This page was not yet optimized for use on mobile devices.
TuxCare OpenSSL FIPS Provider
Certificate details
| Certificate ID | #5373 |
|---|---|
| Status | active |
| Validation dates | 07.07.2026 |
| Sunset date | 06-07-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | AlmaLinux 9.6 OpenSSL FIPS provider implementation providing cryptographic services to Linux user space software components. |
| Vendor | Cloud Linux Software, Inc. d/b/a TuxCare http://www.tuxcare.com |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES, AES-, CAST, HMAC, CMACAsymmetric Algorithms
RSA-PSS, ECDH, ECDSA, EdDSA, ECC, DHE, DH, Diffie-HellmanHash functions
SHA-1, SHA-224, SHA-512, SHA-256, SHA-2, SHA-3, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, SHAKE256, PBKDF2, PBKDFSchemes
MAC, Key Exchange, Key AgreementProtocols
SSH, TLS v1.2, TLS v1.3, TLS 1.2, TLS, TLS 1.3, IKERandomness
DRBG, RNG, RBGLibraries
OpenSSLElliptic Curves
P-224, P-256, P-384, P-521, Ed25519, Ed448Block cipher modes
CBC, CTR, OFB, GCM, CCM, XTSTrusted Execution Environments
PSP, SSCSecurity level
Level 1Side-channel analysis
side-channel, timing attacksStandards
FIPS 140-3, FIPS PUB 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS 202, FIPS 140, FIPS 197, SP 800-132, SP 800-38A, SP 800-38C, SP 800-38B, SP 800-38F, SP 800-38E, SP 800-90A, SP 800-56A, SP 800-56C, SP 800-135, SP 800-108, SP 800-56B, SP 800-140B, SP 800-38D, SP 800-52, PKCS#1, RFC7627, RFC5288, RFC8446, RFC 4253, RFC 6668, RFC 5288, RFC 3526, RFC 7919, RFC 8446Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5373,
"dgst": "93919581b9314dda",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A7114",
"#A7127",
"KDA OneStep SP800-56Cr2A7121",
"EDDSA SigVerA7098",
"#A7111",
"AES-GMACA7128",
"SHAKE-256A7102",
"HMAC-SHA2-224A7114",
"#A7113",
"KDA TwoStep SP800-56Cr2A7121",
"KDA HKDF SP800-56Cr2A7096",
"#A7118",
"#A7128",
"HMAC-SHA-1A7114",
"KDF SSHA7124",
"SHA3-512A7102",
"AES-KWA7099",
"AES-ECBA7124",
"ECDSA SigGen (FIPS186-5)A7114",
"AES-KWPA7099",
"#A7101",
"#A7124",
"TLS v1.3 KDFA7096",
"SHA2-256A7114",
"Safe Primes Key GenerationA7120",
"#A7122",
"AES-CTRA7099",
"Hash DRBGA7097",
"HMAC-SHA2-512/224A7114",
"KAS-ECC-SSC Sp800-56Ar3A7114",
"AES-XTS Testing Revision 2.0A7099",
"EDDSA SigGenA7098",
"#A7099",
"RSA KeyGen (FIPS186-5)A7114",
"#A7097",
"AES-CBC-CS3A7099",
"KDF ANS 9.42A7114",
"SHA2-384A7114",
"#A7105",
"KDF ANS 9.63A7114",
"#A7102",
"#A7094",
"#A7110",
"SHA2-512A7114",
"PBKDFA7114",
"#A7121",
"HMAC-SHA2-512A7114",
"SHA2-512/256A7114",
"HMAC-SHA2-512/256A7114",
"AES-CMACA7099",
"#A7114",
"KAS-IFC-SSCA7114",
"#A7096",
"#A7108",
"#A7112",
"ECDSA KeyGen (FIPS186-5)A7114",
"RSA SigGen (FIPS186-5)A7114",
"SHAKE-128A7102",
"AES-CCMA7099",
"SHA3-256A7102",
"KTS-IFCA7114",
"HMAC-SHA3-256A7102",
"AES-OFBA7099",
"KAS-FFC-SSC Sp800-56Ar3A7120",
"ECDSA KeyVer (FIPS186-5)A7114",
"#A7109",
"AES-CFB128A7099",
"#A7115",
"SHA3-224A7102",
"AES-CFB1A7099",
"HMAC-SHA2-384A7114",
"SHA-1A7114",
"SHA2-512/224A7114",
"AES-GCMA7128",
"HMAC-SHA3-384A7102",
"#A7106",
"#A7107",
"TLS v1.2 KDF RFC7627A7114",
"Safe Primes Key VerificationA7120",
"RSA SigVer (FIPS186-5)A7114",
"HMAC-SHA3-224A7102",
"#A7119",
"AES-CBC-CS2A7099",
"AES-CBC-CS1A7099",
"#A7100",
"Counter DRBGA7097",
"SHA3-384A7102",
"EDDSA KeyGenA7098",
"#A7098",
"AES-CFB8A7099",
"#A7095",
"#A7123",
"KDF SP800-108A7119",
"#A7120",
"HMAC-SHA3-512A7102",
"SHA2-224A7114",
"AES-CBCA7099",
"HMAC DRBGA7097",
"ECDSA SigVer (FIPS186-5)A7114"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC-CS1",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC-CS2",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC-CS3",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CFB1",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB8",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Generation Key Length - 128, 192, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A7094, A7095, A7099, A7115, A7118, A7122, A7123, A7124",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A7100, A7105, A7106, A7107, A7108, A7109, A7110, A7127, A7128",
"properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal Key Length - 128, 192, 256 IV Generation Mode - 8.2.2",
"reference": "SP 800- 38D"
},
{
"algorithm": "AES-GMAC",
"cavpCertName": "A7100, A7105, A7106, A7107, A7108, A7109, A7110, A7127, A7128",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256",
"reference": "SP 800- 38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-KWP",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A7094, A7095, A7099",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A7097",
"properties": "Prediction Resistance - No, Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Curve - P-224, P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256 Component - No, Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A7102",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512 Component - No, Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A7102",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA KeyGen",
"cavpCertName": "A7098",
"properties": "Curve - ED-25519, ED-448",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA SigGen",
"cavpCertName": "A7098",
"properties": "Curve - ED-25519, ED-448 PreHash - Yes Pure - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA SigVer",
"cavpCertName": "A7098",
"properties": "Curve - ED-25519, ED-448 PreHash - Yes Pure - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A7097",
"properties": "Prediction Resistance - No, Yes Mode - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A7097",
"properties": "Prediction Resistance - No, Yes Mode - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/224",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/256",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 224",
"cavpCertName": "A7102",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 256",
"cavpCertName": "A7102",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 384",
"cavpCertName": "A7102",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3- 512",
"cavpCertName": "A7102",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Domain Parameter Generation Methods - P-224, P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A7120",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-IFC-SSC",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Modulo - 2048, 3072, 4096, 6144, 8192 Key Generation Methods - rsakpg1-basic, rsakpg1-crt, rsakpg1-prime-factor, rsakpg2-basic, rsakpg2-crt, rsakpg2-prime-factor Scheme - KAS1 -",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "KAS Role - initiator, responder KAS2 - KAS Role - initiator, responder",
"reference": ""
},
{
"algorithm": "KDA HKDF SP800-56Cr2",
"cavpCertName": "A7096",
"properties": "Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224- 8192 Increment 8 HMAC Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224, SHA3-256, SHA3-384, SHA3-512",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "KDA OneStep SP800-56Cr2",
"cavpCertName": "A7121",
"properties": "Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224- 2048 Increment 8",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "KDA TwoStep SP800-56Cr2",
"cavpCertName": "A7121",
"properties": "MAC Salting Methods - default, random KDF Mode - feedback Derived Key Length - 2048 Shared Secret Length - Shared Secret Length: 224- 2048 Increment 8",
"reference": "SP 800-56C Rev. 2"
},
{
"algorithm": "KDF ANS 9.42 (CVL)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "KDF Type - DER Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256 Key Data Length - Key Data Length: 112-4096 Increment 8",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF ANS 9.42 (CVL)",
"cavpCertName": "A7102",
"properties": "KDF Type - DER Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512 Key Data Length - Key Data Length: 112-4096 Increment 8",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF ANS 9.63 (CVL)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256 Key Data Length - Key Data Length: 128-4096 Increment 8",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF ANS 9.63 (CVL)",
"cavpCertName": "A7102",
"properties": "Hash Algorithm - SHA3-224, SHA3-256, SHA3-384, SHA3-512 Key Data Length - Key Data Length: 128-4096 Increment 8",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SP800- 108",
"cavpCertName": "A7119",
"properties": "KDF Mode - Counter, Feedback Supported Lengths - Supported Lengths: 112-4096 Increment 8",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A7115, A7118, A7122, A7123, A7124",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KTS-IFC",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Modulo - 2048, 3072, 4096, 6144, 8192 Key Generation Methods - rsakpg1-basic, rsakpg1-crt, rsakpg1-prime-factor, rsakpg2-basic, rsakpg2-crt, rsakpg2-prime-factor Scheme - KTS-OAEP-basic - KAS Role - initiator, responder Key Transport Method -",
"reference": "SP 800-56B Rev. 2"
},
{
"algorithm": "PBKDF",
"cavpCertName": "A7101, A7102, A7111, A7112, A7113, A7114",
"properties": "Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1",
"reference": "SP 800-132"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Key Generation Mode - probableWithProbableAux Modulo - 2048, 3072, 4096, 6144, 8192 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A7101, A7102, A7111, A7112, A7113, A7114",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A7101, A7102, A7111, A7112, A7113, A7114",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A7120",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A7120",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/224",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/256",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A7102",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A7102",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A7102",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A7102",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-128",
"cavpCertName": "A7102",
"properties": "Output Length - Output Length: 16-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-256",
"cavpCertName": "A7102",
"properties": "Output Length - Output Length: 16-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A7101, A7111, A7112, A7113, A7114",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A7096",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Used to perform symmet ric encrypti on of an entry plaintex t",
"indicator": "EVP_EncryptFinal_ex returns 1",
"inputs": "Plainte xt, AES key",
"name": "Symmetr ic Encrypti on",
"outputs": "Cipher text",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Symmetr ic Encrypti on with AES"
},
{
"description": "Used to perform symmet ric decrypti on of an entry cipherte xt",
"indicator": "EVP_DecryptFinal_ex returns 1",
"inputs": "Cipher text, AES key",
"name": "Symmetr ic Decrypti on",
"outputs": "Plainte xt",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Symmetr ic Decrypti on with AES"
},
{
"description": "Used to perform authenti cated encrypti",
"indicator": "AES GCM: EVP_CIPHER_REDHAT_FIPS_INDICAT OR_APPROVED; Others: EVP_EncryptFinal_ex returns 1",
"inputs": "Plainte xt, AES key, IV",
"name": "Authenti cated Encrypti on",
"outputs": "Cipher text, MAC tag",
"rolesSspAccess": "Crypto Officer - AES key: W,E - GCM",
"secFunImpl": "Authenti cated Encrypti on with AES"
},
{
"description": "on with AES",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "IV: W,E",
"secFunImpl": ""
},
{
"description": "Used to perform authenti cated decrypti on with AES",
"indicator": "AES GCM: EVP_CIPHER_REDHAT_FIPS_INDICAT OR_APPROVED; Others: EVP_DecryptFinal_ex returns 1",
"inputs": "Cipher text, AES key, MAC tag, IV",
"name": "Authenti cated Decrypti on",
"outputs": "Plainte xt or failure",
"rolesSspAccess": "Crypto Officer - AES key: W,E - GCM IV: W,E",
"secFunImpl": "Authenti cated Decrypti on with AES"
},
{
"description": "Comput e a MAC tag",
"indicator": "HMAC: OSSL_MAC_PARAM_REDHAT_FIPS_IN DICATOR_APPROVED; Others: EVP_MAC_final returns 1",
"inputs": "Messa ge, AES key or HMA C key",
"name": "Message Authenti cation Code",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - HMAC key: W,E - AES key: W,E",
"secFunImpl": "Message Authenti cation Code with AES Message Authenti cation Code with HMAC"
},
{
"description": "Used to generate a SHA- 1, SHA- 2, or SHA- 3/SHAK E message digest",
"indicator": "Hash: EVP_DigestFinal returns 1; XOF: EVP_DigestFinalXOF returns 1",
"inputs": "Messa ge",
"name": "Message Digest",
"outputs": "Messag e digest",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Message Digest"
},
{
"description": "Derive a key from a key- derivati on key",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Key- derivat ion key",
"name": "Key Derivatio n with KBKDF",
"outputs": "KBKD F Derive d Key",
"rolesSspAccess": "Crypto Officer - Key Derivati on Key: W,E - KBKDF Derived Key: G,R",
"secFunImpl": "Key Derivatio n with KBKDF"
},
{
"description": "Derive a key from a shared secret using HKDF",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio n with HKDF",
"outputs": "HKDF Derive d Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - HKDF Derived Key: G,R",
"secFunImpl": "Key Derivatio n with HKDF"
},
{
"description": "Derive a key from a shared secret using SSH KDF",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio n with SSH KDF",
"outputs": "SSH Derive d Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - SSH Derived Key: G,R",
"secFunImpl": "Key Derivatio n with SSH KDF"
},
{
"description": "Derive a key from a shared secret using X9.63 KDF",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio n with X9.63 KDF",
"outputs": "X9.63 Derive d Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - X9.63 Derived Key: G,R",
"secFunImpl": "Key Derivatio n with X9.63 KDF"
},
{
"description": "Derive a key from a shared secret using X9.63 KDF",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio n with X9.42 KDF",
"outputs": "X9.42 Derive d Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - X9.42 Derived Key: G,R",
"secFunImpl": "Key Derivatio n with X9.42 KDF"
},
{
"description": "Derive a key",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio",
"outputs": "KDA OneSte",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Key Derivatio"
},
{
"description": "from a shared secret using KDA OneStep",
"indicator": "",
"inputs": "",
"name": "n with KDA OneStep",
"outputs": "p Derive d Key",
"rolesSspAccess": "- Shared Secret: W,E - KDA OneSte p Derived Key: G,R",
"secFunImpl": "n with KDA OneStep"
},
{
"description": "Derive a key from a shared secret using KDA TwoSte p",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Shared secret",
"name": "Key Derivatio n with KDA TwoStep",
"outputs": "KDA TwoSte p Derive d Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - KDA TwoSte p Derived Key: G,R",
"secFunImpl": "Key Derivatio n with KDA TwoStep"
},
{
"description": "Derive a key from a shared secret using TLS 1.2 KDF / TLS 1.3 KDF",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "TLS pre- master secret",
"name": "TLS Key Derivatio n",
"outputs": "TLS Derive d Key",
"rolesSspAccess": "Crypto Officer - TLS pre- master secret: W,E - TLS master secret: G,E,Z - TLS Derived Key: G,R",
"secFunImpl": "TLS Key Derivatio n"
},
{
"description": "Derive a key from a passwor d",
"indicator": "EVP_KDF_REDHAT_FIPS_INDICATOR_ APPROVED",
"inputs": "Passw ord or passph rase",
"name": "Password -based Key Derivatio n",
"outputs": "PBKDF Derive d Key",
"rolesSspAccess": "Crypto Officer - Passwor d or passphr",
"secFunImpl": "Password -based Key Derivatio n"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ase: W,E - PBKDF Derived Key: G,R",
"secFunImpl": ""
},
{
"description": "Comput e a shared secret",
"indicator": "KAS-IFC-SSC: EVP_PKEY_REDHAT_FIPS_INDICATO R_APPROVED; KAS-FFC-SSC, KAS- ECC-SSC: EVP_PKEY_derive returns 1",
"inputs": "DH private key, DH public key; EC private key, EC public key; RSA public key, RSA private key",
"name": "Shared Secret Computa tion",
"outputs": "Shared secret",
"rolesSspAccess": "Crypto Officer - DH private key: W,E - DH public key: W,E - EC public key: W,E - EC private key: W,E - RSA public key: W,E - RSA private key: W,E - Shared Secret: G,R",
"secFunImpl": "Shared Secret Computa tion with DH Shared Secret Computa tion with ECDH Shared Secret Computa tion with RSA"
},
{
"description": "Generat e a digital signatur e",
"indicator": "RSA: OSSL_RH_FIPSINDICATOR_APPROVE D and EVP_SIGNATURE_REDHAT_FIPS_INDI CATOR_APPROVED; ECDSA:",
"inputs": "Messa ge, private key",
"name": "Signature Generati on",
"outputs": "Signatu re",
"rolesSspAccess": "Crypto Officer - RSA private key: W,E",
"secFunImpl": "Signature Generati on with RSA Signature Generati"
},
{
"description": "",
"indicator": "OSSL_RH_FIPSINDICATOR_APPROVE D; EDDSA: EVP_PKEY_sign returns 1",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- EC private key: W,E - EdDSA private key: W,E",
"secFunImpl": "on with ECDSA Signature Generati on with EdDSA"
},
{
"description": "Verify a digital signatur e",
"indicator": "RSA: OSSL_RH_FIPSINDICATOR_APPROVE D and EVP_SIGNATURE_REDHAT_FIPS_INDI CATOR_APPROVED; ECDSA: OSSL_RH_FIPSINDICATOR_APPROVE D; EDDSA: EVP_PKEY_verify returns 1",
"inputs": "Messa ge, public key, signat ure",
"name": "Signature Verificati on",
"outputs": "Pass/fai l",
"rolesSspAccess": "Crypto Officer - RSA public key: W,E - EC public key: W,E - EdDSA public key: W,E",
"secFunImpl": "Signature Verificati on with RSA Signature Verificati on with ECDSA Signature Verificati on with EdDSA"
},
{
"description": "Generat e a key pair",
"indicator": "EVP_PKEY_generate returns 1",
"inputs": "Group or Curve or Modul us bits",
"name": "Key Pair Generati on",
"outputs": "Modul e- generat ed DH private key, Modul e- generat ed DH public key or Modul e- generat ed EC private key, Modul",
"rolesSspAccess": "Crypto Officer - Module - generat ed RSA private key: G,R - Module - generat ed DH private key: G,R -",
"secFunImpl": "Key Pair Generati on with RSA Key Pair Generati on with ECDSA Key Pair Generati on with Safe Primes Key Pair Generati on with EdDSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "e- generat ed EC public or Modul e- generat ed EdDSA private key, Modul e- generat ed EdDSA public key or key Modul e- generat ed RSA private key, Modul e- generat ed RSA public key",
"rolesSspAccess": "Module - generat ed RSA public key: G,R - Module - generat ed DH public key: G,R - Module - generat ed EC private key: G,R - Module - generat ed EC public key: G,R - Module - generat ed EdDSA private key: G,R - Module - generat",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ed EdDSA public key: G,R - Interme diate key generati on value: G,E,Z",
"secFunImpl": ""
},
{
"description": "Verify a key pair",
"indicator": "EVP_PKEY_public_check or EVP_PKEY_private_check or EVP_PKEY_check returns 1",
"inputs": "Key pair",
"name": "Key Pair Verificati on",
"outputs": "Pass/fai l",
"rolesSspAccess": "Crypto Officer - DH public key: W,E - EC public key: W,E - DH private key: W,E - EC private key: W,E",
"secFunImpl": "Key Pair Verificati on with Safe Primes Public Key Verificati on with ECDSA"
},
{
"description": "Generat e random bytes",
"indicator": "EVP_RAND_generate returns 1",
"inputs": "Outpu t length",
"name": "Random Number Generati on",
"outputs": "Rando m bytes",
"rolesSspAccess": "Crypto Officer - Entropy input: W,E - DRBG internal state (V value, C value): G,W,E",
"secFunImpl": "Random Number Generati on"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG internal state (V value, Key): G,W,E - DRBG seed: G,E",
"secFunImpl": ""
},
{
"description": "Perform RSA- based encrypti on (compli ant with SP 800- 56B Rev. 2))",
"indicator": "EVP_PKEY_REDHAT_FIPS_INDICATO R_APPROVED",
"inputs": "RSA public key, plainte xt",
"name": "Asymmet ric Encrypti on",
"outputs": "Cipher text",
"rolesSspAccess": "Crypto Officer - RSA public key: W,E",
"secFunImpl": "Asymmet ric Encrypti on with RSA"
},
{
"description": "Perform RSA- based decrypti on (compli ant with SP 800- 56B",
"indicator": "EVP_PKEY_REDHAT_FIPS_INDICATO R_APPROVED",
"inputs": "RSA private key, cipher text",
"name": "Asymmet ric Decrypti on",
"outputs": "Plainte xt",
"rolesSspAccess": "Crypto Officer - RSA private key: W,E",
"secFunImpl": "Asymmet ric Decrypti on with RSA"
},
{
"description": "Show the current status of the module",
"indicator": "None",
"inputs": "N/A",
"name": "Show status",
"outputs": "Modul e status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Show module name and the version of the module",
"indicator": "None",
"inputs": "N/A",
"name": "Show module name and version",
"outputs": "Name and version inform ation",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform CASTs and integrity test",
"indicator": "None",
"inputs": "N/A",
"name": "Self-test",
"outputs": "Pass/fai l result of self- tests",
"rolesSspAccess": "",
"secFunImpl": "Message Digest Message Authenti cation Code with AES Message Authenti cation Code with HMAC Symmetr ic Encrypti on with AES Symmetr ic Decrypti on with AES Authenti cated Encrypti on with AES Authenti cated Decrypti on with AES Signature Generati on with RSA Signature Generati on with ECDSA Signature Generati on with"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "EdDSA Signature Verificati on with RSA Signature Verificati on with ECDSA Signature Verificati on with EdDSA Key Derivatio n with KBKDF Key Derivatio n with KDA OneStep Key Derivatio n with HKDF Key Derivatio n with X9.42 KDF Key Derivatio n with X9.63 KDF Key Derivatio n with SSH KDF TLS Key Derivatio n Password"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "-based Key Derivatio n Random Number Generati on Shared Secret Computa tion with DH Shared Secret Computa tion with ECDH Asymmet ric Encrypti on with RSA"
},
{
"description": "Zeroize SSPs.",
"indicator": "None",
"inputs": "Any SSP",
"name": "Zeroizati on",
"outputs": "N/A",
"rolesSspAccess": "Crypto Officer - AES key: Z - GCM IV: Z - HMAC key: Z - Module - generat ed RSA private key: Z - Module - generat ed RSA",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: Z - RSA private key: Z - RSA public key: Z - Module - generat ed DH private key: Z - Module - generat ed DH public key: Z - DH private key: Z - DH public key: Z - Module - generat ed EC private key: Z - Module - generat ed EC public key: Z - EC private",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "key: Z - EC public key: Z - Module - generat ed EdDSA private key: Z - Module - generat ed EdDSA public key: Z - EdDSA private key: Z - EdDSA public key: Z - Key Derivati on Key: Z - KBKDF Derived Key: Z - HKDF Derived Key: Z - SSH Derived Key: Z - X9.63 Derived",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: Z - X9.42 Derived Key: Z - Passwor d or passphr ase: Z - PBKDF Derived Key: Z - KDA OneSte p Derived Key: Z - KDA TwoSte p Derived Key: Z - TLS pre- master secret: Z - TLS master secret: Z - TLS Derived Key: Z - Shared Secret: Z - Entropy input: Z - DRBG seed: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG internal state (V value, C value): Z - DRBG internal state (V value, Key): Z - Interme diate key generati on value: Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "SHA-1 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A7111)",
"condition": "Test runs at power-on",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "before the integrity test",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SHA2-512 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "24-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Message digest",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "32-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7100)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7105)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7106)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7107)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7108)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7109)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7110)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7127)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A7128)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, encrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7100)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7105)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7106)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7107)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7108)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7109)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7110)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7127)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A7128)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key and 96-bit IV, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7094)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7095)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7099)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7115)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7118)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7122)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7123)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A7124)",
"condition": "Test runs at power-on before the integrity test",
"details": "Symmetric operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key, decrypt",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA-256 and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256 and P- 224",
"type": "CAST"
},
{
"algorithmOrTest": "EDDSA SigGen (A7098)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "Ed25519; Ed4488",
"type": "CAST"
},
{
"algorithmOrTest": "EDDSA SigVer (A7098)",
"condition": "Test runs at power-on before the integrity test",
"details": "Digital signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "Ed25519; Ed4488",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800- 108 (A7119)",
"condition": "Test runs at power-on before the integrity test",
"details": "Key Derivation with KBKDF",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "HMAC-SHA2- 256 in counter mode and 128- bit input key",
"type": "CAST"
},
{
"algorithmOrTest": "KDA OneStep SP800-56Cr2 (A7121)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-224 and 448-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDA TwoStep SP800-56Cr2 (A7121)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-224 and 448-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDA HKDF SP800-56Cr2 (A7096)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 48-bit secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.42 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.42 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 KW and SHA-1 and 160-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF ANS 9.63 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "ANS X9.63 key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 192-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7115)",
"condition": "Test runs at power-on before the integrity test",
"details": "SSH KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-1 and 1056-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7118)",
"condition": "Test runs at power-on before the integrity test",
"details": "SSH KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-1 and 1056-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7122)",
"condition": "Test runs at power-on before the integrity test",
"details": "SSH KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-1 and 1056-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7123)",
"condition": "Test runs at power-on before the integrity test",
"details": "SSH KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-1 and 1056-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7124)",
"condition": "Test runs at power-on before the integrity test",
"details": "SSH KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-1 and 1056-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.2 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 384-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.2 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 384-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.2 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 384-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.2 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 384-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.2 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and 384-bit input secret",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.3 KDF (A7096)",
"condition": "Test runs at power-on before the integrity test",
"details": "TLS v1.3 KDF key derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256, expand and extract mode",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288-",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "bit salt, 4096 iterations",
"type": ""
},
{
"algorithmOrTest": "PBKDF (A7102)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288- bit salt, 4096 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288- bit salt, 4096 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288- bit salt, 4096 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288- bit salt, 4096 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Password-based Key Derivation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 with 24 characters password, 288- bit salt, 4096 iterations",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A7097)",
"condition": "Test runs at power-on before the integrity test",
"details": "Instantiate; Generate; Reseed (compliant to SP 800-90A Rev. 1 Section 11.3)",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-128 with derivation function and prediction resistance",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A7097)",
"condition": "Test runs at power-on before the integrity test",
"details": "Instantiate; Generate; Reseed (compliant to SP 800-90A Rev. 1 Section 11.3)",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA2-256 and prediction resistance",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A7097)",
"condition": "Test runs at power-on before the integrity test",
"details": "Instantiate; Generate; Reseed (compliant to SP",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "HMAC-SHA-1 and prediction resistance",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "800-90A Rev. 1 Section 11.3)",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 (A7120)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "ffdhe2048",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A7112)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "Safe Primes Key Generation (A7120)",
"condition": "Key pair generation",
"details": "SP 800-56A Rev. 3 Section 5.6.2.1.4",
"indicator": "Key pair generation is successful",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7101)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7111)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7112)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7113)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7114)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7101)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7111)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7112)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7113)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7114)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "EDDSA KeyGen (A7098)",
"condition": "Key pair generation",
"details": "Signature generation and verification",
"indicator": "Key pair generation is sucessful",
"testMethod": "PCT",
"testProps": "PCT using Ed25519 and Ed448",
"type": "PCT"
},
{
"algorithmOrTest": "KTS-IFC (A7101)",
"condition": "Test runs at power-on before the integrity test",
"details": "Key encapsulation and un- encapsulation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "OAEP with 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-IFC (A7111)",
"condition": "Test runs at power-on before the integrity test",
"details": "Key encapsulation and un- encapsulation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "OAEP with 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-IFC (A7112)",
"condition": "Test runs at power-on",
"details": "Key encapsulation and un- encapsulation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "OAEP with 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "before the integrity test",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KTS-IFC (A7113)",
"condition": "Test runs at power-on before the integrity test",
"details": "Key encapsulation and un- encapsulation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "OAEP with 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "KTS-IFC (A7114)",
"condition": "Test runs at power-on before the integrity test",
"details": "Key encapsulation and un- encapsulation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "OAEP with 2048-bit key",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Software integrity test failure CAST failure PCT failure",
"description": "If the module fails any of the self-tests, the module enters the error state. In the error state, the module immediately stops functioning and ends the application process",
"indicator": "Software integrity test failure CAST failure: OSSL_PROV_PARAM_STATUS is set to 0. Module will not load; PCT failure: module is aborted",
"name": "Error",
"recoveryMethod": "Module reinitialization"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Automatically entered whenever an approved service is requested",
"name": "Approved mode",
"statusIndicator": "Equivalent to the indicator of the requested service. As described in Section 4.3.",
"type": "Approved"
},
{
"description": "Automatically entered whenever a non-approved service is requested",
"name": "Non- approved mode",
"statusIndicator": "Equivalent to the indicator of the requested service. As described in Section 4.4.",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "AES GCM (external IV)",
"use": "Authentication Encryption"
},
{
"name": "HMAC (\u003c 112-bit keys)",
"use": "Message Authentication Code"
},
{
"name": "KBKDF, KDA OneStep, HKDF, ANS X9.42 KDF, ANS X9.63 KDF (\u003c 112-bit keys)",
"use": "Key Derivation"
},
{
"name": "KDA OneStep (SHAKE128, SHAKE256)",
"use": "Key Derivation"
},
{
"name": "ANS X9.42 KDF (SHAKE128, SHAKE256)",
"use": "Key Derivation"
},
{
"name": "ANS X9.63 KDF (SHA-1, SHAKE128, SHAKE256)",
"use": "Key Derivation"
},
{
"name": "SSH KDF (SHA-512/224, SHA-512/256, SHA-3, SHAKE128, SHAKE256)",
"use": "Key Derivation"
},
{
"name": "TLS 1.2 KDF (SHA-1, SHA-224, SHA-512/224, SHA-512/256, SHA- 3)",
"use": "TLS Key Derivation"
},
{
"name": "TLS 1.3 KDF (SHA-1, SHA-224, SHA-512, SHA-512/224, SHA- 512/256, SHA-3)",
"use": "TLS Key Derivation"
},
{
"name": "PBKDF2 (\u003c 8 characters password; \u003c 128 salt length; \u003c 1000 iterations; \u003c 112-bit keys)",
"use": "Password-based Key Derivation"
},
{
"name": "RSA and ECDSA (pre-hashed message)",
"use": "Signature generation; Signature verification"
},
{
"name": "RSA-PSS (invalid salt length)",
"use": "Signature generation; Signature verification"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "AES GCM (external IV)",
"description": "Authenticated Encryption",
"name": "AES GCM (external IV)",
"role": "CO"
},
{
"alg_accessed": "HMAC (\u003c 112-bit keys)",
"description": "Compute a MAC tag",
"name": "HMAC (\u003c 112- bit keys)",
"role": "CO"
},
{
"alg_accessed": "KBKDF, KDA OneStep, HKDF, ANS X9.42 KDF, ANS X9.63 KDF (\u003c 112-bit keys) KDA OneStep (SHAKE128, SHAKE256) ANS X9.42 KDF (SHAKE128, SHAKE256) ANS X9.63 KDF (SHA-1, SHAKE128, SHAKE256) SSH KDF (SHA-512/224, SHA-512/256, SHA- 3, SHAKE128, SHAKE256) TLS 1.2 KDF (SHA-1, SHA-224, SHA- 512/224, SHA-512/256, SHA-3) TLS 1.3 KDF (SHA-1, SHA-224, SHA-512, SHA-512/224, SHA-512/256, SHA-3)",
"description": "Derive a key from a key- derivation key or a shared secret",
"name": "Key derivation",
"role": "CO"
},
{
"alg_accessed": "PBKDF2 (\u003c 8 characters password; \u003c 128 salt length; \u003c 1000 iterations; \u003c 112-bit keys)",
"description": "Derive a key from a password",
"name": "PBKDF (\u003c112- bit keys)",
"role": "CO"
},
{
"alg_accessed": "RSA and ECDSA (pre-hashed message) RSA-PSS (invalid salt length)",
"description": "Generate a signature",
"name": "Signature generation",
"role": "CO"
},
{
"alg_accessed": "RSA and ECDSA (pre-hashed message) RSA-PSS (invalid salt length)",
"description": "Verify a signature",
"name": "Signature verification",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "API Input Parameters",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "API Output Parameters",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API Function Calls",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "API Return Codes, Error Queue",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "1",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC- SHA2-256 (A7101)",
"details": "Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time.",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bits key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7111)",
"details": "Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time.",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bits key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7112)",
"details": "Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time.",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bits key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7113)",
"details": "Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time.",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bits key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A7114)",
"details": "Integrity test of the shared library component of the module. Verified by comparing an HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bits key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "",
"details": "embedded in the fips.so file that was computed at build time.",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Cryptographic module",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API input parameters",
"sfiAlgo": "",
"source": "Operator calling application (TOEPP)"
},
{
"dest": "Operator calling application (TOEPP)",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API output parameters",
"sfiAlgo": "",
"source": "Cryptographic module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroizes the SSPs contained within the cipher handle.",
"method": "Free cipher handle",
"operatorId": "By calling the cipher related zeroization API",
"rationale": "By calling the appropriate zeroization functions: AES key: EVP_CIPHER_CTX_free and EVP_MAC_CTX_free; HMAC key: EVP_MAC_CTX_free; Key-derivation key: EVP_KDF_CTX_free; Shared secret: EVP_KDF_CTX_free; Password: EVP_KDF_CTX_free; KBKDF Derived Key:EVP_KDF_CTX_free; HKDF Derived Key: EVP_KDF_CTX_free; TLS pre-master secret, TLS master secret, TLS Derived Key: EVP_KDF_CTX_free; SSH Derived Key:"
},
{
"description": "",
"method": "",
"operatorId": "",
"rationale": "EVP_KDF_CTX_free; X9.63 Derived Key: EVP_KDF_CTX_free; X9.42 Derived Key: EVP_KDF_CTX_free; PBKDF Derived Key: EVP_KDF_CTX_free; KDA OneStep Derived Key: EVP_KDF_CTX_free; KDA TwoStep Derived Key: EVP_KDF_CTX_free; Entropy input: EVP_RAND_CTX_free; DRBG internal state (V value, Key), DRBG internal state (V value, C value): EVP_RAND_CTX_free; DH public \u0026 private key: EVP_PKEY_free; EC public \u0026 private key: EVP_PKEY_free; RSA public \u0026 private key: EVP_PKEY_free; EdDSA public \u0026 private key: EVP_PKEY_free"
},
{
"description": "Automatically zeroized by the module when no longer needed",
"method": "Automatic",
"operatorId": "N/A",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable"
},
{
"description": "De-allocates the volatile memory used to store SSPs",
"method": "Module Reset",
"operatorId": "By unloading and reloading the module",
"rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Temporary storage for SSPs used by the module as part of service execution. SSPs are stored until they are zeroized by the operator (using a zeroization call or removing power from the module) or zeroized automatically",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "GIGABYTE E163- S30-AAG1",
"hypervisorHostOs": "N/A",
"operatingSystem": "AlmaLinux OS 9.6",
"paa_pai": "Yes",
"processors": "Intel\u00ae Xeon\u00ae Gold 5512U",
"version": "3.2.2- f9f9d133a30b6eb5"
},
{
"hardwarePlatform": "GIGABYTE E163- S30-AAG1",
"hypervisorHostOs": "N/A",
"operatingSystem": "AlmaLinux OS 9.6",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 5512U",
"version": "3.2.2- f9f9d133a30b6eb5"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "Asymmetric Cryptographic Key Generation (CKG)",
"reference": "SP 800-133r2, section 4, example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "GIGABYTE E163-S30-AAG1 on Intel\u00ae Xeon\u00ae Gold 5512U",
"operatingSystem": "Rocky Linux 9.6"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 1
},
"ECDH": {
"ECDH": 11
},
"ECDSA": {
"ECDSA": 72
},
"EdDSA": {
"EdDSA": 48
}
},
"FF": {
"DH": {
"DH": 46,
"DHE": 1,
"Diffie-Hellman": 4
}
},
"RSA": {
"RSA-PSS": 3
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 1
},
"CCM": {
"CCM": 2
},
"CTR": {
"CTR": 2
},
"GCM": {
"GCM": 18
},
"OFB": {
"OFB": 1
},
"XTS": {
"XTS": 4
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 103
}
},
"crypto_protocol": {
"IKE": {
"IKE": 2
},
"SSH": {
"SSH": 41
},
"TLS": {
"TLS": {
"TLS": 49,
"TLS 1.2": 5,
"TLS 1.3": 5,
"TLS v1.2": 19,
"TLS v1.3": 6
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 4
},
"KEX": {
"Key Exchange": 1
},
"MAC": {
"MAC": 11
}
},
"device_model": {},
"ecc_curve": {
"Edwards": {
"Ed25519": 9,
"Ed448": 7
},
"NIST": {
"P-224": 22,
"P-256": 30,
"P-384": 22,
"P-521": 22
}
},
"eval_facility": {
"atsec": {
"atsec": 2
}
},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"AES-128": 9,
"AES-192": 2,
"AES-256": 3,
"HMAC SHA-256": 13,
"HMAC-SHA-1": 4,
"PKCS#1": 34,
"SHA- 1": 1,
"SHA- 2": 1,
"SHA- 3": 2,
"SHA-1": 37,
"SHA-2": 1,
"SHA-224": 4,
"SHA-256": 47,
"SHA-3": 9,
"SHA-512": 2,
"SHA2-224": 9,
"SHA2-256": 41,
"SHA2-384": 9,
"SHA2-512": 20,
"SHA3-224": 6,
"SHA3-256": 9,
"SHA3-384": 6,
"SHA3-512": 6
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"PBKDF": {
"PBKDF": 28,
"PBKDF2": 5
},
"SHA": {
"SHA1": {
"SHA-1": 37
},
"SHA2": {
"SHA-2": 1,
"SHA-224": 4,
"SHA-256": 47,
"SHA-512": 2
},
"SHA3": {
"SHA-3": 9,
"SHA3-224": 6,
"SHA3-256": 9,
"SHA3-384": 6,
"SHA3-512": 6
}
},
"SHAKE": {
"SHAKE128": 9,
"SHAKE256": 9
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 48
},
"RNG": {
"RBG": 2,
"RNG": 2
}
},
"side_channel_analysis": {
"SCA": {
"side-channel": 1,
"timing attacks": 3
}
},
"standard_id": {
"FIPS": {
"FIPS 140": 1,
"FIPS 140-3": 104,
"FIPS 180-4": 8,
"FIPS 186-5": 15,
"FIPS 197": 1,
"FIPS 198-1": 12,
"FIPS 202": 7,
"FIPS PUB 140-3": 3,
"FIPS186-5": 84
},
"NIST": {
"SP 800-108": 1,
"SP 800-132": 3,
"SP 800-135": 7,
"SP 800-140B": 1,
"SP 800-38A": 12,
"SP 800-38B": 2,
"SP 800-38C": 2,
"SP 800-38D": 1,
"SP 800-38E": 2,
"SP 800-38F": 3,
"SP 800-52": 1,
"SP 800-56A": 7,
"SP 800-56B": 1,
"SP 800-56C": 4,
"SP 800-90A": 6
},
"PKCS": {
"PKCS#1": 17
},
"RFC": {
"RFC 3526": 1,
"RFC 4253": 2,
"RFC 5288": 2,
"RFC 6668": 2,
"RFC 7919": 1,
"RFC 8446": 1,
"RFC5288": 1,
"RFC7627": 11,
"RFC8446": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 60,
"AES-": 1,
"AES-128": 9,
"AES-192": 2,
"AES-256": 3
},
"CAST": {
"CAST": 234
}
},
"constructions": {
"MAC": {
"CMAC": 1,
"HMAC": 40
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 9
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A7114",
"HMAC-SHA2-512/224A7114",
"KAS-IFC-SSCA7114",
"KDA OneStep SP800-56Cr2A7121",
"KAS-ECC-SSC Sp800-56Ar3A7114",
"TLS v1.2 KDF RFC7627A7114",
"EDDSA SigVerA7098",
"AES-XTS Testing Revision 2.0A7099",
"AES-GMACA7128",
"ECDSA KeyGen (FIPS186-5)A7114",
"Safe Primes Key VerificationA7120",
"EDDSA SigGenA7098",
"HMAC-SHA3-224A7102",
"RSA SigVer (FIPS186-5)A7114",
"RSA KeyGen (FIPS186-5)A7114",
"SHAKE-256A7102",
"AES-CBC-CS2A7099",
"RSA SigGen (FIPS186-5)A7114",
"AES-CBC-CS1A7099",
"SHAKE-128A7102",
"HMAC-SHA2-224A7114",
"AES-CBC-CS3A7099",
"KDF ANS 9.42A7114",
"KDA TwoStep SP800-56Cr2A7121",
"AES-CCMA7099",
"KDA HKDF SP800-56Cr2A7096",
"SHA3-256A7102",
"KTS-IFCA7114",
"SHA2-384A7114",
"KDF ANS 9.63A7114",
"HMAC-SHA-1A7114",
"Counter DRBGA7097",
"KDF SSHA7124",
"SHA3-384A7102",
"SHA3-512A7102",
"HMAC-SHA3-256A7102",
"AES-KWA7099",
"AES-OFBA7099",
"KAS-FFC-SSC Sp800-56Ar3A7120",
"AES-ECBA7124",
"ECDSA KeyVer (FIPS186-5)A7114",
"ECDSA SigGen (FIPS186-5)A7114",
"AES-KWPA7099",
"AES-CFB128A7099",
"EDDSA KeyGenA7098",
"TLS v1.3 KDFA7096",
"AES-CFB8A7099",
"SHA2-256A7114",
"SHA2-512A7114",
"Safe Primes Key GenerationA7120",
"AES-CBCA7099",
"AES-CTRA7099",
"SHA3-224A7102",
"KDF SP800-108A7119",
"HMAC DRBGA7097",
"AES-CFB1A7099",
"HMAC-SHA2-512A7114",
"HMAC-SHA2-384A7114",
"SHA-1A7114",
"SHA2-512/224A7114",
"SHA2-512/256A7114",
"Hash DRBGA7097",
"AES-GCMA7128",
"HMAC-SHA2-512/256A7114",
"HMAC-SHA3-384A7102",
"HMAC-SHA3-512A7102",
"PBKDFA7114",
"SHA2-224A7114",
"AES-CMACA7099",
"ECDSA SigVer (FIPS186-5)A7114"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A7107",
"#A7127",
"#A7096",
"#A7108",
"#A7112",
"#A7111",
"#A7099",
"#A7119",
"#A7097",
"#A7113",
"#A7100",
"#A7118",
"#A7128",
"#A7105",
"#A7102",
"#A7109",
"#A7094",
"#A7101",
"#A7110",
"#A7124",
"#A7115",
"#A7098",
"#A7095",
"#A7122",
"#A7121",
"#A7123",
"#A7120",
"#A7106",
"#A7114"
]
},
"policy_metadata": {
"/CreationDate": "D:20260706091306-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260706091306-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1077286,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://www.ietf.org/rfc/rfc4253.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf",
"https://www.ietf.org/rfc/rfc7919.txt",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
"https://www.ietf.org/rfc/rfc5288.txt",
"https://webstore.ansi.org/standards/ascx9/ansix9422001",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
"https://csrc.nist.gov/projects/cmvp/sp800-140b",
"https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-add.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38b.pdf",
"https://www.ietf.org/rfc/rfc3526.txt",
"https://www.ietf.org/rfc/rfc6668.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
"https://webstore.ansi.org/standards/ascx9/ansix9632001",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
"https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38e.pdf",
"https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf",
"https://www.ietf.org/rfc/rfc8446.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 96
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "30555e377c1606d58f93db0ae1831f5d143a455a0844d1a8021a540cacb64deb",
"source_hash": "eb3c1a962ac0b96833990673a967ab1b96a0268afdd1db741fab6fbcac7f104c",
"txt_hash": "bbd04cec0610ad1f0c3c94ef5cf836d66fdc79ab276abdcf6f6a1826476431d2"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
"date_sunset": "2031-07-06",
"description": "AlmaLinux 9.6 OpenSSL FIPS provider implementation providing cryptographic services to Linux user space software components.",
"embodiment": "MultiChipStand",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "TuxCare OpenSSL FIPS Provider",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-07-07",
"lab": "atsec information security corporation",
"validation_type": "Initial"
}
],
"vendor": "Cloud Linux Software, Inc. d/b/a TuxCare",
"vendor_url": "http://www.tuxcare.com"
}
}