This page was not yet optimized for use on mobile devices.
Trellix Intrusion Prevention System Sensor NS3600
Certificate details
| Certificate ID | #5378 |
|---|---|
| Status | active |
| Validation dates | 08.07.2026 |
| Sunset date | 07-07-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The NS3600 is an Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) designed for network protection against zero-day, DoS/DDoS, encrypted and SYN Flood attacks, and real-time prevention of threats like spyware, malware, VoIP vulnerabilities, phishing, botnets, network worms, Trojans, and peer-to-peer applications. The Trellix Intrusion Prevention system Sensors (Trellix IPS sensor) connect with the Trellix Intrusion Prevention System Manager Appliances (Trellix IPS Manager-may be referred to as Manager in this document). The Trellix IPS Manager is used to manage and push configuration data and policies to the Sensors. Communication between Manager and Sensors uses secure channels that protect the traffic from disclosure and modification. Authorized administrators may access the Trellix IPS Manager via a GUI (over HTTPS) or a CLI (via SSH or a serial console connection). Sensors may be accessed via CLI (via SSH or a serial console connection) for initial setup. Once initial setup is complete, all management occurs via the Manager. |
| Vendor | Trellix http://www.trellix.com |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES, AES-, CAST, RC4, DES, Triple-DES, HMAC, HMAC-SHA-256, HMAC-SHA-512Asymmetric Algorithms
RSA 2048, ECDH, ECDSAHash functions
SHA-1, SHA1, SHA-384, SHA-256, SHA2, SHA3-256, SHA3-512, MD5Schemes
MAC, Key AgreementProtocols
SSH, SSHv2, TLS v1.2, TLS 1.2, TLSRandomness
DRBG, RNG, RBGLibraries
OpenSSLElliptic Curves
P-256, P-384, P-521Block cipher modes
ECB, CTR, CFB, GCMTrusted Execution Environments
PSP, SSCSecurity level
Level 1, Level 2Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS 202, FIPS1, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, NIST SP 800-90B, PKCS1, PKCS 1, PKCS#1, RFC7627, RFC5288, RFC5647, RFC7, ISO/IEC 19790:2012Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5378,
"dgst": "966243b9a39f6dde",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"KDF SSHA3351",
"RSA SigGen (FIPS186-5)A3350",
"SHA3-256A3303",
"RSA KeyGen (FIPS186-5)A3350",
"ECDSA SigVer (FIPS186-5)A3350",
"SHA2-384A3350",
"HMAC-SHA2-512A3350",
"ECDSA KeyVer (FIPS186-5)A3350",
"TLS v1.2 KDF RFC7627A3352",
"AES-ECBA3350",
"HMAC-SHA2-256A3350",
"#A3303",
"KAS-ECC-SSC Sp800-56Ar3A3350",
"ECDSA SigGen (FIPS186-5)A3350",
"AES-CFB128A3350",
"ECDSA KeyGen (FIPS186-5)A3350",
"SHA2-512A3350",
"AES-GCMA3350",
"#A3353",
"RSA SigVer (FIPS186-5)A3353",
"#A3351",
"#A3352",
"Counter DRBGA3350",
"#A3350",
"SHA-1A3350",
"SHA2-256A3353"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CFB128",
"cavpCertName": "A3350",
"properties": "Direction - Decrypt, Encrypt Key Length - 128",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3350",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3350",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3350",
"properties": "Prediction Resistance - Yes Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - extra bits",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Curve - P-256 Hash Algorithm - SHA2-256 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Curve - P-256 Hash Algorithm - SHA2-256",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3350",
"properties": "Key Length - Key Length: 8-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A3350",
"properties": "Key Length - Key Length: 8-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A3350",
"properties": "Domain Parameter Generation Methods - P- 224, P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A3351",
"properties": "Cipher - AES-128, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2- 512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Key Generation Mode - probableWithProbableAux Modulo - 2048 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Modulo - 2048 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A3350",
"properties": "Modulo - 2048 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A3353",
"properties": "Modulo - 2048 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3350",
"properties": "Message Length - Message Length: 0- 51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3350",
"properties": "Message Length - Message Length: 0- 51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3353",
"properties": "Message Length - Message Length: 0- 51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3350",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3350",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A3303",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A3352",
"properties": "Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provides the status of the module, usage statistics, log data, and alerts, Hardware and Firmware versions and Module Identifier (show command)",
"indicator": "Approve d Mode Indicator combine d with Sensor and Sensor network configura tion informati on printed on CLI",
"inputs": "show; status; show mgmtport; show mgmtcfg; show intfport \u003cport\u003e; show ssh config",
"name": "Show Status/Show version",
"outputs": "Status outputs or status of invoked service, hardwar e, firmwar e versions and module identifier (show comma nd), network configur ation informat ion (show comma nd), Approve d mode status (status comma nd)",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2 Passw ord Hash SSH all algorit hms TLS all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Server): E Sensor Operator(s) - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic Officer) - TLS Session private Keys (for Manager): E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Session Public Key : E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E",
"secFunImpl": ""
},
{
"description": "Allows Admin to add/delete Sensor Operators, set their service authorization level, set their session timeout limit, and unlock them if needed",
"indicator": "Approve d Mode Indicator combine d with \u0027User \u003cuserna me\u003e is created successf ully\u0027 gets printed after successf ul creation of the user post which the operator is prompted to assign a passwor d to the",
"inputs": "The \u0027userlist\u0027 command displays the existing users and their access rights, \u0027adduser \u003cuser- name\u003e\u0027 command is used to create new user, \u0027userrole \u003cuser- name\u003e \u003crole\u003e\u0027 command is used to update an exisiting user; The \u0027deleteuser \u003cuser- name\u003e\u0027 command is",
"name": "Sensor Operator Management",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Host Public Key (Sensor as Server): E",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2 Passw ord Hash SSH all algorit hms TLS all algorit hms"
},
{
"description": "",
"indicator": "created user",
"inputs": "used to delete a user and userpasswd \u003cusername\u003e command is to assign password for created user",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic Officer) - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Session private Keys (for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: E - TLS Session Public Key : E",
"secFunImpl": ""
},
{
"description": "Establish network settings for the module or set them back to default values",
"indicator": "Approve d Mode Indicator combine d with status of all ports and manage ment configura tion",
"inputs": "show mgmtport; show mgmtcfg; set sensor ip x.x.x.x(modu le ip) y.y.y.y (module subnet mask); set sensor gateway x.x.x.x; set",
"name": "Network Configuratio n",
"outputs": "Same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2 Passw ord Hash SSH all algorit hms TLS all"
},
{
"description": "",
"indicator": "displayed on CLI",
"inputs": "scpserver ip x.x.x.x",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s) - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as",
"secFunImpl": "algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic Officer) - TLS Session private Keys (for Manager): E - TLS Session Public Key : E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E",
"secFunImpl": ""
},
{
"description": "Other various services provided for admin, private, and support levels",
"indicator": "Approve d Mode Indicator combine d with status of all ports and",
"inputs": "show mgmtport; show mgmtcfg; set sensor ip x.x.x.x(modu le ip) y.y.y.y (module",
"name": "Administrativ e Configuratio n",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Manager Initialization Secret (i.e., Manager \"Shared",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2 Passw ord Hash SSH"
},
{
"description": "",
"indicator": "manage ment configura tion displayed on CLI",
"inputs": "subnet mask); set sensor gateway x.x.x.x; set scpserver ip x.x.x.x, set manager ip x.x.x.x",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret\"): W - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - Administrator Passwords: E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s) - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Session private Keys",
"secFunImpl": "all algorit hms TLS all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic Officer) - TLS Session private Keys (for Manager): E - TLS Session Public Key : E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: E - Manager Initialization Secret (i.e.,",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Manager \"Shared Secret\"): E",
"secFunImpl": ""
},
{
"description": "Install an external firmware image through SCP or USB",
"indicator": "Approve d Mode Indicator combine d with CLI displayin g the string \u0027Applying the image... Image applied successf ully, please reboot the sensor\u0027",
"inputs": "loadimage scp \"complete firmware path\"",
"name": "Firmware Update",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): W,E - Trellix FW Verification key: W,E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Client): E - SSH Session Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Client): E - SSH Client Private Keys (id_ecdsa) (Sensor as SSH Client) : E - SSH Client Public Key (Sensor as Client): E - SSH Host",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2 Passw ord Hash SSH all algorit hms TLS all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - Administrator Passwords: E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): W,E - Trellix FW Verification key: W,E - SSH Session private Keys (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Client): E - SSH Session",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Client): E - SSH Client Private Keys (id_ecdsa) (Sensor as SSH Client) : E - SSH Client Public Key (Sensor as Client): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Officer) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): W,E - TLS Session private Keys (for Manager): E - Trellix FW Verification key: W,E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: W,E - TLS Session Public Key : E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E",
"secFunImpl": ""
},
{
"description": "Configures module for use; This step includes establishing trust between the module and",
"indicator": "Approve d Mode Indicator combine d with, the trust establish ed",
"inputs": "Set sensor sharedsecret key",
"name": "Install with Manager",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Proprietary File Transfer Channel Session Key (Secret and IV",
"secFunImpl": "KTS-1 KAS-1 Passw ord Hash Entrop y Sourc"
},
{
"description": "the associated management station",
"indicator": "between sensor and manager indicated via the following status \u0027Trust Establish ed : yes (Self Signed cert support)\u0027 after entering the Manager Initializati on secret and checking status via \u0027status\u0027 comman d",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "are encrypted by Manager using the Sensor public key): W,E - TLS Sensor Private Key (alert/sysEvent channel for Manager): G,E - TLS Session private Keys (for Manager): G,E - TLS Session Public Key : G,E - Entropy Input String: G,E - Seed for RNG: G,E - DRBG Internal State - Key: G,E - TLS Sensor Public Key (for Manager): G,E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E",
"secFunImpl": "e TLS all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH Session Public Key (Sensor as Server): E - Administrator Passwords: E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): W,E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E - DRBG Internal State - V: G,E Sensor Operator(s) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): W,E - TLS Sensor Private Key (alert/sysEvent channel for Manager): G,E - TLS Session private Keys (for Manager): G,E - Entropy Input String: G,E - Seed for",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "RNG: G,E - DRBG Internal State - V: G,E - TLS Sensor Public Key (for Manager): G,E - TLS Session Public Key : G,E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E - SSH Remote",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Client Public Key Authentication Key (Sensor as Server): E - DRBG Internal State - Key: G,E",
"secFunImpl": ""
},
{
"description": "Configures module for 3rd Party SNMPv3 use; This step includes establishing trust between the module and the associated 3rd Party SNMP Client; Trust is provided by Manager",
"indicator": "Approve d Mode Indicator combine d with the user list indicated on the CLI \u0027NMS User 1 = \u003cuser created\u003e\u0027 after running the comman d \u0027show mgmtcfg\u0027",
"inputs": "The 3rd party SNMP users are created using the IPS Manager web application interface by entering the username, entering (and confirming) the initialization key and the private key",
"name": "Install with 3rd Party SNMP Client",
"outputs": "same as indicator",
"rolesSspAccess": "Trellix IPS Manager (Cryptographic Officer) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): W - TLS Session Public Key : E - 3rd Party SNMP Client Privacy and Authentication Keys: W,E - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Session private Keys (for Manager): E - TLS Sensor",
"secFunImpl": "KTS-1 KAS-1 Passw ord Hash TLS all algorit hms SNMP v3"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key (for Manager): E - TLS Manager Public Key: E",
"secFunImpl": ""
},
{
"description": "Allows Admin and Sensor Operators to change their associated passwords; Admin can also change/reset Sensor Operators passwords",
"indicator": "Approve d Mode Indicator combine d with operator asked to enter the new passwor d twice, and successf ul executio n of which would print \u0027Passwor d successf ully changed\u0027 on console",
"inputs": "userpasswd if Admin is updating the password for a particular operator, passwd if a Sensor User (maintainer) is doing it",
"name": "Change Passwords",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: W - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): W - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s)",
"secFunImpl": "KTS-2 KAS-2 Passw ord Hash SSH all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Sensor User Passwords (Users created by Admin using \"adduser\" CLI): W - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E",
"secFunImpl": ""
},
{
"description": "Performs zeroisation; destroys all plaintext secrets contained within the module; The \"resetconfig\" command is used,",
"indicator": "Approve d Mode Indicator combine d with, Manager communi cation channels : Alert channel,",
"inputs": "resetconfig",
"name": "Perform zeroisation",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: Z - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): Z",
"secFunImpl": "KTS-2 KAS-2 Passw ord Hash SSH all algorit hms"
},
{
"description": "followed by a reboot",
"indicator": "log channel and authentic ation channel go down after running the resetconf ig (zeroizati on) comman d; Also, the trust establish ment between sensor and IPS Manager breaks after resetconf ig comman d",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Manager Initialization Secret (i.e., Manager \"Shared Secret\"): Z - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): Z - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): Z - SSH Session private Keys (Sensor as SSH Server): Z - SSH Session private Keys (Sensor as SSH Client): Z - TLS Sensor Private Key (alert/sysEvent channel for Manager): Z - TLS Session private Keys (for Manager): Z - Seed for RNG: Z - DRBG Internal State - V: Z - Entropy Input",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "String: Z - SSH Remote Client Public Key (Sensor as Server): Z - SSH Session Public Key (Sensor as Server): Z - SSH Session Public Key (Sensor as Client): Z - TLS Sensor Public Key (for Manager): Z - TLS Manager Public Key: Z - TLS Session Public Key : Z - 3rd Party SNMP Client Privacy and Authentication Keys: Z - Manager SNMP Client Privacy and Authentication Keys: Z - SSH Remote Client Public Key Authentication Key (Sensor as Server): E,Z - DRBG Internal State - Key: Z Sensor Operator(s) - Administrator Passwords: Z - Sensor User Passwords",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(Users created by Admin using \"adduser\" CLI): Z - Manager Initialization Secret (i.e., Manager \"Shared Secret\"): Z - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): Z - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): Z - SSH Session private Keys (Sensor as SSH Server): Z - SSH Session private Keys (Sensor as SSH Client): Z - TLS Sensor Private Key (alert/sysEvent channel for Manager): Z - TLS Session private Keys (for Manager): Z - Seed for RNG: Z",
"secFunImpl": ""
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Output s",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Secur ity Functi"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Internal State - V: Z - Entropy Input String: Z - SSH Remote Client Public Key (Sensor as Server): Z - SSH Session Public Key (Sensor as Server): Z - SSH Session Public Key (Sensor as Client): Z - TLS Sensor Public Key (for Manager): Z - TLS Manager Public Key: Z - TLS Session Public Key : Z - 3rd Party SNMP Client Privacy and Authentication Keys: Z - Manager SNMP Client Privacy and Authentication Keys: Z - SSH Remote Client Public Key Authentication Key (Sensor as Server): E,Z - DRBG Internal State - Key: Z",
"secFunImpl": "ons"
},
{
"description": "Management of intrusion",
"indicator": "Approve d Mode",
"inputs": "Can be managed/mo",
"name": "Intrusion Detection/Pr",
"outputs": "same as indicator",
"rolesSspAccess": "Trellix IPS Manager",
"secFunImpl": "KTS-1 KAS-1"
},
{
"description": "detection/pre vention policies and configuration s through SNMPv3 and TLS",
"indicator": "Indicator combine d with display of operation al status of the port including any packet errors; displays the log output",
"inputs": "nitored via the Manager\u0027s dashboard",
"name": "evention Management",
"outputs": "",
"rolesSspAccess": "(Cryptographic Officer) - Proprietary File Transfer Channel Session Key (Secret and IV are encrypted by Manager using the Sensor public key): E - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Session private Keys (for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Session Public Key : E - TLS Manager Public Key: E - Manager SNMP Client Privacy and Authentication Keys: E 3rd Party SNMP Client(s) - 3rd Party SNMP Client Privacy and Authentication Keys: E",
"secFunImpl": "TLS all algorit hms SNMP v3"
},
{
"description": "Limited monitoring of Intrusion Detection/Pr",
"indicator": "Approve d Mode Indicator combine",
"inputs": "show intfport \u003cport range\u003e; show",
"name": "Intrusion Detection/Pr evention Monitoring",
"outputs": "same as indicator",
"rolesSspAccess": "Trellix IPS Manager (Cryptographic Officer)",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "evention configuration , status, and statistics through SNMPv3, TLS 1.2 and via show commands using the console/SSH connections",
"indicator": "d with display of operation al status of the port including any packet errors; displays the log output",
"inputs": "malware statistics, etc.",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Session private Keys (for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: E - TLS Session Public Key : E - Manager SNMP Client Privacy and Authentication Keys: E 3rd Party SNMP Client(s) - 3rd Party SNMP Client Privacy and Authentication Keys: E Sensor Operator(s) - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys",
"secFunImpl": "Passw ord Hash SSH all algorit hms TLS all algorit hms SNMP v3"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(Sensor as SSH Server): E - SSH Session Public Key (Sensor as Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E",
"secFunImpl": ""
},
{
"description": "Enables/disa bles SSH/Consol e Access via the CLI",
"indicator": "Approve d Mode Indicator combine d with the display of \u0027sshd disabled\u0027 after running the sshd disable comman d",
"inputs": "sshd(enable| disable)",
"name": "Enable/disab le SSH/Consol e Access",
"outputs": "same as indicator",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s) - Sensor User Passwords",
"secFunImpl": "KTS-2 KAS-2 Passw ord Hash SSH all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(Users created by Admin using \"adduser\" CLI): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Host Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E",
"secFunImpl": ""
},
{
"description": "On demand execution of self-tests via rebooting the module",
"indicator": "Approve d Mode Indicator",
"inputs": "Power-cycle",
"name": "Perform Self- tests",
"outputs": "The module reboots and prints the success ful completi on of each self-test in the",
"rolesSspAccess": "Admin (Cryptographic Officer) - Administrator Passwords: E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys",
"secFunImpl": "KTS-2 KAS-2 RSA SigVer 1 Passw ord Hash SSH all algorit hms"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "boot logs else returns the error indicator s as follows: Console displays \u0027!!! CRITIC AL FAILUR E !!! FIPS 140-3 POST and KAT...F ailed REBOO TING IN 15 SECON DS\u0027 in case of a self- test failure (pre- operatio nal firmwar e integrity test and/or CAST)",
"rolesSspAccess": "(Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Sensor Operator(s) - Sensor User Passwords (Users created by Admin using \"adduser\" CLI): E - SSH Host Private Keys (ssh_host_EC DSA_key) (Sensor as SSH Server): E - SSH Session private Keys (Sensor as SSH Server): E - SSH Host Public Key (Sensor as Server): E - SSH Remote Client Public Key (Sensor as",
"secFunImpl": "Self- Tests"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Server): E - SSH Session Public Key (Sensor as Server): E - SSH Remote Client Public Key Authentication Key (Sensor as Server): E Trellix IPS Manager (Cryptographic Officer) - TLS Sensor Private Key (alert/sysEvent channel for Manager): E - TLS Session private Keys (for Manager): E - TLS Sensor Public Key (for Manager): E - TLS Manager Public Key: W,E - TLS Session Public Key : E Unauthenticate d",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "Assuming a password of exactly 15 characters for simplicity, the minimum required characters would take up 8 positions (2 of each type), leaving 7 positions to fill with any characters; Choosing positions for 2 uppercase, 2 lowercase, 2 numeric, and 2 special characters: Total ways to choose positions for 2 uppercase from 15: binomial(15 2)=105; Total ways to choose positions for 2 lowercase from the remaining 13: binomial(13 2)=78; Total ways to choose positions for 2",
"mechanism": "SHA2-512 (A3350)",
"name": "Username and Password",
"perMinute": "After three (3) consecutive failed authentication attempts, the session goes inactive and the operator must retry, this is enforced by the module; Additionally, the module only supports 5 concurrent SSH sessions; Thus, the probability of success in a one- minute period is: 60*4.77x10^-15 = 2.862 x 10^-13, which is less than 1/100,000",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/[(105) x (78) x (55) x (36) x (93^7)] = ~ 9.54\u00d710^16, given 5 consecutive attempts are possible, it is = 5*(9.54\u00d710^16)= 4.77\u00d710^ 15 which is less than 1/1,000,000"
},
{
"description": "numeric from the remaining 11: binomial(11 2)=55; Total ways to choose positions for 2 special characters from the remaining 9: binomial(9 2)=36; The remaining 7 positions can be filled with any of the 93 characters (93^7)",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "RSA 2048-bit keys using SHA2- 256 are used for the signing (in isolated Trellix laboratory) and verification (by sensor) of digital signatures",
"mechanism": "RSA SigVer (FIPS186-5) (A3353)",
"name": "Digital Signature",
"perMinute": "The module can only perform one (1) digital signature verification per second; The probability of successfully authenticating to the module within one minute through random attempts is 60/2^112 which is less than 1/100,000",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/2^112, which is less than 1/1,000,000"
},
{
"description": "The privacy key and authentication key together make an alphanumeric string of a minimum of eight (8) characters and maximum of 15 (for 3rd party SNMP key) and 16 (for Manager SNMP key) chosen from the set of sixty-two",
"mechanism": "SNMPv3",
"name": "Username, Privacy and Authentication Key",
"perMinute": "The module will allow approximately one (1) attempt per millisecond, meaning that 60,000 attempts can be made per minute; The probability of successfully authenticating to the module within one minute through random",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/62^8, which is less than 1/1,000,000"
},
{
"description": "(62) numbers, lower case letters, and upper case letters",
"mechanism": "",
"name": "",
"perMinute": "attempts is 60,000/62^8 which is less than 1/100,000",
"strength": ""
},
{
"description": "Shared secret used to authenticate a Manager to the module",
"mechanism": "Shared secret",
"name": "Manager Initialization Secret (i.e., Manager \"Shared Secret\")",
"perMinute": "The module will allow approximately one (1) attempt per millisecond, meaning that 60,000 attempts can be made per minute. Thus, the probability of a successful random attempt within one minute is 60,000/(96^8), which is less than 1/1 million",
"strength": "The module enforces 8- characters(at minimum) chosen from the 96 human readable ASCII characters. The maximum length is 25-characters. Thus, the probability of a successful random attempt is 1/(96^8), which is less than 1/1 million"
},
{
"description": "RSA public key used to authenticate a host to the module",
"mechanism": "RSA SigVer (FIPS186-5) (A3350)",
"name": "Public key authentication - RSA",
"perMinute": "The module can only perform one (1) digital signature verification per second with a maximum of 5 consecutive SSH sessions supported by the module; The probability of successfully authenticating to the module within one minute through random attempts is 60*5/2^112 which is less than 1/100,000",
"strength": "The module supports RSA (2048 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million)"
},
{
"description": "ECDSA public key used to authenticate a host to the module",
"mechanism": "ECDSA SigVer (FIPS186-5) (A3350)",
"name": "Public key authentication - ECDSA",
"perMinute": "The module can only perform one (1) digital signature verification per",
"strength": "The module supports ECDSA (P-256), which has a minimum equivalent"
},
{
"description": "",
"mechanism": "",
"name": "",
"perMinute": "second with a maximum of 5 consecutive SSH sessions supported by the module; The probability of successfully authenticating to the module within one minute through random attempts is 60*5/2^128 which is less than 1/100,000",
"strength": "computational resistance to attack of either 2^128 (P- 256); Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million)"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-ECB (A3350) - Encrypt",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on",
"details": "Encrypt",
"indicator": "Console displays \u0027AES encryption/decryption... successful when the self-test passes",
"testMethod": "KAT",
"testProps": "Key size:12 8 bits with key strengt h: 128 bits",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-ECB (A3350) - Decrypt",
"condition": "demand All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Decrypt",
"indicator": "Console displays \u0027AES encryption/decryption... successful when the self-test passes",
"testMethod": "KAT",
"testProps": "Key size:12 8 bits with key strengt h: 128 bits",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-GCM (A3350) - Encrypt",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Encrypt",
"indicator": "Console displays \u0027AES- GCM encryption/decryption... successful\u0027 when the self-test passes",
"testMethod": "KAT",
"testProps": "Key size:12 8 bits with key strengt h: 128 bits",
"type": "CAS T"
},
{
"algorithmOrTest": "AES-GCM (A3350) - Decrypt",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Decrypt",
"indicator": "Console displays \u0027AES- GCM encryption/decryption... successful\u0027 when the self-test passes",
"testMethod": "KAT",
"testProps": "Key size:12 8 bits with key strengt h: 128 bits",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can",
"details": "Key Generatio n",
"indicator": "Console displays \u0027RSA key generation and encryption/decryption... successful\u0027 when the self-test passes",
"testMethod": "PCT",
"testProps": "Modulu s: 2048 bits",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "be initiated by an operator on demand",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Sign Generatio n",
"indicator": "Console displays \u0027Signature RSA test started Signature RSA test OK\u0027 when the self- test passes",
"testMethod": "KAT",
"testProps": "Type: PKCS 1.5; Modulu s: 2048; Hash Algorith m: SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "SIgn Verificatio n",
"indicator": "Console displays \u0027Signature RSA test started Signature RSA test OK\u0027 when the self- test passes",
"testMethod": "KAT",
"testProps": "Type: PKCS 1.5; Modulu s: 2048; Hash Algorith m: SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "SHA-1 (A3350)",
"condition": "All module CASTs are run automati",
"details": "Message Digest Generatio n",
"indicator": "Console displays \u0027SHA- 1 hash...successful\u0027 when the self-test passes",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "cally during boot by the module and can be initiated by an operator on demand",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SHA2-256 (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Message Digest Generatio n",
"indicator": "Console displays \u0027SHA- 256 hash...successful\u0027 when the self-test passes",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "SHA2-512 (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator",
"details": "Message Digest Generatio n",
"indicator": "Console displays \u0027SHA- 512 hash...successful\u0027 when the self-test passes",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "on demand",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "Counter DRBG (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Generate, Reseed, Instantiat e functions per NIST SP 800- 90Ar1",
"indicator": "Console displays \u0027DRBG`AES-256-CTR DF test started; DRBG AES-256-CTR DF test OK; DRBG AES-256- CTR test started; DRBG AES-256-CTR test OK\u0027 when self-tests pass",
"testMethod": "KAT",
"testProps": "AES- 256 with key strengt h: 256 bits",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Message Authentic ation",
"indicator": "Console displays \u0027HMAC-SHA-256 hash...successful\u0027 when self-test passes",
"testMethod": "KAT",
"testProps": "HMAC- SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 (A3350)",
"condition": "All module CASTs are run automati cally during boot by the",
"details": "Message Authentic ation",
"indicator": "Console displays \u0027HMAC-SHA-512 hash...successful\u0027 when self-test passes",
"testMethod": "KAT",
"testProps": "HMAC- SHA2- 512",
"type": "CAS T"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A3352)",
"condition": "on demand All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Key Derivatio n Function",
"indicator": "Console displays \u0027SP 800-135 Application- Specific KDF-TLS 1.2 with EMS SHA-384 test...succeeded.\u0027 when self-test passes",
"testMethod": "KAT",
"testProps": "TLS 1.2 KDF (SHA2- 384)",
"type": "CAS T"
},
{
"algorithmOrTest": "KDF SSH (A3351)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Key Derivatio n Function",
"indicator": "Console displays \u0027SP 800-135 Application- Specific KDF-SSH SHA-256 test...succeeded.\u0027 when self-test passes",
"testMethod": "KAT",
"testProps": "SSH KDF (SHA2- 256)",
"type": "CAS T"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A3350)",
"condition": "All module CASTs",
"details": "Key Agreeme nt",
"indicator": "Console displays \u0027ECDH ID=713 test started ECDH ID=713",
"testMethod": "KAT",
"testProps": "KAS- SSC (SP800",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "(Shared Secret Computat ion)",
"indicator": "test OK\u0027 when self-test passes",
"testMethod": "",
"testProps": "- 56Arev 3) IG D.F Scenari o 2 path (2) ; P- 256 with key strengt h: 128 bits",
"type": ""
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A3350) PCT - Signature generation/verif ication",
"condition": "All self tests (includin g PCTs) can be initiated by an operator on demand by rebootin g the module",
"details": "Signature Generatio n and KAS- ECC- SSC Key Agreeme nt",
"indicator": "Console displays \u0027ECDSA KAT sign \u0026 verify passed\u0027 if self-test passes",
"testMethod": "PCT",
"testProps": "Curve: P-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Signature Generatio n",
"indicator": "Console displays \u0027ECDSA Test OK\u0027 if the test passes",
"testMethod": "KAT",
"testProps": "Curve: P-256",
"type": "CAS T"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A3350)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Signature Verificatio n",
"indicator": "Console displays \u0027ECDSA Test OK\u0027 if the test passes",
"testMethod": "KAT",
"testProps": "Curve: P-256",
"type": "CAS T"
},
{
"algorithmOrTest": "NIST SP 800- 90B Entropy Source Adaptive Proportion Test (APT)",
"condition": "Run at startup and continuo usly under the normal operatin g condition s, can be initiated by an operator on demand",
"details": "N/A",
"indicator": "1",
"testMethod": "Adaptiv e Proport ion Test (APT)",
"testProps": "N/A",
"type": "CAS T"
},
{
"algorithmOrTest": "NIST SP 800- 90B Entropy Source Repetition Count Test (RCT)",
"condition": "Run at startup and continuo usly under the normal operatin g condition",
"details": "N/A",
"indicator": "1",
"testMethod": "Repetiti on Count Test (RCT)",
"testProps": "N/A",
"type": "CAS T"
},
{
"algorithmOrTest": "",
"condition": "s, can be initiated by an operator on demand",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A3353)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Signature Verificatio n",
"indicator": "Console displays \u0027PKCS#1 sig. verify: RSA-SHA2 hash verify. RSA SHA2 key verify passed\u0027 if the self-test passes",
"testMethod": "KAT",
"testProps": "Type: PKCS 1.5; Modulu s: 2048; Hash Algorith m: SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "SHA2-256 (A3353)",
"condition": "All module CASTs are run automati cally during boot by the module and can be initiated by an operator on demand",
"details": "Message Digest Generatio n",
"indicator": "Console displays \u0027SHA- 256 self test #1:`self test passed SHA-256 self test #2: self test passed SHA-256 self test #3: self test passed\u0027 if self-tests pass",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAS T"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "Can be initiated by an operator on",
"details": "Signature Verificatio n",
"indicator": "Successful completion indicated by return of the command prompt to the operator",
"testMethod": "Signatu re Verifica tion",
"testProps": "Modulu s: 2048; Hash Algorith",
"type": "SW/ FW Load"
},
{
"algorithmOrTest": "",
"condition": "demand by loading firmware onto the module",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "m: SHA2- 256",
"type": ""
},
{
"algorithmOrTest": "Manual entry test",
"condition": "Can be initiated by an operator on demand by configuri ng passwor ds or the Manager Initializati on Secret",
"details": "N/A",
"indicator": "Successful completion indicated by return of the command prompt to the operator",
"testMethod": "Duplica te entry test",
"testProps": "Duplica te entry test",
"type": "Man ual Entry"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Cryptographic Algorithm Self Test failure Pre- operational Firmware Integrity Test failure Pairwise Consistency Test failure",
"description": "In the case of one or more failed Cryptographic Algorithm Self Tests, a pre- operational firmware integrity test failure, or a pairwise- consistency test failure, the module enters the hard error state, and reboots continually",
"indicator": "Console displays \u0027!!! CRITICAL FAILURE !!! FIPS 140- 3 POST and KAT...Failed REBOOTING IN 15 SECONDS\u0027 in case of a self-test failure (pre- operational firmware integrity test and/or CAST) ; The console displays \"cannot generateSensorCertAndKey in install\" in case of a pairwise consistency test failure",
"name": "Hard Error State",
"recoveryMethod": "Reinitialize the module via reinstallation of the firmware image"
},
{
"conditions": "Firmware load test failure Manual entry test failure",
"description": "In case of a firmware load test or manual entry test failure, the module enters a soft error state",
"indicator": "The following message is printed on the CLI: \"Load Image with SCP Failed.\" for a firmware load test and \"the two entries do not match\" for a manual entry test",
"name": "Soft Error State",
"recoveryMethod": "The module rejects the load/entered values and continues normal operation"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module supports the Approved mode of operation by default once it has been installed and initialization per Section 11.1 of the Security Policy; Only Approved and allowed algorithms, modes, and key sizes are supported by the module in the Approved mode",
"name": "Approved mode",
"statusIndicator": "\"FIPS Mode: Enabled\" indicator printed on CLI using the \"show\" command",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "MD5 - file fingerprint",
"use": "To calculate fingerprint of a file: The MD5 hash of a file is sent to malware engines such as Allow/Block list, GTI, TIE etc. Malware engines use the md5sum of a file to determine if a file is malicious or not"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "MD5 - Inspection alerts",
"use": "MD5 hash is shared in the inspection alerts that IPS generates"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "MD5 - Internal cache lookup",
"use": "MD5 hash is used in Sensor\u0027s internal cache lookup"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "MD5 - Configuration segments",
"use": "MD5 hash is used in configuration segments: IPS Manager sends huge configuration data in segments to Sensor; Prior to sending, for each segment, IPS Manager populates MD5 hash \u0026 appends it to the segment. When Sensor receives it, it also populates MD5 hash of the received segment data and compares it with the received MD5 hash to check for integrity. After data integrity check is passed, Sensor uses MD5 hash value to check if a particular configuration segment is modified or not"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "MD5 - SSLv2",
"use": "MD5 used in SSLv2 to ensure data integrity; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with"
},
{
"caveat": "Additional Comment 2",
"name": "",
"use": "the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 example a",
"name": "MD5 - SSLv3/TLS",
"use": "MD5 used in SSLv3/TLS to ensure data integrity"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "SHA-1 - SNMPv3",
"use": "Used in SNMPv3 to ensure data integrity; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "SHA-1 - file fingerprint",
"use": "The SHA-1 hash of a file is sent to malware engines such as TIE etc. Malware engines use the SHA-1 hash of a file to determine if a file is malicious or not"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "SHA-1 - Inspection Alerts",
"use": "SHA-1 hash is shared in the inspection alerts that IPS generates"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2",
"name": "SHA-1 - proprietary file transfer channel",
"use": "The Sensor \u0026 Manager share configuration data via proprietary file transfer channel. The data is encrypted using AES128_CFB symmetric cipher. When Manager sends data to Sensor, it calculates SHA1 hash of the data; It encrypts the SHA-1 hash and the data in AES128_CFB symmetric cipher; When the Sensor receives it, it calculates the SHA-1 hash of the received data and compares it with the received SHA1 hash value. Similarly, when Sensor sends data to Manager, it calculates the SHA1 hash of the data; It encrypts the SHA1 hash along with the data in"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "SHA2 (SHA2-256 and SHA2-384)",
"use": "AES128_CFB symmetric cipher SHA2 (SHA2-256 and SHA2-384) No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 Used in TLS 1.2 to ensure data integrity; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "HMAC",
"use": "Used in the SSLv2, SSLv3/TLS and SNMPv3 protocols for the same purpose i.e. to provide message/data authentication; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the"
},
{
"caveat": "",
"name": "",
"use": "functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality"
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "Triple-DES",
"use": "recognized in FIPS 140-3. Triple-DES No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 Used for symmetric decryption over SSLv2 and SSLv3/TLS; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "DES",
"use": "Used for symmetric decryption over SSLv2 and SSLv3/TLS; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of"
},
{
"caveat": "",
"name": "",
"use": "operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "AES - SSLv3/TLS",
"use": "AES - SSLv3/TLS No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 Used for symmetric decryption over SSLv3/TLS; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "AES - SNMPv3",
"use": "AES - SNMPv3 No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 AES-CFB128 for symmetric encryption/decryption over SNMPv3; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional"
},
{
"caveat": "",
"name": "",
"use": "Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "AES - TLS 1.2",
"use": "AES-GCM (128/256 bits) for symmetric encryption/decryption over TLS 1.2; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "RC4",
"use": "RC4 No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 Used for symmetric decryption over SSLv2 and SSLv3/TLS; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not"
},
{
"caveat": "",
"name": "",
"use": "used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "SNMPv3 KDF",
"use": "Used for key derivation in the context of SNMPv3 (SNMPv3 is used as a transport mechanism between the Manager and the sensor with no security claimed (when using self-signed certificates); SNMPv3 is used as a Read Only connection and responses to non-CSP objects for 3rd Party Clients with no security claimed); Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "KAS-ECC",
"use": "Used in TLS 1.2 for key exchange; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional"
},
{
"caveat": "",
"name": "",
"use": "Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "RSA PKCS1.5 (encrypt/decrypt/key wrapping)",
"use": "RSA PKCS1.5 (encrypt/decrypt/key wrapping) No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2 * Used for key wrapping in the context of SNMPv3 (when using self-signed certificates). * Used for encryption of the secret and IV values by Manager using the RSA PKCS1.5 mod 2048-bit sensor public key * Used in the context of SSLv2, SSLv3/TLS, TLS 1.2 and SNMPv3; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed; Per IG 2.4.A Scenario 2 Additional Comment 2",
"name": "ECDSA",
"use": "Used in TLS 1.2 for authentication; Note: This algorithm is implemented independently from all other cryptographic code in the module and is used to analyze the network stream for malware and malicious network attacks in accordance with the functionality of the product. Due to this, the corresponding functionality is deemed allowed in the Approved mode of operation with no security"
},
{
"caveat": "",
"name": "",
"use": "claimed, per Additional Comment 2 in IG 2.4.A and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non-approved use and purpose (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data and control input to/data/status output from the module directly from the serial console",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "RS232 Console port (1)"
},
{
"data": "Image Configuration",
"logicalInterface": "Data Input",
"physicalPort": "USB Ports (2)"
},
{
"data": "Ethernet data input/output",
"logicalInterface": "Data Input Data Output",
"physicalPort": "RJ-45 10/100/1000 Mbps Ethernet Monitoring ports (1-4 or 7-10)"
},
{
"data": "Management traffic",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "RJ-45 10/100/1000 Management port (MGMT) (1)"
},
{
"data": "Output data/response traffic",
"logicalInterface": "Data Output",
"physicalPort": "RJ-45 10/100/1000 Response port (R1) (1)"
},
{
"data": "Ethernet data input/output",
"logicalInterface": "Data Input Data Output",
"physicalPort": "2-port 10/1 Gbps Ethernet Monitoring ports (5-6) (This requires SFP/SFP+ transceivers and they are sold separately.)"
},
{
"data": "Status Indicator",
"logicalInterface": "Status Output",
"physicalPort": "LEDs [Power LED(s) (Solid Green - The system is ON, Off - The system is OFF)]; [HDD LED (Red - The LED lights will blink when there is data transmission in the SATA port and M.2 Key M (NVMe))]; [Management Port Speed LED (Green - The port speed is 1000 Mbps, Amber - The port speed is 100 Mbps, Off - The port speed is 10 Mbps]; [Management Port Link LED, Green - The link is up, Off - The link is down]; [Response Port Speed LED, Green - The port speed is 1000 Mbps, Amber - The port speed is 100 Mbps, Off - The port speed is 10 Mbps]; [Response Port Link LED, Green - The link is up, Off - The link is down]; [Normal/Bypass LED (Off - The port pair is in Inline Fail-Open/Inline Fail-Active/Inline Fail- Close/SPAN/Tap Mode, Green - The Port Pair is in the Bypass Mode, Red - The Port Pair is in Inline Fail-"
},
{
"data": "",
"logicalInterface": "",
"physicalPort": "Close/SPAN/Tap/Inline Fail-Open/Inline Fail-Active Mode while the system is in a reboot phase and before it is back to a good health state or when the system is shutdown)]; [Ethernet Ports Link LED (Green - The link is up, Off - The link is down)]; [Ethernet Ports Speed LED(Green - The port speed is 1000 Mbps, Amber - The port speed is 100 Mbps, Off - The port speed is 10 Mbps)]; [Power supply (Blinking Red - One power feed is being used in a slot, and the system is in good condition, Solid Red - One power feed is used for each slot, and the system is on standby, Blinking Green - Two power feeds are being used, and the system is on standby, Solid Green - Two power feeds are used, and the system is in good condition)]"
},
{
"data": "Power input",
"logicalInterface": "Power",
"physicalPort": "Power Ports (2)"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Username and Password Public key authentication - RSA Public key authentication - ECDSA",
"name": "Admin (Cryptographic Officer)",
"operatorType": "CO",
"type": "Role"
},
{
"authMethodList": "Username and Password Public key authentication - RSA Public key authentication - ECDSA",
"name": "Sensor Operator(s)",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Username, Privacy and Authentication Key",
"name": "3rd Party SNMP Client(s)",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Digital Signature Username, Privacy and Authentication Key Manager Initialization Secret (i.e., Manager \"Shared Secret\")",
"name": "Trellix IPS Manager (Cryptographic Officer)",
"operatorType": "CO",
"type": "Role"
},
{
"authMethodList": "None",
"name": "Unauthenticated",
"operatorType": "User",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "2",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A3353)",
"details": "Verify",
"indicator": "Console displays \u0027The signature verification passed for \u003cimage file name\u003e\u0027 if firmware integrity check passes; If integrity test fails then the CLI displays the following error message: \u0027Software integrity test failed - use netboot to recover. System will reboot in 5 seconds ...\u0027",
"testMethod": "KAT",
"testProps": "RSA mod 2048 bits (Cert. A3353) signature verification using SHA2-256 (Cert. A3353)",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Received from Manager as a plaintext key through TLS 1.2 channel",
"sfiAlgo": "KTS-1",
"source": "Manager"
},
{
"dest": "via SHA2- 512 hash in shell.conf file",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered by the operator through CLI over SSH",
"sfiAlgo": "KTS-2",
"source": "External endpoint"
},
{
"dest": "via SHA2- 512 hash in Linux shadow file",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered by the operator through CLI over SSH-2",
"sfiAlgo": "KTS-2",
"source": "External endpoint"
},
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered by the operator through CLI over SSH -3",
"sfiAlgo": "KTS-2",
"source": "External endpoint"
},
{
"dest": "via SHA2- 512 hash in shell.conf file",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered by the operator through CLI via direct connection to serial console port",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "via SHA2- 512 hash in Linux shadow file",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered by the operator through CLI via direct connection to serial console port- 2",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered by the operator through CLI via direct connection to serial console port- 3",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "N/A",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Never output",
"sfiAlgo": "",
"source": "N/A"
},
{
"dest": "N/A",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Never entered",
"sfiAlgo": "",
"source": "N/A"
},
{
"dest": "Plaintext on internal Storage Media (SSD)",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Entered at manufacture",
"sfiAlgo": "",
"source": "By Trellix"
},
{
"dest": "Plaintext on internal Storage Media (SSD)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered over SCP",
"sfiAlgo": "KTS-2",
"source": "Host"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output During SSH handshake",
"sfiAlgo": "",
"source": "Stored temporarily in RAM in plaintext"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output During SSH handshake -2",
"sfiAlgo": "",
"source": "Plaintext on internal Storage Media (SSD)"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH handshake -3",
"sfiAlgo": "",
"source": "Plaintext in EEPROM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during initial TLS handshake",
"sfiAlgo": "",
"source": "Stored temporarily in RAM in plaintext"
},
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered during SSH handshake",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "Plaintext on internal Storage Media (SSD)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered during SSH handshake - 2",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered during initial TLS handshake",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "Plaintext on internal Storage Media (SSD)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered during initial TLS handshake -2",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "Encrypted on Storage Media (Internal SSD)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered over TLS 1.2",
"sfiAlgo": "KTS-1",
"source": "Manager"
},
{
"dest": "Stored temporarily in RAM in plaintext",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entered RSA (PKCS1.5 key wrapped, no security claimed hence considered plaintext)",
"sfiAlgo": "",
"source": "Manager"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroised from Storage Media (internal SSD) on resetconfig",
"method": "Zeroised from Storage Media (internal SSD) on resetconfig",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize persistently stored SSPs"
},
{
"description": "Zeroised from Storage Media (internal SSD) on rescue",
"method": "Zeroised from Storage Media (internal SSD) on rescue",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize persistently stored SSPs"
},
{
"description": "Zeroised from RAM on each reboot",
"method": "Zeroised from RAM on each reboot",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize temporarily stored SSPs"
},
{
"description": "Zeroization of temporary SSPs on session termination",
"method": "Zeroised by OpenSSH library upon every SCP/SSH session closure",
"operatorId": "Module initiated",
"rationale": "Method used to zeroize temporarily stored SSPs"
},
{
"description": "Zeroised from EEPROM on resetconfig or rescue",
"method": "Zeroised from EEPROM on resetconfig or rescue",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize persistently stored SSPs"
},
{
"description": "Zeroised in the context of internal function calls",
"method": "Zeroised as part of OpenSSL scrubbing",
"operatorId": "Module initiated",
"rationale": "Method used to zeroize temporarily stored SSPs"
},
{
"description": "Manager is de-installed from the module",
"method": "Zeroised on de- install",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize persistently stored SSPs"
},
{
"description": "Zeroisation of individual user passwords (SHA2-512 hash) from the Linux shadow file when the cli command \"deleteuser\" is run for that user, also, all the newly created users and their passwords are zeroised (removed) during the resetconfig",
"method": "Zeroisation of passwords",
"operatorId": "Operator initiated",
"rationale": "Method used to zeroize persistently stored SSPs"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "\"Admin\" and \"user\" password stored in hashed form using SHA2-512 in the Linux shadow file",
"name": "via SHA2-512 hash in Linux shadow file",
"persistance": "Static"
},
{
"description": "\"support\" and \"private\" passwords stored in hashed form using SHA2- 512 in the shell.conf file",
"name": "via SHA2-512 hash in shell.conf file",
"persistance": "Static"
},
{
"description": "Stored in encrypted form on the Internal SSD",
"name": "Encrypted on Storage Media (Internal SSD)",
"persistance": "Static"
},
{
"description": "Stored in encrypted form on the Internal SSD using an RSA private/public key pair",
"name": "Encrypted using a set of RSA private/public key pair and stored in Storage Media (internal SSD)",
"persistance": "Static"
},
{
"description": "Stored temporarily in RAM in plaintext",
"name": "Stored temporarily in RAM in plaintext",
"persistance": "Dynamic"
},
{
"description": "Stored in EEPROM in plaintext",
"name": "Plaintext in EEPROM",
"persistance": "Static"
},
{
"description": "Stored on internal Storage Media (SSD) in plaintext",
"name": "Plaintext on internal Storage Media (SSD)",
"persistance": "Static"
},
{
"description": "Used to store the Trellix FW Verification key",
"name": "Plaintext on boot media",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "11.1.17.7",
"hwVersion": "1.00",
"modelPartNum": "NS3600",
"processors": "Intel\u00ae Xeon\u00ae D Processors (D-1734NT, Ice Lake)"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "NIST SP800-133r2 Section 4: Symmetric key generation and Asymmetric seed generation using an unmodified output from an Approved DRBG (example 1); The module supports the following per NIST SP 800-133r2: 1. Section"
},
{
"algoPropList": "",
"implName": "",
"name": "",
"reference": "5.1: Key Pairs for Digital Signature Schemes 2. Section 5.2: Key Pairs for Key Establishment 3. Section 6.2.1: Derivation of symmetric keys"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 2
},
"ECDSA": {
"ECDSA": 42
}
},
"RSA": {
"RSA 2048": 7
}
},
"certification_process": {},
"cipher_mode": {
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 2
},
"ECB": {
"ECB": 5
},
"GCM": {
"GCM": 11
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 1
}
},
"crypto_protocol": {
"SSH": {
"SSH": 283,
"SSHv2": 3
},
"TLS": {
"TLS": {
"TLS": 116,
"TLS 1.2": 21,
"TLS v1.2": 7
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 6
},
"MAC": {
"MAC": 3
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 56,
"P-384": 14,
"P-521": 12
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"AES 128": 3,
"AES 128, 256": 4,
"AES 128/256": 2,
"AES- 256": 1,
"AES-128": 2,
"AES-256": 2,
"HMAC-SHA-256": 2,
"HMAC-SHA-512": 2,
"PKCS 1": 6,
"PKCS#1": 2,
"PKCS1": 9,
"RSA 2048": 7,
"RSA PKCS1": 3,
"SHA- 1": 1,
"SHA- 256": 2,
"SHA- 512": 1,
"SHA-1": 14,
"SHA-256": 3,
"SHA-384": 1,
"SHA1": 4,
"SHA2": 3,
"SHA2- 256": 14,
"SHA2- 384": 1,
"SHA2- 512": 12,
"SHA2-256": 16,
"SHA2-384": 5,
"SHA2-512": 13,
"SHA3-256": 2,
"SHA3-512": 1
}
},
"fips_security_level": {
"Level": {
"Level 1": 5,
"Level 2": 2
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 16
}
},
"SHA": {
"SHA1": {
"SHA-1": 14,
"SHA1": 4
},
"SHA2": {
"SHA-256": 3,
"SHA-384": 1,
"SHA2": 3
},
"SHA3": {
"SHA3-256": 2,
"SHA3-512": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 47
},
"RNG": {
"RBG": 2,
"RNG": 3
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 41,
"FIPS 180-4": 5,
"FIPS 186-5": 21,
"FIPS 198-1": 2,
"FIPS 202": 1,
"FIPS1": 10,
"FIPS186-5": 43
},
"ISO": {
"ISO/IEC 19790:2012": 2
},
"NIST": {
"NIST SP 800-90B": 2,
"SP 800-135": 4,
"SP 800-38A": 2,
"SP 800-38D": 1,
"SP 800-56A": 1,
"SP 800-90A": 1
},
"PKCS": {
"PKCS 1": 3,
"PKCS#1": 1,
"PKCS1": 6
},
"RFC": {
"RFC5288": 1,
"RFC5647": 1,
"RFC7": 2,
"RFC7627": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 27,
"AES-": 10,
"AES-128": 2,
"AES-256": 2
},
"CAST": {
"CAST": 24
},
"RC": {
"RC4": 2
}
},
"DES": {
"3DES": {
"Triple-DES": 2
},
"DES": {
"DES": 1
}
},
"constructions": {
"MAC": {
"HMAC": 17,
"HMAC-SHA-256": 1,
"HMAC-SHA-512": 1
}
}
},
"tee_name": {
"AMD": {
"PSP": 10
},
"IBM": {
"SSC": 9
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"KDF SSHA3351",
"RSA SigGen (FIPS186-5)A3350",
"SHA3-256A3303",
"RSA KeyGen (FIPS186-5)A3350",
"ECDSA SigVer (FIPS186-5)A3350",
"SHA2-384A3350",
"HMAC-SHA2-512A3350",
"ECDSA KeyVer (FIPS186-5)A3350",
"TLS v1.2 KDF RFC7627A3352",
"AES-ECBA3350",
"HMAC-SHA2-256A3350",
"KAS-ECC-SSC Sp800-56Ar3A3350",
"ECDSA SigGen (FIPS186-5)A3350",
"AES-CFB128A3350",
"ECDSA KeyGen (FIPS186-5)A3350",
"SHA2-512A3350",
"AES-GCMA3350",
"RSA SigVer (FIPS186-5)A3353",
"Counter DRBGA3350",
"SHA-1A3350",
"SHA2-256A3353"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3352",
"#A3303",
"#A3350",
"#A3353",
"#A3351"
]
},
"policy_metadata": {
"/CreationDate": "D:20260706074210-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260706074210-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1115334,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program",
"https://docs.trellix.com/",
"http://www.trellix.com/",
"http://www.acumensecurity.net/"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 102
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "2fe918698365febf05b60dbff976c0702beb174d9ed2cd0c03a62ddfa91f531a",
"source_hash": "3fb6098a0e9806e1fc685e7b161a793bc61d5cd6c45e4ce98d77c838de54e79e",
"txt_hash": "b82f80c87281f66acdb09f8f59ad62ac109bfc6ea1fa69f0b8c2226243ea6fb2"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
"date_sunset": "2031-07-07",
"description": "The NS3600 is an Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) designed for network protection against zero-day, DoS/DDoS, encrypted and SYN Flood attacks, and real-time prevention of threats like spyware, malware, VoIP vulnerabilities, phishing, botnets, network worms, Trojans, and peer-to-peer applications. The Trellix Intrusion Prevention system Sensors (Trellix IPS sensor) connect with the Trellix Intrusion Prevention System Manager Appliances (Trellix IPS Manager-may be referred to as Manager in this document). The Trellix IPS Manager is used to manage and push configuration data and policies to the Sensors. Communication between Manager and Sensors uses secure channels that protect the traffic from disclosure and modification. Authorized administrators may access the Trellix IPS Manager via a GUI (over HTTPS) or a CLI (via SSH or a serial console connection). Sensors may be accessed via CLI (via SSH or a serial console connection) for initial setup. Once initial setup is complete, all management occurs via the Manager.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 2",
"Software/Firmware security: Level 2",
"Non-invasive security: N/A",
"Sensitive security parameter management: Level 2",
"Life-cycle assurance: Level 2",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Trellix Intrusion Prevention System Sensor NS3600",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-07-08",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "Trellix",
"vendor_url": "http://www.trellix.com"
}
}