IOS Common Cryptographic Module (IC2M)

Certificate details

Certificate ID #5356
Status active
Validation dates 26.06.2026
Sunset date 06-08-2029
Standard FIPS 140-3
Security level 1
Type Firmware
Embodiment MultiChipStand
Caveat When operated in approved mode. No assurance of the minimum strength of generated SSPs (e.g., keys). No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description The IC2M module provides the FIPS validated cryptographic algorithms for services requiring those algorithms. The module does not implement any protocols directly; Instead, it provides the cryptographic primitives and functions to allow IOS to implement those various protocols.
Vendor Cisco Systems, Inc. http://www.cisco.com
Lab Gossamer Security Solutions
Algorithms
  • AES-CBCA4354
  • AES-CFB128A4354
  • AES-CMACA4354
  • AES-ECBA4354
  • AES-GCMA4354
  • AES-GMACA4354
  • AES-KWA4354
  • Counter DRBGA4354
  • ECDSA KeyGen (FIPS186-4)A4354
  • ECDSA SigGen (FIPS186-4)A4354
  • ECDSA SigVer (FIPS186-4)A4354
  • HMAC-SHA-1A4354
  • HMAC-SHA2-256A4354
  • HMAC-SHA2-384A4354
  • HMAC-SHA2-512A4354
  • KAS-ECC-SSC Sp800-56Ar3A4354
  • KAS-FFC-SSC Sp800-56Ar3A4354
  • KDF IKEv2A4354
  • KDF SNMPA4354
  • KDF SRTPA4354
  • KDF SSHA4354
  • RSA KeyGen (FIPS186-4)A4354
  • RSA SigGen (FIPS186-4)A4354
  • RSA SigVer (FIPS186-4)A4354
  • Safe Primes Key GenerationA4354
  • SHA-1A4354
  • SHA2-256A4354
  • SHA2-384A4354
  • SHA2-512A4354
  • TLS v1.2 KDF RFC7627A4354
  • TLS v1.3 KDFA4354
References

This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES-, AES-256, AES, AES-128, AES-192, CAST, DES, Triple-DES, HMAC, CMAC
Asymmetric Algorithms
RSA 2048, ECDH, ECDSA, Diffie-Hellman, DHE, DH, DSA
Hash functions
SHA-1, SHA2, MD5
Schemes
MAC
Protocols
SSHv2, SSH, TLS v1.2, TLS v1.3, TLSv1.2, TLSv1.3, TLS, IKEv2, IKE, IPsec
Randomness
DRBG, RBG
Elliptic Curves
P-256, P-384, P-521
Block cipher modes
ECB, CBC, CTR, GCM

Trusted Execution Environments
PSP, SSC
Vendor
Cisco Systems, Inc, Cisco

Security level
Level 1, level 1

Creation date D:20260626085246-04'00'
Modification date D:20260626085246-04'00'
Pages 37
Creator Microsoft® Word for Microsoft 365
Producer Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

No references are available for this certificate.

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5356,
  "dgst": "9e25d9e0feebb921",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "KDF SSHA4354",
        "SHA2-512A4354",
        "AES-CBCA4354",
        "TLS v1.2 KDF RFC7627A4354",
        "AES-CMACA4354",
        "KDF IKEv2A4354",
        "RSA SigGen (FIPS186-4)A4354",
        "RSA SigVer (FIPS186-4)A4354",
        "HMAC-SHA2-256A4354",
        "RSA KeyGen (FIPS186-4)A4354",
        "#54",
        "HMAC-SHA2-384A4354",
        "AES-CFB128A4354",
        "ECDSA SigVer (FIPS186-4)A4354",
        "#A43",
        "Safe Primes Key GenerationA4354",
        "KAS-FFC-SSC Sp800-56Ar3A4354",
        "Counter DRBGA4354",
        "ECDSA SigGen (FIPS186-4)A4354",
        "HMAC-SHA-1A4354",
        "KAS-ECC-SSC Sp800-56Ar3A4354",
        "AES-GMACA4354",
        "ECDSA KeyGen (FIPS186-4)A4354",
        "SHA2-384A4354",
        "AES-KWA4354",
        "HMAC-SHA2-512A4354",
        "KDF SRTPA4354",
        "TLS v1.3 KDFA4354",
        "SHA2-256A4354",
        "SHA-1A4354",
        "AES-GCMA4354",
        "AES-ECBA4354",
        "KDF SNMPA4354"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 1,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES- CBC",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800- 38A"
          },
          {
            "algorithm": "AES- CFB128",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800- 38A"
          },
          {
            "algorithm": "AES- CMAC",
            "cavpCertName": "A43 54",
            "properties": "Direction - Generation, Verification Key Length - 128, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 32-4096 Increment 8",
            "reference": "SP 800- 38B"
          },
          {
            "algorithm": "AES- ECB",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800- 38A"
          },
          {
            "algorithm": "AES- GCM",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
            "reference": "SP 800- 38D"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 16, 128, 136, 256, 264 AAD Length - AAD Length: 0, 128, 136, 256",
            "reference": ""
          },
          {
            "algorithm": "AES- GMAC",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128 Tag Length - 128 IV Length - IV Length: 96 AAD Length - AAD Length: 0, 128, 136, 256",
            "reference": "SP 800- 38D"
          },
          {
            "algorithm": "AES- KW",
            "cavpCertName": "A43 54",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 192, 256 Payload Length - Payload Length: 128",
            "reference": "SP 800- 38F"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A43 54",
            "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 256-512 Increment 128 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0- 256 Increment 256 Returned Bits - 256",
            "reference": "SP 800- 90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Curve - P-256, P-384 Secret Generation Mode - Testing Candidates",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "HMAC- SHA-1",
            "cavpCertName": "A43 54",
            "properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 256-448 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC- SHA2- 256",
            "cavpCertName": "A43 54",
            "properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC- SHA2- 384",
            "cavpCertName": "A43 54",
            "properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC- SHA2- 512",
            "cavpCertName": "A43 54",
            "properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS- ECC- SSC Sp800- 56Ar3",
            "cavpCertName": "A43 54",
            "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Hash Function Z - SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800- 56A Rev. 3"
          },
          {
            "algorithm": "KAS- FFC- SSC Sp800- 56Ar3",
            "cavpCertName": "A43 54",
            "properties": "Domain Parameter Generation Methods - modp-2048, modp- 3072, modp-4096 Scheme - dhEphem - KAS Role - initiator, responder",
            "reference": "SP 800- 56A Rev. 3"
          },
          {
            "algorithm": "KDF IKEv2 (CVL)",
            "cavpCertName": "A43 54",
            "properties": "Initiator Nonce Length - Initiator Nonce Length: 2048 Responder Nonce Length - Responder Nonce Length: 2048 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 3072 Hash Algorithm - SHA-1",
            "reference": "SP 800- 135 Rev. 1"
          },
          {
            "algorithm": "KDF SNMP (CVL)",
            "cavpCertName": "A43 54",
            "properties": "Password Length - Password Length: 128, 64 Engine ID - 000002b87766554433221100, 800002B805123456789ABCDEF0123456789ABCDEF01234567 89ABCDEF0123456",
            "reference": "SP 800- 135 Rev. 1"
          },
          {
            "algorithm": "KDF SRTP (CVL)",
            "cavpCertName": "A43 54",
            "properties": "AES Key Length - 128, 192, 256 Supports Empty KDR - No KDR Exponents - 1, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 2, 20, 21, 22, 23, 24, 3, 4, 5, 6, 7, 8, 9 Supports 48 bit SRTCP Index - No",
            "reference": "SP 800- 135 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A43 54",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
            "reference": "SP 800- 135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Key Generation Mode - B.3.4 Modulo - 2048, 3072, 4096 Hash Algorithm - SHA2-256 Info Generated By Server - Yes Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigGen (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA2-256",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS18 6-4)",
            "cavpCertName": "A43 54",
            "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA2-256",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Public Exponent Mode - Fixed Fixed Public Exponent - 010001",
            "reference": ""
          },
          {
            "algorithm": "Safe Primes Key Generat ion",
            "cavpCertName": "A43 54",
            "properties": "Safe Prime Groups - modp-2048, modp-3072, modp-4096",
            "reference": "SP 800- 56A Rev. 3"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A43 54",
            "properties": "Message Length - Message Length: 0-4096 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2- 256",
            "cavpCertName": "A43 54",
            "properties": "Message Length - Message Length: 0-4096 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2- 384",
            "cavpCertName": "A43 54",
            "properties": "Message Length - Message Length: 0-4096 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2- 512",
            "cavpCertName": "A43 54",
            "properties": "Message Length - Message Length: 0-4096 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC762 7 (CVL)",
            "cavpCertName": "A43 54",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
            "reference": "SP 800- 135 Rev. 1"
          },
          {
            "algorithm": "TLS v1.3 KDF (CVL)",
            "cavpCertName": "A43 54",
            "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
            "reference": "SP 800- 135 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Initialization occurs when the module is loaded",
            "indicator": "N/A",
            "inputs": "None",
            "name": "Initialize Module",
            "outputs": "Module Loaded",
            "rolesSspAccess": "Crypto Officer Unauthen ticated",
            "secFunImpl": "None"
          },
          {
            "description": "Display running status of the module",
            "indicator": "N/A",
            "inputs": "API Command",
            "name": "Show Status",
            "outputs": "Module\u0027s current status",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Perform Self- tests (Pre- operational self-tests and Conditional CASTs)",
            "indicator": "N/A",
            "inputs": "API Command",
            "name": "Perform Self- Test",
            "outputs": "Output display on each algorithm running self-test and pass/fail indicator",
            "rolesSspAccess": "Crypto Officer Unauthen ticated",
            "secFunImpl": "None"
          },
          {
            "description": "Provide module\u0027s name and version information",
            "indicator": "N/A",
            "inputs": "API Command",
            "name": "Show Version",
            "outputs": "Displays the module\u0027s name/ID and versioning information",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Perform encryption/de cryption of data",
            "indicator": "API return value for succe ss",
            "inputs": "API commands, key, and plaintext/ci phertext data",
            "name": "Symmetric Cipher Operation",
            "outputs": "Plaintext or ciphertext",
            "rolesSspAccess": "Crypto Officer - AES EDK: G,R,W,E",
            "secFunImpl": "AES Encryption/D ecryption Symmetric Key"
          },
          {
            "description": "Perform signature generation/ve rification and key generation",
            "indicator": "API return value for succe ss",
            "inputs": "API commands, keys, and ciphertext/p laintext",
            "name": "Asymmetric Cipher Operation",
            "outputs": "Signature and plaintext/ci phertext",
            "rolesSspAccess": "Crypto Officer - RSA SGK: G,R,W,E - RSA SVK: G,R,W,E - ECDSA SGK: G,R,W,E - ECDSA SVK: G,R,W,E, Z - DRBG Entropy Input: G,R,W,E - DRBG Seed: G,R,W,E - DRBG Internal State (V,",
            "secFunImpl": "Generation RSA KeyGen RSA SigGen RSA SigVer ECDSA KeyGen ECDSA SigGen ECDSA SigVer Counter DRBG"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Key): G,R,W,E",
            "secFunImpl": ""
          },
          {
            "description": "Perform key agreement primitives on behalf of the calling application (does not establish keys into the module)",
            "indicator": "API return value for succe ss",
            "inputs": "Api commands, asymmetric keys",
            "name": "Key Exchange/Ag reement Component",
            "outputs": "Asymmetri c keypair or key agreement component",
            "rolesSspAccess": "Crypto Officer - DH Private Key: G,R,W,E - DH Public Key: G,R,W,E - DH Shared Secret: G,R - ECDH Private Key: G,R,W,E - ECDH Public Key: G,R,W,E - ECDH Shared Secret: G,R - DRBG Entropy Input: G,R,W,E - DRBG Seed: G,R,W,E - DRBG Internal State (V, Key): G,R,W,E",
            "secFunImpl": "KAS-ECC- KeyGen KAS-FFC- KeyGen KAS-ECC- SSC KAS-FFC- SSC Counter DRBG"
          },
          {
            "description": "Encrypt a key value on behalf of the calling application",
            "indicator": "API return value for succe ss",
            "inputs": "API commands, wrapping key, key",
            "name": "Key Wrapping (KW)",
            "outputs": "Wrapped key",
            "rolesSspAccess": "Crypto Officer - AES KWK: G,R,W,E",
            "secFunImpl": "AES Key Wrapping (KW) Symmetric Key Generation"
          },
          {
            "description": "Derive keys for IKEv2 protocol",
            "indicator": "API return value for succe ss",
            "inputs": "IKEv2 (existing application specific): IKEv2 parameters",
            "name": "KDF IKEv2 Function",
            "outputs": "IKEv2 Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret: W,E - ECDH Shared Secret: W,E - IKEv2 Keying Materials: G,R",
            "secFunImpl": "IKEv2 Key Derivation"
          },
          {
            "description": "Derive keys for SNMPv3 protocol",
            "indicator": "API return value for succe ss",
            "inputs": "SNMPv3 (existing application specific): SNMPv3 parameters",
            "name": "KDF SNMPv3 Function",
            "outputs": "SNMPv3 Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret: W,E - ECDH Shared Secret: W,E - SNMPv3 Keying Materials: G,R",
            "secFunImpl": "SNMPv3 Key Derivation"
          },
          {
            "description": "Derive keys for SRTP protocol",
            "indicator": "API return value for succe ss",
            "inputs": "SRTP (existing application specific): SRTP parameters",
            "name": "KDF SRTP Function",
            "outputs": "SRTP Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret: W,E - ECDH Shared Secret: W,E - SRTP Keying Materials: G,R",
            "secFunImpl": "SRTP Key Derivation"
          },
          {
            "description": "Derive keys for SSHv2 protocol",
            "indicator": "API return value for",
            "inputs": "SSHv2 (existing application specific):",
            "name": "KDF SSHv2 Function",
            "outputs": "SSHv2 Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret:",
            "secFunImpl": "SSHv2 Key Derivation"
          },
          {
            "description": "",
            "indicator": "succe ss",
            "inputs": "SSHv2 parameters",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "W,E - ECDH Shared Secret: W,E - SSHv2 Keying Materials: G,R",
            "secFunImpl": ""
          },
          {
            "description": "Derive keys for TLSv1.2 protocol",
            "indicator": "API return value for succe ss",
            "inputs": "TLSv1.2 (existing application specific): TLSv1.2 parameters",
            "name": "KDF TLSv1.2 Function",
            "outputs": "TLSv1.2 Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret: W,E - ECDH Shared Secret: W,E - TLSv1.2 Keying Materials: G,R",
            "secFunImpl": "TLSv1.2 Key Derivation"
          },
          {
            "description": "Derive keys for TLSv1.3 protocol",
            "indicator": "API return value for succe ss",
            "inputs": "TLSv1.3 (existing application specific): TLSv1.3 parameters",
            "name": "KDF TLSv1.3 Function",
            "outputs": "TLSv1.3 Keying Materials",
            "rolesSspAccess": "Crypto Officer - DH Shared Secret: W,E - ECDH Shared Secret: W,E - TLSv1.3 Keying Materials: G,R",
            "secFunImpl": "TLSv1.3 Key Derivation"
          },
          {
            "description": "Generate keyed hash",
            "indicator": "API return value for succe ss",
            "inputs": "API commands, HMAC key, plaintext",
            "name": "Keyed Hash Function",
            "outputs": "MAC value",
            "rolesSspAccess": "Crypto Officer - HMAC Key: G,R,W,E",
            "secFunImpl": "HMAC Symmetric Key Generation"
          },
          {
            "description": "Generate message digest (secure",
            "indicator": "API return value for",
            "inputs": "API commands, plaintext",
            "name": "Message Digest",
            "outputs": "Hash value",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "SHA"
          },
          {
            "description": "hashing function)",
            "indicator": "succe ss",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Provide random data for key generation",
            "indicator": "API return value for succe ss",
            "inputs": "API commands",
            "name": "Random number generation",
            "outputs": "Random bits",
            "rolesSspAccess": "Crypto Officer - DRBG Entropy Input: G,R,W,E - DRBG Seed: G,R,W,E - DRBG Internal State (V, Key): G,R,W,E",
            "secFunImpl": "Counter DRBG"
          },
          {
            "description": "Zeroize all SSPs stored in allocated mempory. Cleanup is the responsibility of the calling application.",
            "indicator": "N/A",
            "inputs": "API commands",
            "name": "Zeroization",
            "outputs": "None",
            "rolesSspAccess": "Crypto Officer - AES EDK: Z - AES KWK: Z - RSA SGK: Z - RSA SVK: Z - ECDSA SGK: Z - ECDSA SVK: Z - DH Private Key: Z - DH Public Key: Z - DH Shared Secret: Z - ECDH Private Key: Z - ECDH Public Key: Z - ECDH Shared Secret: Z - HMAC",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Key: Z - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State (V, Key): Z - IKEv2 Keying Materials: Z - SSHv2 Keying Materials: Z - SNMPv3 Keying Materials: Z - SRTP Keying Materials: Z - TLSv1.2 Keying Materials: Z - TLSv1.3 Keying Materials: Z",
            "secFunImpl": ""
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-ECB Encrypt KAT",
            "condition": "Power Up",
            "details": "Encrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB Decrypt KAT",
            "condition": "Power Up",
            "details": "Decrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Encrypt KAT",
            "condition": "Power Up",
            "details": "Encrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Decrypt KAT",
            "condition": "Power Up",
            "details": "Decrypt",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "256 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG Instantiate KAT",
            "condition": "Power Up",
            "details": "Instantiate KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG Generate KAT",
            "condition": "Power Up",
            "details": "Generate KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG Reseed KAT",
            "condition": "Power Up",
            "details": "Reseed KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-256 KAT",
            "condition": "Power Up",
            "details": "HMAC- SHA2-256",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA-1 KAT",
            "condition": "Power Up",
            "details": "SHA-1",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA-1",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 KAT",
            "condition": "Power Up",
            "details": "SHA2-256",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-512 KAT",
            "condition": "Power Up",
            "details": "SHA2-512",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigGen KAT",
            "condition": "Power Up",
            "details": "ECDSA SigGen KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256 with SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer KAT",
            "condition": "Power Up",
            "details": "ECDSA SigVer KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256 with SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigGen KAT",
            "condition": "Power Up",
            "details": "RSA SigGen KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "2048-bit modulus with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer KAT",
            "condition": "Power Up",
            "details": "RSA SigVer KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "2048-bit modulus with SHA2- 256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 KAT",
            "condition": "Power Up",
            "details": "Primitive Z KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "MODP-2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 KAT",
            "condition": "Power Up",
            "details": "Primitive Z KAT",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "P-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF IKEv2 KAT",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SNMP KAT",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SRTP KAT",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SSH KAT",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLSv1.2 KSF with RFC7627 KAT",
            "condition": "Power Up",
            "details": "With RFC7627",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLSv1.3 KDF KAT",
            "condition": "Power Up",
            "details": "N/A",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen PCT",
            "condition": "Performs all required pair-wise consistency tests on the newly generated key pairs before the first operational use",
            "details": "ECDSA",
            "indicator": "Module is in normal state",
            "testMethod": "PCT",
            "testProps": "P-256",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "RSA KeyGen PCT",
            "condition": "Performs all required pair-wise consistency tests on the newly generated key pairs before the first operational use",
            "details": "RSA",
            "indicator": "Module is in normal state",
            "testMethod": "PCT",
            "testProps": "2048-bit modulus",
            "type": "PCT"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Self-test failure",
            "description": "If any of the pre-operational or conditional CASTS fail, the module is put into an error state",
            "indicator": "System Halt",
            "name": "Critical Error State",
            "recoveryMethod": "Reboot the module"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "N/A",
            "inspectGuidance": "N/A",
            "mechanism": "Production-grade components with standard passivation"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Automatically entered whenever an approved service is requested.",
            "name": "Approved Mode",
            "statusIndicator": "Equivalent to the indicator of the requested service.",
            "type": "Approved"
          },
          {
            "description": "Automatically entered whenever a non-approved service is requested.",
            "name": "Non- Approved Mode",
            "statusIndicator": "Equivalent to the indicator of the requested service.",
            "type": "Non- Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [
          {
            "name": "MD5",
            "use": "Message Digest"
          },
          {
            "name": "RSA",
            "use": "Key Encapsulation"
          },
          {
            "name": "Triple-DES",
            "use": "Encryption/Decryption"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [
          {
            "alg_accessed": "MD5",
            "description": "Generate message digest using MD5",
            "name": "Message digest using MD5",
            "role": "CO"
          },
          {
            "alg_accessed": "RSA",
            "description": "Perform RSA key encapsulation/un- encapsulation using RSA 2048 bits (not approved, not allowed per IG D.G)",
            "name": "Non-SP 800-56Br2- compliant Key Transport scheme using RSA",
            "role": "CO"
          },
          {
            "alg_accessed": "Triple-DES",
            "description": "Perform symmetric operation using Triple- DES",
            "name": "Symmetric operation using Triple-DES",
            "role": "CO"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "API input parameters - plaintext and/or ciphertext data",
            "logicalInterface": "Data Input",
            "physicalPort": "N/A"
          },
          {
            "data": "API output parameters - plaintext and/or ciphertext data",
            "logicalInterface": "Data Output",
            "physicalPort": "N/A"
          },
          {
            "data": "API input parameters - function calls, or input arguments that specify commands and control data used to control the operation of the module",
            "logicalInterface": "Control Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Not Applicable",
            "logicalInterface": "Control Output",
            "physicalPort": "N/A"
          },
          {
            "data": "API return codes- function return codes, error codes, or output arguments that receive status information used to indicate the status of the module",
            "logicalInterface": "Status Output",
            "physicalPort": "N/A"
          },
          {
            "data": "Not applicable",
            "logicalInterface": "Power",
            "physicalPort": "N/A"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "None",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "1",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "1",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Firmware Integrity Test",
            "details": "Firmware Integrity Test",
            "indicator": "Module is in normal state",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA2- 256",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Module",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "API Input",
            "sfiAlgo": "",
            "source": "Calling application (Within TOEPP)"
          },
          {
            "dest": "Calling application (Within TOEPP)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "API Output",
            "sfiAlgo": "",
            "source": "Module"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "De-allocates the volatile memory used to store SSPs",
            "method": "Remove power from the module",
            "operatorId": "Removing power from the module",
            "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "The module stores SSPs in RAM provided by the operational environment. They are received for use or generated by the module only at the command of the calling application. The operating system protects all SSPs through the memory separation and protection mechanisms. No process other than the module itself can access the SSPs in its process\u0027 memory.",
            "name": "RAM of the TOEPP",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "Cisco Aggregated Services Router (ASR) 1001-HX",
            "hypervisorHostOs": "",
            "operatingSystem": "IOS-XE 17.12",
            "paa_pai": "No",
            "processors": "Intel Xeon E3- 1125C v2",
            "version": "Rel5b"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric and Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "SP 800-133r2 Section 4, example 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "Catalyst 9200 Series Switches",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Catalyst 9300 Series Switches",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Catalyst 9400 Series Switches",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Catalyst 9500 Series Switches",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Catalyst 9600 Series Switches",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Embedded Services 3300 Series Switch",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Embedded Services 9300 Series Switch",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Catalyst Industrial Ethernet 3000 Series Switch",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Catalyst Industrial Ethernet 9300 Series Switch",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco C8500, C8500L Series Edge Platforms",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco C8200, C8200L, C8300 Series Edge Platforms",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Aggregation Services Router (ASR) 1000 series",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Integrated Services Router (ISR) 4000 series",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco Integrated Services Router (ISR) 1000 series",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco C8000V Edge Software Router",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco IR 1100, 1800, 8100, 8300 Series Industrial Routers",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco 8100 Series Secure Routers",
            "operatingSystem": "IOS-XE 17.12"
          },
          {
            "hardwarePlatform": "Cisco 8400 Series Secure Routers",
            "operatingSystem": "IOS-XE 17.12"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECDH": {
            "ECDH": 21
          },
          "ECDSA": {
            "ECDSA": 37
          }
        },
        "FF": {
          "DH": {
            "DH": 21,
            "DHE": 1,
            "Diffie-Hellman": 2
          },
          "DSA": {
            "DSA": 3
          }
        },
        "RSA": {
          "RSA 2048": 1
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 1
        },
        "CTR": {
          "CTR": 1
        },
        "ECB": {
          "ECB": 1
        },
        "GCM": {
          "GCM": 2
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "IKE": {
          "IKE": 2,
          "IKEv2": 19
        },
        "IPsec": {
          "IPsec": 2
        },
        "SSH": {
          "SSH": 5,
          "SSHv2": 17
        },
        "TLS": {
          "TLS": {
            "TLS": 9,
            "TLS v1.2": 3,
            "TLS v1.3": 3,
            "TLSv1.2": 17,
            "TLSv1.3": 17
          }
        }
      },
      "crypto_scheme": {
        "MAC": {
          "MAC": 10
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 28,
          "P-384": 20,
          "P-521": 14
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 2,
          "AES-128": 4,
          "AES-192": 1,
          "AES-256": 3,
          "AES-GCM Decrypt KAT 256": 1,
          "AES-GCM Encrypt KAT 256": 1,
          "HMAC- SHA-1": 1,
          "PKCS 1": 2,
          "RSA 2048": 1,
          "SHA-1": 10,
          "SHA2": 1,
          "SHA2- 256": 4,
          "SHA2- 384": 2,
          "SHA2- 512": 2,
          "SHA2-256": 17,
          "SHA2-384": 5,
          "SHA2-512": 7
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 3,
          "level 1": 1
        }
      },
      "hash_function": {
        "MD": {
          "MD5": {
            "MD5": 3
          }
        },
        "SHA": {
          "SHA1": {
            "SHA-1": 10
          },
          "SHA2": {
            "SHA2": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 53
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 7,
          "FIPS 180-4": 4,
          "FIPS 186-4": 8,
          "FIPS 198-1": 4,
          "FIPS PUB 197": 1,
          "FIPS PUB 198": 1,
          "FIPS18": 6
        },
        "ISO": {
          "ISO/IEC 19790": 6
        },
        "NIST": {
          "NIST SP 800-140": 1
        },
        "PKCS": {
          "PKCS 1": 2
        },
        "RFC": {
          "RFC 3526": 1,
          "RFC 4106": 1,
          "RFC 4419": 1,
          "RFC 5288": 1,
          "RFC 8446": 1,
          "RFC762": 1,
          "RFC7627": 3
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 20,
            "AES-": 10,
            "AES-128": 4,
            "AES-192": 1,
            "AES-256": 3
          },
          "CAST": {
            "CAST": 46
          }
        },
        "DES": {
          "3DES": {
            "Triple-DES": 3
          },
          "DES": {
            "DES": 1
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 1,
            "HMAC": 13
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 4
        },
        "IBM": {
          "SSC": 9
        }
      },
      "tls_cipher_suite": {},
      "vendor": {
        "Cisco": {
          "Cisco": 16,
          "Cisco Systems, Inc": 4
        }
      },
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "KDF SSHA4354",
        "SHA2-512A4354",
        "AES-CBCA4354",
        "TLS v1.2 KDF RFC7627A4354",
        "AES-CMACA4354",
        "KDF IKEv2A4354",
        "RSA SigGen (FIPS186-4)A4354",
        "RSA SigVer (FIPS186-4)A4354",
        "HMAC-SHA2-256A4354",
        "RSA KeyGen (FIPS186-4)A4354",
        "HMAC-SHA2-384A4354",
        "AES-ECBA4354",
        "AES-CFB128A4354",
        "ECDSA SigVer (FIPS186-4)A4354",
        "Safe Primes Key GenerationA4354",
        "KAS-FFC-SSC Sp800-56Ar3A4354",
        "Counter DRBGA4354",
        "ECDSA SigGen (FIPS186-4)A4354",
        "HMAC-SHA-1A4354",
        "KAS-ECC-SSC Sp800-56Ar3A4354",
        "ECDSA KeyGen (FIPS186-4)A4354",
        "SHA2-384A4354",
        "AES-KWA4354",
        "HMAC-SHA2-512A4354",
        "KDF SRTPA4354",
        "TLS v1.3 KDFA4354",
        "SHA-1A4354",
        "KDF SNMPA4354",
        "AES-GCMA4354",
        "AES-GMACA4354",
        "SHA2-256A4354"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A43",
        "#54"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260626085246-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260626085246-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 597244,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": []
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 37
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "46f629818e2c60f206f4963c0744f6cdc1ec15875b5b0bed1726211cc7e14db0",
      "source_hash": "806e6bd9902a372f9dd623934d8c0c52450c9433aa0af2370458c96a4316bf5f",
      "txt_hash": "73e9bdcc50b217b92998a32d8cd846ee3e02dc4727abf5ea4a338b6745076e53"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When operated in approved mode. No assurance of the minimum strength of generated SSPs (e.g., keys). No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
    "date_sunset": "2029-08-06",
    "description": "The IC2M module provides the FIPS validated cryptographic algorithms for services requiring those algorithms. The module does not implement any protocols directly; Instead, it provides the cryptographic primitives and functions to allow IOS to implement those various protocols.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {},
    "module_name": "IOS Common Cryptographic Module (IC2M)",
    "module_type": "Firmware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-06-26",
        "lab": "Gossamer Security Solutions",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Cisco Systems, Inc.",
    "vendor_url": "http://www.cisco.com"
  }
}