This page was not yet optimized for use on mobile devices.
G&D Cryptographic Module
Certificate details
| Certificate ID | #5528 |
|---|---|
| Status | active |
| Validation dates | 20.09.2026 , 25.09.2026 |
| Sunset date | 18-07-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | MultiChipStand |
| Caveat | No assurance of the minimum strength of generated SSPs (e.g., keys); No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs; When operated in approved mode |
| Exceptions |
|
| Description | G&D Cryptographic Module is a software library providing a C language API for use by other applications requiring cryptographic functionality. G&D Cryptographic Module offers symmetric encryption/decryption, digital signature generation/verification, hashing, cryptographic key generation, random number generation, message authentication, and key establishment functions to secure data-at-rest/data-in-flight and to support industry-standard secure communications protocols (including TLS 1.2/1.3). |
| Vendor | Guntermann & Drunck GmbH http://www.gdsys.com/ |
| Lab | Teron Labs |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-128, AES-192, AES-256, AES-, CAST, CAST5, RC2, RC4, RC5, DES, TDES, ChaCha20, Poly1305, IDEA, Blowfish, Camellia, ARIA, SM4, SEED, HMAC, CMACAsymmetric Algorithms
ECDH, ECDSA, EdDSA, DHE, DH, Diffie-Hellman, DSAHash functions
SHA-1, SHA3-256, SHA3-384, SHA3-512, SHA3-224, Blake2, MD4, MD5, RIPEMD, PBKDF, PBKDF2Schemes
MAC, Key Agreement, AEADProtocols
SSL, TLS, TLS v1.2, TLS v1.3, TLS 1.3, TLS 1.2Randomness
DRBG, RNG, RBGElliptic Curves
P-224, P-256, P-521, P-192, P-384, B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, B-163, K-163Block cipher modes
ECB, CBC, CTR, GCM, CCM, XEX, XTSTLS cipher suites
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CCM, TLS_ECDHE_ECDSA_WITH_AES_256_CCM, TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8JavaCard API constants
SM2Trusted Execution Environments
PSP, SSCVendor
NXP, G&DSecurity level
Level 1Standards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS 202, FIPS PUB 186-4, FIPS PUB 186-2, FIPS PUB 186-5, SP 800-38A, SP 800-38C, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-38E, SP 800-90A, SP 800-56A, SP 800-132, SP 800-67, SP 800-135, SP 800-133, NIST SP 800-38D, NIST SP 800-56A, NIST SP 800-132, PKCS 1, PKCS#1, RFC7627, RFC 5288, RFC 8446, ISO/IEC 19790, ISO/IEC 19790:2012Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5528,
"dgst": "8fe5aff59d1fb619",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A7573",
"AES-CBCA7573",
"TDES-ECBA7573",
"TDES-CFB64A7573",
"AES-CTRA7573",
"KAS-FFC-SSC Sp800-56Ar3A7573",
"AES-CFB1A7573",
"HMAC-SHA2-384A7573",
"PBKDFA7573",
"SHA3-512A7573",
"#A7572",
"HMAC-SHA-1A7573",
"RSA KeyGen (FIPS186-5)A7573",
"DSA PQGGen (FIPS186-4)A7573",
"ECDSA SigGen (FIPS186-5)A7573",
"ECDSA SigVer (FIPS186-4)A7573",
"TDES-OFBA7573",
"HMAC-SHA3-512A7573",
"TDES-CFB1A7573",
"AES-ECBA7573",
"HMAC-SHA3-256A7573",
"HMAC-SHA3-224A7573",
"AES-KWA7573",
"ECDSA KeyVer (FIPS186-5)A7573",
"TDES-CFB8A7573",
"SHA2-384A7573",
"AES-CCMA7573",
"SHAKE-256A7573",
"SHA2-256A7573",
"AES-CMACA7573",
"TDES-CMACA7573",
"TLS v1.2 KDF RFC7627A7573",
"AES-CFB8A7573",
"HMAC-SHA2-224A7573",
"AES-GCMA7573",
"ECDSA KeyVer (FIPS186-4)A7573",
"AES-XTS Testing Revision 2.0A7573",
"KAS-ECC-SSC Sp800-56Ar3A7573",
"Counter DRBGA7573",
"AES-KWPA7573",
"DSA SigVer (FIPS186-4)A7573",
"DSA KeyGen (FIPS186-4)A7573",
"ECDSA KeyGen (FIPS186-5)A7573",
"HMAC-SHA3-384A7573",
"AES-OFBA7573",
"SHA3-224A7573",
"SHA3-384A7573",
"ECDSA SigVer (FIPS186-5)A7573",
"RSA SigVer (FIPS186-5)A7573",
"AES-GMACA7573",
"HMAC-SHA2-512A7573",
"SHA2-224A7573",
"AES-CFB128A7573",
"RSA SigVer (FIPS186-4)A7573",
"#A7573",
"TDES-CBCA7573",
"SHA2-512A7573",
"TLS v1.3 KDFA7572",
"SHA-1A7573",
"SHAKE-128A7573",
"SHA3-256A7573",
"RSA SigGen (FIPS186-5)A7573"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A7573",
"properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56, 64, 72, 80, 88, 96, 104 Payload Length - Payload Length: 256 AAD Length - AAD Length: 0, 256, 65536",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CFB1",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A7573",
"properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 32-128 Increment 8 Message Length - Message Length: 0-65536 Increment 8",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - Yes Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96, 1024 Payload Length - Payload Length: 16, 128, 136, 256, 264 AAD Length - AAD Length: 0, 128, 136, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GMAC",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96, 1024",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A7573",
"properties": "AAD Length - AAD Length: 0, 128, 136, 256 Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 64",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-KWP",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 8",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 128-65536 Increment 8 Tweak Mode - Hex Data Unit Length Matches Payload Length - Yes",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A7573",
"properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 128-256 Increment 128, Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0-128 Increment 128, Personalization String Length: 0-256 Increment 256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "DSA KeyGen (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "Returned Bits - 256 L - 2048 N - 224, 256",
"reference": "FIPS 186-4"
},
{
"algorithm": "DSA PQGGen (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "P/Q Generation Methods - Probable G Generation Methods - Unverifiable L - 2048 N - 224, 256 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "DSA SigVer (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "L - 1024, 2048, 3072 N - 160, 224, 256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Curve - B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P- 384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "Curve - B-163, K-163, P-192",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Curve - B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P- 384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Curve - B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P- 384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "Curve - B-163, B-233, B-283, B-409, B-571, K-163, K-233, K-283, K-409, K-571, P-192, P-224, P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Curve - B-233, B-283, B-409, B-571, K-233, K-283, K-409, K-571, P-224, P-256, P- 384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 160 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-224",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 224 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-256",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 256 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-384",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 384 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-512",
"cavpCertName": "A7573",
"properties": "MAC - MAC: 512 Key Length - Key Length: 8-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A7573",
"properties": "Domain Parameter Generation Methods - B-233, B-283, B-409, B-571, K-233, K- 283, K-409, K-571, P-224, P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A7573",
"properties": "Domain Parameter Generation Methods - FB, FC Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "PBKDF",
"cavpCertName": "A7573",
"properties": "Iteration Count - Iteration Count: 10-10000 Increment 1 HMAC Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3- 224, SHA3-256, SHA3-384, SHA3-512 Password Length - Password Length: 8-128 Increment 1 Salt Length - Salt Length: 128-4096 Increment 8 Key Data Length - Key Data Length: 112-4096 Increment 8",
"reference": "SP 800-132"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 1 Primality Tests - 2powSecStr q mod 8 - 1 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A7573",
"properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Fixed Fixed Public Exponent - 010001",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A7573",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A7573",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-128",
"cavpCertName": "A7573",
"properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes Supports Bit-Oriented Output - No Output Length - Output Length: 16-1024 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-256",
"cavpCertName": "A7573",
"properties": "Supports Bit-Oriented Messages - No Supports Empty Message - Yes Supports Bit-Oriented Output - No Output Length - Output Length: 16-1024 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "TDES-CBC",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-CFB1",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-CFB64",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-CFB8",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-CMAC",
"cavpCertName": "A7573",
"properties": "Direction - Verification Keying Option - 1, 2 MAC Length - MAC Length: 32-64 Increment 8 Message Length - Message Length: 0-65536 Increment 8",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-ECB",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-OFB",
"cavpCertName": "A7573",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A7573",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A7572",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Returns the status of the module.",
"indicator": "N/A",
"inputs": "API call parameters",
"name": "Show Status",
"outputs": "Current operational status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": ""
},
{
"description": "Performs pre- operational self-tests by unloading and then re- initializing the module or by invoking API.",
"indicator": "N/A",
"inputs": "Re- instantiate module; API call parameters",
"name": "Perform self- tests on- demand",
"outputs": "Status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": ""
},
{
"description": "Zeroizes and de-allocates memory containing sensitive data.",
"indicator": "N/A",
"inputs": "Restart calling application; reboot or power-cycle host platform",
"name": "Zeroize",
"outputs": "None Crypto Officer - AES key: Z - AES CCM key: Z - AES GCM",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Passphrase: Z - AES GCM IV: Z - DRBG entropy input: Z - DRBG seed: Z - DRBG \u0027V\u0027 value: Z - DRBG \u0027Key\u0027 value: Z",
"secFunImpl": ""
},
{
"description": "Returns module versioning information.",
"indicator": "N/A",
"inputs": "API call parameters",
"name": "Show versioning information",
"outputs": "Module name, version",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": ""
},
{
"description": "Encrypts data using an approved mode of AES.",
"indicator": "EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, key, plaintext",
"name": "Perform symmetric encryption",
"outputs": "Status, ciphertext",
"rolesSspAccess": "User - AES key: W,E - AES XTS key: W,E",
"secFunImpl": "AES for Symmetric Encryption AES-XTS for Symmetric Encryption"
},
{
"description": "Decrypts data using an approved ode of AES.",
"indicator": "EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, key, ciphertext",
"name": "Perform symmetric decryption",
"outputs": "Status, plaintext",
"rolesSspAccess": "User - AES key: W,E - AES XTS key: W,E - TDES key: W,E",
"secFunImpl": "AES for Symmetric Decryption AES-XTS for Symmetric Decryption TDES for Symmetric Decryption (legacy)"
},
{
"description": "Generates symmetric digest.",
"indicator": "For CMAC: CMAC_get_service_indicator() For GMAC: EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, key, plaintext",
"name": "Generate symmetric digest",
"outputs": "Status, digest",
"rolesSspAccess": "User - AES CMAC key: W,E - AES GMAC key: W,E",
"secFunImpl": "AES- CMAC/GMAC for Message Authenticatio n"
},
{
"description": "Verifies symmetric digest.",
"indicator": "For CMAC: CMAC_get_service_indicator() For GMAC: EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, digest",
"name": "Verify symmetric digest",
"outputs": "Status",
"rolesSspAccess": "User - AES CMAC key: W,E - AES GMAC key: W,E - TDES CMAC key: W,E",
"secFunImpl": "AES- CMAC/GMAC for Message Authenticatio n TDES-CMAC for Message Authenticatio n (legacy)"
},
{
"description": "Encrypts data using AES- GCM or AES- CCM.",
"indicator": "EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, key, plaintext",
"name": "Perform authenticate d symmetric encryption",
"outputs": "Status, ciphertext",
"rolesSspAccess": "User - AES key: W,E - AES CCM key: W,E - AES GCM key: W,E",
"secFunImpl": "AES for Authenticated Symmetric Encryption"
},
{
"description": "Decrypts data using AES- GCM or AES- CCM.",
"indicator": "EVP_cipher_get_service_indicator( )",
"inputs": "API call parameters, key, ciphertext",
"name": "Perform authenticate d symmetric decryption",
"outputs": "Status, plaintext",
"rolesSspAccess": "User - AES key: W,E - AES CCM key: W,E - AES GCM key: W,E",
"secFunImpl": "AES for Authenticated Symmetric Decryption"
},
{
"description": "Generates random bits using DRBG.",
"indicator": "DRBG_get_service_indicator()",
"inputs": "API call parameters",
"name": "Generate random number",
"outputs": "Status, random bits",
"rolesSspAccess": "User - DRBG entropy input: W,E - DRBG seed: G,E - DRBG \u0027V\u0027 value: G,E - DRBG \u0027Key\u0027 value: G,E",
"secFunImpl": "DRBG"
},
{
"description": "Computes a message authenticatio n code.",
"indicator": "HMAC_get_service_indicator()",
"inputs": "API call parameters, key, message",
"name": "Perform keyed hash operation",
"outputs": "Status, MAC",
"rolesSspAccess": "User - HMAC key: W,E",
"secFunImpl": "HMAC for Message Authenticatio n"
},
{
"description": "Computes a message digest.",
"indicator": "EVP_Digest_get_service_indicator( )",
"inputs": "API call parameters, message",
"name": "Perform hash operation",
"outputs": "Status, hash",
"rolesSspAccess": "User",
"secFunImpl": "SHA/SHAKE for Message Digest"
},
{
"description": "Generates FIPS-186-4 domain parameters to be used for KAS-FFC-SSC.",
"indicator": "DSA_get_service_indicator()",
"inputs": "API call, parameters",
"name": "Generate DSA domain parameters",
"outputs": "Status, domain parameters",
"rolesSspAccess": "User",
"secFunImpl": "DSA for Domain Parameter Generation"
},
{
"description": "Verify DSA domain parameters.",
"indicator": "DSA_get_service_indicator()",
"inputs": "API call parameters",
"name": "Verify domain parameters",
"outputs": "Status",
"rolesSspAccess": "User",
"secFunImpl": "DSA for Domain Parameter Verification (legacy)"
},
{
"description": "Generates a public/private key pair.",
"indicator": "For RSA: RSA_key_get_service_indicator() For ECDSA: EC_key_get_service_indicator()",
"inputs": "API call parameters",
"name": "Generate asymmetric key pair",
"outputs": "Status, key pair",
"rolesSspAccess": "User - ECDSA private key: G - ECDSA public key: G - RSA private key: G - RSA public key: G - DRBG entropy input: W,E - DRBG seed: G,E - DRBG \u0027V\u0027 value: G,E - DRBG \u0027Key\u0027 value:",
"secFunImpl": "ECDSA for Key Generation RSA for Key Generation"
},
{
"description": "Verifies an ECDSA public key.",
"indicator": "EC_key_get_service_indicator()",
"inputs": "API call parameters, key",
"name": "Verify ECDSA public key",
"outputs": "Status",
"rolesSspAccess": "G,E User - ECDSA public key: W",
"secFunImpl": "ECDSA for Key Verification ECDSA for Key Verification"
},
{
"description": "Generates a digital signature.",
"indicator": "EVP_Digest_get_service_indicator( )",
"inputs": "API call parameters, key, message",
"name": "Generate digital signature",
"outputs": "Status, signature",
"rolesSspAccess": "User - ECDSA private key: W,E - RSA private key: W,E",
"secFunImpl": "(legacy) ECDSA for Signature Generation RSA for Signature Generation"
},
{
"description": "Verifies a digital signature.",
"indicator": "EVP_Digest_get_service_indicator( )",
"inputs": "API call parameters, key, signature, message",
"name": "Verify digital signature",
"outputs": "Status",
"rolesSspAccess": "User - DSA public key: W,E - ECDSA public key: W,E - RSA public key: W,E",
"secFunImpl": "DSA for Signature Verification (legacy) ECDSA for Signature Verification ECDSA for Signature Verification (legacy) RSA for Signature Verification RSA for Signature Verification (legacy)"
},
{
"description": "Computes DH/ECDH shared secret.",
"indicator": "For DH parameter \u0026 key generation: DSA_get_service_indicator() For KAS-FFC-SSC: DH_compute_key() For KAS-ECC-SSC: EC_key_get_service_indicator()",
"inputs": "API call parameters",
"name": "Compute shared secret",
"outputs": "Status, shared secret",
"rolesSspAccess": "User - DH private component : G,E - DH public component : G,W,E - DH shared secret: G,R - ECDH private component : G,E - ECDH public component : G,W,E - ECDH shared secret: G,R",
"secFunImpl": "DH Shared Secret Computation ECDH Shared Secret Computation"
},
{
"description": "Derives keying material via TLS v1.2 or TLS v1.3 KDF.",
"indicator": "For TLS v1.2 KDF: TLSKDF_get_service_indicator() For TLS v1.3 KDF: TLS1_3_kdf_get_service_indicator( )",
"inputs": "API call parameters",
"name": "Derive key via SP 800-135 Rev. 1 KDF",
"outputs": "Status, derived keying material",
"rolesSspAccess": "User - DH shared secret: W,E - ECDH shared secret: W,E - TLS pre- master secret: G,R - AES key: G,R - AES CCM key: G,R - AES GCM key: G,R - AES XTS key: G,R - AES CMAC key: G,R - AES GMAC key: G,R - HMAC key: G,R",
"secFunImpl": "TLSv1.2-KDF TLSv1.3-KDF"
},
{
"description": "Derives keying material from PBKDF2.",
"indicator": "PBKDF_get_service_indicator()",
"inputs": "API call parameters, password",
"name": "Derive key via PBKDF2",
"outputs": "Status, derived keying material",
"rolesSspAccess": "User - Passphrase: W,E - AES key: G,R - AES CCM key: G,R - AES GCM key: G,R - AES XTS key: G,R - AES CMAC key: G,R - AES GMAC key: G,R - TDES key: G,R - TDES CMAC key: G,R - HMAC key: G,R",
"secFunImpl": "PBKDF"
},
{
"description": "Establishes a TLS session. Please refer to Section 11.3 for a list of approved TLS cipher suites.",
"indicator": "For KAS-ECC-SSC: EC_key_get_service_indicator() For cipher: EVP_cipher_get_service_indicator( ) For message authentication: HMAC_get_service_indicator() For ECDSA certificate verification: EC_key_get_service_indicator() For RSA certificate verification: RSA_key_get_service_indicator() For TLS v1.2 KDF: TLSKDF_get_service_indicator() For TLS v1.3 KDF: TLS1_3_kdf_get_service_indicator( )",
"inputs": "API call parameters, TLS configuration , TLS keys",
"name": "Establish TLS connection",
"outputs": "Status, TLS connection informatio n",
"rolesSspAccess": "User - ECDH private component : G,E - ECDH public component : G,R,E - ECDH shared secret: G,E - TLS pre- master secret: G,E - TLS master secret: G,E - AES key: G,E - AES CCM key: G,E - AES GCM key: G,E - HMAC key: G,E - ECDSA private key: W,E - ECDSA public key: R,W,E - RSA private key: W,E - RSA public key: R,W,E",
"secFunImpl": "ECDH Shared Secret Computation TLSv1.2-KDF TLSv1.3-KDF AES for Authenticated Symmetric Encryption AES for Authenticated Symmetric Decryption AES for Symmetric Encryption AES for Symmetric Decryption HMAC for Message Authenticatio n ECDSA for Signature Generation ECDSA for Signature Verification ECDSA for Signature Verification (legacy) RSA for Signature Generation RSA for Signature Verification RSA for Signature Verification (legacy)"
},
{
"description": "Performs certificate management services.",
"indicator": "For ECDSA certificate verification: EC_key_get_service_indicator() For RSA certificate verification: RSA_key_get_service_indicator() For cipher: EVP_cipher_get_service_indicator( ) For hash: EVP_Digest_get_service_indicator( )",
"inputs": "AES key, API call parameters, private keys, public keys, certificates, certificate data",
"name": "Certificate Management",
"outputs": "Status",
"rolesSspAccess": "User - AES key: W,E - AES CCM key: W,E - AES GCM key: W,E - ECDSA private key: R,W,E - ECDSA public key: R,W,E - RSA private key: R,W,E - RSA public key: R,W,E",
"secFunImpl": "AES for Symmetric Encryption AES for Symmetric Decryption AES for Authenticated Symmetric Encryption AES for Authenticated Symmetric Decryption ECDSA for Signature Generation ECDSA for Signature Verification ECDSA for Signature Verification (legacy) RSA for Signature Generation RSA for Signature Verification RSA for Signature Verification (legacy)"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-ECB #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Encrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Encrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "256-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "256-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 #3",
"condition": "After successfully completing the software integrity tests.",
"details": "Encrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "512-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 #4",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "512-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Encrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "192-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "192-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Encrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "128-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #3",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "192-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #4",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "192-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #5",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "256-bit",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC #6",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "256-bit",
"type": "CAST"
},
{
"algorithmOrTest": "TDES-ECB",
"condition": "After successfully completing the software integrity tests.",
"details": "Decrypt",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "3-Key",
"type": "CAST"
},
{
"algorithmOrTest": "TDES-CMAC",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "3-Key",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate/Instantiate/Reseed",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "AES-128-CTR, with derivation function",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate/Instantiate/Reseed",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "AES-192-CTR, with derivation function",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG #3",
"condition": "After successfully completing the software integrity tests.",
"details": "Generate/Instantiate/Reseed",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "AES-256-CTR, with derivation function",
"type": "CAST"
},
{
"algorithmOrTest": "DSA SigVer (FIPS186-4)",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "2048-bit; SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Sign",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "P-224; SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) #1",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "P-224; SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Sign",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "K-233; SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) #2",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "K-233; SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5)",
"condition": "After successfully completing the software integrity tests.",
"details": "Sign",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "2048-bit; SHA2-256; PKCS#1.5 scheme",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5)",
"condition": "After successfully completing the software integrity tests.",
"details": "Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "2048-bit; SHA2-256; PKCS#1.5 scheme",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1",
"condition": "Before completing the software integrity tests.",
"details": "Hashed Message",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 224",
"condition": "Before completing the software integrity tests.",
"details": "Hashed Message",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256",
"condition": "Before completing the software integrity tests.",
"details": "Hashed Message",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384",
"condition": "Before completing the software integrity tests.",
"details": "Hashed Message",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512",
"condition": "Before completing the software integrity tests.",
"details": "Hashed Message",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256",
"condition": "Before completing the software integrity tests.",
"details": "Hash",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA3-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3",
"condition": "After successfully completing the software integrity tests.",
"details": "Shared Secret Computation",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "P-224",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3",
"condition": "After successfully completing the software integrity tests.",
"details": "Shared Secret Computation",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "2048-bit",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF",
"condition": "After successfully completing the software integrity tests.",
"details": "Derive",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-256; 5 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627",
"condition": "After successfully completing the software integrity tests.",
"details": "Derive",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.3 KDF",
"condition": "After successfully completing the software integrity tests.",
"details": "Derive",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "DSA KeyGen (FIPS186-4)",
"condition": "When the requested service requires the generation of a DH key pair.",
"details": "Sign/Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "PCT",
"testProps": "-",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5)",
"condition": "When the requested service requires the generation of an ECDH/ECDSA key pair.",
"details": "Sign/Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "PCT",
"testProps": "-",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5)",
"condition": "When the requested service requires the generation of an RSA key pair.",
"details": "Sign/Verify",
"indicator": "An integer value indicating success (1) or failure (0) of the self-test procedure call.",
"testMethod": "PCT",
"testProps": "-",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "If any of the pre- operational integrity tests fail. If any of the conditional self-tests fail.",
"description": "Upon test failure, the module immediately terminates the calling application\u0027s API call with a returned error code and sets an internal flag, signaling the error condition. For any subsequent request made by the calling application for cryptographic services, the module will return a failure indicator, thereby disabling all access to its cryptographic functions, sensitive security parameters (SSPs), and data output services while the error condition persists.",
"indicator": "Returns error code and sets an internal flag. Subsequent requests return failure indicator.",
"name": "Critical Error",
"recoveryMethod": "The module must be re- instantiated by the calling application. The Crypto Officer should contact Sunhillo Corporation if errors persist after re- instantiation."
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module is in the Approved mode when all pre-operational self-tests have successfully been completed, and only Approved Services are invoked.",
"name": "Approved",
"statusIndicator": "",
"type": "Approved"
},
{
"description": "The module will operate in the non-Approved mode upon execution of a non-Approved service.",
"name": "Non- approved",
"statusIndicator": "",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "AES-GCM (non-compliant)",
"use": "Authenticated encryption/decryption"
},
{
"name": "AES-OCB",
"use": "Authenticated encryption/decryption"
},
{
"name": "ANSI X9.31 RNG (with 128-bit AES core)",
"use": "Random number generation"
},
{
"name": "ARIA",
"use": "Encryption/decryption"
},
{
"name": "Blake2",
"use": "Encryption/decryption"
},
{
"name": "Blowfish",
"use": "Encryption/decryption"
},
{
"name": "Camellia",
"use": "Encryption/decryption"
},
{
"name": "CAST",
"use": "Encryption/decryption"
},
{
"name": "CAST5",
"use": "Encryption/decryption"
},
{
"name": "ChaCha20",
"use": "Encryption/decryption"
},
{
"name": "DES",
"use": "Encryption/decryption"
},
{
"name": "Hash DRBG",
"use": "Random bit generation"
},
{
"name": "HMAC DRBG",
"use": "Random bit generation"
},
{
"name": "DSA SigGen",
"use": "Digital signature generation"
},
{
"name": "DH (non-compliant)",
"use": "Shared secret computation; key pair generation"
},
{
"name": "DSA KeyGen (non-compliant)",
"use": "Key pair generation"
},
{
"name": "DSA SigVer (non-compliant)",
"use": "Digital signature verification"
},
{
"name": "ECDH (non-compliant)",
"use": "Shared secret computation; key pair generation"
},
{
"name": "ECDSA KeyGen (non-compliant)",
"use": "Key pair generation"
},
{
"name": "ECDSA SigGen (non-compliant)",
"use": "Digital signature generation"
},
{
"name": "ECDSA SigVer (non-compliant)",
"use": "Digital signature verification"
},
{
"name": "EdDSA KeyGen",
"use": "Key pair generation"
},
{
"name": "EdDSA SigGen",
"use": "Digital signature generation"
},
{
"name": "EdDSA SigVer",
"use": "Digital signature verification"
},
{
"name": "IDEA",
"use": "Encryption/decryption"
},
{
"name": "TLS v1.0/v1.1 KDF",
"use": "Key derivation"
},
{
"name": "HKDF",
"use": "Key derivation"
},
{
"name": "KBKDF",
"use": "Key derivation"
},
{
"name": "MD2",
"use": "Message digest"
},
{
"name": "MD4",
"use": "Message digest"
},
{
"name": "MD5",
"use": "Message digest"
},
{
"name": "Poly1305",
"use": "Message authentication code"
},
{
"name": "RC2",
"use": "Encryption/decryption"
},
{
"name": "RC4",
"use": "Encryption/decryption"
},
{
"name": "RC5",
"use": "Encryption/decryption"
},
{
"name": "RIPEMD",
"use": "Message digest"
},
{
"name": "RMD160",
"use": "Message digest"
},
{
"name": "RSA KeyGen (non-compliant)",
"use": "Key pair generation"
},
{
"name": "RSA SigGen (non-compliant)",
"use": "Digital signature generation"
},
{
"name": "RSA SigVer (non-compliant)",
"use": "Digital signature verification"
},
{
"name": "RSA encrypt/decrypt",
"use": "Asymmetric encryption/decryption"
},
{
"name": "SEED",
"use": "Encryption/decryption"
},
{
"name": "SHA-1 (non-compliant)",
"use": "Signature generation for TLS v1.0/v1.1"
},
{
"name": "SM2",
"use": "Digital signature generation; digital signature verification"
},
{
"name": "SM3",
"use": "Message digest"
},
{
"name": "SM4",
"use": "Encryption/decryption"
},
{
"name": "TDES (non-compliant)",
"use": "Encryption/decryption; MAC generation"
},
{
"name": "Whirlpool",
"use": "Message digest"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "ARIA Blake2 Blowfish Camellia CAST CAST5 ChaCha20 DES IDEA RC2 RC4 RC5 SEED SM4",
"description": "Perform symmetric data encryption",
"name": "Perform data encryption (non-compliant)",
"role": "User"
},
{
"alg_accessed": "TDES (non-compliant) ARIA Blake2 Blowfish Camellia CAST CAST5 ChaCha20 DES IDEA RC2 RC4 RC5 SEED",
"description": "Perform symmetric data decryption",
"name": "Perform data decryption (non-compliant)",
"role": "User"
},
{
"alg_accessed": "SM4 TDES (non-compliant) Poly1305 TDES (non-compliant)",
"description": "Perform message authentication operations",
"name": "Perform MAC operations (non-compliant)",
"role": "User"
},
{
"alg_accessed": "MD2 MD4 MD5 RIPEMD RMD160 SHA-1 (non-compliant) SM3 Whirlpool",
"description": "Perform hash operation",
"name": "Perform hash operation (non-compliant)",
"role": "User"
},
{
"alg_accessed": "DSA SigGen DSA SigVer (non-compliant) ECDSA SigGen (non-compliant) ECDSA SigVer (non-compliant) EdDSA SigGen EdDSA SigVer RSA SigGen (non-compliant) RSA SigVer (non-compliant) SM2",
"description": "Perform digital signature functions",
"name": "Perform digital signature functions (non- compliant)",
"role": "User"
},
{
"alg_accessed": "RSA encrypt/decrypt",
"description": "Perform asymmetric encryption",
"name": "Perform asymmetric encryption",
"role": "User"
},
{
"alg_accessed": "RSA encrypt/decrypt",
"description": "Perform asymmetric decryption functions",
"name": "Perform asymmetric decryption",
"role": "User"
},
{
"alg_accessed": "TLS v1.0/v1.1 KDF HKDF KBKDF",
"description": "Perform key derivation functions",
"name": "Perform key derivation functions (non-compliant)",
"role": "User"
},
{
"alg_accessed": "AES-GCM (non-compliant) AES-OCB",
"description": "Perform authenticated encryption/decryption",
"name": "Perform authenticated encryption/decryption (non-compliant)",
"role": "User"
},
{
"alg_accessed": "ANSI X9.31 RNG (with 128-bit AES core) Hash DRBG HMAC DRBG",
"description": "Perform random number generation",
"name": "Perform random number generation (non- compliant)",
"role": "User"
},
{
"alg_accessed": "DH (non-compliant) DSA KeyGen (non-compliant) ECDH (non-compliant) ECDSA KeyGen (non-compliant) EdDSA KeyGen RSA KeyGen (non-compliant)",
"description": "Perform key pair generation",
"name": "Perform key pair generation (non-compliant)",
"role": "User"
},
{
"alg_accessed": "DH (non-compliant) ECDH (non-compliant)",
"description": "Perform shared secret computation",
"name": "Shared secret computation (non-compliant)",
"role": "User"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Logical interface is defined as API input arguments that provide input data for processing. This includes data to be encrypted, decrypted, signed, verified, and hashed, keys to be used in cryptographic services, random seed material for the DRBG of the module, keying material used as input to key establishment services, and intermediate data required for services.",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "Logical interface is defined as API output arguments that return generated or processed data back to the caller. This includes data that has been encrypted/decrypted/verified, digital signatures, hashes, random values generated by the DRBG of the module, keys established using key establishment methods of the module, and key components/intermediate data/traffic (client and server data and messages).",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "Logical interface is defined as API input arguments that are used to initialize and control the operation of the module. This includes API commands invoking cryptographic services, modes, key sizes, etc. used with cryptographic services.",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "N/A, the module does not implement a Control Output interface.",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Logical interface is defined as API call return values. This includes status information regarding the module or invoked service/operation.",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
},
{
"authMethodList": "",
"name": "User",
"operatorType": "User",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC-SHA2- 256 #1",
"details": "Software integrity test for libcrypto. Performed automatically without operator action",
"indicator": "Internal flag; subsequent requests return failure indicator",
"testMethod": "Software Integrity Test",
"testProps": "SHA2-256",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 #2",
"details": "Software integrity test for libssl. Performed automatically without operator action",
"indicator": "Internal flag; subsequent requests return failure indicator",
"testMethod": "Software Integrity Test",
"testProps": "SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "Imported in plaintext via API parameter",
"sfiAlgo": "",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "Exported in plaintext via API parameter",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "The OpenSSL_cleanse() function zeroizes SSPs.",
"method": "OpenSSL_cleanse()",
"operatorId": "The operator calls the OpenSSL_cleanse() function. The successful completion of the procedural zeroization suffices as the implicit indicator that zeroization has completed.",
"rationale": "The OpenSSL_cleanse() function zeroizes SSPs, yielding them irretrievable."
},
{
"description": "The host device is rebooted or power cycled, which zeroizes the SSPs.",
"method": "Reboot/Power cycle",
"operatorId": "The operator reboots or power cycles the host device.",
"rationale": "Rebooting or power cycling the host device clears RAM, yielding the SSPs irretrievable."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [],
"found": false,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [
{
"features": "",
"integrityTest": "Yes",
"packageFileName": "libssl.so.1.1 libcrypto.so.1.1",
"swFwVersion": "1.1.1zd.001"
},
{
"features": "",
"integrityTest": "Yes",
"packageFileName": "libcrypto-1_1-x64.dll libssl-1_1-x64.dll",
"swFwVersion": "1.1.1zd.001"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "Dell PowerEdge R440",
"hypervisorHostOs": "",
"operatingSystem": "Debian 9",
"paa_pai": "Yes",
"processors": "Intel Xeon Silver 4214R",
"version": "1.1.1zd.001"
},
{
"hardwarePlatform": "Dell PowerEdge R440",
"hypervisorHostOs": "",
"operatingSystem": "Debian 9",
"paa_pai": "No",
"processors": "Intel Xeon Silver 4214R",
"version": "1.1.1zd.001"
},
{
"hardwarePlatform": "Dell PowerEdge R760",
"hypervisorHostOs": "VMware ESXi v8.0",
"operatingSystem": "Windows Server 2022",
"paa_pai": "Yes",
"processors": "Intel Xeon Gold 6542Y",
"version": "1.1.1zd.001"
},
{
"hardwarePlatform": "Dell PowerEdge R760",
"hypervisorHostOs": "VMware ESXi v8.0",
"operatingSystem": "Windows Server 2022",
"paa_pai": "No",
"processors": "Intel Xeon Gold 6542Y",
"version": "1.1.1zd.001"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG Section 4",
"reference": "SP 800-133 Rev. 2 Section 4 Example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "ControlCenter-IP (2.0) series; Marvell Armada A8040; ARM A72",
"operatingSystem": "ControlCenter-IP 2.0 firmware v1.6 with SecureCert"
},
{
"hardwarePlatform": "ControlCenter-IP (2.0) series; Marvell Armada A8040; ARM A72",
"operatingSystem": "ControlCenter-IP 2.0 firmware v1.7 with SecureCert"
},
{
"hardwarePlatform": "ControlCenter-IP MAX series; Intel Xeon, x86_64",
"operatingSystem": "ControlCenter-IP MAX firmware v1.0 with SecureCert"
},
{
"hardwarePlatform": "ControlCenter-IP-XS series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "ControlCenter-IP-XS firmware v1.1 with SecureCert"
},
{
"hardwarePlatform": "ControlCenter-IP-XS series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "ControlCenter-IP-XS firmware v1.2 with SecureCert"
},
{
"hardwarePlatform": "RemoteAccess IP series; NXP i.MX8m; ARM A53",
"operatingSystem": "RemoteAccess-IP firmware v1.3 with SecureCert"
},
{
"hardwarePlatform": "Vision-IP series; NXP Freescale MPC 8308; PPC e300",
"operatingSystem": "Vision-IP firmware v2.4 with SecureCert"
},
{
"hardwarePlatform": "VisionVS-IP series; NXP Freescale MPC 8308; PPC e300",
"operatingSystem": "Vision-IP firmware v2.4 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.4 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.5 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.6 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP (2.0) series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.6 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.7 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP (2.0) series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.7 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.8 with SecureCert"
},
{
"hardwarePlatform": "VisionXS-IP (2.0) series; NXP i.MX8m mini; ARM A53",
"operatingSystem": "VisionXS-IP firmware v1.8 with SecureCert"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 39
},
"ECDSA": {
"ECDSA": 90
},
"EdDSA": {
"EdDSA": 6
}
},
"FF": {
"DH": {
"DH": 37,
"DHE": 1,
"Diffie-Hellman": 1
},
"DSA": {
"DSA": 43
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 1
},
"CCM": {
"CCM": 13
},
"CTR": {
"CTR": 1
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 27
},
"XEX": {
"XEX": 1
},
"XTS": {
"XTS": 9
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"TLS": {
"SSL": {
"SSL": 3
},
"TLS": {
"TLS": 37,
"TLS 1.2": 1,
"TLS 1.3": 4,
"TLS v1.2": 10,
"TLS v1.3": 10
}
}
},
"crypto_scheme": {
"AEAD": {
"AEAD": 2
},
"KA": {
"Key Agreement": 2
},
"MAC": {
"MAC": 24
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"B-163": 3,
"B-233": 6,
"B-283": 6,
"B-409": 6,
"B-571": 6,
"K-163": 3,
"K-233": 8,
"K-283": 5,
"K-409": 6,
"K-571": 6,
"P-192": 6,
"P-224": 18,
"P-256": 12,
"P-384": 4,
"P-521": 12
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 18,
"#12": 1,
"#2": 18,
"#3": 7,
"#4": 4,
"#5": 2,
"#6": 2
}
},
"fips_certlike": {
"Certlike": {
"AES 2": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"AES-CMAC #1": 2,
"AES-CMAC #2": 2,
"AES-CMAC #3": 2,
"AES-CMAC #4": 2,
"AES-CMAC #5": 2,
"AES-CMAC #6": 2,
"AES-GCM #1": 2,
"AES-GCM #2": 2,
"DRBG #1": 2,
"DRBG #2": 2,
"DRBG #3": 2,
"HMAC-SHA-1": 6,
"PKCS 1": 2,
"PKCS#1": 4,
"SHA-1": 14,
"SHA2- 256": 4,
"SHA2-224": 12,
"SHA2-256": 21,
"SHA2-384": 12,
"SHA2-512": 11,
"SHA3- 224": 1,
"SHA3-224": 1,
"SHA3-256": 4,
"SHA3-384": 2,
"SHA3-512": 2
}
},
"fips_security_level": {
"Level": {
"Level 1": 3
}
},
"hash_function": {
"BLAKE": {
"Blake2": 3
},
"MD": {
"MD4": {
"MD4": 2
},
"MD5": {
"MD5": 2
}
},
"PBKDF": {
"PBKDF": 21,
"PBKDF2": 4
},
"RIPEMD": {
"RIPEMD": 2
},
"SHA": {
"SHA1": {
"SHA-1": 14
},
"SHA3": {
"SHA3-224": 1,
"SHA3-256": 4,
"SHA3-384": 2,
"SHA3-512": 2
}
}
},
"ic_data_group": {},
"javacard_api_const": {
"curves": {
"SM2": 2
}
},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 57
},
"RNG": {
"RBG": 2,
"RNG": 3
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 88,
"FIPS 180-4": 5,
"FIPS 186-4": 10,
"FIPS 186-5": 7,
"FIPS 198-1": 9,
"FIPS 202": 6,
"FIPS PUB 186-2": 1,
"FIPS PUB 186-4": 2,
"FIPS PUB 186-5": 2,
"FIPS186-4": 15,
"FIPS186-5": 23
},
"ISO": {
"ISO/IEC 19790": 8,
"ISO/IEC 19790:2012": 1
},
"NIST": {
"NIST SP 800-132": 2,
"NIST SP 800-38D": 3,
"NIST SP 800-56A": 1,
"SP 800-132": 1,
"SP 800-133": 1,
"SP 800-135": 3,
"SP 800-38A": 7,
"SP 800-38B": 1,
"SP 800-38C": 1,
"SP 800-38D": 5,
"SP 800-38E": 1,
"SP 800-38F": 4,
"SP 800-56A": 2,
"SP 800-67": 7,
"SP 800-90A": 1
},
"PKCS": {
"PKCS 1": 1,
"PKCS#1": 2
},
"RFC": {
"RFC 5288": 1,
"RFC 8446": 1,
"RFC7627": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 113,
"AES-": 6,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 91,
"CAST5": 1
},
"RC": {
"RC2": 3,
"RC4": 1,
"RC5": 3
}
},
"DES": {
"3DES": {
"TDES": 22
},
"DES": {
"DES": 6
}
},
"constructions": {
"MAC": {
"CMAC": 14,
"HMAC": 23
}
},
"djb": {
"ChaCha": {
"ChaCha20": 3
},
"Poly": {
"Poly1305": 2
}
},
"miscellaneous": {
"ARIA": {
"ARIA": 3
},
"Blowfish": {
"Blowfish": 3
},
"Camellia": {
"Camellia": 3
},
"IDEA": {
"IDEA": 3
},
"SEED": {
"SEED": 3
},
"SM4": {
"SM4": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 6
},
"IBM": {
"SSC": 1
}
},
"tls_cipher_suite": {
"TLS": {
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_CCM": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8": 1,
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_CCM": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": 1,
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 2,
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 1
}
},
"vendor": {
"GD": {
"G\u0026D": 86
},
"NXP": {
"NXP": 13
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A7573",
"AES-CBCA7573",
"TDES-ECBA7573",
"TDES-CFB64A7573",
"AES-CTRA7573",
"KAS-FFC-SSC Sp800-56Ar3A7573",
"AES-CFB1A7573",
"HMAC-SHA2-384A7573",
"PBKDFA7573",
"SHA3-512A7573",
"HMAC-SHA-1A7573",
"RSA KeyGen (FIPS186-5)A7573",
"DSA PQGGen (FIPS186-4)A7573",
"ECDSA SigGen (FIPS186-5)A7573",
"ECDSA SigVer (FIPS186-4)A7573",
"TDES-OFBA7573",
"HMAC-SHA3-512A7573",
"TDES-CFB1A7573",
"AES-ECBA7573",
"HMAC-SHA3-256A7573",
"HMAC-SHA3-224A7573",
"AES-KWA7573",
"ECDSA KeyVer (FIPS186-5)A7573",
"TDES-CFB8A7573",
"SHA2-384A7573",
"AES-CCMA7573",
"SHAKE-256A7573",
"SHA2-256A7573",
"AES-CMACA7573",
"TDES-CMACA7573",
"TLS v1.2 KDF RFC7627A7573",
"AES-CFB8A7573",
"HMAC-SHA2-224A7573",
"AES-GCMA7573",
"ECDSA KeyVer (FIPS186-4)A7573",
"AES-XTS Testing Revision 2.0A7573",
"KAS-ECC-SSC Sp800-56Ar3A7573",
"Counter DRBGA7573",
"AES-KWPA7573",
"DSA SigVer (FIPS186-4)A7573",
"DSA KeyGen (FIPS186-4)A7573",
"ECDSA KeyGen (FIPS186-5)A7573",
"HMAC-SHA3-384A7573",
"AES-OFBA7573",
"SHA3-224A7573",
"SHA3-384A7573",
"ECDSA SigVer (FIPS186-5)A7573",
"RSA SigVer (FIPS186-5)A7573",
"AES-GMACA7573",
"HMAC-SHA2-512A7573",
"SHA2-224A7573",
"AES-CFB128A7573",
"RSA SigVer (FIPS186-4)A7573",
"TDES-CBCA7573",
"SHA2-512A7573",
"TLS v1.3 KDFA7572",
"SHA-1A7573",
"SHAKE-128A7573",
"SHA3-256A7573",
"RSA SigGen (FIPS186-5)A7573"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A7573",
"#A7572"
]
},
"policy_metadata": {
"/Author": "jjing",
"/CreationDate": "D:20260925094822-04\u002700\u0027",
"/Creator": "PScript5.dll Version 5.2.2",
"/ModDate": "D:20260925094822-04\u002700\u0027",
"/Producer": "Acrobat Distiller 26.0 (Windows)",
"/Title": "Microsoft Word - TID-39-0095-VAOE-IS-2609240819_140sp.docx",
"pdf_file_size_bytes": 495843,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 64
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "f18fc2ccd013ca6fcdfdb8b3b211258e6710f7f573ea8205de3848d79a3cd86f",
"source_hash": "acd1162962e19c1d2f6b30c1952e7dd365c390d16789e9c1eed1a1c01f58d1ec",
"txt_hash": "05e303aeec3a9e2f92e81e18ae6994d426541151d95e90b695e6b6f794e3f0da"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "No assurance of the minimum strength of generated SSPs (e.g., keys); No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs; When operated in approved mode",
"certificate_pdf_url": null,
"date_sunset": "2031-07-18",
"description": "G\u0026D Cryptographic Module is a software library providing a C language API for use by other applications requiring cryptographic functionality. G\u0026D Cryptographic Module offers symmetric encryption/decryption, digital signature generation/verification, hashing, cryptographic key generation, random number generation, message authentication, and key establishment functions to secure data-at-rest/data-in-flight and to support industry-standard secure communications protocols (including TLS 1.2/1.3).",
"embodiment": "MultiChipStand",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "G\u0026D Cryptographic Module",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-20",
"lab": "Teron Labs",
"validation_type": "Initial"
},
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-25",
"lab": "Teron Labs",
"validation_type": "Update"
}
],
"vendor": "Guntermann \u0026 Drunck GmbH",
"vendor_url": "http://www.gdsys.com/"
}
}