourt",
      "/CreationDate": "D:20260522064728-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260522064728-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 1102846,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://www.cisco.com/c/en/us/products/collateral/security/firepower-9000-series/datasheet-c78-742471.html",
          "https://www.cisco.com/c/en/us/products/collateral/security/firepower-4100-series/datasheet-c78-742474.html",
          "https://www.cisco.com/c/en/us/td/docs/security/asa/asa919/configuration/general/asa-919-general-config.html"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 74
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "6074a45a4c8e7f437026e53ebc4c87c702d266aef28a671444c45a855fd7745a",
      "source_hash": "5bea45ee58d18789645bdc663eea1449f9d4a5ef5d937678e4aa4ed81602a97b",
      "txt_hash": "d9eaa39f4e9576fe61dee0bea06e840594b6977c3a1302a8f91ff8b8db8bfc9c"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When operated in approved mode and installed, initialized and configured as specified in Section 11 of the Security Policy.",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/May 2026_030626_0716.pdf",
    "date_sunset": "2031-05-21",
    "description": "Cisco Adaptive Security Appliance on 4K/9K Cryptographic Module is an integrated network security system providing enterprise-class firewall with a comprehensive range of next-generation network security services, intrusion prevention system (IPS), content security and secure unified communications, HTTPS/TLSv1.2, SSHv2, IPsec/IKEv2, SNMPv3 and Cryptographic Cipher Suite B using the ASA Cryptographic Module.",
    "embodiment": "MultiChipEmbed",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {},
    "module_name": "Cisco Adaptive Security Appliance on 4K/9K Cryptographic Module",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-05-22",
        "lab": "Gossamer Security Solutions",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Cisco Systems, Inc.",
    "vendor_url": "http://www.cisco.com"
  }
}