{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "9329880431754f35", "cert_id": 5518, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "PTP 700 Point to Point Wireless Ethernet Bridge", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-09-10", "validation_type": "Initial", "lab": "Acumen Security"}], "vendor_url": "http://www.cambiumnetworks.com", "vendor": "Cambium Networks, Ltd.", "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/September 2026_071026_0710.pdf", "module_type": "Hardware", "standard": "FIPS 140-3", "status": "active", "level": 2, "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. No assurance of the minimum strength of generated SSPs (e.g., keys)", "exceptions": ["Roles, services, and authentication: Level 3", "Operational environment: N/A", "Non-invasive security: N/A", "Life-cycle assurance: Level 3", "Mitigation of other attacks: N/A"], "embodiment": "MultiChipStand", "description": "The PTP 700 is deployed to create a point-to-point wireless bridge joining two Ethernet networks, or a point-to-multipoint wireless bridge joining between two and nine Ethernet networks. The PTP 45700 variant operates in licensed, lightly-licensed, and unlicensed frequency bands between 4400 MHz and 5875 MHz in channel bandwidths up to 45 MHz, providing aggregate data rates up to 450 Mbit/s. The PTP 78700 variant operates in licensed frequency bands between 7125 MHz and 8500 MHz, in channel bandwidths up to 45 MHz, providing aggregate data rates up to 503 Mbit/s.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-09-09", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 2": 3}}, "fips_certlike": {"Certlike": {"HMAC- SHA-1": 1, "HMAC SHA-1": 4, "HMAC- SHA1": 3, "SHA-1": 19, "SHA2-256": 17, "SHA2-384": 12, "SHA2- 256": 16, "SHA2- 384": 9, "SHA2- 512": 1, "SHA1": 3, "RSA 2048": 1, "- PKCS 1": 2, "AES 2594": 7, "AES-128": 9, "AES-192": 2, "AES-256": 6, "DRBG 256": 1, "PKCS 1": 2}}, "vendor": {}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES": 20, "AES-": 28, "AES-128": 9, "AES-192": 2, "AES-256": 6}, "CAST": {"CAST": 41}}, "DES": {"DES": {"DES": 1}}, "miscellaneous": {"SEED": {"SEED": 2}}, "constructions": {"MAC": {"HMAC": 26}}}, "asymmetric_crypto": {"RSA": {"RSA 2048": 1}, "ECC": {"ECDH": {"ECDHE": 95, "ECDH": 2}, "ECDSA": {"ECDSA": 29}, "EdDSA": {"EdDSA": 3}, "ECC": {"ECC": 4}}, "FF": {"DH": {"DHE": 1}, "DSA": {"DSA": 15}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 19, "SHA1": 3}}}, "crypto_scheme": {"MAC": {"MAC": 6}}, "crypto_protocol": {"TLS": {"TLS": {"TLS v1.3": 9, "TLS": 99, "TLS 1.3": 16}}}, "randomness": {"PRNG": {"DRBG": 32}, "RNG": {"RBG": 12}}, "cipher_mode": {"ECB": {"ECB": 1}, "CTR": {"CTR": 9}, "GCM": {"GCM": 9}}, "ecc_curve": {"NIST": {"P-256": 18, "P-384": 14}, "Edwards": {"Ed25519": 1}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {"OpenSSL": {"OpenSSL": 4}}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 15}, "IBM": {"SSC": 4}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 9, "FIPS PUB 140-3": 2, "FIPS 140": 2, "FIPS186-4": 10, "FIPS186-2": 3, "FIPS186-5": 7, "FIPS140-3": 4, "FIPS 186-2": 1, "FIPS 186-4": 1}, "NIST": {"SP 800-38D": 2}, "PKCS": {"PKCS 1": 2}, "RFC": {"RFC 8446": 3}, "ISO": {"ISO/IEC 19790": 2, "ISO/IEC 24759": 2}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 2172693, "pdf_is_encrypted": false, "pdf_number_of_pages": 87, "/Producer": "Microsoft\u00ae Word for Microsoft 365", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20260903082142-04'00'", "/ModDate": "D:20260903082142-04'00'", "pdf_hyperlinks": {"_type": "Set", "elements": []}}, "module_algorithms": {"_type": "Set", "elements": ["ECDSA SigVer (FIPS186-5)A4740", "DSA SigVer (FIPS186-4)A4740", "KDF SNMPA4742", "EDDSA SigVerA4740", "ECDSA KeyGen (FIPS186-5)A4740", "RSA SigVer (FIPS186-4)A4740", "ECDSA SigGen (FIPS186-5)A4740", "KAS-ECC-SSC Sp800-56Ar3A4740", "HMAC-SHA2-384A4740", "SHA2-256A4740", "AES-CFB128AES 2594", "SHA2-384A4740", "SHA-1A4740", "AES-GCMA4740", "Counter DRBGA4741", "TLS v1.3 KDFA4740", "SHA2-512A4740", "HMAC-SHA-1A4740", "HMAC-SHA2-256A4740", "RSA SigGen (FIPS186-4)A4740", "AES-ECBA4740", "RSA SigVer (FIPS186-2)A4740"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A474"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "2"}, {"section": "2", "title": "Cryptographic module specification", "level": "2"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "2"}, {"section": "4", "title": "Roles, services, and authentication", "level": "3"}, {"section": "5", "title": "Software/Firmware security", "level": "2"}, {"section": "6", "title": "Operational environment", "level": "N/A"}, {"section": "7", "title": "Physical security", "level": "2"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "2"}, {"section": "10", "title": "Self-tests", "level": "2"}, {"section": "11", "title": "Life-cycle assurance", "level": "3"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "2"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": true, "entries": [{"modelPartNum": "PTP 45700 Connectorized Models", "hwVersion": "C045070B003 B, C045070B003 A, C045070B003 C, C045070B003 D, C045070B034 A, C045070B034 B, C045070B034 C, C045070B034 D, C045070B034E , C045070B034F , C045070B039 A, C045070B039 B, C045070B039 C, C045070B039 D,", "fwVersion": "45700- 04-10- FIPS", "processors": "TI TMS320C665 7, Altera GXC7", "features": "Connectorized, Capacity = Full/Lite 150, Frequency = 45700, Finish = Powder/CARC/Non-CARC"}, {"modelPartNum": "", "hwVersion": "C045070B039E , C045070B039F , C045070B044 A, C045070B044 B, C045070B044 C, C045070B046 A, C045070B046 B, C045070B046 C, C045070B046 D, C045070B046E , C045070B046F , C045070B048 A, C045070B048 B, C045070B048 C, C045070B048 D, C045070B048E , C045070B048F", "fwVersion": "", "processors": "", "features": ""}, {"modelPartNum": "PTP 45700 Connectorized+Integrat ed Models", "hwVersion": "C045070B004 A, C045070B004 B, C045070B004 C, C045070B038 A, C045070B038 B, C045070B038 C, C045070B038 D,", "fwVersion": "45700- 04-10- FIPS", "processors": "TI TMS320C665 7, Altera GXC7", "features": "Connectorized+Integrate d, Capacity = Full/Lite 150, Frequency = 45700, Finish = Powder/CARC/Non-CARC"}, {"modelPartNum": "", "hwVersion": "C045070B038E , C045070B038F , C045070B040 A, C045070B040 B, C045070B040 C, C045070B040 D, C045070B040E , C045070B040F , C045070B045 A, C045070B045 B, C045070B045 C, C045070B047 A, C045070B047 B, C045070B047 C, C045070B047 D, C045070B047E , C045070B047F , C045070B049 A, C045070B049 B, C045070B049 C, C045070B049 D, C045070B049E , C045070B049F", "fwVersion": "", "processors": "", "features": ""}, {"modelPartNum": "PTP 45700 Beam Steering Models", "hwVersion": "C045070B041 A, C045070B041 B, C045070B041 C, C045070B042 A, C045070B042 B, C045070B042 C, C045070B043 A, C045070B043 B, C045070B043 C", "fwVersion": "45700- 04-10- FIPS", "processors": "TI TMS320C665 7, Altera GXC7", "features": "Beam Steer, Capacity = Full, Frequency = 45700, Finish = Powder/CARC/Non-CARC"}, {"modelPartNum": "PTP 78700 Connectorized Models/PTP 78700 Integrated Models", "hwVersion": "C070070B001 A, C070070B001 B, C070070B003 A, C070070B003 B, C070070B003 C, C070070B003 D, C070070B005 A, C070070B005 B, C070070B005 C, C070070B005 D, C070070B007 A, C070070B007 B, C070070B009 A, C070070B009 B, C070070B009", "fwVersion": "78700- 04-10- FIPS", "processors": "TI TMS320C665 7, Altera GXC7", "features": "Connectorized/Integrate d, Capacity = Full/Lite 150, Frequency = 78700, Finish = Powder/CARC/Non-CARC"}, {"modelPartNum": "", "hwVersion": "C, C070070B009 D, C070070B011 A, C070070B011 B, C070070B011 C, C070070B011 D, C070070B002 A, C070070B002 B, C070070B004 A, C070070B004 B, C070070B004 C, C070070B004 D, C070070B006 A, C070070B006 B, C070070B006 C, C070070B006 D, C070070B008 A, C070070B008 B, C070070B010 A, C070070B010 B, C070070B010 C, C070070B010 D, C070070B012 A, C070070B012 B,", "fwVersion": "", "processors": "", "features": ""}, {"modelPartNum": "", "hwVersion": "C070070B012 C, C070070B012 D", "fwVersion": "", "processors": "", "features": ""}]}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": false, "entries": []}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES- CFB128", "cavpCertName": "A474 0", "properties": "Direction - Decrypt, Encrypt Key Length - 128", "reference": "SP 800- 38A"}, {"algorithm": "AES- CFB128", "cavpCertName": "AES 2594", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800- 38A"}, {"algorithm": "AES-ECB", "cavpCertName": "A474 0", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800- 38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A474 0", "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 0-65536 Increment 8 AAD Length - AAD Length: 0-128 Increment 8", "reference": "SP 800- 38D"}, {"algorithm": "Counter DRBG", "cavpCertName": "A474 1", "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-128 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 1024 Nonce - Nonce: 64 Personalization String Length - Personalization String Length: 0- 128 Increment 8 Returned Bits - 2048", "reference": "SP 800- 90A Rev. 1"}, {"algorithm": "DSA SigVer (FIPS186- 4)", "cavpCertName": "A474 0", "properties": "L - 1024, 2048 N - 160, 256 Hash Algorithm - SHA-1, SHA2-256", "reference": "FIPS 186- 4"}, {"algorithm": "ECDSA KeyGen (FIPS186- 5)", "cavpCertName": "A474 0", "properties": "Curve - P-256, P-384 Secret Generation Mode - testing candidates", "reference": "FIPS 186- 5"}, {"algorithm": "ECDSA SigGen (FIPS186- 5)", "cavpCertName": "A474 0", "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384 Component - No", "reference": "FIPS 186- 5"}, {"algorithm": "ECDSA SigVer (FIPS186- 5)", "cavpCertName": "A474 0", "properties": "Component - No Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384", "reference": "FIPS 186- 5"}, {"algorithm": "EDDSA SigVer", "cavpCertName": "A474 0", "properties": "Curve - ED-25519 PreHash - No Pure - Yes", "reference": "FIPS 186- 5"}, {"algorithm": "HMAC- SHA-1", "cavpCertName": "A474 0", "properties": "MAC - MAC: 160 Key Length - Key Length: 8-512 Increment 8", "reference": "FIPS 198- 1"}, {"algorithm": "HMAC- SHA2- 256", "cavpCertName": "A474 0", "properties": "MAC - MAC: 256 Key Length - Key Length: 8-512 Increment 8", "reference": "FIPS 198- 1"}, {"algorithm": "HMAC- SHA2- 384", "cavpCertName": "A474 0", "properties": "MAC - MAC: 384 Key Length - Key Length: 8-1024 Increment 8", "reference": "FIPS 198- 1"}, {"algorithm": "KAS-ECC- SSC Sp800- 56Ar3", "cavpCertName": "A474 0", "properties": "Domain Parameter Generation Methods - P-256, P-384 Hash Function Z - SHA2-256, SHA2-384 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800- 56A Rev. 3"}, {"algorithm": "KDF SNMP (CVL)", "cavpCertName": "A474 2", "properties": "Password Length - Password Length: 64, 256 Engine ID - 53616D706C65205465787420537472696E672031323334353637 38, 80004531010A829F2C", "reference": "SP 800- 135 Rev. 1"}, {"algorithm": "RSA SigGen (FIPS186- 4)", "cavpCertName": "A474 0", "properties": "Signature Type - PKCSPSS Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32", "reference": "FIPS 186- 4"}, {"algorithm": "RSA SigVer (FIPS186- 2)", "cavpCertName": "A474 0", "properties": "Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Signature Type - PKCS 1.5 Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256", "reference": "FIPS 186- 4"}, {"algorithm": "RSA SigVer (FIPS186- 4)", "cavpCertName": "A474 0", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32 Public Exponent Mode - Fixed Fixed Public Exponent - 010001", "reference": "FIPS 186- 4"}, {"algorithm": "SHA-1", "cavpCertName": "A474 0", "properties": "Message Length - Message Length: 160, 0-65536 Increment 8", "reference": "FIPS 180- 4"}, {"algorithm": "SHA2- 256", "cavpCertName": "A474 0", "properties": "Message Length - Message Length: 256, 0-65536 Increment 8", "reference": "FIPS 180- 4"}, {"algorithm": "SHA2- 384", "cavpCertName": "A474 0", "properties": "Message Length - Message Length: 384, 0-65536 Increment 8", "reference": "FIPS 180- 4"}, {"algorithm": "SHA2- 512", "cavpCertName": "A474 0", "properties": "Message Length - Message Length: 512, 0-65536 Increment 8", "reference": "FIPS 180- 4"}, {"algorithm": "TLS v1.3", "cavpCertName": "A474", "properties": "HMAC Algorithm - SHA2-256, SHA2-384", "reference": "SP 800-"}, {"algorithm": "KDF (CVL)", "cavpCertName": "0", "properties": "KDF Running Modes - DHE, PSK-DHE", "reference": "135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG", "algoPropList": "Symmetric: AES-256-CBC, AES-128-CFB128, AES-256-GCM, AES-256-CCM, HMAC SHA-1, HMAC SHA2-256, HMAC SHA2-384, HMAC SHA2-512: :", "implName": "N/A", "reference": "SP800-133rev2 Sections 4 Example 1 and IG D.H"}, {"name": "CKG- Asym", "algoPropList": "Asymmetric: ECC P-256, ECC P-384:", "implName": "N/A", "reference": "SP800-133rev2 Section 4 Example 1 and IG D.H"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "DES", "caveat": "No security claimed.", "use": "Obfuscation of configuration and performance data for remote customer support and obfuscation of configuration management data. Configuration data does not include SSPs."}]}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": false, "entries": []}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "Main PSU Port", "logicalInterface": "Data Input Data Output Control Input Status Output Power", "data": "Transports plaintext data in and out when configured as a logical data port. Transports control in and status out when configured as a logical management port. Provides power to the PTP 700 ODU using power over Ethernet."}, {"physicalPort": "Aux Port", "logicalInterface": "Data Input Data Output Control Input Status Output", "data": "Transports plaintext data in and out when configured as a logical data port. Transports control in and status out when configured as a logical management port."}, {"physicalPort": "SFP (Fiber) Port", "logicalInterface": "Data Input Data Output Control Input Status Output", "data": "Transports plaintext data in and out when configured as a logical data port. Transports control in and status out when configured as a logical management port."}, {"physicalPort": "RF Horizontal", "logicalInterface": "Data Input Data Output Control Input Status Output", "data": "RF input and output for connection to an external horizontally polarized antenna. Exchanges encrypted control in, data in, data out and status out with another ODU. For connectorized operation, input and output are via an N type connector. For integrated operation, input and output are via the internal antenna."}, {"physicalPort": "RF Vertical", "logicalInterface": "Data Input Data Output Control Input Status Output", "data": "RF input and output for connection to an external vertically polarized antenna. Exchanges encrypted control in, data in, data out and status out with another ODU. For connectorized operation, input and output are via an N type connector. For integrated operation, input and output are via the internal antenna."}, {"physicalPort": "Ground terminal", "logicalInterface": "Power", "data": "Used for safety and lightning protection."}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "Local User Accounts", "description": "An identity-based Security Officer (SO) account is created at first use. Other identity-based accounts are created by a SO user. Authentication is by username and password with minimum password length of 15 ASCII characters.", "mechanism": "Password Based", "strength": "1 in 3.95 \u00d7 10^29", "perMinute": "1 in 1.32 \u00d7 10^28"}, {"name": "Single Sign-On", "description": "A local identity-based Security Officer (SO) configures for single sign-on where the authentication is provided by the Identity Provider (IdP)", "mechanism": "RSA SigVer (FIPS186-4) (A4740)", "strength": "1 in 2^112", "perMinute": "1 in 2^112"}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Security Officer (SO)", "type": "Identity", "operatorType": "CO", "authMethodList": "Local User Accounts Single Sign-On"}, {"name": "System Administrator (SA)", "type": "Identity", "operatorType": "User", "authMethodList": "Local User Accounts Single Sign-On"}, {"name": "Installer (IN)", "type": "Identity", "operatorType": "User", "authMethodList": "Local User Accounts Single Sign-On"}, {"name": "Read Only (RO)", "type": "Identity", "operatorType": "User", "authMethodList": "Local User Accounts Single Sign-On"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Self-Test", "description": "Known answer tests for all the supported cryptograp hic algorithms", "indicator": "Successful completion of self tests is implied by the restart of the module. On failure, module restarts and sets error code in Restart Reason.", "inputs": "Power", "outputs": "Error status: Module restarts and sets error code in restart reason Success: Module restarts normal operation", "secFunImpl": "None", "rolesSspAccess": "Unauthentic ated"}, {"name": "Web interface network connectio n", "description": "Establish a secure connectio n using HTTPS from module to web", "indicator": "Web browser indicates secure connection. For example, padlock", "inputs": "-", "outputs": "-", "secFunImpl": "AES- GCM-D (SFI#7) AES- GCM-E (SFI#8) CKG (SFI#9)", "rolesSspAccess": "Unauthentic ated - RSA WEB PRIV: E - RSA WEB PUB: W - ECDHE WEB PRIV: G"}, {"name": "Name", "description": "Descriptio n", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Securit y Functi", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "browser on an external general purpose computer (GPC)", "indicator": "symbol in Site Informatio n in Google Chrome.", "inputs": "", "outputs": "", "secFunImpl": "ons HMAC- SHA2- 256 (SFI#13 ) HMAC- SHA2- 384 (SFI#14 ) KAS1 (SFI#15 ) KAS- SSC (SFI#16 ) KDF- TLS (SFI#17 ) RBG (SF#19 ) RSA- PSS- GEN (SFI#20 ) RSA- PKCS (SFI#22 ) SHA2- 256 (SFI#24 ) SHA2- 384 (SFI#25 ) ECDSA (SFI#26 ) ECDSA (SFI#27", "rolesSspAccess": "- ECDHE WEB PUB1: G - ECDHE WEB PUB2: W - TLS WEB MS: G - TLS WEB SK: G - CTR DRBG SEED: G"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": ") ECDSA (SFI#28 )", "rolesSspAccess": ""}, {"name": "Web interface login", "description": "Operator accesses the module by authentica ting username and password.", "indicator": "Module displays the login dialog in the web interface and provides access when user is authenticat ed.", "inputs": "Username Password", "outputs": "-", "secFunImpl": "HMAC- SHA2- 256 (SFI#13 ) SHA2- 256 (SFI#24 )", "rolesSspAccess": "Security Officer (SO) - PW DIGEST: E - HMAC KEY: E System Administrat or (SA) - PW DIGEST: E - HMAC KEY: E Installer (IN) - PW DIGEST: E - HMAC KEY: E Read Only (RO) - PW DIGEST: E - HMAC KEY: E"}, {"name": "Web interface logout", "description": "Operator logs out from the module", "indicator": "Module displays logout dialogue in the web interface.", "inputs": "Command", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO) System Administrat or (SA) Installer (IN) Read Only"}, {"name": "Web interface SSO", "description": "Operator accesses the module using single sign on with SAML security assertion.", "indicator": "Module displays the login dialog in the web interface and provides access when user is", "inputs": "-", "outputs": "-", "secFunImpl": "RSA- PSS- VER (SFI#21 )", "rolesSspAccess": "(RO) Security Officer (SO) - RSA SSO PUB: System Administrat or (SA) - RSA SSO PUB: E Installer (IN)"}, {"name": "", "description": "", "indicator": "authenticat ed to identity provider.", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- RSA SSO PUB: E Read Only (RO) - RSA SSO PUB: E"}, {"name": "Web interface module status (Show Status/Sh ow Version)", "description": "Show module status and versioning informatio n including the module identifier (model number)", "indicator": "Module displays status information in the web interface.", "inputs": "N/A", "outputs": "Module Identifier: PTP 45700 Connectorized+Inte grated ODU, PTP 45700 Connectorized ODU, PTP 47500 Beam Steering ODU, PTP 78700 Connectorized ODU. Approved mode status: FIPS 140-3 text highlighted in Green, on the web interface. Hardware Version: All versions listed in Table Tested Module Identification - Hardware. Firmware Version: 45700-40-10-FIPS and 78700-04-10- FIPS", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO) System Administrat or (SA) Installer (IN) Read Only (RO)"}, {"name": "Web interface security configura tion", "description": "Operator configures security operation of the module, including License Key, excluding SSPs.", "indicator": "Module accepts configurati on data in the web interface.", "inputs": "-", "outputs": "-", "secFunImpl": "DSA (SFI#10 ) EDDSA (SFI#11 )", "rolesSspAccess": "Security Officer (SO) - DSA LIC PUB: E - EDDSA LIC PUB: E"}, {"name": "Web interface general", "description": "Operator configures wireless", "indicator": "Module accepts configurati", "inputs": "-", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO) System"}, {"name": "configura tion", "description": "and networkin g operation of the module.", "indicator": "on data in the web interface.", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Administrat or (SA)"}, {"name": "Web interface wireless security configura tion", "description": "Operator configures wireless security configurati on like encryption keys and certificate s", "indicator": "Module accepts configurati on data in the web interface.", "inputs": "-", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO)"}, {"name": "Web interface cnMaestr o configura tion", "description": "Operator configures cnMaestro connectio n parameter s of the module.", "indicator": "Module accepts configurati on data in the web interface.", "inputs": "-", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO)"}, {"name": "Web interface installatio n", "description": "Operator selects a predefine d configurati on for wireless and networkin g operation.", "indicator": "Module accepts configurati on data in the web interface.", "inputs": "-", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Installer (IN)"}, {"name": "Reboot by command at the web interface", "description": "Reboot the module.", "indicator": "Module requests confirmatio n in the web interface and restarts.", "inputs": "Command", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO) - ECDHE WEB PRIV: Z - ECDHE WEB PUB1: Z - ECDHE WEB PUB2: Z - TLS WEB"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "MS: Z - TLS WEB SK: Z - RSA MAES PUB: Z - ECDHE MAES PRIV: Z - ECDHE MAES PUB1: Z - ECDHE MAES PUB2: Z - TLS MAES MS: Z - TLS MAES SK: Z - RSA WLS PUB2: Z - ECDHE WLS PRIV: Z - ECDHE WLS PUB1: Z - ECDHE WLS PUB2: Z - TLS WLS MS: Z - TLS WLS SK1: Z - TLS WLS SK2: Z - SNMP AUTHPRIV PP: Z - HMAC KEY: Z - DRBG STATE: Z System Administrat or (SA) - ECDHE WEB PRIV: Z - ECDHE WEB PUB1:"}, {"name": "Name", "description": "Descriptio n", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Securit y Functi", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "ons", "rolesSspAccess": "Z - ECDHE WEB PUB2: Z - TLS WEB MS: Z - TLS WEB SK: Z - RSA MAES PUB: Z - ECDHE MAES PRIV: Z - ECDHE MAES PUB1: Z - ECDHE MAES PUB2: Z - TLS MAES MS: Z - TLS MAES SK: Z - RSA WLS PUB2: Z - ECDHE WLS PRIV: Z - ECDHE WLS PUB1: Z - ECDHE WLS PUB2: Z - TLS WLS MS: Z - TLS WLS SK1: Z - TLS WLS SK2: Z - SNMP AUTHPRIV PP: Z - HMAC KEY: Z - DRBG STATE: Z"}, {"name": "Administ er web", "description": "Create new user", "indicator": "Module allows", "inputs": "Password", "outputs": "-", "secFunImpl": "SHA2- 256", "rolesSspAccess": "Security Officer (SO)"}, {"name": "interface user accounts", "description": "accounts, update or reset passwords .", "indicator": "configurati on changes in the Local User Accounts page in the web interface.", "inputs": "", "outputs": "", "secFunImpl": "(SFI#24 )", "rolesSspAccess": "- PW DIGEST: G"}, {"name": "Update web interface password", "description": "Operator updates his/her own password for the web- based interface.", "indicator": "Module displays change password dialog in the web interface.", "inputs": "Password", "outputs": "-", "secFunImpl": "SHA2- 256 (SFI#24 )", "rolesSspAccess": "Security Officer (SO) - PW DIGEST: G System Administrat or (SA) - PW DIGEST: G Installer (IN) - PW DIGEST: G Read Only (RO) - PW DIGEST: G"}, {"name": "cnMaestr o network connectio n", "description": "Establish a secure tunnel with HTTPS from module to cnMaestro server", "indicator": "Module displays status indicator in the web interface.", "inputs": "-", "outputs": "-", "secFunImpl": "AES- GCM-D (SFI#7) AES- GCM-E (SFI#8) CKG (SFI#9) HMAC- SHA2- 256 (SFI#13 ) HMAC- SHA2- 384 (SFI#14 ) KAS1 (SFI#15 ) KAS-", "rolesSspAccess": "Unauthentic ated - RSA MAES PUB: W - RSA MAES ROOT: E - ECDHE MAES PRIV: G - ECDHE MAES PUB1: G - ECDHE MAES PUB2: W - TLS MAES MS: G - TLS MAES SK: G - CTR DRBG SEED: G"}, {"name": "Name", "description": "Descriptio n", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Outputs", "secFunImpl": "Securit y Functi", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "ons SSC (SFI#16 ) KDF- TLS (SFI#17 ) RBG (SF#19 ) RSA- PSS- GEN (SFI#20 ) RSA- PSS- VER (SFI#21 ) RSA- PKCS (SFI#22 ) SHA2- 256 (SFI#24 ) SHA2- 384 (SFI#25 ) ECDSA (SFI#26 ) ECDSA (SFI#27 ) ECDSA (SFI#28 ) AES-", "rolesSspAccess": ""}, {"name": "Establish secure wireless link", "description": "Module establishe s an authentica ted and", "indicator": "Module displays Wireless Link Status and", "inputs": "-", "outputs": "-", "secFunImpl": "GCM-D (SFI#7) AES- GCM-E", "rolesSspAccess": "Unauthentic ated - RSA WLS PRIV: E - RSA WLS"}, {"name": "", "description": "encrypted wireless link to a remote module using TLS 1.3 for key agreemen t.", "indicator": "Wireless Encryption attributes in the System Status page of the web interface.", "inputs": "", "outputs": "", "secFunImpl": "(SFI#8) CKG (SFI#9) HMAC- SHA2- 256 (SFI#13 ) HMAC- SHA2- 384 (SFI#14 ) KAS1 (SFI#15 ) KAS- SSC (SFI#16 ) KDF- TLS (SFI#17 ) RBG (SF#19 ) RSA- PSS- GEN (SFI#20 ) RSA- PSS- VER (SFI#21 ) RSA- PKCS (SFI#22 ) SHA2- 256 (SFI#24 ) SHA2-", "rolesSspAccess": "PUB1: W - RSA WLS PUB2: W - ECDHE WLS PRIV: G - ECDHE WLS PUB1: G - ECDHE WLS PUB2: W - TLS WLS MS: G - TLS WLS SK1: G - TLS WLS SK2: G - CTR DRBG SEED: G"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "384 (SFI#25 ) ECDSA (SFI#26 ) ECDSA (SFI#27 ) ECDSA (SFI#28 )", "rolesSspAccess": ""}, {"name": "Wireless encryptio n", "description": "Encrypt and decrypt end-user's data for transmissi on across the wireless link", "indicator": "Module displays negotiated wireless encryption algorithm in the Wireless Encryption attribute in the System Status page of the web", "inputs": "Plain text Ethernet, Encrypted wireless", "outputs": "Encrypted wireless, Plain text Ethernet", "secFunImpl": "AES- CFB- WLS-D (SFI#1) AES- CFB- WLS-E (SFI#2)", "rolesSspAccess": "Unauthentic ated - TLS WLS SK2: E - AES GCM IV: E"}, {"name": "Update firmware with zeroizatio n", "description": "Verify digital signature of replaceme nt firmware. Write firmware to non- volatile memory. SSPs are always zeroized upon firmware upgrade.", "indicator": "interface. Operator selects replacemen t firmware using the web interface. Web interface provides progress tracker and requests confirmatio n, including zeroization, before restarting. Module restarts.", "inputs": "Command", "outputs": "-", "secFunImpl": "DSA (SFI#10 ) EDDSA (SFI#11 )", "rolesSspAccess": "Security Officer (SO) - EDDSA FW PUB: E - KoK: Z - DRBG ENT: Z - RSA WEB PRIV: Z - RSA WEB PUB: Z - RSA WLS PRIV: Z - RSA WLS PUB1: Z - RSA WLS ROOT: Z - PSK WLS: Z - SNMP AUTHPRIV"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "LOC: Z - SNTP KEY: Z - PW DIGEST: Z - RSA SSO PUB: Z - DSA LIC PUB: E"}, {"name": "Zeroise SSPs", "description": "Protect encrypted SSPs in non- volatile memory by erasing the key of keys. Remove SSPs from volatile memory by reboot.", "indicator": "Operator triggers zeroization action using the web interface with confirmatio n. Module restarts.", "inputs": "Command", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Security Officer (SO) - ECDHE WEB PRIV: Z - ECDHE WEB PUB1: Z - ECDHE WEB PUB2: Z - TLS WEB MS: Z - TLS WEB SK: Z - RSA MAES PUB: Z - ECDHE MAES PRIV: Z - ECDHE MAES PUB1: Z - ECDHE MAES PUB2: Z - TLS MAES MS: Z - TLS MAES SK: Z - RSA WLS PUB2: Z - ECDHE WLS PRIV: Z - ECDHE WLS PUB1: Z - ECDHE WLS PUB2: Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- TLS WLS MS: Z - TLS WLS SK1: Z - TLS WLS SK2: Z - SNMP AUTHPRIV PP: Z - HMAC KEY: Z - DRBG STATE: Z - KoK: Z - DRBG ENT: Z - RSA WEB PRIV: Z - RSA WEB PUB: Z - RSA WLS PRIV: Z - RSA WLS PUB1: Z - RSA WLS ROOT: Z - PSK WLS: Z - SNMP AUTHPRIV LOC: Z - SNTP KEY: Z - PW DIGEST: Z - RSA SSO"}, {"name": "Configure SSPs", "description": "Configure SSPs for HTTPS, wireless encryption , authentica ted NTP, SNMPv3", "indicator": "Operator configures SSPs in the web interface, submits changes. Module restarts.", "inputs": "SSPs", "outputs": "-", "secFunImpl": "AES- ECB-D (SFI#5) AES- ECB-E (SFI#6) KDF- SNMP (SFI#18 )", "rolesSspAccess": "PUB: Z Security Officer (SO) - KoK: W - DRBG ENT: W - RSA WEB PRIV: W - RSA WEB PUB: W - RSA WLS"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "PRIV: W - RSA WLS PUB1: W - RSA WLS ROOT: W - PSK WLS: W - SNMP AUTHPRIV PP: W - SNTP KEY: W - PW DIGEST: G - RSA SSO PUB: W"}, {"name": "SNMPv3 general configura tion", "description": "Operator configures wireless and networkin g operation of the module using SNMPv3. SNMP does not allow input or output of SSPs.", "indicator": "SNMP manager modifies MIB objects in the module with indication of successful operation.", "inputs": "-", "outputs": "-", "secFunImpl": "AES- CFB- SNMP- D(SFI# 3) AES- CFB- SNMP- E (SFI#4) HMAC- SHA1 (SFI#12 ) SHA-1 (SFI#23 )", "rolesSspAccess": "Security Officer (SO) - SNMP AUTHPRIV LOC: E"}, {"name": "Synchroni ze Real Time Clock", "description": "Synchroniz e RTC with authentica ted NTP server", "indicator": "Module indicates RTC synchroniza tion status in the web interface", "inputs": "NTP messages with authentica tion", "outputs": "Updated date and time", "secFunImpl": "SHA-1 (SFI#23 )", "rolesSspAccess": "Unauthentic ated - SNTP KEY: E"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": false, "entries": []}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": true, "entries": [{"mechanism": "Appropriate module enclosure screws covered with tamper- evident barrels.", "inspectFreq": "30 days", "inspectGuidance": "Inspect screw heads for chipped/missing barrels. If found remove module from service."}]}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "Volatile (S1)", "description": "Stored in volatile memory (RAM)", "persistance": "Dynamic"}, {"name": "Non-volatile (S2)", "description": "Stored in non-volatile memory, encrypted with the Key of Keys.", "persistance": "Static"}, {"name": "Key of Keys (S3)", "description": "Stored in non-volatile memory as plain text.", "persistance": "Static"}, {"name": "Embedded (S4)", "description": "Embedded in the operating firmware as plain text.", "persistance": "Static"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Input with Direct configuration from directly connected GPC (I1)", "source": "General purpose computer (GPC) (outside)", "dest": "Module (S2)", "format": "Plaintext", "distribution": "Manual", "entry": "Direct", "sfiAlgo": ""}, {"name": "Input with Electronic configuration from directly connected GPC (I2)", "source": "GPC (outside)", "dest": "Module (S2)", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Z1", "description": "Erase Key of Keys", "rationale": "A dedicated flash memory bank is erased to zeroize the Instantiate (KoK) CSP. Erased flash memory has a default value of \"1\".", "operatorId": "Triggered by a SO user from Main Application, or Recovery."}, {"method": "Z2", "description": "Overwrite volatile SSPs", "rationale": "Overwritten in RAM with a fixed pattern of zeros.", "operatorId": "Triggered by a SO user from Main Application, or Recovery by a reboot of the module."}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "Firmware integrity", "testProps": "32-bit CRC", "testMethod": "KAT", "type": "SW/FW Integrity", "indicator": "Success: Module starts normally Failure: Module restarts in Recovery", "details": "32 bit CRC computed over firmware image for Main Application or Recovery."}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES-CFB128 Encrypt (AES 2594)", "testProps": "AES-128, AES-192, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Encrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-CFB128 Decrypt (AES 2594)", "testProps": "AES-128, AES-192, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Decrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-CFB128 Encrypt (A4740)", "testProps": "AES-128", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Encrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-CFB128 Decrypt (A4740)", "testProps": "AES-128", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Decrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-ECB Encrypt (A4740)", "testProps": "AES-128, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Encrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-ECB Encrypt (A4740)", "testProps": "AES-128, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Decrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-GCM Encrypt (A4740)", "testProps": "AES-128, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Encrypt", "condition": "Restart"}, {"algorithmOrTest": "AES-GCM Decrypt (A4740)", "testProps": "AES-128, AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Decrypt", "condition": "Restart"}, {"algorithmOrTest": "CSP entry", "testProps": "-", "testMethod": "Duplicate entries", "type": "Manual Entry", "indicator": "Success: Module submits web page or navigates to next web page in Wizard interface. Failure: Module displays error message in dialog box and will not allow user to proceed until the error is resolved.", "details": "-", "condition": "CSP entry for Key of Keys Entropy Wireless PSK SNTP key SNMP authentication SNMP privacy"}, {"algorithmOrTest": "CSP integrity", "testProps": "32-bit CRC", "testMethod": "KAT", "type": "Critical Function", "indicator": "Module restarts Failure code", "details": "CRC checked before CSP is decrypted", "condition": "Reading CSPs from non- volatile storage."}, {"algorithmOrTest": "Counter DRBG (A4741)", "testProps": "AES ECB 128- bit", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Instantiate, Generate, and Reseed critical function tests are implemented in accordance with section 11.3 of [90A] as part of this Known Answer Test (KAT)", "condition": "Restart"}, {"algorithmOrTest": "DSA SigVer (FIPS186-4) (A4740)", "testProps": "1024-bit 2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature verification", "condition": "Restart"}, {"algorithmOrTest": "ECDH", "testProps": "EC P-256 EC P-384", "testMethod": "KAT", "type": "PCT", "indicator": "Success: Module operates normally Failure: Module restarts with failure code", "details": "Pair-wise consistency test upon key generation", "condition": "Before generating EC key pair"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A4740)", "testProps": "EC P-256 EC P-384", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature generation", "condition": "Restart"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A4740)", "testProps": "EC P-256 EC P-384", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature verification", "condition": "Restart"}, {"algorithmOrTest": "EDDSA SigVer (A4740)", "testProps": "Ed25519", "testMethod": "KAT", "type": "SW/FW Load", "indicator": "Web interface", "details": "Signature verification", "condition": "Before writing replacement firmware to flash"}, {"algorithmOrTest": "HMAC SHA-1 (A4740) HMAC SHA2-256 (A4740) HMAC SHA2-384 (A4740)", "testProps": "SHA-1 SHA2- 256 SHA2- 384", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Message authentication", "condition": "Restart"}, {"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A4740)", "testProps": "SHA2-256 SHA2-384", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Shared secret establishment", "condition": "Restart"}, {"algorithmOrTest": "RSA SigVer (FIPS186-2) (A4740)", "testProps": "2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature verification", "condition": "Restart"}, {"algorithmOrTest": "RSA SigGen (FIPS186-4) (A4740)", "testProps": "2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature generation", "condition": "Restart"}, {"algorithmOrTest": "RSA SigVer (FIPS186-4) (A4740)", "testProps": "2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Signature verification", "condition": "Restart"}, {"algorithmOrTest": "SHA-1 SHA2-256 SHA2-384 SHA2- 512", "testProps": "SHA-1 SHA2- 256 SHA2- 384 SHA2- 512", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Digest generation", "condition": "Restart"}, {"algorithmOrTest": "KDF SNMP (A4742)", "testProps": "HMAC SHA-1", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Key Derivation Algorithm using HMAC", "condition": "Restart"}, {"algorithmOrTest": "TLS v1.3 KDF (A4740)", "testProps": "HMAC SHA2- 256, HMAC SHA2-384", "testMethod": "KAT", "type": "CAST", "indicator": "Success: Module starts normally Failure: Module restarts with failure code", "details": "Key derivation using TLS 1.3", "condition": "Restart"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "ES1", "description": "The module fails CAST, PCT, firmware integrity", "conditions": "The module enters the failure state", "recoveryMethod": "Reboot/Power cycle the module", "indicator": "The module restarts with a failure reset reason"}, {"name": "ES2", "description": "The module fails firmware load test", "conditions": "The module returns to normal operation", "recoveryMethod": "None", "indicator": "The module rejects image upgrade with failure message"}, {"name": "ES3", "description": "The module fails manual entry of CSPs", "conditions": "The module returns to normal operation", "recoveryMethod": "None", "indicator": "The module rejects the manual CSP entry with a web-dialog error message"}, {"name": "ES4", "description": "The module fails CSP integrity check", "conditions": "The module enters the failure state", "recoveryMethod": "Reboot/Power cycle the module", "indicator": "The module zeroizes SSPs and restarts with a failure reset reason"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["ECDSA SigVer (FIPS186-5)A4740", "DSA SigVer (FIPS186-4)A4740", "KDF SNMPA4742", "EDDSA SigVerA4740", "ECDSA KeyGen (FIPS186-5)A4740", "RSA SigVer (FIPS186-4)A4740", "ECDSA SigGen (FIPS186-5)A4740", "KAS-ECC-SSC Sp800-56Ar3A4740", "HMAC-SHA2-384A4740", "SHA2-256A4740", "AES-CFB128AES 2594", "SHA2-384A4740", "SHA-1A4740", "AES-GCMA4740", "#A474", "Counter DRBGA4741", "TLS v1.3 KDFA4740", "SHA2-512A4740", "HMAC-SHA-1A4740", "HMAC-SHA2-256A4740", "RSA SigGen (FIPS186-4)A4740", "AES-ECBA4740", "RSA SigVer (FIPS186-2)A4740"]}, "extracted_versions": {"_type": "Set", "elements": ["700"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "0900d775279b13f7b8d89c4ca926bfdb3f49feebede369194d1f07e39a96977d", "txt_hash": "5bdec81986b6366a00137259f86afac485aeec8bc79dca93e991ef30d095eae8", "json_hash": "e2f4b579ab842eebbd46bd9c47fcf2294f9666949e5bfc485348d92ca6555524"}}}