{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "9b8bc70a7157cb4a", "cert_id": 5514, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "SUSE Linux Enterprise NSS Cryptographic Module", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-09-08", "validation_type": "Initial", "lab": "atsec information security corporation"}], "vendor_url": "http://www.suse.com", "vendor": "SUSE LLC", "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/September 2026_071026_0710.pdf", "module_type": "Software", "standard": "FIPS 140-3", "status": "active", "level": 1, "caveat": "When operated in approved mode and installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.", "exceptions": ["Physical security: N/A", "Non-invasive security: N/A"], "embodiment": "MultiChipStand", "description": "SUSE Linux Enterprise NSS Cryptographic Module consists of the Softoken and Freebl libraries offering various cryptographic mechanisms.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-09-07", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 1": 2}}, "fips_certlike": {"Certlike": {"HMAC-SHA-256": 6, "SHA2-224": 11, "SHA2-256": 19, "SHA2-384": 10, "SHA2-512": 12, "SHA-1": 16, "SHA2- 384": 4, "SHA-224": 2, "SHA-256": 4, "SHA-384": 2, "SHA- 512": 1, "SHA3-256": 1, "SHA- 256": 3, "SHA-512": 2, "SHA- 384": 1, "SHA2- 256": 2, "SHA2- 512": 1, "SHA-3": 1, "PKCS#5": 6, "PKCS#7": 2, "PKCS#11": 2, "PKCS#12": 6, "- PKCS 1": 2, "PKCS#1": 14, "AES-GCM IV 2": 1, "Diffie- Hellman 2048": 2, "PKCS 1": 2}}, "vendor": {}, "eval_facility": {"atsec": {"atsec": 2}}, "symmetric_crypto": {"AES_competition": {"AES": {"AES": 74}, "CAST": {"CAST": 127}, "RC": {"RC4": 3}}, "DES": {"DES": {"DES": 5}, "3DES": {"Triple-DES": 5}}, "djb": {"ChaCha": {"ChaCha20": 3}, "Poly": {"Poly1305": 2}}, "miscellaneous": {"Camellia": {"Camellia": 5}}, "constructions": {"MAC": {"HMAC": 19, "HMAC-SHA-256": 3, "CBC-MAC": 2, "CMAC": 8}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 1}, "ECDSA": {"ECDSA": 42}, "ECC": {"ECC": 1}}, "FF": {"DH": {"Diffie-Hellman": 10, "DH": 1}, "DSA": {"DSA": 8}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 16}, "SHA2": {"SHA-224": 2, "SHA-256": 4, "SHA-384": 2, "SHA-512": 2}, "SHA3": {"SHA3-256": 1, "SHA-3": 1}}, "MD": {"MD5": {"MD5": 12}}, "PBKDF": {"PBKDF2": 19, "PBKDF": 3}}, "crypto_scheme": {"MAC": {"MAC": 12}, "KEX": {"Key Exchange": 2}, "KA": {"Key Agreement": 2}}, "crypto_protocol": {"TLS": {"SSL": {"SSL": 2}, "TLS": {"TLS": 56, "TLS v1.2": 4, "TLSv1.0": 1, "TLS 1.2": 6, "TLS 1.3": 5}}, "IKE": {"IKE": 20, "IKEv1": 7, "IKEv2": 9}}, "randomness": {"PRNG": {"DRBG": 32}, "RNG": {"RNG": 1, "RBG": 3}}, "cipher_mode": {"ECB": {"ECB": 1}, "CBC": {"CBC": 2}, "CTR": {"CTR": 1}, "GCM": {"GCM": 6}}, "ecc_curve": {"NIST": {"P-256": 22, "P-384": 16, "P-521": 16}, "Edwards": {"Ed25519": 2}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {"NSS": {"NSS": 76}}, "vulnerability": {}, "side_channel_analysis": {"SCA": {"Timing attacks": 1, "timing attack": 1, "timing attacks": 1}}, "device_model": {}, "tee_name": {"AMD": {"PSP": 6}, "IBM": {"SSC": 7}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 87, "FIPS PUB 140-3": 3, "FIPS186-5": 26, "FIPS 186-5": 8, "FIPS 198-1": 5, "FIPS186-2": 2, "FIPS 186-4": 4, "FIPS186-4": 2, "FIPS 180-4": 5, "FIPS 186-2": 3, "FIPS140-3": 1, "FIPS 197": 1, "FIPS 202": 1}, "NIST": {"SP 800-132": 7, "SP 800-56A": 10, "SP 800-38A": 6, "SP 800-38B": 2, "SP 800-38D": 2, "SP 800-38F": 3, "SP 800-90A": 4, "SP 800-135": 5, "SP 800-108": 2, "SP 800-133": 3, "SP 800-52": 2, "NIST SP 800-57": 2, "SP 800-90B": 1}, "PKCS": {"PKCS#5": 3, "PKCS#7": 1, "PKCS#11": 1, "PKCS#12": 3, "PKCS 1": 2, "PKCS#1": 7}, "RFC": {"RFC7627": 3, "RFC 5288": 3, "RFC 8446": 4, "RFC 3526": 2, "RFC 7919": 2, "RFC 7627": 2}, "X509": {"X.509": 1}}, "javacard_version": {}, "javacard_api_const": {"curves": {"X25519": 4}}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 739903, "pdf_is_encrypted": false, "pdf_number_of_pages": 70, "/Author": "Natan", "/Category": "", "/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos", "/ClassificationContentMarkingHeaderShapeIds": "6a6bd0a3,6e8f7198,707206eb", "/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT", "/Comments": "", "/Company": "", "/Copyright": "2026", "/CreationDate": "D:20260904090155-04'00'", "/Creator": "Acrobat PDFMaker 26 for Word", "/Keywords": "", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "6c7a4f29-07cf-484d-b4c3-4d8c08a19c78", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-09-04T12:54:29Z", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1", "/Manager": "", "/ModDate": "D:20260904090424-04'00'", "/Module name": "SUSE Linux Enterprise NSS Cryptographic Module", "/Module version": "3.2", "/Producer": "Adobe PDF Library 26.1.29", "/SourceModified": "D:20260904130051", "/Subject": "", "/Title": "", "/Vendor": "SUSE LLC", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://doi.org/10.6028/NIST.SP.800-133r2", "https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf", "https://doi.org/10.6028/NIST.FIPS.198-1", "https://www.ietf.org/rfc/rfc5288.txt", "https://doi.org/10.6028/NIST.FIPS.202", "https://www.rfc-editor.org/rfc/rfc8017.txt", "https://doi.org/10.6028/NIST.FIPS.197-upd1", "https://doi.org/10.6028/NIST.FIPS.180-4", "https://doi.org/10.6028/NIST.SP.800-38A", "https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf", "https://www.ietf.org/rfc/rfc8446.txt", "https://doi.org/10.6028/NIST.SP.800-135r1", "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf", "https://doi.org/10.6028/NIST.SP.800-56Ar3", "https://doi.org/10.6028/NIST.SP.800-38F", "https://doi.org/10.6028/NIST.SP.800-38B", "https://doi.org/10.6028/NIST.SP.800-52r2", "https://www.ietf.org/rfc/rfc7919.txt", "https://doi.org/10.6028/NIST.FIPS.186-4", "https://doi.org/10.6028/NIST.SP.800-38A-Add", "https://doi.org/10.6028/NIST.FIPS.186-5", "https://www.ietf.org/rfc/rfc3526.txt", "https://doi.org/10.6028/NIST.SP.800-108r1-upd1", "https://doi.org/10.6028/NIST.SP.800-132", "https://doi.org/10.6028/NIST.SP.800-90B", "https://doi.org/10.6028/NIST.SP.800-57pt1r5", "https://doi.org/10.6028/NIST.SP.800-90Ar1"]}}, "module_algorithms": {"_type": "Set", "elements": ["SHA2-512A6159", "ECDSA SigVer (FIPS186-5)A6152", "HMAC-SHA2-512A6159", "Hash DRBGA6152", "RSA SigVer (FIPS186-2)A6152", "RSA SigVer (FIPS186-4)A6152", "SHA2-224A6159", "HMAC-SHA2-256A6159", "PBKDFA6152", "RSA SigGen (FIPS186-5)A6152", "KDF SP800-108A6152", "RSA KeyGen (FIPS186-5)A6152", "AES-KWPA6157", "AES-KWA6157", "HMAC-SHA2-384A6159", "ECDSA KeyGen (FIPS186-5)A6152", "AES-CBC-CS1A6157", "AES-ECBA6157", "TLS v1.2 KDF RFC7627A6152", "AES-CMACA6157", "KDF TLSA6152", "KAS-ECC-SSC Sp800-56Ar3A6152", "KDF IKEv2A6153", "ECDSA SigGen (FIPS186-5)A6152", "HMAC-SHA2-224A6159", "AES-CBCA6157", "AES-GCMA6158", "AES-CTRA6157", "RSA SigVer (FIPS186-5)A6152", "Safe Primes Key GenerationA6152", "KDF IKEv1A6153", "SHA2-384A6159", "KAS-FFC-SSC Sp800-56Ar3A6152", "SHA2-256A6159"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A6158", "#A6159", "#A6154", "#A6153", "#A6157", "#A6152", "#A6156", "#A6155"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "1"}, {"section": "2", "title": "Cryptographic module specification", "level": "1"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "1"}, {"section": "4", "title": "Roles, services, and authentication", "level": "1"}, {"section": "5", "title": "Software/Firmware security", "level": "1"}, {"section": "6", "title": "Operational environment", "level": "1"}, {"section": "7", "title": "Physical security", "level": "N/A"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "1"}, {"section": "10", "title": "Self-tests", "level": "1"}, {"section": "11", "title": "Life-cycle assurance", "level": "1"}, {"section": "12", "title": "Mitigation of other attacks", "level": "1"}, {"section": "", "title": "Overall Level", "level": "1"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on AMD EPYC(TM) 7343 or Intel\u00ae Xeon\u00ae Gold 5416S", "swFwVersion": "3.2", "features": "N/A", "integrityTest": "HMAC-SHA-256"}, {"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on Ampere\u00ae Altra\u00ae Q80- 30", "swFwVersion": "3.2", "features": "N/A", "integrityTest": "HMAC-SHA-256"}, {"packageFileName": "libsoftokn3.so, libfreeblpriv3.so on IBM\u00ae Telum(TM)", "swFwVersion": "3.2", "features": "N/A", "integrityTest": "HMAC-SHA-256"}]}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6", "processors": "AMD EPYC(TM) 7343", "paa_pai": "Yes", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6", "processors": "AMD EPYC(TM) 7343", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "GIGABYTE R152-P30", "processors": "Ampere\u00ae Altra\u00ae Q80-30", "paa_pai": "Yes", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "GIGABYTE R152-P30", "processors": "Ampere\u00ae Altra\u00ae Q80-30", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "IBM z16 A01", "processors": "IBM\u00ae Telum(TM)", "paa_pai": "Yes", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "IBM z16 A01", "processors": "IBM\u00ae Telum(TM)", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "ASUS RS700-E11-RS4U", "processors": "Intel\u00ae Xeon\u00ae Gold 5416S", "paa_pai": "Yes", "hypervisorHostOs": "N/A", "version": "3.2"}, {"operatingSystem": "SUSE Linux Enterprise Server 15 SP6", "hardwarePlatform": "ASUS RS700-E11-RS4U", "processors": "Intel\u00ae Xeon\u00ae Gold 5416S", "paa_pai": "No", "hypervisorHostOs": "N/A", "version": "3.2"}]}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP6", "hardwarePlatform": "IBM LinuxONE III Model LT1 on z15"}, {"operatingSystem": "SUSE Linux Enterprise Server Real Time 15SP6", "hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6", "hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP6", "hardwarePlatform": "QEMU VM on Intel\u00ae i7-1195G7"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "QEMU VM on Intel\u00ae Xeon\u00ae Gold 6338"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "QEMU VM on Ampere\u00ae Altra\u00ae Q80-30"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP6", "hardwarePlatform": "IBM LinuxONE III Model LT1 QEMU VM on z15"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP6", "hardwarePlatform": "IBM LinuxONE III Model LT1 QEMU VM on z15"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP6", "hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP6", "hardwarePlatform": "QEMU VM on Ampere\u00ae Altra\u00ae Q80-30"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP6", "hardwarePlatform": "QEMU VM on Intel\u00ae Xeon\u00ae Gold 6338"}, {"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP6", "hardwarePlatform": "QEMU VM on AMD EPYC(TM) 7773X"}, {"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP7", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Server for SAP 15SP7", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP7", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Desktop 15SP7", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7", "hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7", "hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)"}, {"operatingSystem": "SUSE Linux Enterprise Base Container Image 15SP7", "hardwarePlatform": "IBM LinuxONE III Model LT1 on z15"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP7", "hardwarePlatform": "IBM LinuxONE III Model LT1 on z15"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP7", "hardwarePlatform": "IBM z16 A01 on IBM\u00ae Telum(TM)"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP7", "hardwarePlatform": "ASUS RS700-E11-RS4U on Intel\u00ae Xeon\u00ae Gold 5416S"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP7", "hardwarePlatform": "SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343"}, {"operatingSystem": "SUSE Linux Enterprise Server 15SP7", "hardwarePlatform": "GIGABYTE R152-P30 on Ampere\u00ae Altra\u00ae Q80-30"}]}, "modes_of_operation": {"section": 2, "subsection": 4, "found": true, "entries": [{"name": "Approved", "description": "Automatically entered whenever an approved service is requested.", "type": "Approved", "statusIndicator": "Equivalent to the indicator of the requested service ('CKR_OK' for approved DRBG service and NSC_NSSGetFIPSStatus returns CKS_NSS_FIPS_OK (1) for all other approved services)."}, {"name": "Non- Approved", "description": "Automatically entered whenever a non- approved service is requested.", "type": "Non- Approved", "statusIndicator": "Equivalent to the indicator of the requested service (DRBG service does not return CKR_OK, NSC_NSSGetFIPSStatus does not return CKS_NSS_FIPS_OK (1) for all other services)."}]}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CBC-CS1", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CMAC", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Generation Key Length - 128, 192, 256", "reference": "SP 800-38B"}, {"algorithm": "AES-CTR", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-ECB", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A6152, A6154, A6155, A6157, A6158", "properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal Key Length - 128, 192, 256 IV Generation Mode - 8.2.1, 8.2.2", "reference": "SP 800-38D"}, {"algorithm": "AES-KW", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38F"}, {"algorithm": "AES-KWP", "cavpCertName": "A6152, A6154, A6157", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38F"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A6152", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A6152", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A6152", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-5"}, {"algorithm": "Hash DRBG", "cavpCertName": "A6152", "properties": "Prediction Resistance - No, Yes Mode - SHA2-256", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "HMAC-SHA2- 224", "cavpCertName": "A6152, A6156, A6159", "properties": "Key Length - Key Length: 112-524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 256", "cavpCertName": "A6152, A6156, A6159", "properties": "Key Length - Key Length: 112-524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 384", "cavpCertName": "A6152, A6156, A6159", "properties": "Key Length - Key Length: 112-524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 512", "cavpCertName": "A6152, A6156, A6159", "properties": "Key Length - Key Length: 112-524288 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A6152", "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC-SSC Sp800-56Ar3", "cavpCertName": "A6152", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192 Scheme -", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "Algorithm", "cavpCertName": "CAVP Cert", "properties": "Properties dhEphem - KAS Role - initiator, responder", "reference": "Reference"}, {"algorithm": "KDF IKEv1 (CVL)", "cavpCertName": "A6153", "properties": "Authentication Method - Digital Signature, Pre-shared Key Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Preshared Key Length - Preshared Key Length: 8, 384, 768, 8192", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A6153", "properties": "Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Derived Keying Material Length - Derived Keying Material Length: 1056, 3072 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF SP800-108", "cavpCertName": "A6152", "properties": "KDF Mode - Counter, Double Pipeline Iteration, Feedback Supported Lengths - Supported Lengths: 112-4096 Increment 8", "reference": "SP 800-108 Rev. 1"}, {"algorithm": "KDF TLS (CVL)", "cavpCertName": "A6152", "properties": "TLS Version - v1.0/1.1", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "PBKDF", "cavpCertName": "A6152", "properties": "Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1", "reference": "SP 800-132"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A6152", "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096, 6144, 8192 Primality Tests - 2pow100 Private Key Format - standard", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A6152", "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-2)", "cavpCertName": "A6152", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1536", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS186-4)", "cavpCertName": "A6152", "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A6152", "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss", "reference": "FIPS 186-5"}, {"algorithm": "Safe Primes Key Generation", "cavpCertName": "A6152", "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "SHA2-224", "cavpCertName": "A6152, A6156, A6159", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A6152, A6156, A6159", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-384", "cavpCertName": "A6152, A6156, A6159", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A6152, A6156, A6159", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8", "reference": "FIPS 180-4"}, {"algorithm": "TLS v1.2 KDF RFC7627 (CVL)", "cavpCertName": "A6152", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800-135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "Symmetric Cryptographic Key Generation (CKG)", "algoPropList": "Key type:Symmetric", "implName": "N/A", "reference": "SP 800-133 Rev. 2, section 4, example 1, and section 6.1"}, {"name": "Asymmetric Cryptographic Key Generation (CKG)", "algoPropList": "Key type:Asymmetric", "implName": "N/A", "reference": "SP 800-133 Rev. 2, section 4, example 1"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "MD5", "caveat": "Only allowed as the PRF in TLSv1.0 and v1.1 per IG 2.4.A", "use": "Message digest used in TLSv1.0/v1.1 KDF only"}]}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "MD2, MD5, SHA-1", "use": "Message digest"}, {"name": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(-Poly1305)", "use": "Encryption, Decryption"}, {"name": "AES GCM (external IV)", "use": "Encryption"}, {"name": "CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (< 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation)", "use": "Message authentication"}, {"name": "KDF using only MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA- 512, DES, Triple-DES, AES, Camellia", "use": "Key derivation"}, {"name": "ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret", "use": "Key derivation"}, {"name": "KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with < 112-bit keys", "use": "Key derivation"}, {"name": "KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5)", "use": "Key derivation"}, {"name": "PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or < 112-bit keys, PKCS#5 PBE, PKCS#12 PBE", "use": "Password-based key derivation"}, {"name": "J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519", "use": "Shared secret computation"}, {"name": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1)", "use": "Signature generation, Signature verification"}, {"name": "RSA (< 2048-bit keys)", "use": "Signature generation"}, {"name": "RSA (< 1024-bit keys)", "use": "Signature verification"}, {"name": "RSA (data encryption / decryption)", "use": "Asymmetric encryption, Asymmetric decryption"}, {"name": "DSA", "use": "Parameter generation, Parameter verification"}, {"name": "DSA, Diffie Hellman (FIPS 186-type groups), RSA (< 2048 bits), RSA (> 4096 bits), Ed25519, X25519", "use": "Key pair generation"}, {"name": "Symmetric key generation (< 112 bits)", "use": "Secret key generation"}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "N/A", "logicalInterface": "Data Input", "data": "API input parameters"}, {"physicalPort": "N/A", "logicalInterface": "Data Output", "data": "API output parameters"}, {"physicalPort": "N/A", "logicalInterface": "Control Input", "data": "API function calls, API input parameters for control input"}, {"physicalPort": "N/A", "logicalInterface": "Status Output", "data": "API return codes"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": false, "entries": []}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Crypto Officer", "type": "Role", "operatorType": "CO", "authMethodList": "None"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Encryption", "description": "Encrypt a plaintext", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key, IV, plaintext", "outputs": "Ciphertext", "secFunImpl": "Encryption with AES", "rolesSspAccess": "Crypto Officer - AES Key: W,E"}, {"name": "Decryption", "description": "Decrypt a ciphertext", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key, IV, ciphertext", "outputs": "Plaintext", "secFunImpl": "Decryption with AES", "rolesSspAccess": "Crypto Officer - AES Key: W,E"}, {"name": "Authenticated Encryption", "description": "Encrypt a plaintext", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key, IV, plaintext", "outputs": "Ciphertext, MAC tag", "secFunImpl": "Authenticated Encryption with AES", "rolesSspAccess": "Crypto Officer - AES Key: W,E"}, {"name": "Authenticated Decryption", "description": "Decrypt a ciphertext", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key, IV, MAC tag, ciphertext", "outputs": "Plaintext or fail", "secFunImpl": "Authenticated Decryption with AES", "rolesSspAccess": "Crypto Officer - AES Key: W,E"}, {"name": "Key Derivation from a KDK", "description": "Derive a key from a key- derivation key", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Key- Derivation Key, output length", "outputs": "KBKDF Derived Key", "secFunImpl": "Key Derivation with KBKDF", "rolesSspAccess": "Crypto Officer - Key- Derivation Key: W,E - KBKDF Derived Key: G,R"}, {"name": "Key Derivation with IKE KDF", "description": "Derive a key from a shared secre using IKE KDF", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Shared secret, output length", "outputs": "IKE Derived Key", "secFunImpl": "Key Derivation with IKE KDF", "rolesSspAccess": "Crypto Officer - Shared Secret: W,E - IKE Derived Key: G,R"}, {"name": "Key Derivation with TLS KDF", "description": "Derive a key from a shared secre using TLS KDF", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "TLS Pre- Master Secret, output length", "outputs": "TLS Derived Key", "secFunImpl": "Key Derivation with TLS KDF", "rolesSspAccess": "Crypto Officer - TLS Pre- Master Secret: W,E - TLS Master Secret: G,E,Z - TLS Derived Key: G,R"}, {"name": "Password- Based Key Derivation", "description": "Derive a key from a password", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Password, salt, iteration count, output length", "outputs": "PBKDF2 Derived Key", "secFunImpl": "Key Derivation with PBKDF2", "rolesSspAccess": "Crypto Officer - Password: W,E - PBKDF2 Derived Key: G,R"}, {"name": "Key Wrapping", "description": "Wrap a CSP", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key- Encryptio n Key, any CSP (other than Password)", "outputs": "Wrapped CSP", "secFunImpl": "Key Wrapping with AES (KTS)", "rolesSspAccess": "Crypto Officer - AES Key- Encryption Key: W,E - Wrapped CSP: R"}, {"name": "Key Unwrapping", "description": "Unwrap a CSP", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "AES Key- Decryptio n Key, Wrapped CSP", "outputs": "Any CSP (other than Password)", "secFunImpl": "Key Unwrapping with AES (KTS)", "rolesSspAccess": "Crypto Officer - AES Key- Decryption Key: W,E - Wrapped CSP: W,E"}, {"name": "Message Authenticatio n with HMAC", "description": "Compute a MAC tag", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Message, HMAC Key", "outputs": "MAC tag", "secFunImpl": "Message Authenticatio n with HMAC", "rolesSspAccess": "Crypto Officer - HMAC Key: W,E"}, {"name": "Message Authenticatio n with CMAC", "description": "Compute a MAC tag", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Message, AES Key", "outputs": "MAC tag", "secFunImpl": "Message Authenticatio n with CMAC", "rolesSspAccess": "Crypto Officer - AES Key: W,E"}, {"name": "Message Digest", "description": "Compute a message digest", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Message", "outputs": "Digest value", "secFunImpl": "Message Digest with SHA", "rolesSspAccess": "Crypto Officer"}, {"name": "Random Number Generation", "description": "Generate random bytes", "indicator": "CKR_OK", "inputs": "Output length", "outputs": "Random bytes", "secFunImpl": "Random Number Generation with Hash_DRBG", "rolesSspAccess": "Crypto Officer - Entropy Input: W,E,Z - DRBG Seed: G,E,Z - DRBG Internal State (V, C): G,W,E"}, {"name": "KAS-FFC-SSC Shared Secret Computation", "description": "Compute a shared secret", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "FFC Private Key (owner), FFC Public Key (peer)", "outputs": "Shared Secret", "secFunImpl": "Shared Secret Computation with KAS- FFC-SSC", "rolesSspAccess": "Crypto Officer - FFC Private Key: W,E - FFC Public Key: W,E - Shared Secret: G,R"}, {"name": "EC Shared Secret Computation", "description": "Compute a shared secret", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "EC Private Key (owner), EC Public Key (peer)", "outputs": "Shared Secret", "secFunImpl": "Shared Secret Computation with KAS- ECC-SSC", "rolesSspAccess": "Crypto Officer - EC Private Key: W,E - EC Public Key: W,E - Shared Secret: G,R"}, {"name": "Signature Generation with RSA", "description": "Generate a signature", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "RSA Private Key, message", "outputs": "Signature", "secFunImpl": "Signature Generation with RSA", "rolesSspAccess": "Crypto Officer - RSA Private Key: W,E"}, {"name": "Signature Generation with ECDSA", "description": "Generate a signature", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "EC Private Key, message", "outputs": "Signature", "secFunImpl": "Signature Generation with ECDSA", "rolesSspAccess": "Crypto Officer - EC Private Key: W,E"}, {"name": "Signature Verification with RSA", "description": "Verify a signature", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "RSA Public Key, message, signature", "outputs": "Pass/fail", "secFunImpl": "Signature Verification with RSA Signature Verification with RSA (legacy use)", "rolesSspAccess": "Crypto Officer - RSA Public Key: W,E"}, {"name": "Signature Verification with ECDSA", "description": "Verify a signature", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "EC Public Key, message, signature", "outputs": "Pass/fail", "secFunImpl": "Signature Verification with ECDSA", "rolesSspAccess": "Crypto Officer - EC Public Key: W,E"}, {"name": "Key Pair Generation with Safe Primes", "description": "Generate a key pair", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Group", "outputs": "Module- generated FFC Public Key, Module- generated FFC Private Key", "secFunImpl": "Key Pair Generation with Safe Primes", "rolesSspAccess": "Crypto Officer - Module- generated FFC Private Key: G,R - Module- generated FFC Public Key: G,R - Intermediat e key generation value: G,E,Z"}, {"name": "Key Pair Generation with RSA", "description": "Generate a key pair", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Modulus size", "outputs": "Module- generated RSA Public Key, Module-", "secFunImpl": "Key Pair Generation with RSA", "rolesSspAccess": "Crypto Officer - Module- generated RSA Private Key: G,R"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "generated RSA Private Key", "secFunImpl": "", "rolesSspAccess": "- Module- generated RSA Public Key: G,R - Intermediat e key generation value: G,E,Z"}, {"name": "Key Pair Generation with ECDSA", "description": "Generate a key pair", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Curve", "outputs": "Module- generated EC Public Key, Module- generated EC Private Key", "secFunImpl": "Key Pair Generation with ECDSA", "rolesSspAccess": "Crypto Officer - Module- generated EC Private Key: G,R - Module- generated EC Public Key: G,R - Intermediat e key generation value: G,E,Z"}, {"name": "Symmetric Key Generation", "description": "Generate a secret key", "indicator": "CKS_NSS_FIPS_O K (1)", "inputs": "Key size", "outputs": "Symmetric Key", "secFunImpl": "Symmetric Key Generation with Hash_DRBG", "rolesSspAccess": "Crypto Officer - Symmetric Key: G,R"}, {"name": "Show Version", "description": "Return the module name and version informatio n", "indicator": "None", "inputs": "N/A", "outputs": "Module name and version informatio n", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer"}, {"name": "Show Status", "description": "Return the module status", "indicator": "None", "inputs": "N/A", "outputs": "Module status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer"}, {"name": "Self-Test", "description": "Perform the CASTs and", "indicator": "None", "inputs": "N/A", "outputs": "Pass/fail", "secFunImpl": "Message Digest with SHA", "rolesSspAccess": "Crypto Officer"}, {"name": "", "description": "integrity tests", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Message Authenticatio n with HMAC Encryption with AES Decryption with AES Authenticated Encryption with AES Authenticated Decryption with AES Message Authenticatio n with CMAC Key Derivation with KBKDF Key Derivation with TLS KDF Key Derivation with IKE KDF Key Derivation with PBKDF2 Shared Secret Computation with KAS- FFC-SSC Shared Secret Computation with KAS- ECC-SSC Signature Generation with RSA Signature Verification with RSA Signature Generation with ECDSA", "rolesSspAccess": ""}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Signature Verification with ECDSA", "rolesSspAccess": ""}, {"name": "Zeroization", "description": "Zeroize all SSPs", "indicator": "N/A", "inputs": "Any SSP", "outputs": "None", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - AES Key: Z - AES Key- Encryption Key: Z - AES Key- Decryption Key: Z - HMAC Key: Z - Key- Derivation Key: Z - Shared Secret: Z - Password: Z - KBKDF Derived Key: Z - PBKDF2 Derived Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Derived Key: Z - IKE Derived Key: Z - Entropy Input: Z - DRBG Seed: Z - DRBG"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Internal State (V, C): Z - FFC Private Key: Z - FFC Public Key: Z - EC Private Key: Z - EC Public Key: Z - RSA Private Key: Z - RSA Public Key: Z - Intermediat e key generation value: Z"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "Message Digest", "description": "Compute a message digest", "alg_accessed": "MD2, MD5, SHA-1", "role": "CO"}, {"name": "Encryption", "description": "Encrypt a plaintext", "alg_accessed": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305) AES GCM (external IV)", "role": "CO"}, {"name": "Decryption", "description": "Decrypt a ciphertext", "alg_accessed": "RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305)", "role": "CO"}, {"name": "Message Authentication", "description": "Compute a MAC tag", "alg_accessed": "CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (< 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation)", "role": "CO"}, {"name": "Key Derivation", "description": "Derive a key from a key-derivation key or a shared secret", "alg_accessed": "KDF using only MD2, MD5, SHA-1, SHA-224, SHA- 256, SHA-384, SHA-512, DES, Triple-DES, AES, Camellia ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with < 112-bit keys KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5)", "role": "CO"}, {"name": "Password-Based Key Derivation", "description": "Derive a key from a password", "alg_accessed": "PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or < 112-bit keys, PKCS#5 PBE, PKCS#12 PBE", "role": "CO"}, {"name": "Shared Secret Computation", "description": "Compute a shared secret", "alg_accessed": "J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519", "role": "CO"}, {"name": "Signature Generation", "description": "Generate a signature", "alg_accessed": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (< 2048-bit keys)", "role": "CO"}, {"name": "Signature Verification", "description": "Verify a signature", "alg_accessed": "DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (< 1024-bit keys)", "role": "CO"}, {"name": "Asymmetric Encryption", "description": "Encrypt a plaintext", "alg_accessed": "RSA (data encryption / decryption)", "role": "CO"}, {"name": "Asymmetric Decryption", "description": "Decrypt a plaintext", "alg_accessed": "RSA (data encryption / decryption)", "role": "CO"}, {"name": "Parameter Generation", "description": "Generate domain parameters", "alg_accessed": "DSA", "role": "CO"}, {"name": "Parameter Verification", "description": "Verify domain parameters", "alg_accessed": "DSA", "role": "CO"}, {"name": "Key Pair Generation", "description": "Generate a key pair", "alg_accessed": "DSA, Diffie Hellman (FIPS 186-type groups), RSA (< 2048 bits), RSA (> 4096 bits), Ed25519, X25519", "role": "CO"}, {"name": "Secret Key Generation", "description": "Generate a secret key", "alg_accessed": "Symmetric key generation (< 112 bits)", "role": "CO"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": false, "entries": []}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "RAM", "description": "Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "API input parameters (plaintext)", "source": "Calling application within TOEPP", "dest": "Cryptographic module", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}, {"name": "API input parameters (encrypted)", "source": "Calling application within TOEPP", "dest": "Cryptographic module", "format": "Encrypted", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": "Key Unwrapping with AES (KTS)"}, {"name": "API output parameters (plaintext)", "source": "Cryptographic module", "dest": "Calling application within TOEPP", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}, {"name": "API output parameters (encrypted)", "source": "Cryptographic module", "dest": "Calling application within TOEPP", "format": "Encrypted", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": "Key Wrapping with AES (KTS)"}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Destroy Object", "description": "Destroys the SSP represented by the object", "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded.", "operatorId": "By calling the C_DestroyObject function."}, {"method": "Automatic", "description": "Automatically zeroized by the module when no longer needed", "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable.", "operatorId": "N/A"}, {"method": "Module Reset", "description": "De-allocates the volatile memory used to store SSPs", "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed. Module power off indicates that the zeroization procedure succeeded.", "operatorId": "By removing power"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "HMAC- SHA2-256", "testProps": "256-bit key", "testMethod": "Message authentication", "type": "SW/FW Integrity", "indicator": "Module becomes operational and services are available for use", "details": "Integrity test for libsoftokn3.so and libfreeblpriv3.so"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "SHA2-224 (A6152)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-224 (A6156)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-224 (A6159)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-256 (A6152)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-256 (A6156)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-256 (A6159)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-384 (A6152)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-384 (A6156)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-384 (A6159)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-512 (A6152)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-512 (A6156)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "SHA2-512 (A6159)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Digest", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 224 (A6152)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 224 (A6156)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 224 (A6159)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 256 (A6152)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 256 (A6156)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 256 (A6159)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 384 (A6152)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 384 (A6156)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 384 (A6159)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 512 (A6152)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 512 (A6156)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "HMAC-SHA2- 512 (A6159)", "testProps": "288-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Encrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Encrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Encrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Decrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Decrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-ECB - Decrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Encrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Encrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Encrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Decrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Decrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CBC - Decrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Encrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Encrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Encrypt (A6155)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Encrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Encrypt (A6158)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Encryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Decrypt (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Decrypt (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Decrypt (A6155)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Decrypt (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-GCM - Decrypt (A6158)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Decryption", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CMAC (A6152)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CMAC (A6154)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "AES-CMAC (A6157)", "testProps": "128, 192, 256- bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Message Authentication", "condition": "Module initialization"}, {"algorithmOrTest": "KDF SP800-108 (A6152)", "testProps": "HMAC- SHA2-256 in counter mode", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Key Derivation", "condition": "Module initialization"}, {"algorithmOrTest": "KDF TLS (A6152)", "testProps": "512-bit message", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Key Derivation", "condition": "Module initialization"}, {"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A6152)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Key Derivation", "condition": "Module initialization"}, {"algorithmOrTest": "KDF IKEv2 (A6153)", "testProps": "SHA-1, SHA- 256, SHA- 384, SHA-512", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Key Derivation", "condition": "Module initialization"}, {"algorithmOrTest": "PBKDF (A6152)", "testProps": "SHA2-256 with 5 iterations, 128-bit salt and 14 characters password", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Key Derivation", "condition": "Module initialization"}, {"algorithmOrTest": "Hash DRBG (A6152)", "testProps": "SHA-256 without prediction resistance", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Instantiate Generate; Reseed Generate (compliant to SP 800- 90A Rev. 1, Section 11.3)", "condition": "Module initialization"}, {"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A6152)", "testProps": "ffdhe2048", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Shared Secret Computation", "condition": "Module initialization"}, {"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A6152)", "testProps": "P-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Shared Secret Computation", "condition": "Module initialization"}, {"algorithmOrTest": "RSA SigGen (FIPS186-5) (A6152)", "testProps": "PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2-", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services", "details": "Signature Generation", "condition": "Module initialization"}, {"algorithmOrTest": "", "testProps": "512, and 2048-bit key", "testMethod": "", "type": "", "indicator": "are available for use", "details": "", "condition": ""}, {"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6152)", "testProps": "PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2- 512, and 2048-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Signature Verification", "condition": "Module initialization"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A6152)", "testProps": "SHA2-256 and P-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Signature Generation", "condition": "Module initialization"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A6152)", "testProps": "SHA2-256 and P-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module becomes operational and services are available for use", "details": "Signature Verification", "condition": "Module initialization"}, {"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A6152)", "testProps": "PKCS#1 v1.5 with SHA- 256", "testMethod": "PCT", "type": "PCT", "indicator": "Successful key pair generation", "details": "Signature Generation and Signature Verification", "condition": "Key Pair Generation"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) - SSC (A6152)", "testProps": "N/A", "testMethod": "PCT", "type": "PCT", "indicator": "Successful key pair generation", "details": "PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3", "condition": "Key Pair Generation"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) - SigGen/SigVer (A6152)", "testProps": "SHA-256", "testMethod": "PCT", "type": "PCT", "indicator": "Successful key pair generation", "details": "Signature Generation and Signature Verification", "condition": "Key Pair Generation"}, {"algorithmOrTest": "Safe Primes Key Generation (A6152)", "testProps": "N/A", "testMethod": "PCT", "type": "PCT", "indicator": "Successful key pair generation", "details": "PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3", "condition": "Key Pair Generation"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Power- On Error", "description": "An error occurred during the self-tests executed on power-on", "conditions": "Software integrity test failure or CAST failure", "recoveryMethod": "Restart of the module", "indicator": "Module will not load"}, {"name": "PCT Error", "description": "An error occurred during a PCT", "conditions": "PCT failure", "recoveryMethod": "Restart of the module", "indicator": "Module stops functioning (sftk_fatalError is set to TRUE)"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["SHA2-512A6159", "#A6158", "ECDSA SigVer (FIPS186-5)A6152", "HMAC-SHA2-512A6159", "Hash DRBGA6152", "RSA SigVer (FIPS186-2)A6152", "RSA SigVer (FIPS186-4)A6152", "SHA2-224A6159", "HMAC-SHA2-256A6159", "PBKDFA6152", "#A6156", "RSA SigGen (FIPS186-5)A6152", "#A6159", "KDF SP800-108A6152", "RSA KeyGen (FIPS186-5)A6152", "#A6153", "AES-KWPA6157", "AES-KWA6157", "HMAC-SHA2-384A6159", "ECDSA KeyGen (FIPS186-5)A6152", "AES-CBC-CS1A6157", "AES-ECBA6157", "TLS v1.2 KDF RFC7627A6152", "AES-CMACA6157", "#A6154", "KDF TLSA6152", "KAS-ECC-SSC Sp800-56Ar3A6152", "#A6157", "KDF IKEv2A6153", "ECDSA SigGen (FIPS186-5)A6152", "HMAC-SHA2-224A6159", "AES-CBCA6157", "AES-GCMA6158", "AES-CTRA6157", "RSA SigVer (FIPS186-5)A6152", "Safe Primes Key GenerationA6152", "KDF IKEv1A6153", "SHA2-384A6159", "KAS-FFC-SSC Sp800-56Ar3A6152", "#A6152", "#A6155", "SHA2-256A6159"]}, "extracted_versions": {"_type": "Set", "elements": ["-"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "0b88be86a6f1badbf12e215b990fe901d36a604a0c42faaf22ff5471a0cce7b4", "txt_hash": "74d22f97750169a6abffc4fbf3d406dfec132a92fad84f0f3ab99eb1a978c65d", "json_hash": "a6ea7855ac524e339d0b9076e6ed17f400e8dd3111ed7b43f0f908a5026a231e"}}}