This page was not yet optimized for use on mobile devices.
SUSE Linux Enterprise NSS Cryptographic Module
Certificate details
| Certificate ID | #5514 |
|---|---|
| Status | active |
| Validation dates | 08.09.2026 |
| Sunset date | 07-09-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode and installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | SUSE Linux Enterprise NSS Cryptographic Module consists of the Softoken and Freebl libraries offering various cryptographic mechanisms. |
| Vendor | SUSE LLC http://www.suse.com |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, CAST, RC4, DES, Triple-DES, ChaCha20, Poly1305, Camellia, HMAC, HMAC-SHA-256, CBC-MAC, CMACAsymmetric Algorithms
ECDH, ECDSA, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA-3, MD5, PBKDF2, PBKDFSchemes
MAC, Key Exchange, Key AgreementProtocols
SSL, TLS, TLS v1.2, TLSv1.0, TLS 1.2, TLS 1.3, IKE, IKEv1, IKEv2Randomness
DRBG, RNG, RBGLibraries
NSSElliptic Curves
P-256, P-384, P-521, Ed25519Block cipher modes
ECB, CBC, CTR, GCMJavaCard API constants
X25519Trusted Execution Environments
PSP, SSCSecurity level
Level 1Side-channel analysis
Timing attacks, timing attack, timing attacksStandards
FIPS 140-3, FIPS PUB 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS186-2, FIPS 186-4, FIPS186-4, FIPS 180-4, FIPS 186-2, FIPS140-3, FIPS 197, FIPS 202, SP 800-132, SP 800-56A, SP 800-38A, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-90A, SP 800-135, SP 800-108, SP 800-133, SP 800-52, NIST SP 800-57, SP 800-90B, PKCS#5, PKCS#7, PKCS#11, PKCS#12, PKCS 1, PKCS#1, RFC7627, RFC 5288, RFC 8446, RFC 3526, RFC 7919, RFC 7627, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5514,
"dgst": "9b8bc70a7157cb4a",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"#A6157",
"#A6156",
"ECDSA KeyGen (FIPS186-5)A6152",
"AES-CTRA6157",
"KAS-ECC-SSC Sp800-56Ar3A6152",
"#A6152",
"HMAC-SHA2-256A6159",
"PBKDFA6152",
"KAS-FFC-SSC Sp800-56Ar3A6152",
"ECDSA SigVer (FIPS186-5)A6152",
"SHA2-224A6159",
"HMAC-SHA2-384A6159",
"KDF TLSA6152",
"Hash DRBGA6152",
"SHA2-512A6159",
"SHA2-256A6159",
"RSA SigGen (FIPS186-5)A6152",
"#A6158",
"AES-GCMA6158",
"SHA2-384A6159",
"#A6155",
"AES-ECBA6157",
"HMAC-SHA2-512A6159",
"HMAC-SHA2-224A6159",
"#A6153",
"KDF SP800-108A6152",
"RSA SigVer (FIPS186-4)A6152",
"RSA KeyGen (FIPS186-5)A6152",
"RSA SigVer (FIPS186-5)A6152",
"KDF IKEv1A6153",
"#A6154",
"AES-CMACA6157",
"AES-KWA6157",
"#A6159",
"Safe Primes Key GenerationA6152",
"AES-CBCA6157",
"AES-KWPA6157",
"RSA SigVer (FIPS186-2)A6152",
"AES-CBC-CS1A6157",
"ECDSA SigGen (FIPS186-5)A6152",
"KDF IKEv2A6153",
"TLS v1.2 KDF RFC7627A6152"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC-CS1",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Generation Key Length - 128, 192, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A6152, A6154, A6155, A6157, A6158",
"properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal Key Length - 128, 192, 256 IV Generation Mode - 8.2.1, 8.2.2",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-KWP",
"cavpCertName": "A6152, A6154, A6157",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A6152",
"properties": "Prediction Resistance - No, Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA2- 224",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A6152",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A6152",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192 Scheme -",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Algorithm",
"cavpCertName": "CAVP Cert",
"properties": "Properties dhEphem - KAS Role - initiator, responder",
"reference": "Reference"
},
{
"algorithm": "KDF IKEv1 (CVL)",
"cavpCertName": "A6153",
"properties": "Authentication Method - Digital Signature, Pre-shared Key Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Preshared Key Length - Preshared Key Length: 8, 384, 768, 8192",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A6153",
"properties": "Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Derived Keying Material Length - Derived Keying Material Length: 1056, 3072 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A6152",
"properties": "KDF Mode - Counter, Double Pipeline Iteration, Feedback Supported Lengths - Supported Lengths: 112-4096 Increment 8",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF TLS (CVL)",
"cavpCertName": "A6152",
"properties": "TLS Version - v1.0/1.1",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "PBKDF",
"cavpCertName": "A6152",
"properties": "Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1",
"reference": "SP 800-132"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096, 6144, 8192 Primality Tests - 2pow100 Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-2)",
"cavpCertName": "A6152",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1536",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A6152",
"properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6152",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A6152",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6152, A6156, A6159",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A6152",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Encrypt a plaintext",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key, IV, plaintext",
"name": "Encryption",
"outputs": "Ciphertext",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "Encryption with AES"
},
{
"description": "Decrypt a ciphertext",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key, IV, ciphertext",
"name": "Decryption",
"outputs": "Plaintext",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "Decryption with AES"
},
{
"description": "Encrypt a plaintext",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key, IV, plaintext",
"name": "Authenticated Encryption",
"outputs": "Ciphertext, MAC tag",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "Authenticated Encryption with AES"
},
{
"description": "Decrypt a ciphertext",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key, IV, MAC tag, ciphertext",
"name": "Authenticated Decryption",
"outputs": "Plaintext or fail",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "Authenticated Decryption with AES"
},
{
"description": "Derive a key from a key- derivation key",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Key- Derivation Key, output length",
"name": "Key Derivation from a KDK",
"outputs": "KBKDF Derived Key",
"rolesSspAccess": "Crypto Officer - Key- Derivation Key: W,E - KBKDF Derived Key: G,R",
"secFunImpl": "Key Derivation with KBKDF"
},
{
"description": "Derive a key from a shared secre using IKE KDF",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Shared secret, output length",
"name": "Key Derivation with IKE KDF",
"outputs": "IKE Derived Key",
"rolesSspAccess": "Crypto Officer - Shared Secret: W,E - IKE Derived Key: G,R",
"secFunImpl": "Key Derivation with IKE KDF"
},
{
"description": "Derive a key from a shared secre using TLS KDF",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "TLS Pre- Master Secret, output length",
"name": "Key Derivation with TLS KDF",
"outputs": "TLS Derived Key",
"rolesSspAccess": "Crypto Officer - TLS Pre- Master Secret: W,E - TLS Master Secret: G,E,Z - TLS Derived Key: G,R",
"secFunImpl": "Key Derivation with TLS KDF"
},
{
"description": "Derive a key from a password",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Password, salt, iteration count, output length",
"name": "Password- Based Key Derivation",
"outputs": "PBKDF2 Derived Key",
"rolesSspAccess": "Crypto Officer - Password: W,E - PBKDF2 Derived Key: G,R",
"secFunImpl": "Key Derivation with PBKDF2"
},
{
"description": "Wrap a CSP",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key- Encryptio n Key, any CSP (other than Password)",
"name": "Key Wrapping",
"outputs": "Wrapped CSP",
"rolesSspAccess": "Crypto Officer - AES Key- Encryption Key: W,E - Wrapped CSP: R",
"secFunImpl": "Key Wrapping with AES (KTS)"
},
{
"description": "Unwrap a CSP",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "AES Key- Decryptio n Key, Wrapped CSP",
"name": "Key Unwrapping",
"outputs": "Any CSP (other than Password)",
"rolesSspAccess": "Crypto Officer - AES Key- Decryption Key: W,E - Wrapped CSP: W,E",
"secFunImpl": "Key Unwrapping with AES (KTS)"
},
{
"description": "Compute a MAC tag",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Message, HMAC Key",
"name": "Message Authenticatio n with HMAC",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - HMAC Key: W,E",
"secFunImpl": "Message Authenticatio n with HMAC"
},
{
"description": "Compute a MAC tag",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Message, AES Key",
"name": "Message Authenticatio n with CMAC",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - AES Key: W,E",
"secFunImpl": "Message Authenticatio n with CMAC"
},
{
"description": "Compute a message digest",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Message",
"name": "Message Digest",
"outputs": "Digest value",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Message Digest with SHA"
},
{
"description": "Generate random bytes",
"indicator": "CKR_OK",
"inputs": "Output length",
"name": "Random Number Generation",
"outputs": "Random bytes",
"rolesSspAccess": "Crypto Officer - Entropy Input: W,E,Z - DRBG Seed: G,E,Z - DRBG Internal State (V, C): G,W,E",
"secFunImpl": "Random Number Generation with Hash_DRBG"
},
{
"description": "Compute a shared secret",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "FFC Private Key (owner), FFC Public Key (peer)",
"name": "KAS-FFC-SSC Shared Secret Computation",
"outputs": "Shared Secret",
"rolesSspAccess": "Crypto Officer - FFC Private Key: W,E - FFC Public Key: W,E - Shared Secret: G,R",
"secFunImpl": "Shared Secret Computation with KAS- FFC-SSC"
},
{
"description": "Compute a shared secret",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "EC Private Key (owner), EC Public Key (peer)",
"name": "EC Shared Secret Computation",
"outputs": "Shared Secret",
"rolesSspAccess": "Crypto Officer - EC Private Key: W,E - EC Public Key: W,E - Shared Secret: G,R",
"secFunImpl": "Shared Secret Computation with KAS- ECC-SSC"
},
{
"description": "Generate a signature",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "RSA Private Key, message",
"name": "Signature Generation with RSA",
"outputs": "Signature",
"rolesSspAccess": "Crypto Officer - RSA Private Key: W,E",
"secFunImpl": "Signature Generation with RSA"
},
{
"description": "Generate a signature",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "EC Private Key, message",
"name": "Signature Generation with ECDSA",
"outputs": "Signature",
"rolesSspAccess": "Crypto Officer - EC Private Key: W,E",
"secFunImpl": "Signature Generation with ECDSA"
},
{
"description": "Verify a signature",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "RSA Public Key, message, signature",
"name": "Signature Verification with RSA",
"outputs": "Pass/fail",
"rolesSspAccess": "Crypto Officer - RSA Public Key: W,E",
"secFunImpl": "Signature Verification with RSA Signature Verification with RSA (legacy use)"
},
{
"description": "Verify a signature",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "EC Public Key, message, signature",
"name": "Signature Verification with ECDSA",
"outputs": "Pass/fail",
"rolesSspAccess": "Crypto Officer - EC Public Key: W,E",
"secFunImpl": "Signature Verification with ECDSA"
},
{
"description": "Generate a key pair",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Group",
"name": "Key Pair Generation with Safe Primes",
"outputs": "Module- generated FFC Public Key, Module- generated FFC Private Key",
"rolesSspAccess": "Crypto Officer - Module- generated FFC Private Key: G,R - Module- generated FFC Public Key: G,R - Intermediat e key generation value: G,E,Z",
"secFunImpl": "Key Pair Generation with Safe Primes"
},
{
"description": "Generate a key pair",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Modulus size",
"name": "Key Pair Generation with RSA",
"outputs": "Module- generated RSA Public Key, Module-",
"rolesSspAccess": "Crypto Officer - Module- generated RSA Private Key: G,R",
"secFunImpl": "Key Pair Generation with RSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "generated RSA Private Key",
"rolesSspAccess": "- Module- generated RSA Public Key: G,R - Intermediat e key generation value: G,E,Z",
"secFunImpl": ""
},
{
"description": "Generate a key pair",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Curve",
"name": "Key Pair Generation with ECDSA",
"outputs": "Module- generated EC Public Key, Module- generated EC Private Key",
"rolesSspAccess": "Crypto Officer - Module- generated EC Private Key: G,R - Module- generated EC Public Key: G,R - Intermediat e key generation value: G,E,Z",
"secFunImpl": "Key Pair Generation with ECDSA"
},
{
"description": "Generate a secret key",
"indicator": "CKS_NSS_FIPS_O K (1)",
"inputs": "Key size",
"name": "Symmetric Key Generation",
"outputs": "Symmetric Key",
"rolesSspAccess": "Crypto Officer - Symmetric Key: G,R",
"secFunImpl": "Symmetric Key Generation with Hash_DRBG"
},
{
"description": "Return the module name and version informatio n",
"indicator": "None",
"inputs": "N/A",
"name": "Show Version",
"outputs": "Module name and version informatio n",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Return the module status",
"indicator": "None",
"inputs": "N/A",
"name": "Show Status",
"outputs": "Module status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform the CASTs and",
"indicator": "None",
"inputs": "N/A",
"name": "Self-Test",
"outputs": "Pass/fail",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Message Digest with SHA"
},
{
"description": "integrity tests",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Message Authenticatio n with HMAC Encryption with AES Decryption with AES Authenticated Encryption with AES Authenticated Decryption with AES Message Authenticatio n with CMAC Key Derivation with KBKDF Key Derivation with TLS KDF Key Derivation with IKE KDF Key Derivation with PBKDF2 Shared Secret Computation with KAS- FFC-SSC Shared Secret Computation with KAS- ECC-SSC Signature Generation with RSA Signature Verification with RSA Signature Generation with ECDSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": "Signature Verification with ECDSA"
},
{
"description": "Zeroize all SSPs",
"indicator": "N/A",
"inputs": "Any SSP",
"name": "Zeroization",
"outputs": "None",
"rolesSspAccess": "Crypto Officer - AES Key: Z - AES Key- Encryption Key: Z - AES Key- Decryption Key: Z - HMAC Key: Z - Key- Derivation Key: Z - Shared Secret: Z - Password: Z - KBKDF Derived Key: Z - PBKDF2 Derived Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Derived Key: Z - IKE Derived Key: Z - Entropy Input: Z - DRBG Seed: Z - DRBG",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Internal State (V, C): Z - FFC Private Key: Z - FFC Public Key: Z - EC Private Key: Z - EC Public Key: Z - RSA Private Key: Z - RSA Public Key: Z - Intermediat e key generation value: Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "SHA2-224 (A6152)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A6156)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A6159)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6152)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6156)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6159)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A6152)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A6156)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A6159)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6152)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6156)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6159)",
"condition": "Module initialization",
"details": "Message Digest",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 224 (A6152)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 224 (A6156)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 224 (A6159)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 (A6152)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 (A6156)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 256 (A6159)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 (A6152)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 (A6156)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 384 (A6159)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 (A6152)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 (A6156)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2- 512 (A6159)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "288-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Encrypt (A6152)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Encrypt (A6154)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Encrypt (A6157)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Decrypt (A6152)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Decrypt (A6154)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB - Decrypt (A6157)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Encrypt (A6152)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Encrypt (A6154)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Encrypt (A6157)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Decrypt (A6152)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Decrypt (A6154)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC - Decrypt (A6157)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A6152)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A6154)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A6155)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A6157)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Encrypt (A6158)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A6152)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A6154)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A6155)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A6157)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM - Decrypt (A6158)",
"condition": "Module initialization",
"details": "Decryption",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC (A6152)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC (A6154)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC (A6157)",
"condition": "Module initialization",
"details": "Message Authentication",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "128, 192, 256- bit key",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800-108 (A6152)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "HMAC- SHA2-256 in counter mode",
"type": "CAST"
},
{
"algorithmOrTest": "KDF TLS (A6152)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "512-bit message",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A6152)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 (A6153)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA-1, SHA- 256, SHA- 384, SHA-512",
"type": "CAST"
},
{
"algorithmOrTest": "PBKDF (A6152)",
"condition": "Module initialization",
"details": "Key Derivation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA2-256 with 5 iterations, 128-bit salt and 14 characters password",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A6152)",
"condition": "Module initialization",
"details": "Instantiate Generate; Reseed Generate (compliant to SP 800- 90A Rev. 1, Section 11.3)",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA-256 without prediction resistance",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A6152)",
"condition": "Module initialization",
"details": "Shared Secret Computation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "ffdhe2048",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A6152)",
"condition": "Module initialization",
"details": "Shared Secret Computation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A6152)",
"condition": "Module initialization",
"details": "Signature Generation",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2-",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "are available for use",
"testMethod": "",
"testProps": "512, and 2048-bit key",
"type": ""
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6152)",
"condition": "Module initialization",
"details": "Signature Verification",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2- 512, and 2048-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A6152)",
"condition": "Module initialization",
"details": "Signature Generation",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA2-256 and P-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A6152)",
"condition": "Module initialization",
"details": "Signature Verification",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "KAT",
"testProps": "SHA2-256 and P-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A6152)",
"condition": "Key Pair Generation",
"details": "Signature Generation and Signature Verification",
"indicator": "Successful key pair generation",
"testMethod": "PCT",
"testProps": "PKCS#1 v1.5 with SHA- 256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) - SSC (A6152)",
"condition": "Key Pair Generation",
"details": "PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3",
"indicator": "Successful key pair generation",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) - SigGen/SigVer (A6152)",
"condition": "Key Pair Generation",
"details": "Signature Generation and Signature Verification",
"indicator": "Successful key pair generation",
"testMethod": "PCT",
"testProps": "SHA-256",
"type": "PCT"
},
{
"algorithmOrTest": "Safe Primes Key Generation (A6152)",
"condition": "Key Pair Generation",
"details": "PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3",
"indicator": "Successful key pair generation",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Software integrity test failure or CAST failure",
"description": "An error occurred during the self-tests executed on power-on",
"indicator": "Module will not load",
"name": "Power- On Error",
"recoveryMethod": "Restart of the module"
},
{
"conditions": "PCT failure",
"description": "An error occurred during a PCT",
"indicator": "Module stops functioning (sftk_fatalError is set to TRUE)",
"name": "PCT Error",
"recoveryMethod": "Restart of the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Automatically entered whenever an approved service is requested.",
"name": "Approved",
"statusIndicator": "Equivalent to the indicator of the requested service (\u0027CKR_OK\u0027 for approved DRBG service and NSC_NSSGetFIPSStatus returns CKS_NSS_FIPS_OK (1) for all other approved services).",
"type": "Approved"
},
{
"description": "Automatically entered whenever a non- approved service is requested.",
"name": "Non- Approved",
"statusIndicator": "Equivalent to the indicator of the requested service (DRBG service does not return CKR_OK, NSC_NSSGetFIPSStatus does not return CKS_NSS_FIPS_OK (1) for all other services).",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "Only allowed as the PRF in TLSv1.0 and v1.1 per IG 2.4.A",
"name": "MD5",
"use": "Message digest used in TLSv1.0/v1.1 KDF only"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "MD2, MD5, SHA-1",
"use": "Message digest"
},
{
"name": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(-Poly1305)",
"use": "Encryption, Decryption"
},
{
"name": "AES GCM (external IV)",
"use": "Encryption"
},
{
"name": "CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (\u003c 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation)",
"use": "Message authentication"
},
{
"name": "KDF using only MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA- 512, DES, Triple-DES, AES, Camellia",
"use": "Key derivation"
},
{
"name": "ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret",
"use": "Key derivation"
},
{
"name": "KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with \u003c 112-bit keys",
"use": "Key derivation"
},
{
"name": "KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5)",
"use": "Key derivation"
},
{
"name": "PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or \u003c 112-bit keys, PKCS#5 PBE, PKCS#12 PBE",
"use": "Password-based key derivation"
},
{
"name": "J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519",
"use": "Shared secret computation"
},
{
"name": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1)",
"use": "Signature generation, Signature verification"
},
{
"name": "RSA (\u003c 2048-bit keys)",
"use": "Signature generation"
},
{
"name": "RSA (\u003c 1024-bit keys)",
"use": "Signature verification"
},
{
"name": "RSA (data encryption / decryption)",
"use": "Asymmetric encryption, Asymmetric decryption"
},
{
"name": "DSA",
"use": "Parameter generation, Parameter verification"
},
{
"name": "DSA, Diffie Hellman (FIPS 186-type groups), RSA (\u003c 2048 bits), RSA (\u003e 4096 bits), Ed25519, X25519",
"use": "Key pair generation"
},
{
"name": "Symmetric key generation (\u003c 112 bits)",
"use": "Secret key generation"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "MD2, MD5, SHA-1",
"description": "Compute a message digest",
"name": "Message Digest",
"role": "CO"
},
{
"alg_accessed": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305) AES GCM (external IV)",
"description": "Encrypt a plaintext",
"name": "Encryption",
"role": "CO"
},
{
"alg_accessed": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305)",
"description": "Decrypt a ciphertext",
"name": "Decryption",
"role": "CO"
},
{
"alg_accessed": "CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (\u003c 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation)",
"description": "Compute a MAC tag",
"name": "Message Authentication",
"role": "CO"
},
{
"alg_accessed": "KDF using only MD2, MD5, SHA-1, SHA-224, SHA- 256, SHA-384, SHA-512, DES, Triple-DES, AES, Camellia ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with \u003c 112-bit keys KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5)",
"description": "Derive a key from a key-derivation key or a shared secret",
"name": "Key Derivation",
"role": "CO"
},
{
"alg_accessed": "PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or \u003c 112-bit keys, PKCS#5 PBE, PKCS#12 PBE",
"description": "Derive a key from a password",
"name": "Password-Based Key Derivation",
"role": "CO"
},
{
"alg_accessed": "J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519",
"description": "Compute a shared secret",
"name": "Shared Secret Computation",
"role": "CO"
},
{
"alg_accessed": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (\u003c 2048-bit keys)",
"description": "Generate a signature",
"name": "Signature Generation",
"role": "CO"
},
{
"alg_accessed": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (\u003c 1024-bit keys)",
"description": "Verify a signature",
"name": "Signature Verification",
"role": "CO"
},
{
"alg_accessed": "RSA (data encryption / decryption)",
"description": "Encrypt a plaintext",
"name": "Asymmetric Encryption",
"role": "CO"
},
{
"alg_accessed": "RSA (data encryption / decryption)",
"description": "Decrypt a plaintext",
"name": "Asymmetric Decryption",
"role": "CO"
},
{
"alg_accessed": "DSA",
"description": "Generate domain parameters",
"name": "Parameter Generation",
"role": "CO"
},
{
"alg_accessed": "DSA",
"description": "Verify domain parameters",
"name": "Parameter Verification",
"role": "CO"
},
{
"alg_accessed": "DSA, Diffie Hellman (FIPS 186-type groups), RSA (\u003c 2048 bits), RSA (\u003e 4096 bits), Ed25519, X25519",
"description": "Generate a key pair",
"name": "Key Pair Generation",
"role": "CO"
},
{
"alg_accessed": "Symmetric key generation (\u003c 112 bits)",
"description": "Generate a secret key",
"name": "Secret Key Generation",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "API input parameters",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "API output parameters",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API function calls, API input parameters for control input",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "API return codes",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "1",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC- SHA2-256",
"details": "Integrity test for libsoftokn3.so and libfreeblpriv3.so",
"indicator": "Module becomes operational and services are available for use",
"testMethod": "Message authentication",
"testProps": "256-bit key",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Cryptographic module",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API input parameters (plaintext)",
"sfiAlgo": "",
"source": "Calling application within TOEPP"
},
{
"dest": "Cryptographic module",
"distribution": "Manual",
"entry": "Electronic",
"format": "Encrypted",
"name": "API input parameters (encrypted)",
"sfiAlgo": "Key Unwrapping with AES (KTS)",
"source": "Calling application within TOEPP"
},
{
"dest": "Calling application within TOEPP",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API output parameters (plaintext)",
"sfiAlgo": "",
"source": "Cryptographic module"
},
{
"dest": "Calling application within TOEPP",
"distribution": "Manual",
"entry": "Electronic",
"format": "Encrypted",
"name": "API output parameters (encrypted)",
"sfiAlgo": "Key Wrapping with AES (KTS)",
"source": "Cryptographic module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Destroys the SSP represented by the object",
"method": "Destroy Object",
"operatorId": "By calling the C_DestroyObject function.",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded."
},
{
"description": "Automatically zeroized by the module when no longer needed",
"method": "Automatic",
"operatorId": "N/A",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
},
{
"description": "De-allocates the volatile memory used to store SSPs",
"method": "Module Reset",
"operatorId": "By removing power",
"rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed. Module power off indicates that the zeroization procedure succeeded."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on AMD EPYC(TM) 7343 or Intel\u00ae Xeon\u00ae Gold 5416S",
"swFwVersion": "3.2"
},
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on Ampere\u00ae Altra\u00ae Q80- 30",
"swFwVersion": "3.2"
},
{
"features": "N/A",
"integrityTest": "HMAC-SHA-256",
"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on IBM\u00ae Telum(TM)",
"swFwVersion": "3.2"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "Yes",
"processors": "AMD EPYC(TM) 7343",
"version": "3.2"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "No",
"processors": "AMD EPYC(TM) 7343",
"version": "3.2"
},
{
"hardwarePlatform": "GIGABYTE R152-P30",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "Yes",
"processors": "Ampere\u00ae Altra\u00ae Q80-30",
"version": "3.2"
},
{
"hardwarePlatform": "GIGABYTE R152-P30",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "No",
"processors": "Ampere\u00ae Altra\u00ae Q80-30",
"version": "3.2"
},
{
"hardwarePlatform": "IBM z16 A01",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "Yes",
"processors": "IBM\u00ae Telum(TM)",
"version": "3.2"
},
{
"hardwarePlatform": "IBM z16 A01",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "No",
"processors": "IBM\u00ae Telum(TM)",
"version": "3.2"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "Yes",
"processors": "Intel\u00ae Xeon\u00ae Gold 5416S",
"version": "3.2"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U",
"hypervisorHostOs": "N/A",
"operatingSystem": "SUSE Linux Enterprise Server 15 SP6",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 5416S",
"version": "3.2"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key type:Symmetric",
"implName": "N/A",
"name": "Symmetric Cryptographic Key Generation (CKG)",
"reference": "SP 800-133 Rev. 2, section 4, example 1, and section 6.1"
},
{
"algoPropList": "Key type:Asymmetric",
"implName": "N/A",
"name": "Asymmetric Cryptographic Key Generation (CKG)",
"reference": "SP 800-133 Rev. 2, section 4, example 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "IBM LinuxONE III Model LT1 on z15",
"operatingSystem": "SUSE Linux Enterprise Server 15SP6"
},
{
"hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X",
"operatingSystem": "SUSE Linux Enterprise Server Real Time 15SP6"
},
{
"hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6"
},
{
"hardwarePlatform": "QEMU VM on Intel\u00ae i7-1195G7",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6"
},
{
"hardwarePlatform": "QEMU VM on Intel\u00ae Xeon\u00ae Gold 6338",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "QEMU VM on Ampere\u00ae Altra\u00ae Q80-30",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "IBM LinuxONE III Model LT1 QEMU VM on z15",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6"
},
{
"hardwarePlatform": "IBM LinuxONE III Model LT1 QEMU VM on z15",
"operatingSystem": "SUSE Linux Enterprise Server 15SP6"
},
{
"hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X",
"operatingSystem": "SUSE Linux Enterprise Server 15SP6"
},
{
"hardwarePlatform": "QEMU VM on Ampere\u00ae Altra\u00ae Q80-30",
"operatingSystem": "SUSE Linux Enterprise Server 15SP6"
},
{
"hardwarePlatform": "QEMU VM on Intel\u00ae Xeon\u00ae Gold 6338",
"operatingSystem": "SUSE Linux Enterprise Server 15SP6"
},
{
"hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X",
"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP7"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP7"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP7"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Desktop 15SP7"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7"
},
{
"hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7"
},
{
"hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7"
},
{
"hardwarePlatform": "IBM LinuxONE III Model LT1 on z15",
"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7"
},
{
"hardwarePlatform": "IBM LinuxONE III Model LT1 on z15",
"operatingSystem": "SUSE Linux Enterprise Server 15SP7"
},
{
"hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)",
"operatingSystem": "SUSE Linux Enterprise Server 15SP7"
},
{
"hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S",
"operatingSystem": "SUSE Linux Enterprise Server 15SP7"
},
{
"hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343",
"operatingSystem": "SUSE Linux Enterprise Server 15SP7"
},
{
"hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30",
"operatingSystem": "SUSE Linux Enterprise Server 15SP7"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 1
},
"ECDH": {
"ECDH": 1
},
"ECDSA": {
"ECDSA": 42
}
},
"FF": {
"DH": {
"DH": 1,
"Diffie-Hellman": 10
},
"DSA": {
"DSA": 8
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 2
},
"CTR": {
"CTR": 1
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 6
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"NSS": {
"NSS": 76
}
},
"crypto_protocol": {
"IKE": {
"IKE": 20,
"IKEv1": 7,
"IKEv2": 9
},
"TLS": {
"SSL": {
"SSL": 2
},
"TLS": {
"TLS": 56,
"TLS 1.2": 6,
"TLS 1.3": 5,
"TLS v1.2": 4,
"TLSv1.0": 1
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 2
},
"KEX": {
"Key Exchange": 2
},
"MAC": {
"MAC": 12
}
},
"device_model": {},
"ecc_curve": {
"Edwards": {
"Ed25519": 2
},
"NIST": {
"P-256": 22,
"P-384": 16,
"P-521": 16
}
},
"eval_facility": {
"atsec": {
"atsec": 2
}
},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 2,
"AES-GCM IV 2": 1,
"Diffie- Hellman 2048": 2,
"HMAC-SHA-256": 6,
"PKCS 1": 2,
"PKCS#1": 14,
"PKCS#11": 2,
"PKCS#12": 6,
"PKCS#5": 6,
"PKCS#7": 2,
"SHA- 256": 3,
"SHA- 384": 1,
"SHA- 512": 1,
"SHA-1": 16,
"SHA-224": 2,
"SHA-256": 4,
"SHA-3": 1,
"SHA-384": 2,
"SHA-512": 2,
"SHA2- 256": 2,
"SHA2- 384": 4,
"SHA2- 512": 1,
"SHA2-224": 11,
"SHA2-256": 19,
"SHA2-384": 10,
"SHA2-512": 12,
"SHA3-256": 1
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 12
}
},
"PBKDF": {
"PBKDF": 3,
"PBKDF2": 19
},
"SHA": {
"SHA1": {
"SHA-1": 16
},
"SHA2": {
"SHA-224": 2,
"SHA-256": 4,
"SHA-384": 2,
"SHA-512": 2
},
"SHA3": {
"SHA-3": 1,
"SHA3-256": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {
"curves": {
"X25519": 4
}
},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 32
},
"RNG": {
"RBG": 3,
"RNG": 1
}
},
"side_channel_analysis": {
"SCA": {
"Timing attacks": 1,
"timing attack": 1,
"timing attacks": 1
}
},
"standard_id": {
"FIPS": {
"FIPS 140-3": 87,
"FIPS 180-4": 5,
"FIPS 186-2": 3,
"FIPS 186-4": 4,
"FIPS 186-5": 8,
"FIPS 197": 1,
"FIPS 198-1": 5,
"FIPS 202": 1,
"FIPS PUB 140-3": 3,
"FIPS140-3": 1,
"FIPS186-2": 2,
"FIPS186-4": 2,
"FIPS186-5": 26
},
"NIST": {
"NIST SP 800-57": 2,
"SP 800-108": 2,
"SP 800-132": 7,
"SP 800-133": 3,
"SP 800-135": 5,
"SP 800-38A": 6,
"SP 800-38B": 2,
"SP 800-38D": 2,
"SP 800-38F": 3,
"SP 800-52": 2,
"SP 800-56A": 10,
"SP 800-90A": 4,
"SP 800-90B": 1
},
"PKCS": {
"PKCS 1": 2,
"PKCS#1": 7,
"PKCS#11": 1,
"PKCS#12": 3,
"PKCS#5": 3,
"PKCS#7": 1
},
"RFC": {
"RFC 3526": 2,
"RFC 5288": 3,
"RFC 7627": 2,
"RFC 7919": 2,
"RFC 8446": 4,
"RFC7627": 3
},
"X509": {
"X.509": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 74
},
"CAST": {
"CAST": 127
},
"RC": {
"RC4": 3
}
},
"DES": {
"3DES": {
"Triple-DES": 5
},
"DES": {
"DES": 5
}
},
"constructions": {
"MAC": {
"CBC-MAC": 2,
"CMAC": 8,
"HMAC": 19,
"HMAC-SHA-256": 3
}
},
"djb": {
"ChaCha": {
"ChaCha20": 3
},
"Poly": {
"Poly1305": 2
}
},
"miscellaneous": {
"Camellia": {
"Camellia": 5
}
}
},
"tee_name": {
"AMD": {
"PSP": 6
},
"IBM": {
"SSC": 7
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"ECDSA KeyGen (FIPS186-5)A6152",
"AES-CTRA6157",
"KAS-ECC-SSC Sp800-56Ar3A6152",
"HMAC-SHA2-256A6159",
"PBKDFA6152",
"KAS-FFC-SSC Sp800-56Ar3A6152",
"ECDSA SigVer (FIPS186-5)A6152",
"SHA2-224A6159",
"HMAC-SHA2-384A6159",
"KDF TLSA6152",
"Hash DRBGA6152",
"SHA2-512A6159",
"SHA2-256A6159",
"RSA SigGen (FIPS186-5)A6152",
"AES-GCMA6158",
"SHA2-384A6159",
"AES-ECBA6157",
"HMAC-SHA2-512A6159",
"HMAC-SHA2-224A6159",
"KDF SP800-108A6152",
"RSA SigVer (FIPS186-4)A6152",
"RSA KeyGen (FIPS186-5)A6152",
"RSA SigVer (FIPS186-5)A6152",
"KDF IKEv1A6153",
"AES-CMACA6157",
"AES-KWA6157",
"Safe Primes Key GenerationA6152",
"AES-CBCA6157",
"AES-KWPA6157",
"RSA SigVer (FIPS186-2)A6152",
"AES-CBC-CS1A6157",
"ECDSA SigGen (FIPS186-5)A6152",
"KDF IKEv2A6153",
"TLS v1.2 KDF RFC7627A6152"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6157",
"#A6156",
"#A6158",
"#A6154",
"#A6152",
"#A6155",
"#A6159",
"#A6153"
]
},
"policy_metadata": {
"/Author": "Natan",
"/Category": "",
"/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos",
"/ClassificationContentMarkingHeaderShapeIds": "6a6bd0a3,6e8f7198,707206eb",
"/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT",
"/Comments": "",
"/Company": "",
"/Copyright": "2026",
"/CreationDate": "D:20260904090155-04\u002700\u0027",
"/Creator": "Acrobat PDFMaker 26 for Word",
"/Keywords": "",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "6c7a4f29-07cf-484d-b4c3-4d8c08a19c78",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-09-04T12:54:29Z",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1",
"/Manager": "",
"/ModDate": "D:20260904090424-04\u002700\u0027",
"/Module name": "SUSE Linux Enterprise NSS Cryptographic Module",
"/Module version": "3.2",
"/Producer": "Adobe PDF Library 26.1.29",
"/SourceModified": "D:20260904130051",
"/Subject": "",
"/Title": "",
"/Vendor": "SUSE LLC",
"pdf_file_size_bytes": 739903,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://doi.org/10.6028/NIST.SP.800-38B",
"https://doi.org/10.6028/NIST.SP.800-56Ar3",
"https://www.ietf.org/rfc/rfc7919.txt",
"https://doi.org/10.6028/NIST.FIPS.202",
"https://www.rfc-editor.org/rfc/rfc8017.txt",
"https://doi.org/10.6028/NIST.SP.800-38F",
"https://doi.org/10.6028/NIST.SP.800-135r1",
"https://doi.org/10.6028/NIST.SP.800-38A",
"https://doi.org/10.6028/NIST.FIPS.186-5",
"https://www.ietf.org/rfc/rfc5288.txt",
"https://doi.org/10.6028/NIST.SP.800-90B",
"https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf",
"https://doi.org/10.6028/NIST.SP.800-90Ar1",
"https://www.ietf.org/rfc/rfc3526.txt",
"https://doi.org/10.6028/NIST.SP.800-52r2",
"https://doi.org/10.6028/NIST.SP.800-132",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
"https://doi.org/10.6028/NIST.FIPS.197-upd1",
"https://doi.org/10.6028/NIST.SP.800-38A-Add",
"https://doi.org/10.6028/NIST.SP.800-133r2",
"https://doi.org/10.6028/NIST.FIPS.186-4",
"https://doi.org/10.6028/NIST.SP.800-108r1-upd1",
"https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf",
"https://doi.org/10.6028/NIST.FIPS.180-4",
"https://doi.org/10.6028/NIST.FIPS.198-1",
"https://www.ietf.org/rfc/rfc8446.txt",
"https://doi.org/10.6028/NIST.SP.800-57pt1r5"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 70
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "a6ea7855ac524e339d0b9076e6ed17f400e8dd3111ed7b43f0f908a5026a231e",
"source_hash": "0b88be86a6f1badbf12e215b990fe901d36a604a0c42faaf22ff5471a0cce7b4",
"txt_hash": "74d22f97750169a6abffc4fbf3d406dfec132a92fad84f0f3ab99eb1a978c65d"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode and installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": null,
"date_sunset": "2031-09-07",
"description": "SUSE Linux Enterprise NSS Cryptographic Module consists of the Softoken and Freebl libraries offering various cryptographic mechanisms.",
"embodiment": "MultiChipStand",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "SUSE Linux Enterprise NSS Cryptographic Module",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-08",
"lab": "atsec information security corporation",
"validation_type": "Initial"
}
],
"vendor": "SUSE LLC",
"vendor_url": "http://www.suse.com"
}
}