This page was not yet optimized for use on mobile devices.
WatchGuard Firebox T20, T20-W, T40, T40-W, T80, NV5, T25, T25-W, T45, T45-PoE, T45-W-PoE, T45-CW, T85-PoE, M290, M390, M590 and M690
Certificate details
| Certificate ID | #5301 |
|---|---|
| Status | active |
| Validation dates | 03.06.2026 |
| Sunset date | 02-06-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. When installed, initialized and configured as specified in Section Secure Operation in Section 11 of the Security Policy. The tamper evident seals installed as indicated in the Security Policy |
| Exceptions |
|
| Description | WatchGuard® Firebox appliances are built for enterprise-grade performance with blazing throughput and numerous connectivity options. Advanced networking features include clustering, high availability (active/active), VLAN support, multi-WAN load balancing and enhanced VoIP security, plus inbound and outbound HTTPS inspection, to give the strong security enterprises need. And the Firebox appliances are completely configurable - turn on or off components and services to fit different network security deployment requirements. |
| Vendor | WatchGuard Technologies, Inc. http://www.watchguard.com |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES-192, AES, AES-, AES256, CAST, DES, Triple-DES, HMACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, ECC, Diffie-Hellman, DHE, DHHash functions
SHA-1, SHA3-256, MD5Schemes
MACProtocols
SSH, SSHv2, TLS, TLS v1.2, TLS v1.3, TLSv1.2, TLS 1.3, TLSv1.3, IKEv1, IKEv2, IKE, IPsec, VPNRandomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, Curve P-256Block cipher modes
CTR, GCMTrusted Execution Environments
PSP, SSCVendor
NXPSecurity level
Level 2Certification process
out of scope, of the TELs as depicted below and any additional requirement per the site security policy which are out of scope of this Security PolicyStandards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-52, RFC7627, RFC 5288, RFC8446, RFC 7296, RFC 4419, RFC 7919, RFC 3526, ISO/IEC 19790Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.CPE matches
- cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t20-w:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t40-w:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*
- cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5301,
"dgst": "9401e925f19506af",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"#A4431",
"#A4433",
"Counter DRBGA4397",
"#A4432",
"SHA2-512A4436",
"AES-CBCA4436",
"KDF IKEv1A4397",
"TLS v1.3 KDFA4397",
"SHA2-384A4436",
"TLS v1.2 KDF RFC7627A4397",
"ECDSA SigVer (FIPS186-5)A4397",
"KAS-ECC-SSC Sp800-56Ar3A4397",
"HMAC-SHA-1A4436",
"RSA KeyGen (FIPS186-5)A4397",
"AES-GCMA4436",
"SHA-1A4436",
"SHA2-256A4436",
"Safe Primes Key GenerationA4397",
"HMAC-SHA2-512A4436",
"KDF SSHA4397",
"RSA SigGen (FIPS186-5)A4397",
"ECDSA KeyGen (FIPS186-5)A4397",
"#A4430",
"#A4435",
"#A4397",
"ECDSA SigGen (FIPS186-5)A4397",
"RSA SigVer (FIPS186-5)A4397",
"#A4434",
"HMAC-SHA2-256A4436",
"KDF IKEv2A4397",
"HMAC-SHA2-384A4436",
"#A4436",
"#A4424",
"#A4429",
"KAS-FFC-SSC Sp800-56Ar3A4397",
"AES-CTRA4397"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:h:watchguard:firebox_t40-w:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t85:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t20:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_m390:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_m290:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_nv5:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t40:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t80:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t25:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t20-w:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_m690:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_m590:-:*:*:*:*:*:*:*",
"cpe:2.3:h:watchguard:firebox_t45:-:*:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4397",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4424",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4429",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4430",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4431",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4432",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4433",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4434",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4435",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4436",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A4397",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4397",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4424",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4429",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4430",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4431",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4432",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4433",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4434",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4435",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A4436",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A4397",
"properties": "Prediction Resistance - Yes Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4397",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4424",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4429",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4430",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4431",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4432",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4433",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4434",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4435",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4436",
"properties": "Key Length - Key Length: 8-320 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4397",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4424",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4429",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4430",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4431",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4432",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4433",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4434",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4435",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A4436",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4397",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4424",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4429",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4430",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4431",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4432",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4433",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4434",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4435",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A4436",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4397",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4424",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4429",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4430",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4431",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4432",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4433",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4434",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4435",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A4436",
"properties": "Key Length - Key Length: 8-512 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC- SSC Sp800- 56Ar3",
"cavpCertName": "A4397",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A4397",
"properties": "Domain Parameter Generation Methods - FB, FC, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP- 4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv1 (CVL)",
"cavpCertName": "A4397",
"properties": "Authentication Method - Digital Signature, Pre- shared Key Preshared Key Length - Preshared Key Length: 8, 224 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256-3072 Increment 256 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A4397",
"properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256-3072 Increment 256 Derived Keying Material Length - Derived Keying Material Length: 1056, 3072 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A4397",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A4397",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A4397",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4397",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4424",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4429",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4430",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4431",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4432",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4433",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4434",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4435",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4436",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4397",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4424",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4429",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4430",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4431",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4432",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4433",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4434",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4435",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4436",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4397",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4424",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4429",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4430",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4431",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4432",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4433",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4434",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4435",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A4436",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4397",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4424",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4429",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4430",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4431",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4432",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4433",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4434",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4435",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4436",
"properties": "Message Length - Message Length: 8-16384 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A4397",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A4397",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Create and manage roles accounts",
"indicator": "N/A",
"inputs": "Commands to create roles accounts",
"name": "Roles account manageme nt",
"outputs": "Status of the completion of account status",
"rolesSspAccess": "Crypto Officer - Crypto Officer passwo rd: G,W,Z - User passwo rd: G,W,Z",
"secFunImpl": "None"
},
{
"description": "Crypto officer authenticati on to the module",
"indicator": "N/A",
"inputs": "Crypto Officer authenticati on request",
"name": "Crypto Officer authenticati on",
"outputs": "Status of Cyrpto Officer authentication",
"rolesSspAccess": "Crypto Officer - Crypto Officer passwo rd: W,E",
"secFunImpl": "None"
},
{
"description": "User authenticati on to the module",
"indicator": "N/A",
"inputs": "User authenticati on request",
"name": "User authenticati on",
"outputs": "Status of User authentication",
"rolesSspAccess": "User - User passwo rd: W,E",
"secFunImpl": "None"
},
{
"description": "VPN Peer authenticati on",
"indicator": "N/A",
"inputs": "VPN Peer authenticati on request",
"name": "VPN Peer authenticati on",
"outputs": "Status of the VPN Peer authentication",
"rolesSspAccess": "VPN Peer - IPSec/I KE RSA public key: W,E - IPSec/I",
"secFunImpl": "IKEv1/v2 ECDSA SigVer IKEv1/v2 RSA SigVer"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KE ECDSA public key: W,E",
"secFunImpl": ""
},
{
"description": "Configure module\u0027s network",
"indicator": "N/A",
"inputs": "Commands to configure the network",
"name": "Configure network",
"outputs": "Status of the completion of network configuration status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Show module\u0027s status",
"indicator": "N/A",
"inputs": "Command used to show Module\u0027s Status",
"name": "Show status",
"outputs": "Module\u0027s operational status",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Show module\u0027s ID and versioning information",
"indicator": "N/A",
"inputs": "Command to show Module\u0027s ID and version",
"name": "Show version",
"outputs": "Module\u0027s ID and versioning information",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Enable/disa ble module\u0027s approved mode serivce",
"indicator": "N/A",
"inputs": "Commands to enable/disa ble module\u0027s approved mode",
"name": "Enable/Dis able module\u0027s approved mode",
"outputs": "Status of the module\u0027s mode status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Reboot module serivce",
"indicator": "N/A",
"inputs": "Commands to reboot the module",
"name": "Reboot module",
"outputs": "Status of the module\u0027s reboot status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform self-tests serivce",
"indicator": "N/A",
"inputs": "Command to trigger self-tests",
"name": "Perform self-test",
"outputs": "Status of the self-tests results",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Firmware integrity test"
},
{
"description": "Perform firmware update serivce",
"indicator": "Log shows approve d algorith m currentl y utilized in the firmwar e update service",
"inputs": "Command to trigger firmware update",
"name": "Firmware update",
"outputs": "Status of the updated firmware installation",
"rolesSspAccess": "Crypto Officer - Firmwar e load test key: R,E",
"secFunImpl": "Firmware load test"
},
{
"description": "Sets the Bypass capability",
"indicator": "N/A",
"inputs": "Commands to configure the Bypass capability",
"name": "Configure Bypass capability",
"outputs": "Status of the completion of Bypass capability configuration",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Configure SSHv2 service",
"indicator": "Log shows approve d algorith ms currentl y utilized in SSHv2 service",
"inputs": "Commands to configure SSHv2 service",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completion of SSHv2 configuration",
"rolesSspAccess": "Crypto Officer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - SSH ECDH private key: G,R,W, E - SSH ECDH public key: G,R,W, E - SSH peer ECDH public key: G,R,W, E - SSH ECDH shared secret:",
"secFunImpl": "KAS-ECC- KeyGen (SSHv2) KAS-FFC- KeyGen (SSHv2) KAS-ECC (SSHv2) KAS-FFC (SSHv2) SSH RSA KeyGen SSH RSA SigGen SSH RSA SigVer Block ciphers (SSHv2) DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W, E - SSH DH private key: G,R,W, E - SSH DH public key: G,R,W, E - SSH peer DH public key: G,R,W, E - SSH DH shared secret: G,R,W, E - SSH RSA private key: G,R,W, E - SSH RSA public key: G,R,W, E - SSH encrypti on key: G,R,W, E - SSH integrity key: G,R,W, E",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "User - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - SSH ECDH private key: G,R,W, E - SSH ECDH public key: G,R,W, E - SSH peer ECDH public key: G,R,W, E - SSH ECDH shared secret: G,R,W, E - SSH DH private key:",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W, E - SSH DH public key: G,R,W, E - SSH peer DH public key: G,R,W, E - SSH DH shared secret: G,R,W, E - SSH RSA private key: G,R,W, E - SSH RSA public key: G,R,W, E - SSH encrypti on key: G,R,W, E - SSH integrity key: G,R,W, E Crypto",
"secFunImpl": "Functions"
},
{
"description": "Configure TLS (v1.2/v1.3) Function",
"indicator": "Log shows approve d algorith ms",
"inputs": "Commands to configure TLS (v1.2/v1.3) service",
"name": "Configure TLS (v1.2/v1.3) Function",
"outputs": "Status of the completion of TLS (v1.2/v1.3) configuration",
"rolesSspAccess": "Officer - DRBG entropy input: G,R,W,",
"secFunImpl": "KAS-ECC- KeyGen (TLSv1.2/v 1.3) KAS-FFC- KeyGen"
},
{
"description": "Descriptio",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "currentl y utilized in TLS (v1.2/v1 .3) service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - TLS ECDH private key: G,R,W, E - TLS ECDH public key: G,R,W, E - TLS peer ECDH public key: G,R,W, E - TLS ECDH shared secret: G,R,W, E - TLS DH private key: G,R,W, E - TLS DH public",
"secFunImpl": "Functions (TLSv1.2/v 1.3) KAS-ECC (TLSv1.2/v 1.3) KAS-FFC (TLSv1.2/v 1.3) TLS ECDSA KeyGen TLS ECDSA SigGen TLS ECDSA SigVer TLS RSA KeyGen TLS RSA SigGen TLS RSA SigVer Block ciphers (TLSv1.2/v 1.3) DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "key: G,R,W, E - TLS peer DH public key: G,R,W, E - TLS DH shared secret: G,R,W, E - TLS ECDSA private key: G,R,W, E - TLS ECDSA public key: G,R,W, E - TLS RSA private key: G,R,W, E - TLS RSA public key: G,R,W, E - TLS master secret: G,R,W, E - TLS encrypti on key: G,R,W,",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - TLS integrity key: G,R,W, E",
"secFunImpl": ""
},
{
"description": "Configure IPsec/IKE (v1/v2) function",
"indicator": "Log shows approve d algorith ms currentl y utilized in IPsec/IK E (v1/v2) service",
"inputs": "Commands to configure IPsec/IKE (v1/v2)funct ion",
"name": "Configure IPsec/IKE (v1/v2) Function",
"outputs": "Status of the completion of IPsec/IKE (v1/v2)configur ation",
"rolesSspAccess": "Crypto Officer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - IPSec/I KE ECDH private key: G,R,W, E - IPSec/I KE peer ECDH public key: G,R,W, E - IPSec/I KE ECDH shared secret:",
"secFunImpl": "KAS-ECC- KeyGen (IKEv1/v2) KAS-FFC- KeyGen (IKEv1/v2) KAS-ECC (IKEv1/v2) KAS-FFC (IKEv1/v2) IKEv1/v2 ECDSA KeyGen IKEv1/v2 ECDSA SigGen IKEv1/v2 ECDSA SigVer IKEv1/v2 RSA KeyGen IKEv1/v2 RSA SigGen IKEv1/v2 RSA SigVer Block ciphers (IKEv1/v2) DRBG Function"
},
{
"description": "Descriptio",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W, E - IPsec/I KE DH private key: G,R,W, E - IPSec/I KE DH public key: G,R,W, E - IPSec/I KE peer DH public key: G,R,W, E - IPSec/I KE DH shared secret: G,R,W, E - IPSec/I KE ECDSA private key: G,R,W, E - IPSec/I KE ECDSA public key: G,R,W, E - IPSec/I",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KE RSA private key: G,R,W, E - IPSec/I KE RSA public key: G,R,W, E - IPSec/I KE pre- shared secret: G,R,W, E - IPSec/I KE encrypti on key: G,R,W, E - IPSec/I KE integrity key: G,R,W,",
"secFunImpl": ""
},
{
"description": "Zeroize all SSPs",
"indicator": "N/A",
"inputs": "Command to zeroize the module",
"name": "Perform Zeroization",
"outputs": "Status of the SSPs zeroization",
"rolesSspAccess": "E Crypto Officer - DRBG entropy input: Z - DRBG seed: Z - DRBG internal state V value: Z - DRBG key: Z - Crypto Officer passwo",
"secFunImpl": "None"
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "rd: Z - User passwo rd: Z - Firmwar e load test key: Z - SSH ECDH private key: Z - SSH ECDH public key: Z - SSH peer ECDH public key: Z - SSH ECDH shared secret: Z - SSH DH private key: Z - SSH DH public key: Z - SSH peer DH public key: Z - SSH DH shared secret: Z - SSH RSA private key: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH RSA public key: Z - SSH encrypti on key: Z - SSH integrity key: Z - TLS ECDH private key: Z - TLS ECDH public key: Z - TLS peer ECDH public key: Z - TLS ECDH shared secret: Z - TLS DH private key: Z - TLS DH public key: Z - TLS peer DH public key: Z - TLS DH shared secret: Z - TLS ECDSA",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: Z - TLS ECDSA public key: Z - TLS RSA private key: Z - TLS RSA public key: Z - TLS master secret: Z - TLS encrypti on key: Z - TLS integrity key: Z - IPSec/I KE ECDH private key: Z - IPSec/I KE ECDH public key: Z - IPSec/I KE peer ECDH public key: Z - IPSec/I KE ECDH shared secret:",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Z - IPsec/I KE DH private key: Z - IPSec/I KE DH public key: Z - IPSec/I KE peer DH public key: Z - IPSec/I KE DH shared secret: Z - IPSec/I KE ECDSA private key: Z - IPSec/I KE ECDSA public key: Z - IPSec/I KE RSA private key: Z - IPSec/I KE RSA public key: Z - IPSec/I KE pre- shared",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "secret: Z - IPSec/I KE encrypti on key: Z - IPSec/I KE integrity key: Z",
"secFunImpl": ""
},
{
"description": "Run SSHv2 function",
"indicator": "Log shows approve d algorith ms currentl y utilized in SSHv2 service",
"inputs": "Initiate SSHv2 session establishm ent request",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 session establishment",
"rolesSspAccess": "Crypto Officer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - SSH ECDH private key: G,R,W, E - SSH ECDH public key: G,R,W, E - SSH peer ECDH",
"secFunImpl": "KAS-ECC- KeyGen (SSHv2) KAS-FFC- KeyGen (SSHv2) KAS-ECC (SSHv2) KAS-FFC (SSHv2) SSH RSA KeyGen SSH RSA SigGen SSH RSA SigVer SSH-KTS (AES- GCM) SSH-KTS (AES and HMAC) Block ciphers (SSHv2) DRBG Function"
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: G,R,W, E - SSH ECDH shared secret: G,R,W, E - SSH DH private key: G,R,W, E - SSH DH public key: G,R,W, E - SSH peer DH public key: G,R,W, E - SSH DH shared secret: G,R,W, E - SSH RSA private key: G,R,W, E - SSH RSA public key: G,R,W, E - SSH encrypti",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "on key: G,R,W, E - SSH integrity key: G,R,W, E User - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - SSH ECDH private key: G,R,W, E - SSH ECDH public key: G,R,W, E - SSH peer ECDH public key: G,R,W, E - SSH ECDH",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "shared secret: G,R,W, E - SSH DH private key: G,R,W, E - SSH DH public key: G,R,W, E - SSH peer DH public key: G,R,W, E - SSH DH shared secret: G,R,W, E - SSH RSA private key: G,R,W, E - SSH RSA public key: G,R,W, E - SSH encrypti on key: G,R,W, E - SSH integrity key:",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W, E",
"secFunImpl": ""
},
{
"description": "Run TLS (v1.2/v1.3) function",
"indicator": "Log shows approve d algorith ms currentl y utilized in TLS (v1.2/v1 .3) service",
"inputs": "Initiate TLS (v1.2/v1.3) session establishm ent request",
"name": "Run TLS (v1.2/v1.3) Function",
"outputs": "Status of TLS (v1.2/v1.3) session establishment",
"rolesSspAccess": "Crypto Officer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - TLS ECDH private key: G,R,W, E - TLS ECDH public key: G,R,W, E - TLS peer ECDH public key: G,R,W, E - TLS ECDH shared secret: G,R,W, E - TLS",
"secFunImpl": "KAS-FFC- KeyGen (TLSv1.2/v 1.3) KAS-ECC (TLSv1.2/v 1.3) KAS-FFC (TLSv1.2/v 1.3) TLS ECDSA KeyGen TLS ECDSA SigGen TLS ECDSA SigVer TLS RSA KeyGen TLS RSA SigGen TLS RSA SigVer TLS-KTS (AES- GCM) TLS-KTS (AES and HMAC) Block ciphers (TLSv1.2/v 1.3) DRBG Function"
},
{
"description": "Descriptio",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "DH private key: G,R,W, E - TLS DH public key: G,R,W, E - TLS peer DH public key: G,R,W, E - TLS DH shared secret: G,R,W, E - TLS ECDSA private key: G,R,W, E - TLS ECDSA public key: G,R,W, E - TLS RSA private key: G,R,W, E - TLS RSA public key: G,R,W, E - TLS",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "master secret: G,R,W, E - TLS encrypti on key: G,R,W, E - TLS integrity key: G,R,W, E User - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - TLS ECDH private key: G,R,W, E - TLS ECDH public key: G,R,W, E - TLS peer ECDH",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: G,R,W, E - TLS ECDH shared secret: G,R,W, E - TLS DH private key: G,R,W, E - TLS DH public key: G,R,W, E - TLS peer DH public key: G,R,W, E - TLS DH shared secret: G,R,W, E - TLS ECDSA private key: G,R,W, E - TLS ECDSA public key: G,R,W, E - TLS RSA",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: G,R,W, E - TLS RSA public key: G,R,W, E - TLS master secret: G,R,W, E - TLS encrypti on key: G,R,W, E - TLS integrity key: G,R,W,",
"secFunImpl": ""
},
{
"description": "Run IPsec/IKE (v1/v2) function",
"indicator": "Log shows approve d algorith ms currentl y utilized in IPsec/IK E (v1/v2) service",
"inputs": "Initiate IPsec/IKE (v1/v2) session establishm ent request",
"name": "Run IPsec/IKE (v1/v2) Function",
"outputs": "Status of IPSec/IKE (v1/v2) session establishment",
"rolesSspAccess": "E Crypto Officer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - IPSec/I KE",
"secFunImpl": "KAS-ECC- KeyGen (IKEv1/v2) KAS-FFC- KeyGen (IKEv1/v2) KAS-ECC (IKEv1/v2) KAS-FFC (IKEv1/v2) IKEv1/v2 ECDSA KeyGen IKEv1/v2 ECDSA SigGen IKEv1/v2 ECDSA SigVer IKEv1/v2 RSA KeyGen IKEv1/v2 RSA"
},
{
"description": "Descriptio",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "n",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDH private key: G,R,W, E - IPSec/I KE peer ECDH public key: G,R,W, E - IPSec/I KE ECDH shared secret: G,R,W, E - IPsec/I KE DH private key: G,R,W, E - IPSec/I KE DH public key: G,R,W, E - IPSec/I KE peer DH public key: G,R,W, E - IPSec/I KE DH shared secret: G,R,W,",
"secFunImpl": "SigGen IKEv1/v2 RSA SigVer Block ciphers (IKEv1/v2) DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - IPSec/I KE ECDSA private key: G,R,W, E - IPSec/I KE ECDSA public key: G,R,W, E - IPSec/I KE RSA private key: G,R,W, E - IPSec/I KE RSA public key: G,R,W, E - IPSec/I KE pre- shared secret: G,R,W, E - IPSec/I KE encrypti on key: G,R,W, E - IPSec/I KE integrity",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "key: G,R,W, E User - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W, E - IPSec/I KE ECDH private key: G,R,W, E - IPSec/I KE peer ECDH public key: G,R,W, E - IPSec/I KE ECDH shared secret: G,R,W, E - IPsec/I",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KE DH private key: G,R,W, E - IPSec/I KE DH public key: G,R,W, E - IPSec/I KE peer DH public key: G,R,W, E - IPSec/I KE DH shared secret: G,R,W, E - IPSec/I KE ECDSA private key: G,R,W, E - IPSec/I KE ECDSA public key: G,R,W, E - IPSec/I KE RSA private key: G,R,W,",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - IPSec/I KE RSA public key: G,R,W, E - IPSec/I KE pre- shared secret: G,R,W, E - IPSec/I KE encrypti on key: G,R,W, E - IPSec/I KE integrity key: G,R,W, E VPN Peer - DRBG entropy input: G,R,W, E - DRBG seed: G,R,W, E - DRBG internal state V value: G,R,W, E - DRBG key: G,R,W,",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - IPSec/I KE ECDH private key: G,R,W, E - IPSec/I KE peer ECDH public key: G,R,W, E - IPSec/I KE ECDH shared secret: G,R,W, E - IPsec/I KE DH private key: G,R,W, E - IPSec/I KE DH public key: G,R,W, E - IPSec/I KE peer DH public key: G,R,W, E - IPSec/I",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "KE DH shared secret: G,R,W, E - IPSec/I KE ECDSA private key: G,R,W, E - IPSec/I KE ECDSA public key: G,R,W, E - IPSec/I KE RSA private key: G,R,W, E - IPSec/I KE RSA public key: G,R,W, E - IPSec/I KE pre- shared secret: G,R,W, E - IPSec/I KE encrypti on key: G,R,W, E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPSec/I KE integrity key: G,R,W, E",
"secFunImpl": ""
},
{
"description": "Execute Bypass capability",
"indicator": "N/A",
"inputs": "Command to execute Bypass capability",
"name": "Run Bypass Function",
"outputs": "Status of Bypass capability",
"rolesSspAccess": "Crypto Officer User",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The minimum length is eight (8) characters (94 possible",
"mechanism": "Password Based",
"name": "Password- based authentication",
"perMinute": "The probability of successfully authenticating to the",
"strength": "The probability that a random"
},
{
"description": "characters). The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000. As the module supports at most ten failed attempts to authenticate in a one- minute period, the probability of successfully authenticating to the module within one minute is 10/(94^8), which is less than 1/100,000. This calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 Integer digits, 52 alphabetic characters, and 32 special characters providing 94 characters to choose from in total.",
"mechanism": "",
"name": "",
"perMinute": "module within one minute is 10/(94^8). Please refer to Description section in this table for more details",
"strength": "attempt will succeed or a false acceptance will occur is 1/(94^8). Please refer to Description section in this table for more details"
},
{
"description": "The modules supports RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at",
"mechanism": "RSA SigVer (FIPS186-5) (A4397)",
"name": "RSA-based authentication",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details"
},
{
"description": "most 17,000 new sessions per second to authenticate in a one-minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than 1/100,000.",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "The modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one-minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "ECDSA SigVer (FIPS186-5) (A4397)",
"name": "ECDSA- based authentication",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. Please refer to Description section in this table for more details"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4397)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4397)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4397",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4397)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate KAT (A4397)",
"condition": "Power up",
"details": "CTR_DRBG Instantiate",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Generate KAT (A4397)",
"condition": "Power up",
"details": "CTR_DRBG Generate",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Reseed KAT (A4397)",
"condition": "Power up",
"details": "CTR_DRBG Reseed",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 KAT (A4397)",
"condition": "Power up",
"details": "KAS-ECC- SSC Primitive Z",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 KAT (A4397)",
"condition": "Power up",
"details": "KAS-FFC- SSC Primitive Z",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bits",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv1 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.3 KDF KAT (A4397)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4424)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4424)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4424)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4424)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4424)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4424)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4424)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4424)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4429)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4429)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4429)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4429)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4429)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4429)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4429)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4429)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encryption KAT (A4430)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decryption KAT (A4430)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4430)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4430)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4430)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4430)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4430)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4430)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4431)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4431)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4431)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4431)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4431)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4431)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4431)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4431)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4432)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4432)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4432)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4432)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4432)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4432)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4432)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4432)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4433)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4433)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4433)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4433)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4433)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4433)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4433)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4433)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4434)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4434)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4434)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4434)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4434)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4434)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4434)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4434)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4435)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4435)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4435)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4435)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4435)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4435)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4435)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4435)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt KAT (A4436)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt KAT (A4436)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Encrypt KAT (A4436)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Authenticated Decrypt KAT (A4436)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A4436)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 KAT (A4436)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 KAT (A4436)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 KAT (A4436)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source Start- up Health Test (RCT)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source Start- up Health Test (APT)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source Continuous Health Test (RCT)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source Continuous Health Test (APT)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 PCT (A4397)",
"condition": "New KAS ECC Keypair generation",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "P-256 with SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 PCT (A4397)",
"condition": "New KAS FFC Keypair generation",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) PCT (A4397)",
"condition": "New ECDSA Keypair generation",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "P-256 with SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) PCT (A4397)",
"condition": "New RSA Keypair generation",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bits",
"type": "PCT"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "while doing the firmware upload test",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "HMAC- SHA-1",
"type": "SW/FW Load"
},
{
"algorithmOrTest": "Conditional Bypass",
"condition": "Performs conditional bypass test before first operational use of bypass service",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypass"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Self-tests failure",
"description": "If self-test tests fail, the module enters the error state",
"indicator": "Error message is output via the Console interface",
"name": "Error State",
"recoveryMethod": "Reboot the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "90 days",
"inspectGuidance": "Tamper evidence labels should be checked for nicks and scratches that make the metal case visible through the nicked or scratched seal. Tamper Evidence Label (TEL) may show any of the following as evidence of tampering or removal: TEL is not preset in the positions prescribed (as shown above); TEL has been cut; TEL is not stuck down well, or is loose; Self-destruction of the TEL (broken bits or shreds) present as from an attempt of removal.",
"mechanism": "Tamper Evidence Labels (Part number: SKU WG8566)"
},
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "Production grade components"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module always uses Approved Algorithms for its SSH and TLS services, and operates in Approved mode when the CO configures only Approved algorithms (and not legacy algs) for the IPSec/IKE service",
"name": "Approved mode",
"statusIndicator": "Equivalent to the indicator of the requested services (Firmware update, SSH, TLS and IPSec/IKE) as defined in section 4.3, Table Approved Services",
"type": "Approved"
},
{
"description": "Automatically entered whenever CO configures legacy algorithms for IPSec/IKE (MD5, DES, and Triple- DES) for interoperability with legacy system",
"name": "Non- Approved mode",
"statusIndicator": "Equivalent to the indicator of the requested service as defined in section 4.4, Table Non-Approved Services",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "MD5",
"use": "Message digest"
},
{
"name": "DES",
"use": "Data encryption/decryption"
},
{
"name": "Triple-DES",
"use": "Data encryption/decryption"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "MD5",
"description": "Message digest in IPSec/IKE implementation in non-approved mode. Log message \"fips non-approved mode: using \"MD5\" cipher\" shows non-approved algorithm MD5 is currently utilized in IPSec/IKE implementation while in non-approved mode",
"name": "MD5",
"role": "CO"
},
{
"alg_accessed": "DES",
"description": "Data encryption/decryption in IPSec/IKE implementation in non-approved mode. Log message \"fips non-approved mode: using \"DES-CBC\" cipher\" shows non-approved algorithm DES is currently utilized in IPSec/IKE implementation while in non- approved mode",
"name": "DES",
"role": "CO"
},
{
"alg_accessed": "Triple-DES",
"description": "Data encryption/decryption in IPSec/IKE implementation in non-approved mode. Log message \"fips non-approved mode: using \"des3-ede\" cipher\" shows non-approved algorithm Triple-DES is currently utilized in IPSec/IKE implementation while in non-approved mode",
"name": "Triple- DES",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data input into the module for the services defined in Table 16 (Approved Services)",
"logicalInterface": "Data Input",
"physicalPort": "RJ-45 Ethernet Interfaces, and SFP+ Ethernet Interfaces"
},
{
"data": "Data output from the module for the services defined in Table 16 (Approved Services)",
"logicalInterface": "Data Output",
"physicalPort": "RJ-45 Ethernet Interfaces, and SFP+ Ethernet Interfaces"
},
{
"data": "Control input into the module for the services defined in Table 16 (Approved Services)",
"logicalInterface": "Control Input",
"physicalPort": "RJ-45 Ethernet Interfaces, SFP+ Ethernet Interfaces, and Reset Button"
},
{
"data": "Status information output from the module for the services defined in Table 16 (Approved Services)",
"logicalInterface": "Status Output",
"physicalPort": "RJ-45 Ethernet Interfaces, SFP+ Ethernet Interfaces, Console Interface, and LEDs"
},
{
"data": "Power supply",
"logicalInterface": "Power",
"physicalPort": "Power Interface"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password-based authentication",
"name": "Crypto Officer",
"operatorType": "Crypto Officer",
"type": "Identity"
},
{
"authMethodList": "Password-based authentication",
"name": "User",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "RSA-based authentication ECDSA-based authentication",
"name": "VPN Peer",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A4397)",
"details": "Module performs ECDSA SigVer KAT prior to firmware integrity test",
"indicator": "Status message \"Integrity check succeeded\" is output to the log",
"testMethod": "KAT",
"testProps": "P-256 with SHA2-256",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Pre- Operational Bypass Test",
"details": "Module performs pre-operational bypass test at start up",
"indicator": "Module is in normal state",
"testMethod": "N/A",
"testProps": "N/A",
"type": "Bypass"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "External (Outside the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Module public key output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Peer public key input",
"sfiAlgo": "",
"source": "External (Outside"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "",
"sfiAlgo": "",
"source": "the Module\u0027s Boundary)"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "SSPs Input/Output protected by TLS-KTS (AES-GCM)",
"sfiAlgo": "TLS-KTS (AES- GCM)",
"source": "External (Outside the Module\u0027s Boundary)"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "SSPs Input/Output protected by TLS-KTS (AES and HMAC)",
"sfiAlgo": "TLS-KTS (AES and HMAC)",
"source": "External (Outside the Module\u0027s Boundary)"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "SSPs Input/Output protected by SSH-KTS (AES-GCM)",
"sfiAlgo": "SSH-KTS (AES- GCM)",
"source": "External (Outside the Module\u0027s Boundary)"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "SSPs Input/Output protected by SSH-KTS (AES and HMAC)",
"sfiAlgo": "SSH-KTS (AES and HMAC)",
"source": "External (Outside the Module\u0027s Boundary)"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service: \"fips zeroize\" to zeroize all SSPs",
"method": "Zeroization command",
"operatorId": "CO issues zeroization command",
"rationale": "The zeroization command will erase all SSPs stored in Module\u0027s DRAM or Flash memory"
},
{
"description": "Zeroization upon session termination",
"method": "Session termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Zeroization upon rebooting the module",
"method": "Reboot",
"operatorId": "Reboot",
"rationale": "Reboot to zeroize all temporary SSPs stored in Module\u0027s DRAM"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile memory",
"name": "DRAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile memory",
"name": "Flash",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "NV5",
"modelPartNum": "NV5",
"processors": "NXP LS1012A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T20",
"modelPartNum": "T20",
"processors": "NXP LS1023A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T20-W",
"modelPartNum": "T20-W",
"processors": "NXP LS1023A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T40",
"modelPartNum": "T40",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T40-W",
"modelPartNum": "T40-W",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T25",
"modelPartNum": "T25",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T25-W",
"modelPartNum": "T25-W",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T45",
"modelPartNum": "T45",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T45-PoE",
"modelPartNum": "T45-PoE",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T45-W-PoE",
"modelPartNum": "T45-W-PoE",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T45-CW",
"modelPartNum": "T45-CW",
"processors": "NXP LS1043A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T80",
"modelPartNum": "T80",
"processors": "NXP LS1046A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "T85-PoE",
"modelPartNum": "T85-PoE",
"processors": "NXP LS1046A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "M290",
"modelPartNum": "M290",
"processors": "NXP LS1046A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "M390",
"modelPartNum": "M390",
"processors": "NXP LS2084A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "M590",
"modelPartNum": "M590",
"processors": "NXP LX2120A"
},
{
"features": "N/A",
"fwVersion": "12.11",
"hwVersion": "M690",
"modelPartNum": "M690",
"processors": "NXP LX2160A"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for"
},
{
"algoPropList": "",
"implName": "",
"name": "",
"reference": "asymmetric keys as per sections 4 and 5 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG (A4397)"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 5
},
"ECDH": {
"ECDH": 100
},
"ECDSA": {
"ECDSA": 93
}
},
"FF": {
"DH": {
"DH": 111,
"DHE": 1,
"Diffie-Hellman": 6
}
},
"RSA": {
"RSA 2048": 1
}
},
"certification_process": {
"OutOfScope": {
"of the TELs as depicted below and any additional requirement per the site security policy which are out of scope of this Security Policy": 1,
"out of scope": 1
}
},
"cipher_mode": {
"CTR": {
"CTR": 1
},
"GCM": {
"GCM": 10
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 3,
"IKEv1": 5,
"IKEv2": 7
},
"IPsec": {
"IPsec": 1
},
"SSH": {
"SSH": 157,
"SSHv2": 51
},
"TLS": {
"TLS": {
"TLS": 196,
"TLS 1.3": 2,
"TLS v1.2": 6,
"TLS v1.3": 6,
"TLSv1.2": 3,
"TLSv1.3": 1
}
},
"VPN": {
"VPN": 18
}
},
"crypto_scheme": {
"MAC": {
"MAC": 5
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"Curve P-256": 2,
"P-256": 58,
"P-384": 42,
"P-521": 10
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1,
"#5": 1
}
},
"fips_certlike": {
"Certlike": {
"AES 24": 1,
"AES-128": 4,
"AES-192": 1,
"AES-256": 3,
"AES256": 1,
"DRBG 384": 1,
"HMAC- SHA-1": 1,
"HMAC-SHA-1": 62,
"RSA 2048": 1,
"SHA-1": 24,
"SHA2- 512": 3,
"SHA2-256": 36,
"SHA2-384": 26,
"SHA2-512": 22,
"SHA3-256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 4
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 9
}
},
"SHA": {
"SHA1": {
"SHA-1": 24
},
"SHA3": {
"SHA3-256": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 102
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 13,
"FIPS 180-4": 40,
"FIPS 186-5": 7,
"FIPS 198-1": 40,
"FIPS186-5": 38
},
"ISO": {
"ISO/IEC 19790": 2
},
"NIST": {
"SP 800-135": 5,
"SP 800-38A": 11,
"SP 800-38D": 10,
"SP 800-52": 1,
"SP 800-56A": 3,
"SP 800-90A": 1
},
"RFC": {
"RFC 3526": 2,
"RFC 4419": 2,
"RFC 5288": 1,
"RFC 7296": 1,
"RFC 7919": 2,
"RFC7627": 3,
"RFC8446": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 30,
"AES-": 6,
"AES-128": 4,
"AES-192": 1,
"AES-256": 3,
"AES256": 1
},
"CAST": {
"CAST": 196
}
},
"DES": {
"3DES": {
"Triple-DES": 6
},
"DES": {
"DES": 10
}
},
"constructions": {
"MAC": {
"HMAC": 28
}
}
},
"tee_name": {
"AMD": {
"PSP": 17
},
"IBM": {
"SSC": 7
}
},
"tls_cipher_suite": {},
"vendor": {
"NXP": {
"NXP": 26
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"Counter DRBGA4397",
"SHA2-512A4436",
"AES-CBCA4436",
"KDF IKEv1A4397",
"TLS v1.3 KDFA4397",
"SHA2-384A4436",
"TLS v1.2 KDF RFC7627A4397",
"ECDSA SigVer (FIPS186-5)A4397",
"KAS-ECC-SSC Sp800-56Ar3A4397",
"HMAC-SHA-1A4436",
"RSA KeyGen (FIPS186-5)A4397",
"AES-GCMA4436",
"SHA-1A4436",
"SHA2-256A4436",
"Safe Primes Key GenerationA4397",
"HMAC-SHA2-512A4436",
"KDF SSHA4397",
"RSA SigGen (FIPS186-5)A4397",
"ECDSA KeyGen (FIPS186-5)A4397",
"RSA SigVer (FIPS186-5)A4397",
"ECDSA SigGen (FIPS186-5)A4397",
"HMAC-SHA2-256A4436",
"KDF IKEv2A4397",
"HMAC-SHA2-384A4436",
"KAS-FFC-SSC Sp800-56Ar3A4397",
"AES-CTRA4397"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4436",
"#A4431",
"#A4424",
"#A4430",
"#A4429",
"#A4435",
"#A4432",
"#A4397",
"#A4434",
"#A4433"
]
},
"policy_metadata": {
"/Author": "Hawes, David J. (Fed)",
"/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos",
"/ClassificationContentMarkingHeaderShapeIds": "7125f93d,7adbb736,583254e6",
"/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20260601120027-04\u002700\u0027",
"/Creator": "Acrobat PDFMaker 26 for Word",
"/Keywords": "",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "251f2f7a-9aea-472d-b4f6-7f2ded4ee0fe",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-06-01T15:23:33Z",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1",
"/ModDate": "D:20260601120631-04\u002700\u0027",
"/Producer": "Adobe PDF Library 26.1.59",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 3008833,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 109
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "76ed7cde24688a960f859e4081df7643fa5d4cbf777049bf987893ef72c72976",
"source_hash": "1bab187f2227f298387546a7f228c6368f497927d073900a6c40c247eca9e4ec",
"txt_hash": "71985997741b49af23d918fad7ec9a89b02c973ee7c3bb27d116ddb06ce95bfd"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. When installed, initialized and configured as specified in Section Secure Operation in Section 11 of the Security Policy. The tamper evident seals installed as indicated in the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
"date_sunset": "2031-06-02",
"description": "WatchGuard\u00ae Firebox appliances are built for enterprise-grade performance with blazing throughput and numerous connectivity options. Advanced networking features include clustering, high availability (active/active), VLAN support, multi-WAN load balancing and enhanced VoIP security, plus inbound and outbound HTTPS inspection, to give the strong security enterprises need. And the Firebox appliances are completely configurable - turn on or off components and services to fit different network security deployment requirements.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "WatchGuard Firebox T20, T20-W, T40, T40-W, T80, NV5, T25, T25-W, T45, T45-PoE, T45-W-PoE, T45-CW, T85-PoE, M290, M390, M590 and M690",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-03",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "WatchGuard Technologies, Inc.",
"vendor_url": "http://www.watchguard.com"
}
}