F5, Inc.
Cryptographic Module for BIG-IP
FIPS 140-3 Non-Proprietary Security Policy
Prepared by:
atsec information security corporation
4516 Seton Center Parkway, Suite 250
Austin, TX 78759
www.atsec.com
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
Page 2 of 48
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
Page 3 of 48
Table of Contents
1 General.......................................................................................................................................................................7
1.1 Overview ............................................................................................................................................................7
1.2 Security Levels....................................................................................................................................................7
1.3 Additional Information......................................................................................................................................7
2 Cryptographic Module Specification........................................................................................................................8
2.1 Description .........................................................................................................................................................8
2.2 Tested and Vendor Affirmed Module Version and Identification ..................................................................9
2.3 Excluded Components .....................................................................................................................................10
2.4 Modes of Operation..........................................................................................................................................10
2.5 Algorithms........................................................................................................................................................10
2.6 Security Function Implementations................................................................................................................14
2.7 Algorithm Specific Information ......................................................................................................................16
2.8 RBG and Entropy .............................................................................................................................................17
2.9 Key Generation ................................................................................................................................................18
2.10 Key Establishment..........................................................................................................................................18
2.11 Industry Protocols..........................................................................................................................................18
3 Cryptographic Module Interfaces...........................................................................................................................19
3.1 Ports and Interfaces..........................................................................................................................................19
4 Roles, Services, and Authentication .......................................................................................................................20
4.1 Authentication Methods..................................................................................................................................20
4.2 Roles..................................................................................................................................................................20
4.3 Approved Services............................................................................................................................................20
4.4 Non-Approved Services ...................................................................................................................................25
4.5 External Software/Firmware Loaded...............................................................................................................26
5 Software/Firmware Security ...................................................................................................................................27
5.1 Integrity Techniques........................................................................................................................................27
5.2 Initiate on Demand ..........................................................................................................................................27
6 Operational Environment .......................................................................................................................................28
6.1 Operational Environment Type and Requirements .......................................................................................28
6.2 Configuration Settings and Restrictions..........................................................................................................28
7 Physical Security .....................................................................................................................................................29
8 Non-Invasive Security.............................................................................................................................................30
9 Sensitive Security Parameters Management ..........................................................................................................31
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
Page 4 of 48
9.1 Storage Areas....................................................................................................................................................31
9.2 SSP Input-Output Methods .............................................................................................................................31
9.3 SSP Zeroization Methods.................................................................................................................................31
9.4 SSPs...................................................................................................................................................................32
9.5 Transitions........................................................................................................................................................37
10 Self-Tests................................................................................................................................................................38
10.1 Pre-Operational Self-Tests.............................................................................................................................38
10.2 Conditional Self-Tests....................................................................................................................................38
10.3 Periodic Self-Test Information ......................................................................................................................41
10.4 Error States .....................................................................................................................................................42
10.5 Operator Initiation of Self-Tests....................................................................................................................42
11 Life-Cycle Assurance.............................................................................................................................................43
11.1 Installation, Initialization, and Startup Procedures......................................................................................43
11.2 Administrator Guidance ................................................................................................................................43
11.3 Non-Administrator Guidance........................................................................................................................43
11.4 Design and Rules............................................................................................................................................43
11.5 End of Life ......................................................................................................................................................43
12 Mitigation of Other Attacks..................................................................................................................................44
Appendix A. Glossary and Abbreviations .............................................................................................................45
Appendix B. References.........................................................................................................................................46
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
Page 5 of 48
List of Tables
Table 1: Security Levels................................................................................................................................................7
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets) ...............................9
Table 3: Tested Operational Environments - Software, Firmware, Hybrid ..............................................................9
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid ..........................................10
Table 5: Modes List and Description .........................................................................................................................10
Table 6: Approved Algorithms...................................................................................................................................12
Table 7: Vendor-Affirmed Algorithms......................................................................................................................13
Table 8: Non-Approved, Not Allowed Algorithms...................................................................................................14
Table 9: Security Function Implementations............................................................................................................16
Table 10: Entropy Certificates ...................................................................................................................................17
Table 11: Entropy Sources..........................................................................................................................................18
Table 12: Ports and Interfaces....................................................................................................................................19
Table 13: Roles............................................................................................................................................................20
Table 14: Approved Services......................................................................................................................................25
Table 15: Non-Approved Services .............................................................................................................................26
Table 16: Storage Areas ..............................................................................................................................................31
Table 17: SSP Input-Output Methods .......................................................................................................................31
Table 18: SSP Zeroization Methods...........................................................................................................................31
Table 19: SSP Table 1 .................................................................................................................................................34
Table 20: SSP Table 2 .................................................................................................................................................37
Table 21: Pre-Operational Self-Tests.........................................................................................................................38
Table 22: Conditional Self-Tests ................................................................................................................................40
Table 23: Pre-Operational Periodic Information......................................................................................................41
Table 24: Conditional Periodic Information .............................................................................................................42
Table 25: Error States .................................................................................................................................................42
List of Figures
Figure 1: Block Diagram...............................................................................................................................................8
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
Page 6 of 48
Copyrights and Trademarks
F5® is Registered trademarks of F5, Inc.
Intel® Xeon® and Intel® Atom® processors are Registered trademarks of Intel Corporation
VMware ESXi™ is a registered trademark of VMware®, Inc.
Intel® Xeon® is a registered trademark of Intel® Corporation.
Dell is a registered trademark of Dell, Inc.
Azure and Hyper-V are registered trademarks of Microsoft
AWS is a trademark of Amazon.com, Inc.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 7 of 48
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy that contains the security rules under which
the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3
(Federal Information Processing Standards Publication 140-3) for an Overall Security Level 1 module.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 1
12 Mitigation of other attacks N/A
Overall Level 1
Table 1: Security Levels
1.3 Additional Information
In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for
consolidation without altering the technical statements therein contained. The further refining of the Security
Policy document was conducted iteratively throughout the conformance testing. The vendor reviewed the
intermediate and final Security Policy and approved all of its content.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 8 of 48
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The Cryptographic Module for BIG-IP (hereafter referred to as “the module”) is a cryptographic library offering
various cryptographic mechanisms to be used by OpenSSL application running on BIG-IP Virtual Edition.
The module provides cryptographic services to applications through an Application Program Interface (API).
The module also interacts with the underlying operating system via system calls. The processors on which the
module run include PAA functions.
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Cryptographic Boundary: The software block diagram Figure 1 shows the module, its interfaces with the
operational environment and the delimitation of its cryptographic boundary with bold black perimeter. The
software components of the cryptographic module are listed in Table - Tested Module Identification – Software,
Firmware, Hybrid (Executable Code Sets).
Figure 1: Block Diagram
Tested Operational Environment’s Physical Perimeter (TOEPP): The module is aimed to run on a general-
purpose computer; the physical perimeter is the surface of the case of the target platform, as shown with orange
dotted lines in the diagram Figure 1. The components of the TOEPP are listed in Table - Tested Operational
Environments - Software, Firmware, Hybrid.
The entropy source located within the module’s physical perimeter is outside of the module’s cryptographic
boundary (see Figure 1).
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 9 of 48
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File Name Software/ Firmware
Version
Features Integrity Test
libcrypto.so.1.0.2za ,
.libcrypto.so.1.0.2za.hmac
1.0.2za-fips-EHF
0.198.15
N/A HMAC-SHA-256
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Tested Operational Environments - Software, Firmware, Hybrid:
Operating
System
Hardware
Platform
Processors PAA/PAI Hypervisor or Host OS Version(s)
BIG-IP 17.5.0
EHF on
VMware
Dell
PowerEdge
R650
Intel® Xeon®
Gold Ice Lake
6330N
Yes VMware ESXi(TM)
8.0.3 (Build:
24414501)
1.0.2za-fips-
EHF 0.198.15
BIG-IP 17.5.0
EHF on Hyper-
V
Dell
PowerEdge
R450
Intel® Xeon®
Silver Ice Lake
4309Y
Yes Hyper-V 10.0.20348.1
on Windows Server
2022
1.0.2za-fips-
EHF 0.198.15
BIG-IP 17.5.0
EHF on KVM
Dell
PowerEdge
R450
Intel® Xeon®
Silver Ice Lake
4309Y
Yes KVM on Ubuntu
22.04.2 LTS
1.0.2za-fips-
EHF 0.198.15
BIG-IP 17.5.0
EHF on
VMware
Dell
PowerEdge
R650
Intel® Xeon®
Gold Ice Lake
6330N
No VMware ESXi(TM)
8.0.3 (Build:
224414501)
1.0.2za-fips-
EHF 0.198.15
BIG-IP 17.5.0
EHF on Hyper-
V
Dell
PowerEdge
R450
Intel® Xeon®
Silver Ice Lake
4309Y
No Hyper-V 10.0.20348.1
on Windows Server
2022
1.0.2za-fips-
EHF 0.198.15
BIG-IP 17.5.0
EHF on KVM
Dell
PowerEdge
R450
Intel® Xeon®
Silver Ice Lake
4309Y
No KVM on Ubuntu
22.04.2 LTS
1.0.2za-fips-
EHF 0.198.15
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
Operating System Hardware Platform
BIG-IP 17.5.0 EHF Azure CLI 2.48.1 with Intel Xeon Platinum 8272CL
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 10 of 48
Operating System Hardware Platform
BIG-IP 17.5.0 EHF AWS CLI 2.11.19 with Intel Xeon Cascade Lake 8259CL
Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid
CMVP makes no statement as to the correct operation of the module or the security strengths of the generated
keys when so ported if the specific operational environment is not listed on the validation certificate.
2.3 Excluded Components
None
2.4 Modes of Operation
Modes List and Description:
Mode
Name
Description Type Status Indicator
Approved
mode
Automatically entered
whenever an approved
service is requested
Approved Output status corresponding to the calling service
("AES-ECB" is returned when AES-ECB
encryption/decryption is called. See in the Security
Policy section 4.3 "Indicator" column for each
"approved services".
Non-
approved
mode
Automatically entered
whenever a non-
approved service is
requested
Non-
Approved
No indicator
Table 5: Modes List and Description
Mode Change Instructions and Status:
The module enters the approved mode after pre-operational self-tests succeed. The module automatically
switches between the approved and non-approved modes depending on the services requested by the operator.
The status indicator of the mode of operation is equivalent to the indicator of the service that was requested.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP Cert Properties Reference
AES-CBC A7001,
A7002
Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 11 of 48
Algorithm CAVP Cert Properties Reference
AES-CTR A7001,
A7002
Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A7001,
A7002
Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A7001,
A7002
Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 192, 256
SP 800-38D
AES-GMAC A7001,
A7002
Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 192, 256
SP 800-38D
Counter DRBG A7001 Prediction Resistance - No, Yes
Mode - AES-256
Derivation Function Enabled - No, Yes
SP 800-90A
Rev. 1
Counter DRBG A7002 Prediction Resistance - Yes
Mode - AES-256
Derivation Function Enabled - Yes
SP 800-90A
Rev. 1
ECDSA KeyGen
(FIPS186-5)
A7001 Curve - P-256, P-384
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyVer
(FIPS186-5)
A7001 Curve - P-256, P-384 FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A7001 Curve - P-256, P-384
Hash Algorithm - SHA2-256, SHA2-384, SHA2-
512
Component - No
FIPS 186-5
ECDSA SigVer
(FIPS186-5)
A7001 Curve - P-256, P-384
Hash Algorithm - SHA2-256, SHA2-384, SHA2-
512
FIPS 186-5
HMAC-SHA-1 A7001,
A7002
Key Length - Key Length: 8, 16, 64, 128, 1024 FIPS 198-1
HMAC-SHA2-256 A7001,
A7002
Key Length - Key Length: 8, 16, 64, 128, 1024 FIPS 198-1
HMAC-SHA2-384 A7001,
A7002
Key Length - Key Length: 8, 16, 64, 128, 1024 FIPS 198-1
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 12 of 48
Algorithm CAVP Cert Properties Reference
KAS-ECC-SSC Sp800-
56Ar3
A7001 Domain Parameter Generation Methods - P-256,
P-384
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KAS-FFC-SSC Sp800-
56Ar3
A7001 Domain Parameter Generation Methods -
ffdhe2048, ffdhe3072, ffdhe4096
Scheme -
dhEphem -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KDF SSH (CVL) A7001 Cipher - AES-128, AES-256
Hash Algorithm - SHA2-256, SHA2-384
SP 800-135
Rev. 1
RSA KeyGen
(FIPS186-5)
A7001 Key Generation Mode - probable
Modulo - 2048, 3072, 4096
Primality Tests - 2powSecStr
Private Key Format - standard
FIPS 186-5
RSA SigGen (FIPS186-
5)
A7001 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
FIPS 186-5
RSA SigVer (FIPS186-
5)
A7001 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
FIPS 186-5
Safe Primes Key
Generation
A7001 Safe Prime Groups - ffdhe2048, ffdhe3072,
ffdhe4096
SP 800-56A
Rev. 3
Safe Primes Key
Verification
A7001 Safe Prime Groups - ffdhe2048, ffdhe3072,
ffdhe4096
SP 800-56A
Rev. 3
SHA-1 A7001,
A7002
Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
SHA2-256 A7001,
A7002
Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
SHA2-384 A7001,
A7002
Message Length - Message Length: 0-65536
Increment 8
FIPS 180-4
TLS v1.2 KDF
RFC7627 (CVL)
A7001 Hash Algorithm - SHA2-256, SHA2-384 SP 800-135
Rev. 1
Table 6: Approved Algorithms
Vendor-Affirmed Algorithms:
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 13 of 48
Name Properties Implementation Reference
Cryptographic Key
Generation (CKG)
Key
Type:asymmetric
N/A Random bit strings required for generating
the cryptographic keys is compliant with
section 4 example 1 of SP800-133r2
Table 7: Vendor-Affirmed Algorithms
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
Name Use and Function
AES with OFB, CCM, CFB, XTS, KW modes and Blowfish, Camellia, CAST5, DES,
IDEA, RC2, RC4, SEED, SM2, SM4, Triple-DES
Symmetric encryption
/ decryption (not
CAVP tested)
HMAC-SHA2-224, HMAC-SHA2-512, AES CMAC, Triple-DES CMAC Message authentication
(not CAVP tested)
ECDSA using P-224, P-521 curves, DSA with all key and SHA sizes, RSA with
1024 and greater than 4096 up to 16384 modulus
Key generation (not
ACVP tested)
ECDSA using P-224, P-521 curves Key verification (not
ACVP tested)
ECDSA using SM2 algorithm, Probabilistic Signature Scheme (PSS), ANSI X9.31
schemes, PKCS #1 v1.5 scheme with 1024 and greater than 4096 up to 16384
modulus for all SHA sizes, DSA with all key and SHA sizes, ECDSA using curves P-
256, P-384 with SHA-1, SHA2-224, SHA2-512, RSA PKCS #1 v1.5 scheme with
modulus size 2048, 3072, 4096 bits with SHA-1, SHA2-224, SHA2-512
Digital Signature (not
FIPS186-5
compliant/not ACVP
tested)
RSA with modulus sizes up to 16384 bits Asymmetric
encryption /
decryption
DSA with all key and SHA sizes Domain parameter
generation, domain
parameter verification
Diffie-Hellman with groups other than ffdhe2048, ffdhe3072, ffdhe4096, EC
Diffie-Hellman Ephemeral Unified without KDF with curves other than P-256, P-
384.; onePassDh and StaticUnified without KDF
Shared secret
computation (not
CAVP tested)
HMAC_DRBG and Hash_DRBG using all SHA sizes, CTR_DRBG with AES-128,
AES-192, ANSI X9.31 RNG
Random number
generation (not CAVP
tested)
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 14 of 48
Name Use and Function
SHA2-224, SHA2-512, SM3, MD4, MDC2, RIPEMD, Whirlpool Message digest (not
CAVP tested)
TLS Key Derivation function using SHA-1/ MD5 / SHA2-224 / SHA2-512, SSH Key
Derivation function using SHA-1 / SHA2-224 / SHA2-512
KDF (not CAVP
tested)
Table 8: Non-Approved, Not Allowed Algorithms
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Symmetric
Encryption and
Decryption
BC-UnAuth
BC-Auth
Symmetric
Encryption and
Decryption
AES-CBC: (A7001,
A7002)
AES-CTR: (A7001,
A7002)
AES-ECB: (A7001,
A7002)
AES-GCM: (A7001,
A7002)
MAC Generation MAC MAC Generation AES-GMAC:
(A7001, A7002)
IV: internal
Random Number
Generation
DRBG Random Number
Generation
Counter DRBG:
(A7001)
Derivation
Function Enabled:
yes / no
Prediction
Resistance: yes / no
Counter DRBG:
(A7002)
Derivation
Function Enabled:
Yes
Prediction
Resistance: Yes
ECDSA Key Pair
Generation
AsymKeyPair-
KeyGen
CKG
ECDSA Key Pair
Generation
ECDSA KeyGen
(FIPS186-5):
(A7001)
Scheme: A.2.2
Rejection Sampling
CKG: ()
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 15 of 48
Name Type Description Properties Algorithms
Key Type:
Asymmetric
ECDSA public key
Verification
AsymKeyPair-
KeyVer
ECDSA public key
Verification
ECDSA KeyVer
(FIPS186-5):
(A7001)
ECDSA Signature
Generation
DigSig-SigGen ECDSA Signature
Generation
ECDSA SigGen
(FIPS186-5):
(A7001)
ECDSA Signature
Verification
DigSig-SigVer ECDSA Signature
Verification
ECDSA SigVer
(FIPS186-5):
(A7001)
Message
Authentication
MAC Message
Authentication
HMAC-SHA-1:
(A7001, A7002)
HMAC-SHA2-256:
(A7001, A7002)
HMAC-SHA2-384:
(A7001, A7002)
EC Diffie-Hellman
shared secret
computation
KAS-SSC Shared Secret
Computation
IG:D.F Scenario 2
(path 1)
KAS-ECC-SSC
Sp800-56Ar3:
(A7001)
Key derivation KAS-135KDF Key derivation KDF SSH: (A7001)
TLS v1.2 KDF
RFC7627: (A7001)
Diffie-Hellman
shared secret
computation
KAS-SSC Shared Secret
Computation
IG:D.F Scenario 2
(path 1)
KAS-FFC-SSC
Sp800-56Ar3:
(A7001)
RSA Key
Generation
AsymKeyPair-
KeyGen
CKG
RSA Key
Generation
RSA KeyGen
(FIPS186-5):
(A7001)
Scheme: A.1.3
Generation of
Random Primes
that are Probably
Prime
CKG: ()
Key Type:
Asymmetric
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 16 of 48
Name Type Description Properties Algorithms
RSA Signature
Generation
DigSig-SigGen RSA Signature
Generation
RSA SigGen
(FIPS186-5):
(A7001)
RSA Signature
Verification
DigSig-SigVer RSA Signature
Verification
RSA SigVer
(FIPS186-5):
(A7001)
Safe Primes Key
Generation
AsymKeyPair-
DomPar
CKG
Safe Primes Key
Generation
Safe Primes Key
Generation:
(A7001)
CKG: ()
Key Type:
Asymmetric
Public Key
Verification
AsymKeyPair-
PubKeyVal
Public Key
Verification
Safe Primes Key
Verification:
(A7001)
Message Digest SHA Message Digest SHA-1: (A7001,
A7002)
SHA2-256: (A7001,
A7002)
SHA2-384: (A7001,
A7002)
Table 9: Security Function Implementations
2.7 Algorithm Specific Information
KAS-SSC: The module does not establish SSPs using an approved key agreement scheme (KAS).
However, it does offer some or all of the underlying KAS cryptographic functionality to be used by an external
operator/application as part of an approved KAS.
KTS: The module does not establish SSPs using an approved key transport scheme (KTS).
However, it does offer approved authenticated algorithms that can be used by an external operator/application
as part of an approved KTS.
AES-GCM IV: The IV for AES-GCM is constructed in compliance with IG C.H scenario 1a (TLS 1.2) and
scenario 1d (SSHv2).
• For TLS 1.2, the module offers the AES-GCM implementation and uses the context of Scenario 1 of IG C.H.
The module is compliant with SP800-52Rev2 section 3.3.1 and the mechanism for IV generation is
compliant with RFC5288.
The module does not implement the TLS protocol. The module’s implementation of AES-GCM is used
together with an application that runs outside the module’s cryptographic boundary. The design of the TLS
protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the
maximum number of possible values for a given session key.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 17 of 48
• For SSHv2, the IV for the module AES-GCM implementation is only used in the context of the AES-GCM
mode encryptions. The module is compliant with RFCs 4252, 4253 and 5647.
The module does not implement SSH protocol and the module’s implementation of AES-GCM is used
together with an application that runs outside the module’s cryptographic boundary. The design of the SSH
protocol implicitly ensures that the counter does not exhaust the maximum number of possible values for a
given session key and that the no more than 264
-1 AES-GCM encryptions are performed.
When a session is terminated, as new key and a new initial IV shall be derived.
• For both TLSv1.2 and SSHv2 protocols, in the event the module’s power is lost and restored, the consuming
application must ensure that a new key for use with the AES-GCM key encryption or decryption under this
scenario shall be established.
RSA modulus size (IG C.F): The module implements FIPS 186-5 RSA KeyGen, SigVer and RSA SigGen with
modulus lengths of 2048, 3072, 4096 bits. All these modulus lengths have been CAVP tested.
SP800-56Ar3 assurances (IG D.F): To comply with the assurances found in Section 5.6.2 of SP800-56Ar3, the
keys for KAS-FFC-SSC and KAS-ECC-SSC must be generated using the approved key generation services
specified in section 9.2. For KAS-FFC-SSC the module generates keys using Safe Primes Key Generation with
Safe Prime Groups: ffdhe2048, ffdhe3072, ffdhe4096. For KAS-ECC-SSC, the module generates keys using
ECDSA KeyGen, with curves P-384 and P-256. The module performs full public key validation on the
generated public keys. Additionally, the module performs full public key validation on the received public keys.
SHA-1: SHA-1 is only approved when used for Message Authentication HMAC and Message Digest. Use of
SHA-1 in signature generation, signature verification or SSH and TLS Key Derivations is non-approved. Starting
January 1, 2031 SHA-1 will be non-approved for all purposes.
HMAC (IG C.L): In order to comply with IG C.L, the user shall make sure that the HMAC keys are generated as
specified in SP800-133r2.
2.8 RBG and Entropy
Cert
Number
Vendor
Name
E74 F5, Inc
Table 10: Entropy Certificates
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
CPU
Jitter
3.4.0
Non-
Physical
• BIG-IP 17.5.0 EHF on VMware ESXi™ 8.0.3
(Build: 24414501) running on Dell PowerEdge
R650 with an Intel® Xeon® Gold Ice Lake 6330N •
BIG-IP 17.5.0 EHF on Hyper-V version
10.0.20348.1 on Windows Server 2022 Standard
running on Dell PowerEdge R450 with an Intel®
Xeon® Silver 4309Y• BIG-IP 17.5.0 EHF on KVM
on Ubuntu 22.04.2 LTS running on Dell
256 Full
entropy
SHA-3
#A2621
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 18 of 48
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
PowerEdge R450 with an Intel® Xeon® Silver Ice
Lake 4309Y
Table 11: Entropy Sources
The entropy source used by the module is specified in Table Entropy Sources uses jitter variations caused by
executing instructions and memory accessed. The operator does not have the ability to modify the F5 entropy
source (ES) configuration settings (see details in Public Use Document referenced in section 11.2).
The module employs a Deterministic Random Bit Generator (DRBG) based on [SP800-90ARev1] for the
generation of random value used in asymmetric keys, and for providing a RNG service to calling applications.
The approved DRBG provided by the module is the CTR_DRBG with AES-256.
The output of entropy sources provides 256-bits of entropy to seed and reseed SP800-90ARev1 DRBG during
initialization (seed) and reseeding (reseed).
2.9 Key Generation
The module implements asymmetric key generation methods according to SP 800-133r2 section 5. The key
generation methods are specified in the Security Function Implementations table.
The module does not implement symmetric key generation.
2.10 Key Establishment
The module implements SSP agreement, compliant with IG D.F scenario 2 (path 1). The Key Establishment
methods are specified in the Security Function Implementations table.
2.11 Industry Protocols
GCM with internal IV generation in the approved mode is compliant with version 1.2 of the TLS protocol (RFC
5288) and shall only be used in conjunction with the TLS protocol.
Additionally, the module implements the TLS 1.2 and SSH key derivation functions for use in the TLS protocol
and SSH protocol (RFC 4253 and RFC 6668).
No parts of the TLS 1.2 and SSHv2 protocols, other than the KDF, have been tested by the CAVP or CMVP.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 19 of 48
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Data Input Data inputs are provided in the variables passed in the API and callable service
invocations, generally through caller-supplied buffers
N/A Data
Output
Data outputs are provided in the variables passed in the API and callable service
invocations, generally through caller-supplied buffers
N/A Control
Input
Control inputs which control the mode of the module are provided through
dedicated parameters.
N/A Status
Output
Status output is provided in return codes and through messages. Documentation for
each API lists possible return codes. A complete list of all return codes returned by
the C language APIs within the module is provided in the header files and the API
documentation. Messages are also documented in the API documentation.
Table 12: Ports and Interfaces
The logical interfaces are the API through which the applications request services.
The module does not implement Control Output interface.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 20 of 48
4 Roles, Services, and Authentication
4.1 Authentication Methods
FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the module does not
implement an authentication mechanism for Crypto Officer. The Crypto Officer role is implicitly assumed
when accessing all services provided by the module (see Table - Approved Services and Table - Non-Approved
Services below).
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Role Crypto Officer None
Table 13: Roles
No support is provided for multiple concurrent operators.
4.3 Approved Services
The status output from the FIPS_set_indicator_status function indicator's call is provided in Indicator column
in Table – Approved Services. To read this indicator, the calling application must register a callback function
using 'FIPS_register_indicator_callback'. The callback function shall take the input of the form "char *" which is
the form of the indicator being output by the module.
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Encryption
/
Decryption
Executes
AES-
mode
encrypt or
decrypt
operation
AES-ECB,
AES-CBC,
AES-CTR,
AES-GCM
Plaintext
and key /
ciphertext
and key
Ciphertext /
plaintext
Symmetric
Encryption
and
Decryption
Crypto Officer
- AES key: W,E
Random
number
generation
Generate
Random
number
CTR-DRBG-
AES-256
Number of
bits
Random
numbers
Random
Number
Generation
Crypto Officer
- Entropy input
string: W,E,Z
- DRBG seed :
G,E
- DRBG
internal state
(V and Key
values): G,W,E
RSA key
pair
generation
Generate
RSA Key
Pair
RSA-KEY-
GEN-2048,
RSA-KEY-
GEN-3072,
Key size Key pair RSA Key
Generation
Crypto Officer
- RSA public
key: G,R
- RSA private
key: G,R
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 21 of 48
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
RSA-KEY-
GEN-4096
RSA
signature
generation
Sign a
message
with a
specified
RSA
private
key.
RSA-PKCS1-
SIGN-
PADDING,
RSA-PKCS1-
PSS-SIGN-
PADDING
Private
key,
message,
hashing
algorithm
computed
signature
RSA
Signature
Generation
Crypto Officer
- RSA private
key: W,E
RSA
signature
verification
Verify the
signature
of a
message
with a
specified
RSA
public key.
RSA-PKCS1-
VERIFY-
PADDING,
RSA-PKCS1-
PSS-VERIFY-
PADDING
Public key,
digital
signature,
message,
hashing
algorithm
Pass / fail
result of
digital
signature
verification
RSA
Signature
Verification
None
Crypto Officer
- RSA public
key: W,E
ECDSA /
ECDH key
pair
generation
Generate a
key pair
for a
requested
elliptic
curve
EC-KEYGEN-
P-256, EC-
KEYGEN-P-
384
Key size Key pair ECDSA Key
Pair
Generation
Crypto Officer
- ECDSA public
key: G,R
- ECDSA
private key:
G,R
- EC Diffie-
Hellman
private key:
G,R
- EC Diffie-
Hellman public
key : G,R
ECDSA /
ECDH
public key
verification
Test that
an ECC
public key
is a point
on the
specified
elliptic
curve
EC-KEY-
VERIFY-P-
256, EC-KEY-
VERIFY-P-
384
Key pair Pass / fail
result of
public key
verification
ECDSA public
key
Verification
Crypto Officer
- ECDSA public
key: W,E
- EC Diffie-
Hellman public
key : W,E
ECDSA
signature
generation
Sign a
message
with a
ECDSA-SIGN-
P-256,
Private
key,
message,
Computed
signature
ECDSA
Signature
Generation
Crypto Officer
- ECDSA
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 22 of 48
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
specified
ECDSA
private
key.
ECDSA-SIGN-
P-384
hashing
algorithm
private key:
W,E
ECDSA
signature
verification
Verify the
signature
of a
message
with a
specified
ECDSA
public key
ECDSA-
VERIFY-P-
256, ECDSA-
VERIFY-P-
384
Public key,
digital
signature,
message,
hashing
algorithm
Pass / fail
result of
digital
signature
verification
ECDSA
Signature
Verification
Crypto Officer
- ECDSA public
key: W,E
EC Diffie-
Hellman
shared
secret
computatio
n
Calculate a
shared
secret via
the ECDH
algorithm.
ECDH-
COMPUTE-
KEY-P-256,
ECDH-
COMPUTE-
KEY-P-384
Received
public key
and
possessed
private key
Shared secret EC Diffie-
Hellman
shared secret
computation
Crypto Officer
- EC Diffie-
Hellman
private key:
W,E
- EC Diffie-
Hellman
Shared Secret:
G,R
- EC Diffie-
Hellman public
key : W,E
Safe primes
key
generation
Generate a
key pair
FFDHE2048-
KEYGEN,
FFDHE3072-
KEYGEN,
FFDHE4096-
KEYGEN
Key size Generated
Diffie-
Hellman key
pair
Safe Primes
Key
Generation
Crypto Officer
- Diffie-
Hellman
private key:
G,R
- Diffie-
Hellman public
key : G,R
Safe primes
key
verification
Verify
public key
FFDHE2048-
KEYGEN,
FFDHE3072-
KEYGEN,
FFDHE4096-
KEYGEN
Key pair Pass / fail
result of
public key
verification
Public Key
Verification
Crypto Officer
- Diffie-
Hellman
private key:
W,E
- Diffie-
Hellman public
key : W,E
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 23 of 48
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Diffie-
Hellman
Shared
Secret
Computatio
n
Calculate a
shared
secret via
the DH
algorithm.
FFDHE2048-
COMPUTE,
FFDHE3072-
COMPUTE,
FFDHE4096-
COMPUTE
Received
public key
and
possessed
private key
Shared secret Diffie-
Hellman
shared secret
computation
Crypto Officer
- Diffie-
Hellman public
key : W,E
- Diffie-
Hellman shared
secret: G,R
- Diffie-
Hellman
private key:
E,W
Message
digest
Generate a
digest for
the
requested
algorithm
MESSAGE-
DIGEST-SHA-
1, MESSAGE-
DIGEST-SHA-
256,
MESSAGE-
DIGEST-SHA-
384
Message,
Hashing
algorithm
Hashed
message
Message
Digest
Crypto Officer
MAC
Generation
Generate
an HMAC
or GMAC
digest
using the
requested
SHA
algorithm
or AES
algorithm
as
appropriat
e
MSG-AUTH-
HMAC-SHA-
1, MSG-
AUTH-
HMAC-SHA-
256, MSG-
AUTH-
HMAC-SHA-
384, AES-
GMAC
MAC
generation
: Message,
HMAC
key or
GMAC
key, MAC
algorithm,
MAC
length
MAC
generation:
Authenticate
d message
MAC
Generation
Message
Authenticatio
n
Crypto Officer
- AES key: W,E
- HMAC key:
W,E
Show
version
Return the
SW
version
and the
module's
name
None None Name and
Version
information
None Unauthenticate
d
Crypto Officer
Show Status Return the
module
status
None None Status output None Unauthenticate
d
Crypto Officer
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 24 of 48
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Self-tests Execute
integrity
test,
Execute
the CASTs
None Power Pass / fail
results of
self-tests
None Unauthenticate
d
Crypto Officer
Zeroization Zeroize all
non-
protected
SSPs
None Destructio
n
functions
provided
in the
module's
API.
Platform
on which
the
module
runs is
powered
down.
None None Crypto Officer
- AES key: Z
- HMAC key: Z
- RSA public
key: Z
- ECDSA public
key: Z
- EC Diffie-
Hellman
Shared Secret:
Z
- Diffie-
Hellman public
key : Z
- EC Diffie-
Hellman
private key: Z
- Diffie-
Hellman shared
secret: Z
- TLS pre-
primary secret :
Z
- TLS primary
secret: Z
- TLS derived
key (AES
HMAC): Z
- SSH shared
secret: Z
- SSH derived
key (AES,
HMAC): Z
- DRBG seed :
Z
- DRBG
internal state
(V and Key
values): Z
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 25 of 48
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
- Entropy input
string: Z
TLS key
derivation
Deriving
TLS keys
TLS-P-HASH-
DERIVATION
-SHA-256,
TLS-P-HASH-
DERIVATION
SHA-384
PRF
algorithm,
TLS pre-
primary
secret, TLS
primary
secret
Derived key Key
derivation
None
Crypto Officer
- TLS pre-
primary secret :
W,E
- TLS primary
secret: G,E,Z
- TLS derived
key (AES
HMAC): G,R
SSH key
derivation
Deriving
SSH keys
SSH-KEY-
HASH-
DERIVATION
-SHA-256,
SSH-KEY-
HASH-
DERIVATION
-SHA-384
PRF
algorithm,
SSH
shared
secret
Derived key Key
derivation
Crypto Officer
- SSH shared
secret: W,E
- SSH derived
key (AES,
HMAC): G,R
Table 14: Approved Services
For the above table, the convention below applies when specifying the access permissions (types) that the
service has for each SSP.
G = Generate: The module generates or derives the SSP.
R = Read: The SSP is read from the module (e.g. the SSP is output).
W = Write: The SSP is updated, imported, or written to the module.
E = Execute: The module uses the SSP in performing a cryptographic operation.
Z = Zeroise: The module zeroises the SSP.
4.4 Non-Approved Services
Name Description Algorithms Role
Encryption /
Decryption
Encrypt a
plaintext /
Decrypt a
ciphertext
AES with OFB, CCM, CFB, XTS, KW modes and Blowfish,
Camellia, CAST5, DES, IDEA, RC2, RC4, SEED, SM2, SM4,
Triple-DES
CO
Message
authentication
Generate and
verify a MAC tag
HMAC-SHA2-224, HMAC-SHA2-512, AES CMAC,
Triple-DES CMAC
CO
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 26 of 48
Name Description Algorithms Role
Key generation Generate a key
pair
ECDSA using P-224, P-521 curves, DSA with all key and
SHA sizes, RSA with 1024 and greater than 4096 up to
16384 modulus
CO
Key verification Verify a key pair ECDSA using P-224, P-521 curves CO
Digital signature
(not FIPS186-5
compliant/not
ACVP tested)
Generate and
verify signature
ECDSA using SM2 algorithm, Probabilistic Signature
Scheme (PSS), ANSI X9.31 schemes, PKCS #1 v1.5 scheme
with 1024 and greater than 4096 up to 16384 modulus for
all SHA sizes, DSA with all key and SHA sizes, ECDSA
using curves P-256, P-384 with SHA-1, SHA2-224, SHA2-
512, RSA PKCS #1 v1.5 scheme with modulus size 2048,
3072, 4096 bits with SHA-1, SHA2-224, SHA2-512
CO
Asymmetric
encryption /
decryption
Encrypt a
plaintext /
Decrypt a
ciphertext
RSA with modulus sizes up to 16384 bits CO
Domain parameter
generation and
verification
Generate and
verify a domain
parameter
DSA with all key and SHA sizes CO
Shared secret
computation
Compute a
shared secret
Diffie-Hellman with groups other than ffdhe2048,
ffdhe3072, ffdhe4096, EC Diffie-Hellman Ephemeral
Unified without KDF with curves other than P-256, P-
384.; onePassDh and StaticUnified without KDF
CO
Random number
generation
Generate a
random number
HMAC_DRBG and Hash_DRBG using all SHA sizes,
CTR_DRBG with AES-128, AES-192, ANSI X9.31 RNG
CO
Message digest Compute a
message digest
SHA2-224, SHA2-512, SM3, MD4, MDC2, RIPEMD,
Whirlpool
CO
Key Derivation Derive a key
from a key-
derivation key or
a shared secret
TLS Key Derivation function using SHA-1/ MD5 / SHA2-
224 / SHA2-512, SSH Key Derivation function using SHA-
1 / SHA2-224 / SHA2-512
CO
Table 15: Non-Approved Services
4.5 External Software/Firmware Loaded
The section is not applicable for the module.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 27 of 48
5 Software/Firmware Security
5.1 Integrity Techniques
The integrity of the module is verified by comparing a HMAC value calculated at run time on the
libcrypto.so.1.0.2za file, with the HMAC-SHA2-256 value stored in the module file .libcrypto.so.1.0.2za.hmac
that was computed at build time. The HMAC key used for integrity verification is 256 bits in length and is
stored as part of the module binary.
Integrity tests are performed as part of the Pre-Operational Self-Tests.
5.2 Initiate on Demand
The on-demand integrity test is performed by unloading and reloading the module.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 28 of 48
6 Operational Environment
6.1 Operational Environment Type and Requirements
BIG-IP consists of a Linux based operating system customized for performance that runs directly on the
hardware or in virtual environment.
Type of Operational Environment: Modifiable
How Requirements are Satisfied:
The module shall be installed as stated in Section 11.1. If properly installed, the operating system provides
process isolation and memory protection mechanisms that ensure appropriate separation for memory access
among the processes on the system. Each process has control over its own data, and uncontrolled access to the
data of other processes is prevented.
6.2 Configuration Settings and Restrictions
The module runs on a BIG-IP 17.5.0 EHF operating system executing on the hardware and hypervisor specified
in Table - Tested Operational Environments. The module should be installed as stated in section 11.1. The
operator should confirm that the module is installed and configured correctly by section 11.2. The restrictions
to the configuration are listed in sections 11.4.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 29 of 48
7 Physical Security
The module is a software and therefore this section is Not Applicable (N/A).
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 30 of 48
8 Non-Invasive Security
Per IG 12.A: Until requirements of SP 800-140F are defined, non-invasive mechanisms fall under ISO / IEC
19790:2012 Section 7.12 Mitigation of other attacks.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 31 of 48
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description Persistence
Type
RAM Temporary storage for SSPs used by the module as part of service execution. Dynamic
Table 16: Storage Areas
9.2 SSP Input-Output Methods
Name From To Format
Type
Distribution
Type
Entry
Type
SFI or
Algorithm
API input
parameters
Operator calling
application
(TOEPP)
Cryptographic
module
Plaintext Manual Electronic
API output
parameters
Cryptographic
module
Operator calling
application
(TOEPP)
Plaintext Manual Electronic
Table 17: SSP Input-Output Methods
The module only supports SSP entry and output to and from the calling application running on the same
operational environment. This corresponds to manual distribution, electronic entry/output (“CM Software
to/from App via TOEPP Path”) per FIPS 140-3 IG 9.5.A Table 1.
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator
Initiation
Wipe and Free
memory block
allocated
Zeroizes the SSPs
contained within
the cipher handle.
Memory occupied by SSPs is overwritten with
zeroes and then it is released, which renders the
SSP values irretrievable. The completion of the
zeroization routine indicates that the
zeroization procedure succeeded.
By calling the
cipher related
zeroization API
Module Reset De-allocates the
volatile memory
used to store SSPs
Volatile memory used by the module is
overwritten within nanoseconds when power is
removed.
By unloading
and reloading
the module.
Table 18: SSP Zeroization Methods
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 32 of 48
9.4 SSPs
Name Description Size - Strength Type -
Category
Generated
By
Established
By
Used By
AES key AES key used
for encryption /
decryption and
for MAC
Generation and
for Key
Transport
Key length:
128 to 256 bits
- 128 to 256
bits
Symmetric -
CSP
Symmetric
Encryption
and
Decryption
MAC
Generation
HMAC
key
HMAC key used
for Message
authentication
Key length:
112 to 192-bits
- 112 to 192-
bits
Symmetric -
CSP
MAC
Generation
RSA
public
key
RSA public key
used for digital
signature
verification
Modulus N:
2048, 3072,
4096 bits - 112
to 150 bits
Asymmetric
- PSP
RSA Key
Generation
RSA
Signature
Verification
ECDSA
public
key
ECDSA public
key used for
Digital signature
verification
Curve size: P-
256 and P-384
bits - 128 and
192 bits
Asymmetric
- PSP
ECDSA
Key Pair
Generation
ECDSA
Signature
Verification
EC
Diffie-
Hellman
public
key
EC Diffie-
Hellman public
key used for
ECDH SSC
Curve size: P-
256, P-384-bits
- 128 and 192-
bits
Asymmetric
- PSP
ECDSA
Key Pair
Generation
EC Diffie-
Hellman
shared secret
computation
EC
Diffie-
Hellman
Shared
Secret
EC Diffie-
Hellman Shared
Secret
Curve size: P-
256, P-384 bits
- 128 and 192
bits
Asymmetric
- CSP
EC Diffie-
Hellman
shared secret
computation
Key
derivation
Diffie-
Hellman
public
key
Diffie-Hellman
public key used
for KAS-FFC-
SSC
Curve size:
ffdhe2048,
ffdhe3072,
ffdhe4096 -
112 to 150 bits
Asymmetric
- PSP
Safe Primes
Key
Generation
Diffie-
Hellman
shared secret
computation
Diffie-
Hellman
shared
secret
Diffie-Hellman
shared secret
Curve size:
ffdhe2048,
ffdhe3072,
Asymmetric
- CSP
Diffie-
Hellman
shared secret
computation
Key
derivation
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 33 of 48
Name Description Size - Strength Type -
Category
Generated
By
Established
By
Used By
ffdhe4096 -
112 to 150 bits
Entropy
input
string
Entropy
obtained from
the non-
physical entropy
source
384 bits - 384
bits
Entropy
Input - CSP
Random
Number
Generation
DRBG
seed
DRBG seed used
for Random
number
generation
384 bits - 256
bits
Seed - CSP Random
Number
Generation
Random
Number
Generation
DRBG
internal
state (V
and Key
values)
DRBG internal
state (V and Key
values) used for:
Use: Random
number
generation
384 bits - 256
bits
Internal
state - CSP
Random
Number
Generation
Random
Number
Generation
TLS pre-
primary
secret
TLS pre-primary
secret used for
TLS KDF
Diffie-Hellman
curve size: P-
224, P-256,
150-bits EC
Diffie-Hellman
curve size: P-
256-bits, P-
384-bits -
Diffie-
Hellman: 112,
128, 150-bits
EC Diffie-
Hellman: 128-
bits or 192-bits
Asymmetric
- CSP
Key
derivation
TLS
primary
secret
TLS primary
secret used for
TLS KDF
384-bits - 128
or 192-bits
Symmetric -
CSP
Key
derivation
Key
derivation
TLS
derived
key (AES
HMAC)
TLS derived key
(AES HMAC)
used for TLS
protocol
Key length:
128 and 256-
bits (AES); 112
and 256-bits
(HMAC) - 112
to 192-bits
Symmetric -
CSP
Key
derivation
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 34 of 48
Name Description Size - Strength Type -
Category
Generated
By
Established
By
Used By
SSH
shared
secret
SSH shared
secret used for:
SSH protocol
Curve size: P-
256, P-384-bits
- 128 and 192-
bits
Symmetric -
CSP
Key
derivation
SSH
derived
key
(AES,
HMAC)
SSH derived key
(AES, HMAC)
used in SSH
protocol
Key length:
128 and 256-
bits (AES), 112
and 256-bits
(HMAC) - 112
to 192-bits
Symmetric -
CSP
Key
derivation
RSA
private
key
RSA private key
pair used for
digital signature
generation
Modulus N:
2048, 3072,
4096 bits - 112
to 150 bits
Asymmetric
- CSP
RSA Key
Generation
RSA
Signature
Generation
ECDSA
private
key
ECDSA private
key pair used for
digital signature
generation
Curve size: P-
256, P-384 bits
- 128 and 192-
bits
Asymmetric
- CSP
ECDSA
Key Pair
Generation
ECDSA
Signature
Generation
EC
Diffie-
Hellman
private
key
ECDH private
key or digital
signature
generation
Curve size: P-
256, P-384 bits
- 128 and 192-
bits
Asymmetric
- CSP
ECDSA
Key Pair
Generation
EC Diffie-
Hellman
shared secret
computation
Diffie-
Hellman
private
key
DH private key
used for KAS-
FFC-SSC
Curve size:
ffdhe2048,
ffdhe3072,
ffdhe4096 -
112 to 150 bits
Asymmetric
- CSP
Safe Primes
Key
Generation
Diffie-
Hellman
shared secret
computation
Table 19: SSP Table 1
Name Input -
Output
Storage Storage Duration Zeroization Related SSPs
AES key API input
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
HMAC key API input
parameters
RAM:Plaintext From service
invocation to
Wipe and Free
memory block
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 35 of 48
Name Input -
Output
Storage Storage Duration Zeroization Related SSPs
service
completion
allocated
Module Reset
RSA public
key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
RSA private
key:Paired With
ECDSA
public key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
ECDSA private
key:Paired With
EC Diffie-
Hellman
public key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
EC Diffie-Hellman
private key:Paired
With
EC Diffie-
Hellman
Shared Secret
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
EC Diffie-Hellman
public key :Derived
From
EC Diffie-Hellman
private key:Derived
From
Diffie-
Hellman
public key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
Diffie-
Hellman
shared secret
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
Diffie-Hellman
public key
:Established
Diffie-Hellman
private
key:Established
Entropy
input string
RAM:Plaintext From service
invocation to
service
completion
N/A DRBG seed :Used
With
DRBG seed RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
Entropy input
string:Derived From
DRBG internal state
(V and Key
values):Derives
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 36 of 48
Name Input -
Output
Storage Storage Duration Zeroization Related SSPs
DRBG
internal state
(V and Key
values)
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
DRBG seed :Derived
From
TLS pre-
primary
secret
API input
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
TLS primary
secret:Derives
TLS primary
secret
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
TLS pre-primary
secret :Derived From
TLS derived
key (AES
HMAC)
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
TLS primary
secret:Derived From
SSH shared
secret
API input
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
SSH derived key
(AES,
HMAC):Derives
SSH derived
key (AES,
HMAC)
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
SSH shared
secret:Derived From
RSA private
key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
RSA public
key:Paired With
ECDSA
private key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
ECDSA public
key:Paired With
EC Diffie-
Hellman
private key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
EC Diffie-Hellman
public key :Paired
With
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 37 of 48
Name Input -
Output
Storage Storage Duration Zeroization Related SSPs
Diffie-
Hellman
private key
API input
parameters
API output
parameters
RAM:Plaintext From service
invocation to
service
completion
Wipe and Free
memory block
allocated
Module Reset
Diffie-Hellman
shared secret:Paired
With
Table 20: SSP Table 2
9.5 Transitions
The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1,
2031.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 38 of 48
10 Self-Tests
Pre-operational self-tests, and conditional algorithm self-tests are performed automatically when the module is
loaded into memory.
While the module is executing the pre-operational self-tests, and conditional algorithm self-tests, services are
not available, and input and output are inhibited. The module does not return control to the calling application
until the tests are completed. On successful completion of the pre-operational self-tests, and conditional
algorithm self-tests the module enters operational mode and cryptographic services are available.
10.1 Pre-Operational Self-Tests
Algorithm
or Test
Test
Properties
Test Method Test Type Indicator Details
HMAC-
SHA2-256
(A7001)
HMAC
key: 256-
bits
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are
available for use
Integrity of the module is
verified by comparing the
HMAC-SHA2-256 value
calculated at runtime with
the HMAC-SHA2-256 value
stored in the module that was
computed at build time
HMAC-
SHA2-256
(A7002)
HMAC
key: 256-
bits
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are
available for use
Integrity of the module is
verified by comparing the
HMAC-SHA2-256 value
calculated at runtime with
the HMAC-SHA2-256 value
stored in the module that was
computed at build time
Table 21: Pre-Operational Self-Tests
10.2 Conditional Self-Tests
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM
encrypt
256-bit key KAT CAST Module becomes
operational
Encryption Test runs at
power-on
before the
integrity test
AES-GCM
decrypt
256-bit key KAT CAST Module becomes
operational
Decryption Test runs at
power-on
before the
integrity test
Counter
DRBG
AES 256-bits KAT CAST Module becomes
operational
Compliant with SP
800-90Ar1 section
Test runs at
power-on
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 39 of 48
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
11.3 health tests:
instantiate (11.3.2),
generate (11.3.3), and
reseed (11.3.4)
before the
integrity test
HMAC-
SHA2-256
SHA2-256 KAT CAST Module becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-
SHA-1
SHA-1 KAT CAST Module becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
HMAC-
SHA2-384
SHA2-384 KAT CAST Module becomes
operational
Message
authentication
Test runs at
power-on
before the
integrity test
RSA
KeyGen
(FIPS186-5)
SHA2-256
and
respective
keys
PCT PCT Successful key
pair generation
Signature generation
& verification
Key pair
generation
RSA SigGen
(FIPS186-5)
PKCS#1 v1.5
with 2048
bit key and
SHA2-256
KAT CAST Module becomes
operational
Digital signature
generation
Test runs at
power-on
before the
integrity test
RSA SigVer
(FIPS186-5)
PKCS#1 v1.5
with 2048
bit key and
SHA2-256
KAT CAST Module becomes
operational
Digital signature
verification
Test runs at
power-on
before the
integrity test
ECDSA
KeyGen
(FIPS186-5)
SHA2-256
and
respective
keys
PCT PCT Successful key
pair generation
Signature generation
& verification
Key pair
generation
ECDSA
SigGen
(FIPS186-5)
P-256 with
SHA-224
KAT CAST Module becomes
operational
Digital signature
generation
Test runs at
power-on
before the
integrity test
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 40 of 48
Algorithm
or Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
ECDSA
SigVer
(FIPS186-5)
P-256 with
SHA-224
KAT CAST Module becomes
operational
Digital signature
verification
Test runs at
power-on
before the
integrity test
KAS-ECC-
SSC Sp800-
56Ar3
P-256 curve KAT CAST Module becomes
operational
Shared secret
computation
Test runs at
power-on
before the
integrity test
KAS-FFC-
SSC Sp800-
56Ar3
ffdhe2048 KAT CAST Module becomes
operational
Shared secret
computation
Test runs at
power-on
before the
integrity test
AES-ECB
encrypt
128-bit key KAT CAST Module becomes
operational
Encrypt operation Test runs at
power-on
before the
integrity test
AES-ECB
decrypt
128-bit key KAT CAST Module becomes
operational
Decrypt operation Test runs at
power-on
before the
integrity test
Safe Primes
Key
Generation
ffdhe2048 PCT PCT Recomputing the
public key and
comparing it to
the generated
key
Shared secret
computation
comparison
Key pair
generation
KDF SSH SHA2-256 KAT CAST Module becomes
operational
Key derivation Test runs at
power-on
before the
integrity test
TLS v1.2
KDF
RFC7627
SHA2-256 KAT CAST Module becomes
operational
Key derivation Test runs at
power-on
before the
integrity test
Table 22: Conditional Self-Tests
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 41 of 48
10.3 Periodic Self-Test Information
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A7001)
Message
authentication
SW/FW Integrity On Demand Manually
HMAC-SHA2-256
(A7002)
Message
authentication
SW/FW Integrity On Demand Manually
Table 23: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
AES-GCM encrypt KAT CAST On Demand Manually
AES-GCM decrypt KAT CAST On Demand Manually
Counter DRBG KAT CAST On Demand Manually
HMAC-SHA2-256 KAT CAST On Demand Manually
HMAC-SHA-1 KAT CAST On Demand Manually
HMAC-SHA2-384 KAT CAST On Demand Manually
RSA KeyGen
(FIPS186-5)
PCT PCT On Demand Manually
RSA SigGen
(FIPS186-5)
KAT CAST On Demand Manually
RSA SigVer
(FIPS186-5)
KAT CAST On Demand Manually
ECDSA KeyGen
(FIPS186-5)
PCT PCT On Demand Manually
ECDSA SigGen
(FIPS186-5)
KAT CAST On Demand Manually
ECDSA SigVer
(FIPS186-5)
KAT CAST On Demand Manually
KAS-ECC-SSC
Sp800-56Ar3
KAT CAST On Demand Manually
KAS-FFC-SSC
Sp800-56Ar3
KAT CAST On Demand Manually
AES-ECB encrypt KAT CAST On Demand Manually
AES-ECB decrypt KAT CAST On Demand Manually
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 42 of 48
Algorithm or Test Test Method Test Type Period Periodic Method
Safe Primes Key
Generation
PCT PCT On Demand Manually
KDF SSH KAT CAST On Demand Manually
TLS v1.2 KDF
RFC7627
KAT CAST On Demand Manually
Table 24: Conditional Periodic Information
10.4 Error States
Name Description Conditions Recovery
Method
Indicator
Halt
Error
Module is no
longer
operational. The
data output is
inhibited.
HMAC-SHA2-
256 - integrity
technique- KAT
failure,
HMAC-SHA2-
256 integrity
test failure,
Failure of any of
the CASTs,
Failure of any of
the PCTs
The module
must be re-
loaded with a
fresh image
Integrity test failure: the module will not
load. KAT failure: flag fips_selftest_fail set
to 1 and the module will not load, PCT
failure: flag fips_selftest_fail set to 1 and
module is aborted confirming it entered
the error state
Table 25: Error States
The module must be re-loaded in order to clear the error condition.
10.5 Operator Initiation of Self-Tests
The on demand self-tests can be invoked by unloading and subsequently reloading the module. This service
performs the same cryptographic algorithm tests executed during power-on and module loading. During the
execution of the on demand self-tests, crypto services are not available, and no data output or input is possible.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 43 of 48
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
Startup Procedures: Before the Crypto Officer can configure and use the BIG-IP system, the Crypto Officer
must activate a valid license on the system. The Crypto Officer chooses the license to buy by selecting the
hypervisor from Table ‘Tested Operational Environments - Software, Firmware, Hybrid”. The following
procedures described in "K7752 Licensing the BIG-IP system" on my.F5.com
(https://my.f5.com/manage/s/article/K7752#reg) are performed:
• Obtaining a registration key
• Obtaining a dossier
• Activating the license
Installation Process: The Crypto Officer downloads the BIG-IP VE image (ie the module) and deploys it. After
the FIPS validated module license is installed, the command prompt will change to ‘REBOOT REQUIRED’. The
Crypto Officer must reboot the BIG-IP for all FIPS-compliant changes to take effect.
11.2 Administrator Guidance
The Crypto Officer should verify the validity of the BIG-IP software license by running the command: ‘tmsh
show sys license' which should output 'FIPS 140, BIG-IP VE-1G to 10G,’ under the ‘Active Modules’ list.
On the BIG-IP product the Crypto Officer should call the dedicated Show version API,
fips_get_f5fips_module_version, to ensure that the module identifier and version are shown as: Cryptographic
Module for BIG-IP OpenSSL 1.0.2za-fips-EHF 0.198.15.
If the module has passed all self-tests then it is operating in the Approved mode. The Approved mode of
operation can only transition into the non-Approved mode by calling one of the non-Approved services listed
in Table - Non-Approved Services.
The ESV Public Use Document (PUD) reference for non-physical entropy source is as follows:
https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/74
11.3 Non-Administrator Guidance
The section is not applicable for the module.
11.4 Design and Rules
The Crypto Officer shall consider the requirements and restrictions in above section 2.7 when using the
module.
11.5 End of Life
As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the
module. This will zeroize all SSPs in volatile memory.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 44 of 48
12 Mitigation of Other Attacks
The module does not implement security mechanisms to mitigate other attacks.
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 45 of 48
Appendix A. Glossary and Abbreviations
AES Advanced Encryption Standard
AES-NI Advanced Encryption Standard New Instructions
CAVP Cryptographic Algorithm Validation Program
CBC Cipher Block Chaining
CCM Counter with Cipher Block Chaining-Message Authentication Code
CFB Cipher Feedback
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
CTR Counter Mode
DES Data Encryption Standard
DSA Digital Signature Algorithm
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECC Elliptic Curve Cryptography
ESV Entropy Source Validation
FFC Finite Field Cryptography
FIPS Federal Information Processing Standards Publication
GCM Galois Counter Mode
HMAC Hash Message Authentication Code
KAS Key Agreement Schema
KAT Known Answer Test
KDF Key Derivation Function
KW AES Key Wrap
MAC Message Authentication Code
NIST National Institute of Science and Technology
OFB Output Feedback
PAA Processor Algorithm Acceleration
PCT Pairwise Consistency Test
PR Prediction Resistance
PSS Probabilistic Signature Scheme
RNG Random Number Generator
RSA Rivest, Shamir, Addleman
SHA Secure Hash Algorithm
SHS Secure Hash Standard
SSH Secure Shell
XTS XEX-based Tweaked-codebook mode with cipher text Stealing
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 46 of 48
Appendix B. References
FIPS140-3 FIPS PUB 140-3 - Security Requirements for Cryptographic Modules
March 2019
https://doi.org/10.6028/NIST.FIPS.140-3
FIPS140-3_IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation
Program
April 2025
https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-
announcements
FIPS180-4 Secure Hash Standard (SHS)
March 2012
http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
FIPS186-5 Digital Signature Standard (DSS)
February 2023
https://doi.org/10.6028/NIST.FIPS.186-5
FIPS197 Advanced Encryption Standard
November 2001
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
FIPS198-1 The Keyed Hash Message Authentication Code (HMAC)
July 2008
http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
FIPS202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
August 2015
https://dx.doi.org/10.6028/NIST.FIPS.202
PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1
February 2003
http://www.ietf.org/rfc/rfc3447.txt
RFC3394 Advanced Encryption Standard (AES) Key Wrap Algorithm
September 2002
http://www.ietf.org/rfc/rfc3394.txt
RFC5649 Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm
September 2009
http://www.ietf.org/rfc/rfc5649.txt
SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of
Operation Methods and Techniques
December 2001
https://doi.org/10.6028/NIST.SP.800-38A
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 47 of 48
SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of
Operation: The CMAC Mode for Authentication
May 2005
https://doi.org/10.6028/NIST.SP.800-38B
SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of
Operation: the CCM Mode for Authentication and Confidentiality
May 2004
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
SP800-38D NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of
Operation: Galois/Counter Mode (GCM) and GMAC
November 2007
https://doi.org/10.6028/NIST.SP.800-38D
SP800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of
Operation: The XTS AES Mode for Confidentiality on Storage Devices
January 2010
https://doi.org/10.6028/NIST.SP.800-38E
SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of
Operation: Methods for Key Wrapping
December 2012
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
SP800-38G NIST Special Publication 800-38G - Recommendation for Block Cipher Modes of
Operation: Methods for Format - Preserving Encryption
March 2016
https://dx.doi.org/10.6028/NIST.SP.800-38G
SP800-56ARev3 NIST Special Publication 800-56A Revision 3 - Recommendation for Pair Wise Key
Establishment Schemes Using Discrete Logarithm Cryptography
April 2018
https://doi.org/10.6028/NIST.SP.800-56Ar3
SP800-56CRev2 Recommendation for Key Derivation through Extraction-then-Expansion
August 2020
https://doi.org/10.6028/NIST.SP.800-56Cr2
SP800-57 NIST Special Publication 800-57 Part 1 Revision 54 - Recommendation for Key
Management Part 1: General
May 2020
https://doi.org/10.6028/NIST.SP.800-57pt1r5
SP800-90ARev1 NIST Special Publication 800-90A - Revision 1 - Recommendation for Random Number
Generation Using Deterministic Random Bit Generators
June 2015
http://dx.doi.org/10.6028/NIST.SP.800-90Ar1
Cryptographic Module for BIG-IP FIPS 140-3 Non-Proprietary Security Policy
© 2026 F5, Inc.
This document can be reproduced and distributed only whole and intact, including this copyright notice
Page 48 of 48
SP800-90B NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used for
Random Bit Generation
January 2018
https://doi.org/10.6028/NIST.SP.800-90B
SP800-131A NIST Special Publication 800-131A Revision 2- Transitions: Recommendation for
Transitioning the Use of Cryptographic Algorithms and Key Lengths
March 2019
https://doi.org/10.6028/NIST.SP.800-131Ar2
SP800-132 NIST Special Publication 800-132 - Recommendation for Password-Based Key Derivation -
Part 1: Storage Applications
December 2010
https://doi.org/10.6028/NIST.SP.800-132
SP800-133Rev2 NIST Special Publication 800-133 - Recommendation for Cryptographic Key Generation
June 2020
https://doi.org/10.6028/NIST.SP.800-133r2
SP800-135Rev1 NIST Special Publication 800-135 Revision 1 - Recommendation for Existing Application-
Specific Key Derivation Functions
December 2011
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf
SP800-140B NIST Special Publication 800-140B - CMVP Security Policy Requirements
March 2020
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140B.pdf