### SUSE LLC

## SUSE Linux Enterprise NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy

####### Prepared by:

atsec information security corporation 4516 Seton Center Pkwy, Suite 250 Austin, TX 78759

www.atsec.com

© 2026 SUSE LLC/atsec information security corporation.

Document version: 1.2

Last update: 2026-08-25

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 1 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

#### Table of Contents

| General ............................................................................................................................................................. 5   | General ............................................................................................................................................................. 5   | General ............................................................................................................................................................. 5   |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 1.1                                                                                                                                                                     | 1 1.1                                                                                                                                                                     | Overview ..................................................................................................................................................... 5          |
| 1.2 Security Levels ............................................................................................................................................          | 1.2 Security Levels ............................................................................................................................................          | 5                                                                                                                                                                         |
| 2 Cryptographic Module Specification ............................................................................................................... 6                    | 2 Cryptographic Module Specification ............................................................................................................... 6                    | 2 Cryptographic Module Specification ............................................................................................................... 6                    |
| 2.1                                                                                                                                                                       | 2.1                                                                                                                                                                       | Description .................................................................................................................................................. 6          |
| 2.2 Tested and Vendor Affirmed Module Version and Identification                                                                                                          | 2.2 Tested and Vendor Affirmed Module Version and Identification                                                                                                          | ........................................................... 7                                                                                                             |
| 2.3 Excluded Components ..............................................................................................................................                    | 2.3 Excluded Components ..............................................................................................................................                    | 11                                                                                                                                                                        |
| 2.4 Modes of Operation ..................................................................................................................................                 | 2.4 Modes of Operation ..................................................................................................................................                 | 11                                                                                                                                                                        |
| 2.5 Algorithms .................................................................................................................................................          | 2.5 Algorithms .................................................................................................................................................          | 11                                                                                                                                                                        |
| 2.6 Security Function Implementations .........................................................................................................                           | 2.6 Security Function Implementations .........................................................................................................                           | 15                                                                                                                                                                        |
| 2.7 Algorithm                                                                                                                                                             | 2.7 Algorithm                                                                                                                                                             | Specific Information ............................................................................................................... 19                                   |
| 2.7.1 AES-GCM IV                                                                                                                                                          | 2.7.1 AES-GCM IV                                                                                                                                                          | .................................................................................................................................... 19                                   |
| 2.7.2 Key                                                                                                                                                                 | 2.7.2 Key                                                                                                                                                                 | Derivation using SP 800-132 PBKDF2 ..................................................................................... 20                                               |
| 2.7.3                                                                                                                                                                     | SP                                                                                                                                                                        | 800-56A Rev. 3 Assurances ......................................................................................................... 20                                    |
| 2.7.4                                                                                                                                                                     | RSA Approved Modulus Size                                                                                                                                                 | ........................................................................................................... 21                                                            |
| 2.7.5                                                                                                                                                                     | Legacy Use                                                                                                                                                                | ........................................................................................................................................ 21                               |
| 2.8 RBG and Entropy ......................................................................................................................................                | 2.8 RBG and Entropy ......................................................................................................................................                | 21                                                                                                                                                                        |
| 2.9 Key Generation                                                                                                                                                        | 2.9 Key Generation                                                                                                                                                        | ......................................................................................................................................... 22                              |
| 2.10 Key                                                                                                                                                                  | 2.10 Key                                                                                                                                                                  | Establishment ................................................................................................................................ 22                         |
| 2.11 Industry Protocols                                                                                                                                                   | 2.11 Industry Protocols                                                                                                                                                   | ................................................................................................................................ 22                                       |
| 3 Cryptographic Module Interfaces ..................................................................................................................                      | 3 Cryptographic Module Interfaces ..................................................................................................................                      | 23                                                                                                                                                                        |
| 3.1 Ports and Interfaces ..................................................................................................................................               | 3.1 Ports and Interfaces ..................................................................................................................................               | 23                                                                                                                                                                        |
| Roles, Services, and Authentication ............................................................................................................... 24                    | Roles, Services, and Authentication ............................................................................................................... 24                    | Roles, Services, and Authentication ............................................................................................................... 24                    |
| 4 4.1                                                                                                                                                                     | Authentication Methods ...........................................................................................................................                        | 24                                                                                                                                                                        |
| 4.2                                                                                                                                                                       | Roles...........................................................................................................................................................          | 24                                                                                                                                                                        |
| 4.3                                                                                                                                                                       | Approved Services .....................................................................................................................................                   | 24                                                                                                                                                                        |
| 4.4                                                                                                                                                                       | Non-Approved Services ............................................................................................................................                        | 32                                                                                                                                                                        |
| 4.5                                                                                                                                                                       | External Software/Firmware Loaded .......................................................................................................                                 | 33                                                                                                                                                                        |
|                                                                                                                                                                           | Software/Firmware Security ..........................................................................................................................                     | 34                                                                                                                                                                        |
| 5 5.1                                                                                                                                                                     | Integrity Techniques .................................................................................................................................                    | 34                                                                                                                                                                        |
| 5.2                                                                                                                                                                       | Initiate on Demand                                                                                                                                                        | ................................................................................................................................... 34                                    |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 2 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| 6 Operational Environment .............................................................................................................................. 35   | 6 Operational Environment .............................................................................................................................. 35        | 6 Operational Environment .............................................................................................................................. 35          |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 6.1                                                                                                                                                           | 6.1                                                                                                                                                                | Operational Environment Type and Requirements ................................................................................ 35                                    |
| 6.2                                                                                                                                                           | 6.2                                                                                                                                                                | Configuration Settings and Restrictions .................................................................................................. 35                        |
| 7                                                                                                                                                             | Physical Security ............................................................................................................................................ 36  | Physical Security ............................................................................................................................................ 36    |
| 8                                                                                                                                                             | Non-Invasive Security .................................................................................................................................... 37      | Non-Invasive Security .................................................................................................................................... 37        |
| 9                                                                                                                                                             | Sensitive Security Parameters Management .................................................................................................. 38                     | Sensitive Security Parameters Management .................................................................................................. 38                       |
| 9.1                                                                                                                                                           | 9.1                                                                                                                                                                | Storage Areas ............................................................................................................................................. 38       |
| 9.2                                                                                                                                                           | 9.2                                                                                                                                                                | SSP Input-Output Methods ...................................................................................................................... 38                   |
| 9.3                                                                                                                                                           | 9.3                                                                                                                                                                | SSP Zeroization Methods .......................................................................................................................... 39                |
| 9.4                                                                                                                                                           | 9.4                                                                                                                                                                | SSPs ............................................................................................................................................................ 39 |
| 9.5                                                                                                                                                           | 9.5                                                                                                                                                                | Transitions ................................................................................................................................................. 48     |
| 10                                                                                                                                                            | Self-Tests .................................................................................................................................................... 49 | Self-Tests .................................................................................................................................................... 49   |
| 10.1                                                                                                                                                          | 10.1                                                                                                                                                               | Pre-Operational Self-Tests ................................................................................................................... 49                    |
| 10.2                                                                                                                                                          | 10.2                                                                                                                                                               | Conditional Self-Tests .......................................................................................................................... 49                 |
| 10.3                                                                                                                                                          | 10.3                                                                                                                                                               | Periodic Self-Test Information ............................................................................................................. 58                      |
| 10.4                                                                                                                                                          | 10.4                                                                                                                                                               | Error States ............................................................................................................................................ 62         |
| 10.5                                                                                                                                                          | 10.5                                                                                                                                                               | Operator Initiation of Self-Tests .......................................................................................................... 63                      |
| 11                                                                                                                                                            | Life-Cycle Assurance ................................................................................................................................. 64          | Life-Cycle Assurance ................................................................................................................................. 64            |
| 11.1                                                                                                                                                          | 11.1                                                                                                                                                               | Installation, Initialization, and Startup Procedures ............................................................................ 64                                 |
| 11.2                                                                                                                                                          | 11.2                                                                                                                                                               | Administrator Guidance ....................................................................................................................... 64                    |
| 11.3                                                                                                                                                          | 11.3                                                                                                                                                               | Non-Administrator Guidance .............................................................................................................. 64                         |
| 11.4                                                                                                                                                          | 11.4                                                                                                                                                               | End of Life ............................................................................................................................................. 64         |
| 12                                                                                                                                                            | Mitigation of Other Attacks ....................................................................................................................... 65             | Mitigation of Other Attacks ....................................................................................................................... 65               |
| 12.1                                                                                                                                                          | 12.1                                                                                                                                                               | Attack List ............................................................................................................................................. 65         |
| Appendix A.                                                                                                                                                   | Appendix A.                                                                                                                                                        | Glossary and abbreviations ................................................................................................... 66                                    |
| Appendix B.                                                                                                                                                   | Appendix B.                                                                                                                                                        | References ............................................................................................................................. 68                          |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 3 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

#### List of Tables

| Table 1: Security Levels ................................................................................................................................................ 5     |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Table 2: Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets) ............................... 8                                                     |
| Table 3: Tested Operational Environments - Software, Firmware, Hybrid .............................................................. 8                                          |
| Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid .......................................... 10                                                    |
| Table 5: Modes List and Description ......................................................................................................................... 11                |
| Table 6: Approved Algorithms ................................................................................................................................... 14             |
| Table 7: Vendor-Affirmed Algorithms ...................................................................................................................... 14                   |
| Table 8: Non-Approved, Allowed Algorithms with No Security Claimed .............................................................. 14                                            |
| Table 9: Non-Approved, Not Allowed Algorithms ................................................................................................... 15                            |
| Table 10: Security Function Implementations .......................................................................................................... 19                       |
| Table 11: Entropy Certificates ................................................................................................................................... 21           |
| Table 12: Entropy Sources .......................................................................................................................................... 21         |
| Table 13: Ports and Interfaces .................................................................................................................................... 23          |
| Table 14: Roles ............................................................................................................................................................ 24 |
| Table 15: Approved Services ...................................................................................................................................... 31           |
| Table 16: Non-Approved Services ............................................................................................................................. 33                |
| Table 17: Storage Areas .............................................................................................................................................. 38       |
| Table 18: SSP Input-Output Methods ....................................................................................................................... 38                   |
| Table 19: SSP Zeroization Methods ........................................................................................................................... 39                |
| Table 20: SSP Table 1 ................................................................................................................................................. 44      |
| Table 21: SSP Table 2 ................................................................................................................................................. 48      |
| Table 22: Pre-Operational Self-Tests ......................................................................................................................... 49               |
| Table 23: Conditional Self-Tests ................................................................................................................................ 58            |
| Table 24: Pre-Operational Periodic Information ...................................................................................................... 59                        |
| Table 25: Conditional Periodic Information ............................................................................................................. 62                     |
| 26: Error States ................................................................................................................................................. 62           |
| Table                                                                                                                                                                           |
| List of Figures                                                                                                                                                                 |
| Figure 1: Block Diagram ............................................................................................................................................... 7       |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 4 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 1 General

### 1.1 Overview

This document is the non-proprietary FIPS 140-3 Security Policy for version 3.2 of the SUSE Linux Enterprise NSS Cryptographic Module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 module.

This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and intact and including this notice. Other documentation is proprietary to their authors.

### 1.2 Security Levels

Table 1: Security Levels

|   Section | Title                                   | Security Level   |
|-----------|-----------------------------------------|------------------|
|         1 | General                                 | 1                |
|         2 | Cryptographic module specification      | 1                |
|         3 | Cryptographic module interfaces         | 1                |
|         4 | Roles, services, and authentication     | 1                |
|         5 | Software/Firmware security              | 1                |
|         6 | Operational environment                 | 1                |
|         7 | Physical security                       | N/A              |
|         8 | Non-invasive security                   | N/A              |
|         9 | Sensitive security parameter management | 1                |
|        10 | Self-tests                              | 1                |
|        11 | Life-cycle assurance                    | 1                |
|        12 | Mitigation of other attacks             | 1                |
|           | Overall Level                           | 1                |

### 1.3 Additional Information

In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 5 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 2 Cryptographic Module Specification

### 2.1 Description

####### Purpose and Use:

The SUSE Linux Enterprise NSS Cryptographic Module (hereafter referred to as 'the module') is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support TLS, IKE, PKCS#5, PKCS#7, PKCS#11, PKCS#12, S/MIME, X.509 v3 certificates, and other security standards supporting FIPS 140-3 validated cryptographic algorithms. It combines a vertical stack of Linux components intended to limit the external interface each separate component may provide.

Module Type: Software

Module Embodiment: Multi-Chip Standalone

####### Cryptographic Boundary:

The cryptographic boundary consists only of the libsoftokn3.so and libfreeblpriv3.so libraries along with their associated integrity check values as listed in Section 2.2. If any other NSS API outside of these two libraries is invoked, the user is not interacting with the module specified in this Security Policy.

####### Tested Operational Environment's Physical Perimeter (TOEPP):

The TOEPP of the module is defined as the general-purpose computer on which the module is installed.

The entropy source and the PAA/PAI provided by the processor are located within the module's physical perimeter and outside of the module's cryptographic boundary.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 6 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Figure 1: Block Diagram

### 2.2 Tested and Vendor Affirmed Module Version and Identification

####### Tested Module Identification - Hardware:

N/A for this module.

####### Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets):

| Package or File Name                                                              |   Software/ Firmware Version | Features   | Integrity Test   |
|-----------------------------------------------------------------------------------|------------------------------|------------|------------------|
| libsoftokn3.so, libfreeblpriv3.so on AMD EPYC(TM) 7343 or Intel® Xeon® Gold 5416S |                          3.2 | N/A        | HMAC-SHA-256     |
| libsoftokn3.so, libfreeblpriv3.so on Ampere® Altra® Q80- 30                       |                          3.2 | N/A        | HMAC-SHA-256     |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 7 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 2: Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets)

| Package or File Name                                |   Software/ Firmware Version | Features   | Integrity Test   |
|-----------------------------------------------------|------------------------------|------------|------------------|
| libsoftokn3.so, libfreeblpriv3.so on IBM® Telum(TM) |                          3.2 | N/A        | HMAC-SHA-256     |

####### Tested Module Identification - Hybrid Disjoint Hardware:

N/A for this module.

####### Tested Operational Environments - Software, Firmware, Hybrid:

Table 3: Tested Operational Environments - Software, Firmware, Hybrid

| Operating System                    | Hardware Platform                                                   | Processors              | PAA/PAI   | Hypervisor or Host OS   |   Version(s) |
|-------------------------------------|---------------------------------------------------------------------|-------------------------|-----------|-------------------------|--------------|
| SUSE Linux Enterprise Server 15 SP6 | SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6 | AMD EPYC(TM) 7343       | Yes       | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | SuperMicro SuperChassis 825BTQC-R1K23LPB and Motherboard H12DSi-NT6 | AMD EPYC(TM) 7343       | No        | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | GIGABYTE R152-P30                                                   | Ampere® Altra® Q80-30   | Yes       | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | GIGABYTE R152-P30                                                   | Ampere® Altra® Q80-30   | No        | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | IBM z16 A01                                                         | IBM® Telum(TM)          | Yes       | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | IBM z16 A01                                                         | IBM® Telum(TM)          | No        | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | ASUS RS700-E11-RS4U                                                 | Intel® Xeon® Gold 5416S | Yes       | N/A                     |          3.2 |
| SUSE Linux Enterprise Server 15 SP6 | ASUS RS700-E11-RS4U                                                 | Intel® Xeon® Gold 5416S | No        | N/A                     |          3.2 |

####### Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 8 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Operating System                                 | Hardware Platform                                                                       |
|--------------------------------------------------|-----------------------------------------------------------------------------------------|
| SUSE Linux Enterprise Server for SAP 15SP6       | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Server for SAP 15SP6       | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Desktop 15SP6              | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Desktop 15SP6              | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Base Container Image 15SP6 | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Base Container Image 15SP6 | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Base Container Image 15SP6 | GIGABYTE R152-P30 on Ampere® Altra® Q80-30                                              |
| SUSE Linux Enterprise Base Container Image 15SP6 | IBM z16 A01 on IBM® Telum(TM)                                                           |
| SUSE Linux Enterprise Server 15SP6               | IBM LinuxONE III Model LT1 on z15                                                       |
| SUSE Linux Enterprise Server Real Time 15SP6     | QEMU VM on AMD EPYC(TM) 7773X                                                           |
| SUSE Linux Enterprise Desktop 15SP6              | QEMU VM on AMD EPYC(TM) 7773X                                                           |
| SUSE Linux Enterprise Desktop 15SP6              | QEMU VM on Intel® i7-1195G7                                                             |
| SUSE Linux Enterprise Base Container Image 15SP6 | QEMU VM on Intel® Xeon® Gold 6338                                                       |
| SUSE Linux Enterprise Base Container Image 15SP6 | QEMU VM on Ampere® Altra® Q80-30                                                        |
| SUSE Linux Enterprise Base Container Image 15SP6 | IBM LinuxONE III Model LT1 QEMU VM on z15                                               |
| SUSE Linux Enterprise Server 15SP6               | IBM LinuxONE III Model LT1 QEMU VM on z15                                               |
| SUSE Linux Enterprise Server 15SP6               | QEMU VM on AMD EPYC(TM) 7773X                                                           |
| SUSE Linux Enterprise Server 15SP6               | QEMU VM on Ampere® Altra® Q80-30                                                        |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 9 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid

| Operating System                                 | Hardware Platform                                                                       |
|--------------------------------------------------|-----------------------------------------------------------------------------------------|
| SUSE Linux Enterprise Server 15SP6               | QEMU VM on Intel® Xeon® Gold 6338                                                       |
| SUSE Linux Enterprise Server for SAP 15SP6       | QEMU VM on AMD EPYC(TM) 7773X                                                           |
| SUSE Linux Enterprise Server for SAP 15SP7       | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Server for SAP 15SP7       | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Desktop 15SP7              | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Desktop 15SP7              | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Base Container Image 15SP7 | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Base Container Image 15SP7 | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Base Container Image 15SP7 | GIGABYTE R152-P30 on Ampere® Altra® Q80-30                                              |
| SUSE Linux Enterprise Base Container Image 15SP7 | IBM z16 A01 on IBM® Telum(TM)                                                           |
| SUSE Linux Enterprise Base Container Image 15SP7 | IBM LinuxONE III Model LT1 on z15                                                       |
| SUSE Linux Enterprise Server 15SP7               | IBM LinuxONE III Model LT1 on z15                                                       |
| SUSE Linux Enterprise Server 15SP7               | IBM z16 A01 on IBM® Telum(TM)                                                           |
| SUSE Linux Enterprise Server 15SP7               | ASUS RS700-E11-RS4U on Intel® Xeon® Gold 5416S                                          |
| SUSE Linux Enterprise Server 15SP7               | SuperMicro SuperChassis 825BTQCR1K23LPB and Motherboard H12DSi-NT6 on AMD EPYC(TM) 7343 |
| SUSE Linux Enterprise Server 15SP7               | GIGABYTE R152-P30 on Ampere® Altra® Q80-30                                              |

The module is considered to maintain compliance with the FIPS 140-3 validation for SUSE products when operating on any general-purpose platform/processor that supports the SUSE Linux Enterprise Server operating system per the vendor affirmation from SUSE based on the allowance FIPS 140-3 management manual [FIPS140-3_MM] section 7.9.1 bullet 1 a i).

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 10 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

### 2.3 Excluded Components

There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.

### 2.4 Modes of Operation

####### Modes List and Description:

Table 5: Modes List and Description

| Mode Name     | Description                                                          | Type          | Status Indicator                                                                                                                                                                |
|---------------|----------------------------------------------------------------------|---------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Approved      | Automatically entered whenever an approved service is requested.     | Approved      | Equivalent to the indicator of the requested service ('CKR_OK' for approved DRBG service and NSC_NSSGetFIPSStatus returns CKS_NSS_FIPS_OK (1) for all other approved services). |
| Non- Approved | Automatically entered whenever a non- approved service is requested. | Non- Approved | Equivalent to the indicator of the requested service (DRBG service does not return CKR_OK, NSC_NSSGetFIPSStatus does not return CKS_NSS_FIPS_OK (1) for all other services).    |

After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point.

####### Mode Change Instructions and Status:

The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the service that was requested.

### 2.5 Algorithms

####### Approved Algorithms:

| Algorithm   | CAVP Cert           | Properties                                              | Reference   |
|-------------|---------------------|---------------------------------------------------------|-------------|
| AES-CBC     | A6152, A6154, A6157 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A  |
| AES-CBC-CS1 | A6152, A6154, A6157 | Direction - decrypt, encrypt Key Length - 128, 192, 256 | SP 800-38A  |
| AES-CMAC    | A6152, A6154, A6157 | Direction - Generation Key Length - 128, 192, 256       | SP 800-38B  |
| AES-CTR     | A6152, A6154, A6157 | Direction - Decrypt, Encrypt Key Length - 128, 192, 256 | SP 800-38A  |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 11 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm                | CAVP Cert                         | Properties                                                                                                                                                    | Reference         |
|--------------------------|-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------|
| AES-ECB                  | A6152, A6154, A6157               | Direction - Decrypt, Encrypt Key Length - 128, 192, 256                                                                                                       | SP 800-38A        |
| AES-GCM                  | A6152, A6154, A6155, A6157, A6158 | Direction - Decrypt, Encrypt IV Generation - External, Internal Key Length - 128, 192, 256 IV Generation Mode - 8.2.1, 8.2.2                                  | SP 800-38D        |
| AES-KW                   | A6152, A6154, A6157               | Direction - Decrypt, Encrypt Key Length - 128, 192, 256                                                                                                       | SP 800-38F        |
| AES-KWP                  | A6152, A6154, A6157               | Direction - Decrypt, Encrypt Key Length - 128, 192, 256                                                                                                       | SP 800-38F        |
| ECDSA KeyGen (FIPS186-5) | A6152                             | Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates                                                                                       | FIPS 186-5        |
| ECDSA SigGen (FIPS186-5) | A6152                             | Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512 Component - No                                                            | FIPS 186-5        |
| ECDSA SigVer (FIPS186-5) | A6152                             | Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512                                                                           | FIPS 186-5        |
| Hash DRBG                | A6152                             | Prediction Resistance - No, Yes Mode - SHA2-256                                                                                                               | SP 800-90A Rev. 1 |
| HMAC-SHA2- 224           | A6152, A6156, A6159               | Key Length - Key Length: 112-524288 Increment 8                                                                                                               | FIPS 198-1        |
| HMAC-SHA2- 256           | A6152, A6156, A6159               | Key Length - Key Length: 112-524288 Increment 8                                                                                                               | FIPS 198-1        |
| HMAC-SHA2- 384           | A6152, A6156, A6159               | Key Length - Key Length: 112-524288 Increment 8                                                                                                               | FIPS 198-1        |
| HMAC-SHA2- 512           | A6152, A6156, A6159               | Key Length - Key Length: 112-524288 Increment 8                                                                                                               | FIPS 198-1        |
| KAS-ECC-SSC Sp800-56Ar3  | A6152                             | Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder                                         | SP 800-56A Rev. 3 |
| KAS-FFC-SSC Sp800-56Ar3  | A6152                             | Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192 Scheme - | SP 800-56A Rev. 3 |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 12 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm                  | CAVP Cert   | Properties dhEphem - KAS Role - initiator, responder                                                                                                                                                                                                                                | Reference         |
|----------------------------|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------|
| KDF IKEv1 (CVL)            | A6153       | Authentication Method - Digital Signature, Pre-shared Key Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512 Preshared Key Length - Preshared Key Length: 8, 384, 768, 8192 | SP 800-135 Rev. 1 |
| KDF IKEv2 (CVL)            | A6153       | Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224, 2048, 8192 Derived Keying Material Length - Derived Keying Material Length: 1056, 3072 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2- 384, SHA2-512                                              | SP 800-135 Rev. 1 |
| KDF SP800-108              | A6152       | KDF Mode - Counter, Double Pipeline Iteration, Feedback Supported Lengths - Supported Lengths: 112-4096 Increment 8                                                                                                                                                                 | SP 800-108 Rev. 1 |
| KDF TLS (CVL)              | A6152       | TLS Version - v1.0/1.1                                                                                                                                                                                                                                                              | SP 800-135 Rev. 1 |
| PBKDF                      | A6152       | Iteration Count - Iteration Count: 1000-10000 Increment 1 Password Length - Password Length: 8-128 Increment 1                                                                                                                                                                      | SP 800-132        |
| RSA KeyGen (FIPS186-5)     | A6152       | Key Generation Mode - probable Modulo - 2048, 3072, 4096, 6144, 8192 Primality Tests - 2pow100 Private Key Format - standard                                                                                                                                                        | FIPS 186-5        |
| RSA SigGen (FIPS186-5)     | A6152       | Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss                                                                                                                                                                                                                           | FIPS 186-5        |
| RSA SigVer (FIPS186-2)     | A6152       | Signature Type - PKCS 1.5, PKCSPSS Modulo - 1536                                                                                                                                                                                                                                    | FIPS 186-4        |
| RSA SigVer (FIPS186-4)     | A6152       | Signature Type - PKCS 1.5, PKCSPSS Modulo - 1024                                                                                                                                                                                                                                    | FIPS 186-4        |
| RSA SigVer (FIPS186-5)     | A6152       | Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss                                                                                                                                                                                                                           | FIPS 186-5        |
| Safe Primes Key Generation | A6152       | Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192                                                                                                                                                    | SP 800-56A Rev. 3 |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 13 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 6: Approved Algorithms

| Algorithm                  | CAVP Cert           | Properties                                                                            | Reference         |
|----------------------------|---------------------|---------------------------------------------------------------------------------------|-------------------|
| SHA2-224                   | A6152, A6156, A6159 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4        |
| SHA2-256                   | A6152, A6156, A6159 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4        |
| SHA2-384                   | A6152, A6156, A6159 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4        |
| SHA2-512                   | A6152, A6156, A6159 | Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2, 4, 8 | FIPS 180-4        |
| TLS v1.2 KDF RFC7627 (CVL) | A6152               | Hash Algorithm - SHA2-256, SHA2-384, SHA2-512                                         | SP 800-135 Rev. 1 |

####### Vendor-Affirmed Algorithms:

Table 7: Vendor-Affirmed Algorithms

| Name                                          | Properties          | Implementation   | Reference                                                |
|-----------------------------------------------|---------------------|------------------|----------------------------------------------------------|
| Symmetric Cryptographic Key Generation (CKG)  | Key type:Symmetric  | N/A              | SP 800-133 Rev. 2, section 4, example 1, and section 6.1 |
| Asymmetric Cryptographic Key Generation (CKG) | Key type:Asymmetric | N/A              | SP 800-133 Rev. 2, section 4, example 1                  |

####### Non-Approved, Allowed Algorithms:

N/A for this module.

####### Non-Approved, Allowed Algorithms with No Security Claimed:

Table 8: Non-Approved, Allowed Algorithms with No Security Claimed

| Name   | Caveat                                                   | Use and Function                             |
|--------|----------------------------------------------------------|----------------------------------------------|
| MD5    | Only allowed as the PRF in TLSv1.0 and v1.1 per IG 2.4.A | Message digest used in TLSv1.0/v1.1 KDF only |

####### Non-Approved, Not Allowed Algorithms:

| Name                                                                                                                                 | Use and Function       |
|--------------------------------------------------------------------------------------------------------------------------------------|------------------------|
| MD2, MD5, SHA-1                                                                                                                      | Message digest         |
| RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(-Poly1305)                                                                            | Encryption, Decryption |
| AES GCM (external IV)                                                                                                                | Encryption             |
| CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (< 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation) | Message authentication |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 14 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 9: Non-Approved, Not Allowed Algorithms

| Name                                                                                                                            | Use and Function                             |
|---------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------|
| KDF using only MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA- 512, DES, Triple-DES, AES, Camellia                             | Key derivation                               |
| ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret                                                                | Key derivation                               |
| KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with < 112-bit keys                                          | Key derivation                               |
| KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5)                                                                                      | Key derivation                               |
| PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or < 112-bit keys, PKCS#5 PBE, PKCS#12 PBE | Password-based key derivation                |
| J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519                                                                           | Shared secret computation                    |
| DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1)                           | Signature generation, Signature verification |
| RSA (< 2048-bit keys)                                                                                                           | Signature generation                         |
| RSA (< 1024-bit keys)                                                                                                           | Signature verification                       |
| RSA (data encryption / decryption)                                                                                              | Asymmetric encryption, Asymmetric decryption |
| DSA                                                                                                                             | Parameter generation, Parameter verification |
| DSA, Diffie Hellman (FIPS 186-type groups), RSA (< 2048 bits), RSA (> 4096 bits), Ed25519, X25519                               | Key pair generation                          |
| Symmetric key generation (< 112 bits)                                                                                           | Secret key generation                        |

### 2.6 Security Function Implementations

| Name                | Type      | Description          | Properties   | Algorithms                                                                                                                      |
|---------------------|-----------|----------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------|
| Encryption with AES | BC-UnAuth | Encryption using AES |              | AES-CBC: (A6152, A6154, A6157) AES-CBC-CS1: (A6152, A6154, A6157) AES-CTR: (A6152, A6154, A6157) AES-ECB: (A6152, A6154, A6157) |
| Decryption with AES | BC-UnAuth | Decryption using AES |              | AES-CBC: (A6152, A6154, A6157) AES-CBC-CS1: (A6152, A6154, A6157)                                                               |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 15 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Type       | Description                              | Properties                                                                                                                                                                               | Algorithms AES-CTR: (A6152, A6154, A6157) AES-ECB: (A6152, A6154, A6157)                                  |
|-----------------------------------|------------|------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------|
| Authenticated Encryption with AES | BC-Auth    | Authenticated encryption using AES       |                                                                                                                                                                                          | AES-KW: (A6152, A6154, A6157) AES-KWP: (A6152, A6154, A6157) AES-GCM: (A6152, A6154, A6155, A6157, A6158) |
| Authenticated Decryption with AES | BC-Auth    | Authenticated decryption using AES       |                                                                                                                                                                                          | AES-KW: (A6152, A6154, A6157) AES-KWP: (A6152, A6154, A6157) AES-GCM: (A6152, A6154, A6155, A6157, A6158) |
| Key Derivation with PBKDF2        | PBKDF      | Key derivation using PBKDF2              |                                                                                                                                                                                          | PBKDF: (A6152)                                                                                            |
| Key Derivation with KBKDF         | KBKDF      | Key derivation using KBKDF               |                                                                                                                                                                                          | KDF SP800-108: (A6152)                                                                                    |
| Key Derivation with TLS KDF       | KAS-135KDF | Key derivation using TLS 1.0/1.1/1.2 KDF |                                                                                                                                                                                          | KDF TLS: (A6152) TLS v1.2 KDF RFC7627: (A6152)                                                            |
| Key Derivation with IKE KDF       | KAS-135KDF | Key derivation using IKEv1/IKEv2 KDF     |                                                                                                                                                                                          | KDF IKEv1: (A6153) KDF IKEv2: (A6153)                                                                     |
| Key Wrapping with AES (KTS)       | KTS-Wrap   | Key wrapping using AES                   | Standard:SP 800- 38D and SP 800- 38F IG D.G:approved key wrapping method Key confirmation:no Caveat:Key establishment methodology provides between 128 and 256 bits of security strength | AES-KW: (A6152, A6154, A6157) AES-KWP: (A6152, A6154, A6157)                                              |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 16 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                                       | Type          | Description                                 | Properties                                                                                                                                                                                 | Algorithms                                                                                                                                          |
|--------------------------------------------|---------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| Key Unwrapping with AES (KTS)              | KTS-Unwrap    | Key unwrapping using AES                    | Standard:SP 800- 38D and SP 800- 38F IG D.G:approved key unwrapping method Key confirmation:no Caveat:Key establishment methodology provides between 128 and 256 bits of security strength | AES-KW: (A6152, A6154, A6157) AES-KWP: (A6152, A6154, A6157) AES-GCM: (A6152, A6154, A6155, A6157, A6158)                                           |
| Message Authentication with HMAC           | MAC           | Message authentication using HMAC           |                                                                                                                                                                                            | HMAC-SHA2-224: (A6152, A6156, A6159) HMAC-SHA2-256: (A6152, A6156, A6159) HMAC-SHA2-384: (A6152, A6156, A6159) HMAC-SHA2-512: (A6152, A6156, A6159) |
| Message Authentication with CMAC           | MAC           | Message authentication using CMAC           |                                                                                                                                                                                            | AES-CMAC: (A6152, A6154, A6157)                                                                                                                     |
| Random Number Generation with Hash_DRBG    | DRBG          | Random number generation using Hash_DRBG    |                                                                                                                                                                                            | Hash DRBG: (A6152)                                                                                                                                  |
| Shared Secret Computation with KAS-ECC-SSC | KAS-SSC       | Shared secret computation using KAS-ECC-SSC |                                                                                                                                                                                            | KAS-ECC-SSC Sp800-56Ar3: (A6152)                                                                                                                    |
| Shared Secret Computation with KAS-FFC-SSC | KAS-SSC       | Shared secret computation using KAS-FFC-SSC |                                                                                                                                                                                            | KAS-FFC-SSC Sp800-56Ar3: (A6152)                                                                                                                    |
| Signature Generation with RSA              | DigSig-SigGen | Signature generation using RSA              |                                                                                                                                                                                            | RSA SigGen (FIPS186-5): (A6152)                                                                                                                     |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 17 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                                         | Type                    | Description                                          | Properties   | Algorithms                                                                                               |
|----------------------------------------------|-------------------------|------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------|
| Signature Generation with ECDSA              | DigSig-SigGen           | Signature generation using ECDSA                     |              | ECDSA SigGen (FIPS186-5): (A6152)                                                                        |
| Signature Verification with RSA (legacy use) | DigSig-SigVer           | Signature verification using RSA using legacy moduli |              | RSA SigVer (FIPS186-2): (A6152) RSA SigVer (FIPS186-4): (A6152)                                          |
| Signature Verification with RSA              | DigSig-SigVer           | Signature verification using RSA                     |              | RSA SigVer (FIPS186-5): (A6152)                                                                          |
| Signature Verification with ECDSA            | DigSig-SigVer           | Signature verification using ECDSA                   |              | ECDSA SigVer (FIPS186-5): (A6152)                                                                        |
| Symmetric Key Generation with Hash_DRBG      | CKG                     | Direct symmetric key generation using Hash_DRBG      |              | Hash DRBG: (A6152) Symmetric Cryptographic Key Generation (CKG): () Key type: Symmetric                  |
| Key Pair Generation with RSA                 | AsymKeyPair- KeyGen CKG | Key pair generation using RSA                        |              | RSA KeyGen (FIPS186-5): (A6152) Asymmetric Cryptographic Key Generation (CKG): () Key type: Asymmetric   |
| Key Pair Generation with ECDSA               | AsymKeyPair- KeyGen CKG | Key pair generation using ECDSA                      |              | ECDSA KeyGen (FIPS186-5): (A6152) Asymmetric Cryptographic Key Generation (CKG): () Key type: Asymmetric |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 18 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 10: Security Function Implementations

| Name                                 | Type                    | Description                           | Properties   | Algorithms                                                                                                                      |
|--------------------------------------|-------------------------|---------------------------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------|
| Key Pair Generation with Safe Primes | AsymKeyPair- KeyGen CKG | Key pair generation using Safe Primes |              | Safe Primes Key Generation: (A6152) Asymmetric Cryptographic Key Generation (CKG): () Key type: Asymmetric                      |
| Message Digest with SHA              | SHA                     | Message digest using SHA              |              | SHA2-224: (A6152, A6156, A6159) SHA2-256: (A6152, A6156, A6159) SHA2-384: (A6152, A6156, A6159) SHA2-512: (A6152, A6156, A6159) |

### 2.7 Algorithm Specific Information

#### 2.7.1 AES-GCM IV

The Crypto Officer shall consider the following requirements and restrictions when using the module.

For TLS 1.2, the module offers the AES-GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. NSS is compliant with SP 800-52 Rev. 2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288.

The module does not implement the TLS protocol. The module's implementation of AES-GCM is used together with an application that runs outside the module's cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key.

In the event the module's power is lost and restored, the consuming application must ensure that a new key for use with the AES-GCM key encryption or decryption under this scenario shall be established.

Alternatively, the Crypto Officer can use the module's API to perform AES-GCM encryption using internal IV generation that complies with Scenario 2 of the IG C.H. These IVs are always at least 96 bits and generated using the approved DRBG internal to the module's boundary.

Additionally, the module offers an internal deterministic IV generation mode compliant with Scenario 3 of FIPS 140-3 IG C.H. The size of the fixed (name) field used by this IV generation mode is at least 32 bits. The module then internally generates a 32 bit or longer deterministic non-repetitive counter. The module explicitly ensures that this counter is monotonically increasing at each invocation of the AES-GCM for the same encryption key, and that this counter does not exhaust all its possible values. The generated GCM IV is at least 96 bits in length.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 19 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Finally, for TLS 1.3, the AES-GCM implementation uses the context of Scenario 5 of FIPS 140-3 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC 8446 of August 2018, using the cipher-suites that explicitly select AES-GCM as the encryption/decryption cipher (Appendix B.4 of RFC 8446). The module supports acceptable AES-GCM cipher suites from Section 3.3.1 of SP800-52r2. TLS 1.3 employs separate 64-bit sequence numbers, one for protocol records that are received, and one for protocol records that are sent to a peer. These sequence numbers are set at zero at the beginning of a TLS 1.3 connection and each time when the AES-GCM key is changed. After reading or writing a record, the respective sequence number is incremented by one. The protocol specification determines that the sequence number should not wrap, and if this condition is observed, then the protocol implementation must either trigger a re-key of the session (i.e., a new key for AESGCM), or terminate the connection.

In case the module's power is lost and then restored, a new key for use with the AES-GCM encryption/decryption shall be established.

#### 2.7.2 Key Derivation using SP 800-132 PBKDF2

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following requirements shall be met:

- Derived keys shall only be used in storage applications. The MK shall not be used for other purposes. The module enforces the length of the MK or DPK to be of 112 bits or more for the service to be approved.
- Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
- The minimum length of the password or passphrase accepted by the module is 20 characters. The probability of guessing the value is estimated to be at most 1/62 20  = 4 x 10 -36 , when the password is a combination of lowercase, uppercase, and numeric characters. If the password solely consists of digits, the probability of guessing the value is estimated to be 10 -20 . Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks.
- A portion of the salt shall be generated randomly using the SP 800-90A Rev. 1 DRBG provided by the module. The module restricts minimum length to 128 bits.
- The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The module only allows minimum iteration count to be 1000.

#### 2.7.3 SP 800-56A Rev. 3 Assurances

The module provides shared secret computation (KAS-FFC-SSC and KAS-ECC-SSC) compliant with SP80056Ar3, in accordance with scenario 2 (1) of FIPS 140-3 IG D.F.

To comply with the assurances found in Section 5.6.2 of SP 800-56A Rev. 3, the operator must use the module together with an application that implements the TLS protocol. Additionally, the module's approved Key Pair Generation service (see Section 4.3) must be used to generate ephemeral Diffie-Hellman or EC Diffie-Hellman key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the full public key validation of the generated public key.

The module's shared secret computation service will internally perform the full public key validation of the peer public key, complying with Section 5.6.2.2.2 of SP 800-56A Rev. 3.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 20 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

#### 2.7.4 RSA Approved Modulus Size

As allowed by FIPS 140-3 IG C.F, the module implements approved RSA signature verification with 1024, 1280, 1536 and 1792-bit moduli. The 1024-bit modulus has been CAVP tested for RSA signature verification in compliance with FIPS 186-4, while the 1536-bit modulus has been CAVP tested for RSA signature verification in compliance with FIPS 186-2. The 1280 and 1792-bit modulus are approved for FIPS 186-2 signature verification, but are untested as no CAVP testing is available for these moduli.

For all other approved moduli (namely 2048, 3072, and 4096 bit keys) supported by the module, RSA key pair generation, signature generation, and signature verification are approved and CAVP tested in compliance with FIPS 186-5.

#### 2.7.5 Legacy Use

Digital signature using RSA with 1024, 1280, 1536, 1792-bit moduli is allowed for legacy use only.

These legacy algorithms can only be used on data that was generated prior to the Legacy Date specified in FIPS 140-3 IG C.M.

#### 2.7.6 Key Agreement

The module does not establish SSPs using an approved key agreement scheme (KAS). However, it does offer some or all of the underlying KAS cryptographic functionality to be used by an external operator/application as part of an approved KAS.

### 2.8 RBG and Entropy

Table 11: Entropy Certificates

| Cert Number   | Vendor Name   |
|---------------|---------------|
| E200          | SUSE LLC      |

Table 12: Entropy Sources

| Name                                          | Type          | Operational Environment                                                                                                                                                                                                                       | Sample Size   | Entropy per Sample   | Conditioning Component   |
|-----------------------------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|----------------------|--------------------------|
| SUSE Userspace Standalone CPU Time Jitter RNG | Non- Physical | SUSE Linux Enterprise Server 15 SP6 on AMD EPYC(TM) 7343; SUSE Linux Enterprise Server 15 SP6 on Ampere® Altra® Q80-30; SUSE Linux Enterprise Server 15 SP6 on Intel® Xeon® Gold 5416S; SUSE Linux Enterprise Server 15 SP6 on IBM® Telum(TM) | 256 bits      | 256 bits             | SHA3-256 (A5411)         |

The module employs a Deterministic Random Bit Generator (DRBG) implementation based on SP 800-90A Rev. 1. This DRBG is used internally by the module (e.g. to generate symmetric keys, seeds for asymmetric key pairs, and random numbers for security functions). It can also be accessed using the specified API functions.

The DRBG implemented is a SHA-256 Hash_DRBG, seeded by the entropy source described in the table above. It does not employ prediction resistance.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 21 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

The DRBG is instantiated with an 880-bits long entropy input (corresponding to 880 bits of entropy). Additionally, the DRBG is reseeded with a 440-bit long entropy input entropy input length greater than 256 bits. The output is truncated to get the entropy input string which is not

(corresponding to 440 bits of entropy). Outputs of multiple GetEntropy() calls are concatenated to receive the a multiple of 256.

The module complies with the Public Use Document for ESV certificate E200 by reading entropy data from the jent_read_entropy() function. The operational environment on the ESV certificate is identical to the operating system described in this document. which implements the entropy source (outside the module's cryptographic boundary). Thus, the module is compliant with scenario 1 (b) of IG 9.3.A. There are no maintenance requirements for the entropy source. There are no maintenance requirements for the entropy source.

### 2.9 Key Generation

The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800-133r2 as specified in Section 2.6.

When random values are required, they are obtained from the SP 800-90Ar1 approved DRBG, compliant with Section 4 of SP 800-133r2.

Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service.

### 2.10 Key Establishment

The module implements shared secret computation methods as listed in the Security Function Implementation table in Section 2.6.

### 2.11 Industry Protocols

For KAS-FFC-SSC, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919 (TLS) as listed in Section 2.10. Note that the module only implements key pair generation and verification, and shared secret computation. No other part of the IKE or TLS protocols is implemented (with the exception of the TLS 1.0/1.1 KDF, TLS 1.2 KDF (RFC 7627), IKEv1 KDF, and IKEv2 KDF).

TLS 1.0/1.1 KDF, TLS 1.2 KDF (RFC 7627), IKEv1 KDF, and IKEv2 KDF implementations shall only be used to generate secret keys in the context of the TLS and IKE protocols respectively.

AES-GCM with internal IV generation is offered in the approved mode compliant with TLS 1.2 (RFC 5288) and TLS 1.3 (RFC 8446). This functionality shall only be used in conjunction with the TLS protocol.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 22 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 3 Cryptographic Module Interfaces

### 3.1 Ports and Interfaces

Table 13: Ports and Interfaces

| Physical Port   | Logical Interface(s)   | Data That Passes                                           |
|-----------------|------------------------|------------------------------------------------------------|
| N/A             | Data Input             | API input parameters                                       |
| N/A             | Data Output            | API output parameters                                      |
| N/A             | Control Input          | API function calls, API input parameters for control input |
| N/A             | Status Output          | API return codes                                           |

The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module does not implement a control output interface.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 23 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 4 Roles, Services, and Authentication

### 4.1 Authentication Methods

The module does not support authentication for roles.

### 4.2 Roles

| Name           | Type   | Operator Type   | Authentication Methods   |
|----------------|--------|-----------------|--------------------------|
| Crypto Officer | Role   | CO              | None                     |

Table 14: Roles

No support is provided for multiple concurrent operators.

### 4.3 Approved Services

| Name                      | Descriptio n                            | Indicator            | Inputs                             | Outputs             | Security Functions                | SSP Access                                                         |
|---------------------------|-----------------------------------------|----------------------|------------------------------------|---------------------|-----------------------------------|--------------------------------------------------------------------|
| Encryption                | Encrypt a plaintext                     | CKS_NSS_FIPS_O K (1) | AES Key, IV, plaintext             | Ciphertext          | Encryption with AES               | Crypto Officer - AES Key: W,E                                      |
| Decryption                | Decrypt a ciphertext                    | CKS_NSS_FIPS_O K (1) | AES Key, IV, ciphertext            | Plaintext           | Decryption with AES               | Crypto Officer - AES Key: W,E                                      |
| Authenticated Encryption  | Encrypt a plaintext                     | CKS_NSS_FIPS_O K (1) | AES Key, IV, plaintext             | Ciphertext, MAC tag | Authenticated Encryption with AES | Crypto Officer - AES Key: W,E                                      |
| Authenticated Decryption  | Decrypt a ciphertext                    | CKS_NSS_FIPS_O K (1) | AES Key, IV, MAC tag, ciphertext   | Plaintext or fail   | Authenticated Decryption with AES | Crypto Officer - AES Key: W,E                                      |
| Key Derivation from a KDK | Derive a key from a key- derivation key | CKS_NSS_FIPS_O K (1) | Key- Derivation Key, output length | KBKDF Derived Key   | Key Derivation with KBKDF         | Crypto Officer - Key- Derivation Key: W,E - KBKDF Derived Key: G,R |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 24 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                           | Descriptio n                                   | Indicator            | Inputs                                                  | Outputs                       | Security Functions            | SSP Access                                                                                     |
|--------------------------------|------------------------------------------------|----------------------|---------------------------------------------------------|-------------------------------|-------------------------------|------------------------------------------------------------------------------------------------|
| Key Derivation with IKE KDF    | Derive a key from a shared secre using IKE KDF | CKS_NSS_FIPS_O K (1) | Shared secret, output length                            | IKE Derived Key               | Key Derivation with IKE KDF   | Crypto Officer - Shared Secret: W,E - IKE Derived Key: G,R                                     |
| Key Derivation with TLS KDF    | Derive a key from a shared secre using TLS KDF | CKS_NSS_FIPS_O K (1) | TLS Pre- Master Secret, output length                   | TLS Derived Key               | Key Derivation with TLS KDF   | Crypto Officer - TLS Pre- Master Secret: W,E - TLS Master Secret: G,E,Z - TLS Derived Key: G,R |
| Password- Based Key Derivation | Derive a key from a password                   | CKS_NSS_FIPS_O K (1) | Password, salt, iteration count, output length          | PBKDF2 Derived Key            | Key Derivation with PBKDF2    | Crypto Officer - Password: W,E - PBKDF2 Derived Key: G,R                                       |
| Key Wrapping                   | Wrap a CSP                                     | CKS_NSS_FIPS_O K (1) | AES Key- Encryptio n Key, any CSP (other than Password) | Wrapped CSP                   | Key Wrapping with AES (KTS)   | Crypto Officer - AES Key- Encryption Key: W,E - Wrapped CSP: R                                 |
| Key Unwrapping                 | Unwrap a CSP                                   | CKS_NSS_FIPS_O K (1) | AES Key- Decryptio n Key, Wrapped CSP                   | Any CSP (other than Password) | Key Unwrapping with AES (KTS) | Crypto Officer - AES Key- Decryption Key: W,E - Wrapped CSP: W,E                               |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 25 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                                  | Descriptio n             | Indicator            | Inputs                                         | Outputs       | Security Functions                          | SSP Access                                                                                   |
|---------------------------------------|--------------------------|----------------------|------------------------------------------------|---------------|---------------------------------------------|----------------------------------------------------------------------------------------------|
| Message Authenticatio n with HMAC     | Compute a MAC tag        | CKS_NSS_FIPS_O K (1) | Message, HMAC Key                              | MAC tag       | Message Authenticatio n with HMAC           | Crypto Officer - HMAC Key: W,E                                                               |
| Message Authenticatio n with CMAC     | Compute a MAC tag        | CKS_NSS_FIPS_O K (1) | Message, AES Key                               | MAC tag       | Message Authenticatio n with CMAC           | Crypto Officer - AES Key: W,E                                                                |
| Message Digest                        | Compute a message digest | CKS_NSS_FIPS_O K (1) | Message                                        | Digest value  | Message Digest with SHA                     | Crypto Officer                                                                               |
| Random Number Generation              | Generate random bytes    | CKR_OK               | Output length                                  | Random bytes  | Random Number Generation with Hash_DRBG     | Crypto Officer - Entropy Input: W,E,Z - DRBG Seed: G,E,Z - DRBG Internal State (V, C): G,W,E |
| KAS-FFC-SSC Shared Secret Computation | Compute a shared secret  | CKS_NSS_FIPS_O K (1) | FFC Private Key (owner), FFC Public Key (peer) | Shared Secret | Shared Secret Computation with KAS- FFC-SSC | Crypto Officer - FFC Private Key: W,E - FFC Public Key: W,E - Shared Secret: G,R             |
| EC Shared Secret Computation          | Compute a shared secret  | CKS_NSS_FIPS_O K (1) | EC Private Key (owner), EC Public Key (peer)   | Shared Secret | Shared Secret Computation with KAS- ECC-SSC | Crypto Officer - EC Private Key: W,E - EC Public Key: W,E - Shared Secret: G,R               |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 26 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                                 | Descriptio n         | Indicator            | Inputs                             | Outputs                                                             | Security Functions                                                           | SSP Access                                                                                                                                  |
|--------------------------------------|----------------------|----------------------|------------------------------------|---------------------------------------------------------------------|------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
| Signature Generation with RSA        | Generate a signature | CKS_NSS_FIPS_O K (1) | RSA Private Key, message           | Signature                                                           | Signature Generation with RSA                                                | Crypto Officer - RSA Private Key: W,E                                                                                                       |
| Signature Generation with ECDSA      | Generate a signature | CKS_NSS_FIPS_O K (1) | EC Private Key, message            | Signature                                                           | Signature Generation with ECDSA                                              | Crypto Officer - EC Private Key: W,E                                                                                                        |
| Signature Verification with RSA      | Verify a signature   | CKS_NSS_FIPS_O K (1) | RSA Public Key, message, signature | Pass/fail                                                           | Signature Verification with RSA Signature Verification with RSA (legacy use) | Crypto Officer - RSA Public Key: W,E                                                                                                        |
| Signature Verification with ECDSA    | Verify a signature   | CKS_NSS_FIPS_O K (1) | EC Public Key, message, signature  | Pass/fail                                                           | Signature Verification with ECDSA                                            | Crypto Officer - EC Public Key: W,E                                                                                                         |
| Key Pair Generation with Safe Primes | Generate a key pair  | CKS_NSS_FIPS_O K (1) | Group                              | Module- generated FFC Public Key, Module- generated FFC Private Key | Key Pair Generation with Safe Primes                                         | Crypto Officer - Module- generated FFC Private Key: G,R - Module- generated FFC Public Key: G,R - Intermediat e key generation value: G,E,Z |
| Key Pair Generation with RSA         | Generate a key pair  | CKS_NSS_FIPS_O K (1) | Modulus size                       | Module- generated RSA Public Key, Module-                           | Key Pair Generation with RSA                                                 | Crypto Officer - Module- generated RSA Private Key: G,R                                                                                     |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 27 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                           | Descriptio n                                    | Indicator            | Inputs   | Outputs                                                           | Security Functions                      | SSP Access                                                                                                                                |
|--------------------------------|-------------------------------------------------|----------------------|----------|-------------------------------------------------------------------|-----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
|                                |                                                 |                      |          | generated RSA Private Key                                         |                                         | - Module- generated RSA Public Key: G,R - Intermediat e key generation value: G,E,Z                                                       |
| Key Pair Generation with ECDSA | Generate a key pair                             | CKS_NSS_FIPS_O K (1) | Curve    | Module- generated EC Public Key, Module- generated EC Private Key | Key Pair Generation with ECDSA          | Crypto Officer - Module- generated EC Private Key: G,R - Module- generated EC Public Key: G,R - Intermediat e key generation value: G,E,Z |
| Symmetric Key Generation       | Generate a secret key                           | CKS_NSS_FIPS_O K (1) | Key size | Symmetric Key                                                     | Symmetric Key Generation with Hash_DRBG | Crypto Officer - Symmetric Key: G,R                                                                                                       |
| Show Version                   | Return the module name and version informatio n | None                 | N/A      | Module name and version informatio n                              | None                                    | Crypto Officer                                                                                                                            |
| Show Status                    | Return the module status                        | None                 | N/A      | Module status                                                     | None                                    | Crypto Officer                                                                                                                            |
| Self-Test                      | Perform the CASTs and                           | None                 | N/A      | Pass/fail                                                         | Message Digest with SHA                 | Crypto Officer                                                                                                                            |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 28 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name   | Descriptio n    | Indicator   | Inputs   | Outputs   | Security Functions                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | SSP Access   |
|--------|-----------------|-------------|----------|-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|
|        | integrity tests |             |          |           | Message Authenticatio n with HMAC Encryption with AES Decryption with AES Authenticated Encryption with AES Authenticated Decryption with AES Message Authenticatio n with CMAC Key Derivation with KBKDF Key Derivation with TLS KDF Key Derivation with IKE KDF Key Derivation with PBKDF2 Shared Secret Computation with KAS- FFC-SSC Shared Secret Computation with KAS- ECC-SSC Signature Generation with RSA Signature Verification with RSA Signature Generation with ECDSA |              |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 29 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name        | Descriptio n     | Indicator   | Inputs   | Outputs   | Security Functions                | SSP Access                                                                                                                                                                                                                                                                                                                                         |
|-------------|------------------|-------------|----------|-----------|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|             |                  |             |          |           | Signature Verification with ECDSA |                                                                                                                                                                                                                                                                                                                                                    |
| Zeroization | Zeroize all SSPs | N/A         | Any SSP  | None      | None                              | Crypto Officer - AES Key: Z - AES Key- Encryption Key: Z - AES Key- Decryption Key: Z - HMAC Key: Z - Key- Derivation Key: Z - Shared Secret: Z - Password: Z - KBKDF Derived Key: Z - PBKDF2 Derived Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Derived Key: Z - IKE Derived Key: Z - Entropy Input: Z - DRBG Seed: Z - DRBG |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 30 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name   | Descriptio n   | Indicator   | Inputs   | Outputs   | Security Functions   | SSP Access                                                                                                                                                                                |
|--------|----------------|-------------|----------|-----------|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|        |                |             |          |           |                      | Internal State (V, C): Z - FFC Private Key: Z - FFC Public Key: Z - EC Private Key: Z - EC Public Key: Z - RSA Private Key: Z - RSA Public Key: Z - Intermediat e key generation value: Z |

####### Table 15: Approved Services

The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). For the above table, the convention below applies when specifying the access permissions (types) that the service has for each SSP.

- Generate (G): The module generates or derives the SSP.
- Read (R): The SSP is read from the module (e.g. the SSP is output).
- Write (W): The SSP is updated, imported, or written to the module.
- Execute (E): The module uses the SSP in performing a cryptographic operation.
- Zeroize (Z): The module zeroizes the SSP.

To interact with the module, a calling application must use the FIPS token APIs provided by libsoftokn3.so. The FIPS token API layer can be used to retrieve the approved service indicator for the module. This indicator consists of three independent service indicators:

1. The session indicator, which must be used for all cryptographic services except the key (pair) generation and key derivation services. It can be accessed by invoking the NSC_NSSGetFIPSStatus function with the CKT_NSS_SESSION_LAST_CHECK parameter. If the output parameter is set to CKS_NSS_FIPS_OK (1), the service was approved.
2. The object indicator, which must be used for the key (pair) generation and key derivation services. It can be accessed by invoking the NSC_NSSGetFIPSStatus function with the

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 31 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

- CKT_NSS_OBJECT_CHECK parameter and the output derived key. If the output parameter is set to CKS_NSS_FIPS_OK (1), the service was approved.
3. The DRBG service indicator, which must be used for the DRBG service. It can be accessed by invoking the C_SeedRandom or C_GenerateRandom functions. If any of these functions returns CKR_OK, the service was approved.

The above-described behavior maps to example scenario 3 of FIPS140-3 IG 2.4.C.

### 4.4 Non-Approved Services

| Name                          | Description                                               | Algorithms                                                                                                                                                                                                                                                                                             | Role   |
|-------------------------------|-----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
| Message Digest                | Compute a message digest                                  | MD2, MD5, SHA-1                                                                                                                                                                                                                                                                                        | CO     |
| Encryption                    | Encrypt a plaintext                                       | RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305) AES GCM (external IV)                                                                                                                                                                                                                       | CO     |
| Decryption                    | Decrypt a ciphertext                                      | RC4, DES, Triple-DES, CDMF, Camellia, ChaCha20(- Poly1305)                                                                                                                                                                                                                                             | CO     |
| Message Authentication        | Compute a MAC tag                                         | CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96, HMAC (MD2, MD5, SHA-1), HMAC (< 112-bit keys), HMAC/SSLv3 MAC (constant-time implementation)                                                                                                                                                                   | CO     |
| Key Derivation                | Derive a key from a key-derivation key or a shared secret | KDF using only MD2, MD5, SHA-1, SHA-224, SHA- 256, SHA-384, SHA-512, DES, Triple-DES, AES, Camellia ANS X9.63 KDF, SSL 3 PRF, TLS KDF without extended master secret KBKDF, HKDF, TLS 1.0/1.1 KDF, TLS 1.2 KDF, IKEv1 PRF and IKEv2 PRF with < 112-bit keys KBKDF, IKEv1 PRF, and IKEv2 PRF (MD2, MD5) | CO     |
| Password-Based Key Derivation | Derive a key from a password                              | PBKDF2 with parameters (password, salt, iterations) not complying with section 2.7.2 or < 112-bit keys, PKCS#5 PBE, PKCS#12 PBE                                                                                                                                                                        | CO     |
| Shared Secret Computation     | Compute a shared secret                                   | J-PAKE, KAS-FFC-SSC with FIPS 186-type groups, X25519                                                                                                                                                                                                                                                  | CO     |
| Signature Generation          | Generate a signature                                      | DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (< 2048-bit keys)                                                                                                                                                                            | CO     |
| Signature Verification        | Verify a signature                                        | DSA, RSA (primitive), RSA (PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1), ECDSA (component), ECDSA (SHA-1) RSA (< 1024-bit keys)                                                                                                                                                                            | CO     |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 32 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                   | Description                | Algorithms                                                                                        | Role   |
|------------------------|----------------------------|---------------------------------------------------------------------------------------------------|--------|
| Asymmetric Encryption  | Encrypt a plaintext        | RSA (data encryption / decryption)                                                                | CO     |
| Asymmetric Decryption  | Decrypt a plaintext        | RSA (data encryption / decryption)                                                                | CO     |
| Parameter Generation   | Generate domain parameters | DSA                                                                                               | CO     |
| Parameter Verification | Verify domain parameters   | DSA                                                                                               | CO     |
| Key Pair Generation    | Generate a key pair        | DSA, Diffie Hellman (FIPS 186-type groups), RSA (< 2048 bits), RSA (> 4096 bits), Ed25519, X25519 | CO     |
| Secret Key Generation  | Generate a secret key      | Symmetric key generation (< 112 bits)                                                             | CO     |

Table 16: Non-Approved Services

The table above lists the non-approved services in this module, the algorithms involved, the roles that can request the service, and the respective service indicator. In this table, CO specifies the Crypto Officer role.

### 4.5 External Software/Firmware Loaded

The module does not load external software or firmware.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 33 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 5 Software/Firmware Security

### 5.1 Integrity Techniques

The integrity of the module is verified by comparing, for each software component, the HMAC-SHA2-256 value calculated at run time with the integrity value that were computed at build time and stored in the associated check file (.chk). The module makes use of an HMAC key hard-coded within the module to perform the integrity test. If the integrity test fails, the module enters the Power-On Error state.

The CAST for the HMAC-SHA2-256 algorithm used for the integrity check of the module's components is run before the execution of the integrity check itself.

### 5.2 Initiate on Demand

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity tests may be invoked on-demand by unloading and subsequently re-initializing the module, which will perform (among others) the software integrity tests.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 34 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 6 Operational Environment

### 6.1 Operational Environment Type and Requirements

Type of Operational Environment: Modifiable

####### How Requirements are Satisfied:

Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms, and only the module has control over these SSPs.

If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

### 6.2 Configuration Settings and Restrictions

The module shall be installed as stated in Section 11.

Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 35 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 7 Physical Security

The module is comprised of software only and therefore this section is not applicable.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 36 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 8 Non-Invasive Security

This module does not implement any non-invasive security mechanism and therefore this section is not applicable.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 37 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 9 Sensitive Security Parameters Management

### 9.1 Storage Areas

Table 17: Storage Areas

| Storage Area Name   | Description                                                                                                                        | Persistence Type   |
|---------------------|------------------------------------------------------------------------------------------------------------------------------------|--------------------|
| RAM                 | Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs | Dynamic            |

The module maintains internal separation of the SSPs (including CSPs) in approved and non-approved modes of operation using an internal isFIPS flag for each SSP. This flag indicates whether the SSP can be used in approved or non-approved services.

The module does not perform persistent storage of SSPs.

### 9.2 SSP Input-Output Methods

Table 18: SSP Input-Output Methods

| Name                              | From                             | To                               | Format Type   | Distribution Type   | Entry Type   | SFI or Algorithm              |
|-----------------------------------|----------------------------------|----------------------------------|---------------|---------------------|--------------|-------------------------------|
| API input parameters (plaintext)  | Calling application within TOEPP | Cryptographic module             | Plaintext     | Manual              | Electronic   |                               |
| API input parameters (encrypted)  | Calling application within TOEPP | Cryptographic module             | Encrypted     | Manual              | Electronic   | Key Unwrapping with AES (KTS) |
| API output parameters (plaintext) | Cryptographic module             | Calling application within TOEPP | Plaintext     | Manual              | Electronic   |                               |
| API output parameters (encrypted) | Cryptographic module             | Calling application within TOEPP | Encrypted     | Manual              | Electronic   | Key Wrapping with AES (KTS)   |

The module only supports SSP entry and output to and from the calling application running on the same operational environment. This corresponds to manual distribution, electronic entry/output ('CM Software to/from App via TOEPP Path') per FIPS 140-3 IG 9.5.A Table 1.

CSPs (with the exception of passwords) can only be imported to and exported from the module when they are wrapped using an approved security function (e.g. AES KW/KWP or AES-GCM). PSPs can be imported and exported in plaintext. Import and export is performed using API input and output parameters.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 38 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

### 9.3 SSP Zeroization Methods

Table 19: SSP Zeroization Methods

| Zeroization Method   | Description                                                | Rationale                                                                                                                                                                                     | Operator Initiation                      |
|----------------------|------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------|
| Destroy Object       | Destroys the SSP represented by the object                 | Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded. | By calling the C_DestroyObject function. |
| Automatic            | Automatically zeroized by the module when no longer needed | Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable.                                                                                               | N/A                                      |
| Module Reset         | De-allocates the volatile memory used to store SSPs        | Volatile memory used by the module is overwritten within nanoseconds when power is removed. Module power off indicates that the zeroization procedure succeeded.                              | By removing power                        |

All data output is inhibited during zeroization.

### 9.4 SSPs

| Name          | Description                                                             | Size - Strength                         | Type - Category     | Generated By                             | Established By   | Used By                                                                                                                             |
|---------------|-------------------------------------------------------------------------|-----------------------------------------|---------------------|------------------------------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| Symmetric Key | Symmetric key generated by the module                                   | 112-512 bits - 112-256 bits             | Symmetric key - CSP | Symmetric Key Generation with Hash_DRB G |                  | Symmetric Key Generation with Hash_DRBG                                                                                             |
| AES Key       | AES Key used for encryption, decryption, and for message authentication | 128, 192, 256 bits - 128, 192, 256 bits | Symmetric key - CSP |                                          |                  | Encryption with AES Decryption with AES Authenticate d Encryption with AES Authenticate d Decryption with AES Message Authenticatio |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 39 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                    | Description                                             | Size - Strength                         | Type - Category              | Generated By   | Established By                                                                            | Used By                                                   |
|-------------------------|---------------------------------------------------------|-----------------------------------------|------------------------------|----------------|-------------------------------------------------------------------------------------------|-----------------------------------------------------------|
|                         |                                                         |                                         |                              |                |                                                                                           | n with CMAC                                               |
| AES Key- Encryption Key | AES key used for wrapping CSPs                          | 128, 192, 256 bits - 128, 192, 256 bits | Symmetric key - CSP          |                |                                                                                           | Key Wrapping with AES (KTS)                               |
| AES Key- Decryption Key | AES key used for unwrapping CSPs                        | 128, 192, 256 bits - 128, 192, 256 bits | Symmetric key - CSP          |                |                                                                                           | Key Unwrapping with AES (KTS)                             |
| Wrapped CSP             | CSP wrapped through imported/export ed AES key wrapping | 112-8192 bits - 112-256 bits            | Imported/Export ed CSP - CSP |                | Key Wrapping with AES (KTS) Key Unwrappin g with AES (KTS)                                | Key Wrapping with AES (KTS) Key Unwrapping with AES (KTS) |
| HMAC Key                | HMAC key used for message authentication                | 112-512 bits - 112-256 bits             | Symmetric key - CSP          |                |                                                                                           | Message Authenticatio n with HMAC                         |
| Key- Derivation Key     | Symmetric key used to derive symmetric keys             | 112-4096 bits - 112-256 bits            | Symmetric key - CSP          |                |                                                                                           | Key Derivation with KBKDF                                 |
| Shared Secret           | Shared secret generated by KAS-ECC-SSC or KAS-FFC-SSC   | 256-8192 bits - 112-256 bits            | Shared secret - CSP          |                | Shared Secret Computatio n with KAS-FFC- SSC Shared Secret Computatio n with KAS-ECC- SSC | Key Derivation with TLS KDF Key Derivation with IKE KDF   |
| TLS Pre- Master Secret  | Shared secret input to the TLS KDF                      | 112-256 bits - 112-256 bits             | Shared secret - CSP          |                | Shared Secret Computatio n with                                                           | Key Derivation with TLS KDF                               |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 40 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name               | Description                                              | Size - Strength              | Type - Category     | Generated By                             | Established By                                            | Used By                                 |
|--------------------|----------------------------------------------------------|------------------------------|---------------------|------------------------------------------|-----------------------------------------------------------|-----------------------------------------|
|                    |                                                          |                              |                     |                                          | KAS-FFC- SSC Shared Secret Computatio n with KAS-ECC- SSC |                                         |
| TLS Master Secret  | Master secret derived by the TLS KDF                     | 384 bits - 112-256 bits      | Secret - CSP        | Key Derivation with TLS KDF              |                                                           | Key Derivation with TLS KDF             |
| Password           | Password used to derive symmetric keys                   | 20-128 character s - N/A     | Password - CSP      |                                          |                                                           | Key Derivation with PBKDF2              |
| KBKDF Derived Key  | Symmetric key derived from a key-derivation key          | 112-4096 bits - 112-256 bits | Symmetric key - CSP | Key Derivation with KBKDF                |                                                           |                                         |
| PBKDF2 Derived Key | Symmetric key derived from a password                    | 112-4096 bits - 112-256 bits | Symmetric key - CSP | Key Derivation with PBKDF2               |                                                           |                                         |
| TLS Derived Key    | Symmetric key derived from a shared secret using TLS KDF | 112-4096 bits - 112-256 bits | Symmetric key - CSP | Key Derivation with TLS KDF              |                                                           |                                         |
| IKE Derived Key    | Symmetric key derived from a shared secret using IKE KDF | 112-4096 bits - 112-256 bits | Symmetric key - CSP | Key Derivation with IKE KDF              |                                                           |                                         |
| Entropy Input      | Entropy input used to seed the DRBG                      | 440-880 bits - 440-880 bits  | Entropy input - CSP | Random Number Generation with Hash_DRB G |                                                           | Random Number Generation with Hash_DRBG |
| DRBG Seed          | DRBG seed derived from entropy input                     | 440 bits - 256 bits          | Seed - CSP          | Random Number Generation with            |                                                           | Random Number Generation                |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 41 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Description                             | Size - Strength                                                             | Type - Category      | Generated By                             | Established By   | Used By                                     |
|-----------------------------------|-----------------------------------------|-----------------------------------------------------------------------------|----------------------|------------------------------------------|------------------|---------------------------------------------|
|                                   |                                         |                                                                             |                      | Hash_DRB G                               |                  | with Hash_DRBG                              |
| DRBG Internal State (V, C)        | Internal state of the Hash_DRBG         | 880 bits - 256 bits                                                         | Internal state - CSP | Random Number Generation with Hash_DRB G |                  | Random Number Generation with Hash_DRBG     |
| Module- generated FFC Private Key | FFC Private key generated by the module | 2048, 3072, 4096, 6144, 7680, 8192 bits - 112, 128, 152, 176, 192, 200 bits | Private key - CSP    | Key Pair Generation with Safe Primes     |                  | Key Pair Generation with Safe Primes        |
| Module- generated FFC Public Key  | FFC Public key generated by the module  | 2048, 3072, 4096, 6144, 7680, 8192 bits - 112, 128, 152, 176, 192, 200 bits | Public key - PSP     | Key Pair Generation with Safe Primes     |                  | Key Pair Generation with Safe Primes        |
| FFC Private Key                   | Private key used for Diffie- Hellman    | 2048, 3072, 4096, 6144, 7680, 8192 bits - 112, 128, 152, 176, 192, 200 bits | Private key - CSP    |                                          |                  | Shared Secret Computation with KAS- FFC-SSC |
| FFC Public Key                    | Public key used for Diffie- Hellman     | 2048, 3072, 4096, 6144, 7680,                                               | Public key - PSP     |                                          |                  | Shared Secret Computation with KAS- FFC-SSC |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 42 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Description                                       | Size - Strength                               | Type - Category   | Generated By                   | Established By   | Used By                                                                       |
|-----------------------------------|---------------------------------------------------|-----------------------------------------------|-------------------|--------------------------------|------------------|-------------------------------------------------------------------------------|
|                                   |                                                   | 8192 bits - 112, 128, 152, 176, 192, 200 bits |                   |                                |                  |                                                                               |
| Module- generated EC Private Key  | EC Private key generated by the module            | P-256, P-384, P-521 - 128, 192, 256 bits      | Private key - CSP | Key Pair Generation with ECDSA |                  | Key Pair Generation with ECDSA                                                |
| Module- generated EC Public Key   | EC Public key generated by the module             | P-256, P-384, P-521 - 128, 192, 256 bits      | Public key - PSP  | Key Pair Generation with ECDSA |                  | Key Pair Generation with ECDSA                                                |
| EC Private Key                    | Private key used for EC Diffie- Hellman and ECDSA | P-256, P-384, P-521 - 128, 192, 256 bits      | Private key - CSP |                                |                  | Shared Secret Computation with KAS- ECC-SSC Signature Generation with ECDSA   |
| EC Public Key                     | Public key used for EC Diffie- Hellman and ECDSA  | P-256, P-384, P-521 - 128, 192, 256 bits      | Public key - PSP  |                                |                  | Shared Secret Computation with KAS- ECC-SSC Signature Verification with ECDSA |
| Module- generated RSA Private Key | RSA Private key generated by the module           | 2048, 3072, 4096 bits - 112, 128, 149 bits    | Private key - CSP | Key Pair Generation with RSA   |                  | Key Pair Generation with RSA                                                  |
| Module- generated RSA Public Key  | RSA Public key generated by the module            | 2048, 3072, 4096 bits - 112, 128, 149 bits    | Public key - PSP  | Key Pair Generation with RSA   |                  | Key Pair Generation with RSA                                                  |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 43 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                               | Description                                              | Size - Strength                                                                                     | Type - Category          | Generated By                                                                                     | Established By   | Used By                                                                                          |
|------------------------------------|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------|--------------------------|--------------------------------------------------------------------------------------------------|------------------|--------------------------------------------------------------------------------------------------|
| RSA Private Key                    | Private key used for RSA signature generation            | 2048, 3072, 4096 bits - 112, 128, 149 bits                                                          | Private key - CSP        |                                                                                                  |                  | Signature Generation with RSA                                                                    |
| RSA Public Key                     | Public key used for RSA signature verification           | SigVer: 1024, 1280, 1536, 1792, 2048, 3072, 4096 bits - SigVer: 80, 88, 96, 103, 112, 128, 149 bits | Public key - PSP         |                                                                                                  |                  | Signature Verification with RSA Signature Verification with RSA (legacy use)                     |
| Intermediat e key generation value | Temporary value generated during key generation services | 256-8192 bits - 112-256 bits                                                                        | Intermediate value - CSP | Key Pair Generation with RSA Key Pair Generation with ECDSA Key Pair Generation with Safe Primes |                  | Key Pair Generation with RSA Key Pair Generation with ECDSA Key Pair Generation with Safe Primes |

####### Table 20: SSP Table 1

| Name          | Input - Output                    | Storage       | Storage Duration                      | Zeroization                 | Related SSPs   |
|---------------|-----------------------------------|---------------|---------------------------------------|-----------------------------|----------------|
| Symmetric Key | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset |                |
| AES Key       | API input parameters (encrypted)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset |                |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 44 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                    | Input - Output                                                     | Storage       | Storage Duration                      | Zeroization                 | Related SSPs                                                                                                                                                                |
|-------------------------|--------------------------------------------------------------------|---------------|---------------------------------------|-----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| AES Key- Encryption Key | API input parameters (encrypted)                                   | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset |                                                                                                                                                                             |
| AES Key- Decryption Key | API input parameters (encrypted)                                   | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset |                                                                                                                                                                             |
| Wrapped CSP             | API input parameters (encrypted) API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | AES Key-Encryption Key:Wrapped by AES Key-Decryption Key:Unwrapped by                                                                                                       |
| HMAC Key                | API input parameters (encrypted)                                   | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset |                                                                                                                                                                             |
| Key-Derivation Key      | API input parameters (encrypted)                                   | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | KBKDF Derived Key:Derivation Of                                                                                                                                             |
| Shared Secret           | API input parameters (encrypted) API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | FFC Private Key:Derived From FFC Public Key:Derived From EC Private Key:Derived From EC Public Key:Derived From TLS Derived Key:Derivation Of IKE Derived Key:Derivation Of |
| TLS Pre-Master Secret   | API input parameters (encrypted)                                   | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | FFC Private Key:Established by FFC Public Key:Established by EC Private Key:Established by EC Public Key:Established by                                                     |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 45 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Input - Output                    | Storage       | Storage Duration                           | Zeroization                 | Related SSPs                                                        |
|-----------------------------------|-----------------------------------|---------------|--------------------------------------------|-----------------------------|---------------------------------------------------------------------|
|                                   |                                   |               |                                            |                             | TLS Master Secret:Derivation Of                                     |
| TLS Master Secret                 |                                   | RAM:Plaintext | For the duration of the service            | Automatic Module Reset      | TLS Pre-Master Secret:Derived From TLS Derived Key:Derivation Of    |
| Password                          | API input parameters (plaintext)  | RAM:Plaintext | For the duration of the service            | Destroy Object Module Reset | PBKDF2 Derived Key:Derivation Of                                    |
| KBKDF Derived Key                 | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator      | Destroy Object Module Reset | Key-Derivation Key:Derived From                                     |
| PBKDF2 Derived Key                | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator      | Destroy Object Module Reset | Password:Derived From                                               |
| TLS Derived Key                   | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator      | Destroy Object Module Reset | TLS Master Secret:Derived From                                      |
| IKE Derived Key                   | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator      | Destroy Object Module Reset | Shared Secret:Derived From                                          |
| Entropy Input                     |                                   | RAM:Plaintext | From generation until DRBG Seed is created | Automatic Module Reset      | DRBG Seed:Derivation Of                                             |
| DRBG Seed                         |                                   | RAM:Plaintext | While the DRBG is instantiated             | Automatic Module Reset      | Entropy Input:Derived From DRBG Internal State (V, C):Generation Of |
| DRBG Internal State (V, C)        |                                   | RAM:Plaintext | While the module is operational            | Module Reset                | DRBG Seed:Generated From                                            |
| Module- generated FFC Private Key | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator      | Destroy Object              | Module-generated FFC Public Key:Paired With                         |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 46 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Input - Output                    | Storage       | Storage Duration                      | Zeroization                 | Related SSPs                                                                                  |
|-----------------------------------|-----------------------------------|---------------|---------------------------------------|-----------------------------|-----------------------------------------------------------------------------------------------|
|                                   |                                   |               |                                       | Module Reset                | Intermediate key generation value:Generated From                                              |
| Module- generated FFC Public Key  | API output parameters (plaintext) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | Module-generated FFC Private Key:Paired With Intermediate key generation value:Generated From |
| FFC Private Key                   | API input parameters (encrypted)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | FFC Public Key:Paired With                                                                    |
| FFC Public Key                    | API input parameters (plaintext)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | FFC Private Key:Paired With                                                                   |
| Module- generated EC Private Key  | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | Module-generated EC Public Key:Paired With Intermediate key generation value:Generated From   |
| Module- generated EC Public Key   | API output parameters (plaintext) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | Module-generated EC Private Key:Paired With Intermediate key generation value:Generated From  |
| EC Private Key                    | API input parameters (encrypted)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | EC Public Key:Paired With                                                                     |
| EC Public Key                     | API input parameters (plaintext)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | EC Private Key:Paired With                                                                    |
| Module- generated RSA Private Key | API output parameters (encrypted) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | Module-generated RSA Public Key:Paired With Intermediate key                                  |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 47 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Name                              | Input - Output                    | Storage       | Storage Duration                      | Zeroization                 | Related SSPs                                                                                                                                                                                                                                                                         |
|-----------------------------------|-----------------------------------|---------------|---------------------------------------|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|                                   |                                   |               |                                       |                             | generation value:Generated From                                                                                                                                                                                                                                                      |
| Module- generated RSA Public Key  | API output parameters (plaintext) | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | Module-generated RSA Private Key:Paired With Intermediate key generation value:Generated From                                                                                                                                                                                        |
| RSA Private Key                   | API input parameters (encrypted)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | RSA Public Key:Paired With                                                                                                                                                                                                                                                           |
| RSA Public Key                    | API input parameters (plaintext)  | RAM:Plaintext | Until explicitly zeroized by operator | Destroy Object Module Reset | RSA Private Key:Paired With                                                                                                                                                                                                                                                          |
| Intermediate key generation value |                                   | RAM:Plaintext | For the duration of the service       | Automatic                   | Module-generated FFC Private Key:Generation Of Module-generated FFC Public Key:Generation Of Module-generated EC Private Key:Generation Of Module-generated EC Public Key:Generation Of Module-generated RSA Private Key:Generation Of Module-generated RSA Public Key:Generation Of |

Table 21: SSP Table 2

### 9.5 Transitions

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031.

Beginning in 2031, keys providing 112 bits of security strength shall no longer be used to apply cryptographic protection and are limited to legacy use for processing, as specified in Table 4 of NIST SP 800-57 Part 1 Rev. 5.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 48 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 10 Self-Tests

Upon initialization, the module immediately performs all libfreeblpriv3.so cryptographic algorithm self-tests (CASTs) as specified in the Conditional Self-Tests table. These self-tests include the CAST for the HMACSHA2-256 algorithm that is used to verify the integrity of the module's shared libraries.

When all those self-tests pass successfully, the module automatically performs the pre-operational integrity test on the libfreeblpriv3.so file using its associated check value.

Then, the module performs the RSA CAST in the libsoftokn3.so library, followed by the pre-operational integrity test on the libsoftokn3.so file using its associated check value.

Finally, all remaining CASTs for the algorithms implemented in libsoftokn3.so are executed (see the Conditional Self-Tests table).

Only if all CASTs and pre-operational integrity tests passed successfully, the module transitions to the operational state. No operator intervention is required to reach this point.

While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. If any of the self-tests fails, an error message is returned, and the module transitions to an error state.

### 10.1 Pre-Operational Self-Tests

Table 22: Pre-Operational Self-Tests

| Algorithm or Test   | Test Properties   | Test Method            | Test Type       | Indicator                                                     | Details                                                 |
|---------------------|-------------------|------------------------|-----------------|---------------------------------------------------------------|---------------------------------------------------------|
| HMAC- SHA2-256      | 256-bit key       | Message authentication | SW/FW Integrity | Module becomes operational and services are available for use | Integrity test for libsoftokn3.so and libfreeblpriv3.so |

### 10.2 Conditional Self-Tests

| Algorithm or Test   | Test Properties   | Test Method   | Test Type   | Indicator                                                     | Details        | Conditions            |
|---------------------|-------------------|---------------|-------------|---------------------------------------------------------------|----------------|-----------------------|
| SHA2-224 (A6152)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-224 (A6156)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 49 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test   | Test Properties   | Test Method   | Test Type   | Indicator                                                     | Details        | Conditions            |
|---------------------|-------------------|---------------|-------------|---------------------------------------------------------------|----------------|-----------------------|
| SHA2-224 (A6159)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-256 (A6152)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-256 (A6156)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-256 (A6159)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-384 (A6152)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-384 (A6156)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |
| SHA2-384 (A6159)    | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 50 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test      | Test Properties   | Test Method   | Test Type   | Indicator                                                     | Details                | Conditions            |
|------------------------|-------------------|---------------|-------------|---------------------------------------------------------------|------------------------|-----------------------|
| SHA2-512 (A6152)       | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest         | Module initialization |
| SHA2-512 (A6156)       | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest         | Module initialization |
| SHA2-512 (A6159)       | 512-bit message   | KAT           | CAST        | Module becomes operational and services are available for use | Message Digest         | Module initialization |
| HMAC-SHA2- 224 (A6152) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 224 (A6156) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 224 (A6159) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 256 (A6152) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 51 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test      | Test Properties   | Test Method   | Test Type   | Indicator                                                     | Details                | Conditions            |
|------------------------|-------------------|---------------|-------------|---------------------------------------------------------------|------------------------|-----------------------|
| HMAC-SHA2- 256 (A6156) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 256 (A6159) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 384 (A6152) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 384 (A6156) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 384 (A6159) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 512 (A6152) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| HMAC-SHA2- 512 (A6156) | 288-bit key       | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 52 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test         | Test Properties        | Test Method   | Test Type   | Indicator                                                     | Details                | Conditions            |
|---------------------------|------------------------|---------------|-------------|---------------------------------------------------------------|------------------------|-----------------------|
| HMAC-SHA2- 512 (A6159)    | 288-bit key            | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| AES-ECB - Encrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption             | Module initialization |
| AES-ECB - Encrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption             | Module initialization |
| AES-ECB - Encrypt (A6157) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption             | Module initialization |
| AES-ECB - Decrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption             | Module initialization |
| AES-ECB - Decrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption             | Module initialization |
| AES-ECB - Decrypt (A6157) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption             | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 53 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test         | Test Properties        | Test Method   | Test Type   | Indicator                                                     | Details    | Conditions            |
|---------------------------|------------------------|---------------|-------------|---------------------------------------------------------------|------------|-----------------------|
| AES-CBC - Encrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-CBC - Encrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-CBC - Encrypt (A6157) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-CBC - Decrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |
| AES-CBC - Decrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |
| AES-CBC - Decrypt (A6157) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |
| AES-GCM - Encrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 54 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test         | Test Properties        | Test Method   | Test Type   | Indicator                                                     | Details    | Conditions            |
|---------------------------|------------------------|---------------|-------------|---------------------------------------------------------------|------------|-----------------------|
| AES-GCM - Encrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-GCM - Encrypt (A6155) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-GCM - Encrypt (A6157) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-GCM - Encrypt (A6158) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Encryption | Module initialization |
| AES-GCM - Decrypt (A6152) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |
| AES-GCM - Decrypt (A6154) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |
| AES-GCM - Decrypt (A6155) | 128, 192, 256- bit key | KAT           | CAST        | Module becomes operational and services are available for use | Decryption | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 55 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test         | Test Properties                | Test Method   | Test Type   | Indicator                                                     | Details                | Conditions            |
|---------------------------|--------------------------------|---------------|-------------|---------------------------------------------------------------|------------------------|-----------------------|
| AES-GCM - Decrypt (A6157) | 128, 192, 256- bit key         | KAT           | CAST        | Module becomes operational and services are available for use | Decryption             | Module initialization |
| AES-GCM - Decrypt (A6158) | 128, 192, 256- bit key         | KAT           | CAST        | Module becomes operational and services are available for use | Decryption             | Module initialization |
| AES-CMAC (A6152)          | 128, 192, 256- bit key         | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| AES-CMAC (A6154)          | 128, 192, 256- bit key         | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| AES-CMAC (A6157)          | 128, 192, 256- bit key         | KAT           | CAST        | Module becomes operational and services are available for use | Message Authentication | Module initialization |
| KDF SP800-108 (A6152)     | HMAC- SHA2-256 in counter mode | KAT           | CAST        | Module becomes operational and services are available for use | Key Derivation         | Module initialization |
| KDF TLS (A6152)           | 512-bit message                | KAT           | CAST        | Module becomes operational and services are available for use | Key Derivation         | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 56 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test               | Test Properties                                                     | Test Method   | Test Type   | Indicator                                                     | Details                                                                               | Conditions            |
|---------------------------------|---------------------------------------------------------------------|---------------|-------------|---------------------------------------------------------------|---------------------------------------------------------------------------------------|-----------------------|
| TLS v1.2 KDF RFC7627 (A6152)    | SHA2-256                                                            | KAT           | CAST        | Module becomes operational and services are available for use | Key Derivation                                                                        | Module initialization |
| KDF IKEv2 (A6153)               | SHA-1, SHA- 256, SHA- 384, SHA-512                                  | KAT           | CAST        | Module becomes operational and services are available for use | Key Derivation                                                                        | Module initialization |
| PBKDF (A6152)                   | SHA2-256 with 5 iterations, 128-bit salt and 14 characters password | KAT           | CAST        | Module becomes operational and services are available for use | Key Derivation                                                                        | Module initialization |
| Hash DRBG (A6152)               | SHA-256 without prediction resistance                               | KAT           | CAST        | Module becomes operational and services are available for use | Instantiate Generate; Reseed Generate (compliant to SP 800- 90A Rev. 1, Section 11.3) | Module initialization |
| KAS-FFC-SSC Sp800-56Ar3 (A6152) | ffdhe2048                                                           | KAT           | CAST        | Module becomes operational and services are available for use | Shared Secret Computation                                                             | Module initialization |
| KAS-ECC-SSC Sp800-56Ar3 (A6152) | P-256                                                               | KAT           | CAST        | Module becomes operational and services are available for use | Shared Secret Computation                                                             | Module initialization |
| RSA SigGen (FIPS186-5) (A6152)  | PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2-                        | KAT           | CAST        | Module becomes operational and services                       | Signature Generation                                                                  | Module initialization |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 57 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 23: Conditional Self-Tests

| Algorithm or Test                                | Test Properties                                                    | Test Method   | Test Type   | Indicator                                                     | Details                                                 | Conditions            |
|--------------------------------------------------|--------------------------------------------------------------------|---------------|-------------|---------------------------------------------------------------|---------------------------------------------------------|-----------------------|
|                                                  | 512, and 2048-bit key                                              |               |             | are available for use                                         |                                                         |                       |
| RSA SigVer (FIPS186-5) (A6152)                   | PKCS#1 v1.5 with SHA2- 256, SHA2- 384, SHA2- 512, and 2048-bit key | KAT           | CAST        | Module becomes operational and services are available for use | Signature Verification                                  | Module initialization |
| ECDSA SigGen (FIPS186-5) (A6152)                 | SHA2-256 and P-256                                                 | KAT           | CAST        | Module becomes operational and services are available for use | Signature Generation                                    | Module initialization |
| ECDSA SigVer (FIPS186-5) (A6152)                 | SHA2-256 and P-256                                                 | KAT           | CAST        | Module becomes operational and services are available for use | Signature Verification                                  | Module initialization |
| RSA KeyGen (FIPS186-5) (A6152)                   | PKCS#1 v1.5 with SHA- 256                                          | PCT           | PCT         | Successful key pair generation                                | Signature Generation and Signature Verification         | Key Pair Generation   |
| ECDSA KeyGen (FIPS186-5) - SSC (A6152)           | N/A                                                                | PCT           | PCT         | Successful key pair generation                                | PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3 | Key Pair Generation   |
| ECDSA KeyGen (FIPS186-5) - SigGen/SigVer (A6152) | SHA-256                                                            | PCT           | PCT         | Successful key pair generation                                | Signature Generation and Signature Verification         | Key Pair Generation   |
| Safe Primes Key Generation (A6152)               | N/A                                                                | PCT           | PCT         | Successful key pair generation                                | PCT according to section 5.6.2.1.4 of SP 800-56A Rev. 3 | Key Pair Generation   |

### 10.3 Periodic Self-Test Information

| Algorithm or Test   | Test Method            | Test Type       | Period    | Periodic Method   |
|---------------------|------------------------|-----------------|-----------|-------------------|
| HMAC-SHA2-256       | Message authentication | SW/FW Integrity | On demand | Manually          |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 58 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 24: Pre-Operational Periodic Information

| Algorithm or Test     | Test Method   | Test Type   | Period    | Periodic Method   |
|-----------------------|---------------|-------------|-----------|-------------------|
| SHA2-224 (A6152)      | KAT           | CAST        | On demand | Manually          |
| SHA2-224 (A6156)      | KAT           | CAST        | On demand | Manually          |
| SHA2-224 (A6159)      | KAT           | CAST        | On demand | Manually          |
| SHA2-256 (A6152)      | KAT           | CAST        | On demand | Manually          |
| SHA2-256 (A6156)      | KAT           | CAST        | On demand | Manually          |
| SHA2-256 (A6159)      | KAT           | CAST        | On demand | Manually          |
| SHA2-384 (A6152)      | KAT           | CAST        | On demand | Manually          |
| SHA2-384 (A6156)      | KAT           | CAST        | On demand | Manually          |
| SHA2-384 (A6159)      | KAT           | CAST        | On demand | Manually          |
| SHA2-512 (A6152)      | KAT           | CAST        | On demand | Manually          |
| SHA2-512 (A6156)      | KAT           | CAST        | On demand | Manually          |
| SHA2-512 (A6159)      | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-224 (A6152) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-224 (A6156) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-224 (A6159) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-256 (A6152) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-256 (A6156) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-256 (A6159) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-384 (A6152) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-384 (A6156) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-384 (A6159) | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-512 (A6152) | KAT           | CAST        | On demand | Manually          |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 59 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test         | Test Method   | Test Type   | Period    | Periodic Method   |
|---------------------------|---------------|-------------|-----------|-------------------|
| HMAC-SHA2-512 (A6156)     | KAT           | CAST        | On demand | Manually          |
| HMAC-SHA2-512 (A6159)     | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Encrypt (A6152) | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Encrypt (A6154) | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Encrypt (A6157) | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Decrypt (A6152) | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Decrypt (A6154) | KAT           | CAST        | On demand | Manually          |
| AES-ECB - Decrypt (A6157) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Encrypt (A6152) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Encrypt (A6154) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Encrypt (A6157) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Decrypt (A6152) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Decrypt (A6154) | KAT           | CAST        | On demand | Manually          |
| AES-CBC - Decrypt (A6157) | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Encrypt (A6152) | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Encrypt (A6154) | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Encrypt (A6155) | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Encrypt (A6157) | KAT           | CAST        | On demand | Manually          |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 60 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| Algorithm or Test               | Test Method   | Test Type   | Period    | Periodic Method   |
|---------------------------------|---------------|-------------|-----------|-------------------|
| AES-GCM - Encrypt (A6158)       | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Decrypt (A6152)       | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Decrypt (A6154)       | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Decrypt (A6155)       | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Decrypt (A6157)       | KAT           | CAST        | On demand | Manually          |
| AES-GCM - Decrypt (A6158)       | KAT           | CAST        | On demand | Manually          |
| AES-CMAC (A6152)                | KAT           | CAST        | On demand | Manually          |
| AES-CMAC (A6154)                | KAT           | CAST        | On demand | Manually          |
| AES-CMAC (A6157)                | KAT           | CAST        | On demand | Manually          |
| KDF SP800-108 (A6152)           | KAT           | CAST        | On demand | Manually          |
| KDF TLS (A6152)                 | KAT           | CAST        | On demand | Manually          |
| TLS v1.2 KDF RFC7627 (A6152)    | KAT           | CAST        | On demand | Manually          |
| KDF IKEv2 (A6153)               | KAT           | CAST        | On demand | Manually          |
| PBKDF (A6152)                   | KAT           | CAST        | On demand | Manually          |
| Hash DRBG (A6152)               | KAT           | CAST        | On demand | Manually          |
| KAS-FFC-SSC Sp800-56Ar3 (A6152) | KAT           | CAST        | On demand | Manually          |
| KAS-ECC-SSC Sp800-56Ar3 (A6152) | KAT           | CAST        | On demand | Manually          |
| RSA SigGen (FIPS186-5) (A6152)  | KAT           | CAST        | On demand | Manually          |

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 61 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

Table 25: Conditional Periodic Information

| Algorithm or Test                                | Test Method   | Test Type   | Period    | Periodic Method   |
|--------------------------------------------------|---------------|-------------|-----------|-------------------|
| RSA SigVer (FIPS186-5) (A6152)                   | KAT           | CAST        | On demand | Manually          |
| ECDSA SigGen (FIPS186-5) (A6152)                 | KAT           | CAST        | On demand | Manually          |
| ECDSA SigVer (FIPS186-5) (A6152)                 | KAT           | CAST        | On demand | Manually          |
| RSA KeyGen (FIPS186-5) (A6152)                   | PCT           | PCT         | On demand | Manually          |
| ECDSA KeyGen (FIPS186-5) - SSC (A6152)           | PCT           | PCT         | On demand | Manually          |
| ECDSA KeyGen (FIPS186-5) - SigGen/SigVer (A6152) | PCT           | PCT         | On demand | Manually          |
| Safe Primes Key Generation (A6152)               | PCT           | PCT         | On demand | Manually          |

### 10.4 Error States

| Name            | Description                                                  | Conditions                                      | Recovery Method       | Indicator                                                 |
|-----------------|--------------------------------------------------------------|-------------------------------------------------|-----------------------|-----------------------------------------------------------|
| Power- On Error | An error occurred during the self-tests executed on power-on | Software integrity test failure or CAST failure | Restart of the module | Module will not load                                      |
| PCT Error       | An error occurred during a PCT                               | PCT failure                                     | Restart of the module | Module stops functioning (sftk_fatalError is set to TRUE) |

####### Table 26: Error States

In any error state, the output interface is inhibited, and the module accepts no more inputs or requests.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 62 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

### 10.5 Operator Initiation of Self-Tests

The software integrity tests and CASTs can be invoked on demand by unloading and subsequently reinitializing the module. The PCTs can be invoked on demand by requesting the Key Pair Generation service.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 63 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 11 Life-Cycle Assurance

### 11.1 Installation, Initialization, and Startup Procedures

The module is delivered as part of the following RPM packages:

- libfreebl3-3.101.2-150400.3.54.1
- libsoftokn3-3.101.2-150400.3.54.1

Before these packages are installed, the SUSE Linux Enterprise 15 SP6 system must operate in the FIPS validated configuration. This can be achieved by:

- Adding the fips=1 option to the kernel command line during the system installation.  During the software selection stage, do not install any third-party software.
- Switching the system into the FIPS validated configuration after the installation. Execute the fipsmode-setup --enable command. Restart the system.

In both cases, the Crypto Officer must verify the system operates in the FIPS validated configuration by executing the fips-mode-setup --check command, which should output 'FIPS mode is enabled.'

After completion of the above-mentioned system configuration steps, the libfreebl3-3.101.2-150400.3.54.1 and libsoftokn3-3.101.2-150400.3.54.1 RPM packages can be installed using the 'zypper install' command.

### 11.2 Administrator Guidance

After the RPM packages are installed, the Crypto Officer must execute the 'Show name and version' service by accessing the CKA_NSS_VALIDATION_MODULE_ID attribute of the CKO_NSS_VALIDATION object in the default slot. The object attribute must contain the value:

SUSE Linux Enterprise NSS 3.101.2-150400.3.54.1

Finally, the Crypto Officer must observe operational environment configuration settings and restrictions as specified in Section 6.2 to ensure the module is running in a validated operational environment.

To operate as the FIPS 140-3 validated module, the output of the fips-mode-setup --check command must be 'FIPS mode is enabled.' and the 'Show Name and Version' service must match the values specified above. If either output differs, the module cannot be considered as the FIPS 140-3 validated module.

### 11.3 Non-Administrator Guidance

There is no non-administrator guidance.

### 11.4 End of Life

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, both the libfreebl3-3.101.2150400.3.54.1 and libsoftokn3-3.101.2-150400.3.54.1 RPM packages can be uninstalled from the SUSE Linux Enterprise 15 SP6 system.

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 64 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## 12 Mitigation of Other Attacks

### 12.1 Attack List

####### Timing attacks on RSA

- RSA blinding: timing attack on RSA was first demonstrated by Paul Kocher in 1996, who contributed the mitigation code to our module. Most recently Boneh and Brumley showed that RSA blinding is an effective defense against timing attacks on RSA.
- o Specific Limit: None

####### Cache-timing attacks on the modular exponentiation operation used in RSA

- Cache invariant module exponentiation: this is a variant of a modular exponentiation implementation that Colin Percival showed to defend against cache-timing attacks
- o Specific Limit: this mechanism requires intimate knowledge of the cache line sizes of the processor. The mechanism may be ineffective when the module is running on a processor whose cache line sizes are unknown.

####### Arithmetic errors in RSA signatures

- Double-checking RSA signatures: arithmetic errors in RSA signatures might leak the private key. Ferguson and Schneier recommend that every RSA signature generation should verify the signature just generated.

- o Specific Limit: None

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 65 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## Appendix A. Glossary and abbreviations

AES Advanced Encryption Standard

API

Application Programming Interface

CAST Cryptographic Algorithm Self-Test

CAVP Cryptographic Algorithm Validation Program

CBC

Cipher Block Chaining

CKG

Cryptographic Key Generation

CMAC

Cipher-based Message Authentication Code

CMVP

Cryptographic Module Validation Program

CSP

Critical Security Parameter

CTR

Counter

CTS

Ciphertext Stealing

DH

Diffie-Hellman

DRBG

Deterministic Random Bit Generator

ECB

Electronic Code Book

ECC

Elliptic Curve Cryptography

ECDH

Elliptic Curve Diffie-Hellman

ECDSA

Elliptic Curve Digital Signature Algorithm

FFC

Finite Field Cryptography

FIPS

Federal Information Processing Standards

GCM

Galois Counter Mode

HKDF

HMAC-based Key Derivation Function

HMAC

Keyed-Hash Message Authentication Code

IKE

Internet Key Exchange

KAS

Key Agreement Scheme

KAT

Known Answer Test

KBKDF

Key-based Key Derivation Function

KW

Key Wrap

KWP

Key Wrap with Padding

MAC

Message Authentication Code

NIST

National Institute of Science and Technology

PAA

Processor Algorithm Acceleration

PAI Processor Algorithm Implementation

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 66 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| PCT    | Pair-wise Consistency Test                |
|--------|-------------------------------------------|
| PBKDF2 | Password-based Key Derivation Function v2 |
| PKCS   | Public-Key Cryptography Standards         |
| PSS    | Probabilistic Signature Scheme            |
| RSA    | Rivest, Shamir, Addleman                  |
| SHA    | Secure Hash Algorithm                     |
| SSC    | Shared Secret Computation                 |
| SSP    | Sensitive Security Parameter              |
| TLS    | Transport Layer Security                  |
| XOF    | Extendable Output Function                |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 67 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

## Appendix B. References

FIPS 140-3

####### FIPS PUB 140-3 - Security Requirements For Cryptographic Modules

March 2019

[https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf)

####### FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program

18 April 2025

[https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validationprogram/documents/fips 140-3/FIPS 140-3 IG.pdf](https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf)

####### FIPS 180-4 Secure Hash Standard (SHS)

August 2015

[https://doi.org/10.6028/NIST.FIPS.180-4](https://doi.org/10.6028/NIST.FIPS.180-4)

####### FIPS 186-2 Digital Signature Standard (DSS)

July 2013

[https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf](https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf)

####### FIPS 186-4 Digital Signature Standard (DSS)

July 2013

[https://doi.org/10.6028/NIST.FIPS.186-4](https://doi.org/10.6028/NIST.FIPS.186-4)

####### FIPS 186-5 Digital Signature Standard (DSS)

February 2023

[https://doi.org/10.6028/NIST.FIPS.186-5](https://doi.org/10.6028/NIST.FIPS.186-5)

####### FIPS 197

Advanced Encryption Standard

May 2023

[https://doi.org/10.6028/NIST.FIPS.197-upd1](https://doi.org/10.6028/NIST.FIPS.197-upd1)

####### FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC)

July 2008

[https://doi.org/10.6028/NIST.FIPS.198-1](https://doi.org/10.6028/NIST.FIPS.198-1)

SHA-3 Standard:  Permutation-Based Hash and Extendable-Output Functions August 2015

[https://doi.org/10.6028/NIST.FIPS.202](https://doi.org/10.6028/NIST.FIPS.202)

FIPS 202

PKCS#1

Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications

####### Version 2.2

November 2016

[https://www.rfc-editor.org/rfc/rfc8017.txt](https://www.rfc-editor.org/rfc/rfc8017.txt)

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 68 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

RFC 3526

RFC 5288

More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)

May 2003

[https://www.ietf.org/rfc/rfc3526.txt](https://www.ietf.org/rfc/rfc3526.txt)

AES Galois Counter Mode (GCM) Cipher Suites for TLS

RFC 7919

RFC 8446

August 2008

[https://www.ietf.org/rfc/rfc5288.txt](https://www.ietf.org/rfc/rfc5288.txt)

####### Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS)

August 2016

[https://www.ietf.org/rfc/rfc7919.txt](https://www.ietf.org/rfc/rfc7919.txt)

The Transport Layer Security (TLS) Protocol Version 1.3

SP 800-38A

SP 800-38A Addendum

SP 800-38B

SP 800-38D

August 2018

[https://www.ietf.org/rfc/rfc8446.txt](https://www.ietf.org/rfc/rfc8446.txt)

Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001

[https://doi.org/10.6028/NIST.SP.800-38A](https://doi.org/10.6028/NIST.SP.800-38A)

Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode

October 2010

[https://doi.org/10.6028/NIST.SP.800-38A-Add](https://doi.org/10.6028/NIST.SP.800-38A-Add)

Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication

May 2005

[https://doi.org/10.6028/NIST.SP.800-38B](https://doi.org/10.6028/NIST.SP.800-38B)

Recommendation for Block Cipher Modes of Operation:  Galois/Counter Mode

SP 800-38F

SP 800-52 Rev. 2

(GCM) and GMAC

November 2007

[https://doi.org/10.6028/NIST.SP.800-38A](https://doi.org/10.6028/NIST.SP.800-38A)

Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping

December 2012

[https://doi.org/10.6028/NIST.SP.800-38F](https://doi.org/10.6028/NIST.SP.800-38F)

Guidelines for the Selection, Configuration, and Use of Transport Layer Security

(TLS) Implementations

August 2019

[https://doi.org/10.6028/NIST.SP.800-52r2](https://doi.org/10.6028/NIST.SP.800-52r2)

© 2026 SUSE LLC/atsec information security corporation.

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 69 of 70

SUSE Linux Enterprise NSS Cryptographic Module

FIPS 140-3 Non-Proprietary Security Policy

| SP 800-56A Rev. 3            | Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://doi.org/10.6028/NIST.SP.800-56Ar3            |
|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
| NIST SP 800-57 Part 1 Rev. 5 | Recommendation for Key Management: Part 1 - General May 2020 https://doi.org/10.6028/NIST.SP.800-57pt1r5                                                     |
| SP 800-90A Rev. 1            | Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 https://doi.org/10.6028/NIST.SP.800-90Ar1                    |
| SP 800-90B                   | Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://doi.org/10.6028/NIST.SP.800-90B                                   |
| SP 800-108 Rev. 1            | NIST Special Publication 800-108 - Recommendation for Key Derivation Using Pseudorandom Functions August 2022 https://doi.org/10.6028/NIST.SP.800-108r1-upd1 |
| SP 800-132                   | Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 https://doi.org/10.6028/NIST.SP.800-132                        |
| SP 800-133 Rev. 2            | Recommendation for Cryptographic Key Generation June 2020 https://doi.org/10.6028/NIST.SP.800-133r2                                                          |
| SP 800-135 Rev. 1            | Recommendation for Existing Application-Specific Key Derivation Functions December 2011 https://doi.org/10.6028/NIST.SP.800-135r1                            |

This document can be reproduced and distributed only whole and intact, including this copyright notice.

Page 70 of 70