Advanced Micro Devices (AMD)
AMD ASP Cryptographic CoProcessor ("Turin")
FIPS 140-3 Non-Proprietary Security Policy
Prepared by:
atsec information security corporation
4516 Seton Center Pkwy, Suite 250
Austin, TX 78759 Document version: 1.1
www.atsec.com Last update: 2025-10-08
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 2 of 48
Table of Contents
1 General................................................................................................................................... 5
1.1 Overview.......................................................................................................................... 5
1.2 Security Levels ................................................................................................................ 5
2 Cryptographic Module Specification ...................................................................................... 6
2.1 Description....................................................................................................................... 6
2.2 Tested and Vendor Affirmed Module Version and Identification..................................... 8
2.3 Excluded Components..................................................................................................... 8
2.4 Modes of Operation ......................................................................................................... 8
2.5 Algorithms ....................................................................................................................... 8
2.6 Security Function Implementations............................................................................... 11
2.7 Algorithm Specific Information ...................................................................................... 13
2.8 RBG and Entropy ........................................................................................................... 14
2.9 Key Generation.............................................................................................................. 14
2.10 Key Establishment....................................................................................................... 15
2.11 Industry Protocols........................................................................................................ 15
3 Cryptographic Module Interfaces......................................................................................... 16
3.1 Ports and Interfaces....................................................................................................... 16
4 Roles, Services, and Authentication .................................................................................... 17
4.1 Authentication Methods................................................................................................. 17
4.2 Roles .............................................................................................................................. 17
4.3 Approved Services......................................................................................................... 17
4.4 Non-Approved Services ................................................................................................. 26
4.5 External Software/Firmware Loaded ............................................................................. 27
5 Software/Firmware Security................................................................................................. 28
5.1 Integrity Techniques...................................................................................................... 28
5.2 Initiate on Demand........................................................................................................ 28
6 Operational Environment ..................................................................................................... 29
6.1 Operational Environment Type and Requirements....................................................... 29
6.2 Configuration Settings and Restrictions........................................................................ 29
7 Physical Security .................................................................................................................. 30
7.1 Mechanisms and Actions Required................................................................................ 30
8 Non-Invasive Security .......................................................................................................... 31
9 Sensitive Security Parameters Management ....................................................................... 32
9.1 Storage Areas ................................................................................................................ 32
9.2 SSP Input-Output Methods ............................................................................................ 32
9.3 SSP Zeroization Methods............................................................................................... 32
9.4 SSPs ............................................................................................................................... 33
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 3 of 48
9.5 Transitions ..................................................................................................................... 37
10 Self-Tests............................................................................................................................ 38
10.1 Pre-Operational Self-Tests........................................................................................... 38
10.2 Conditional Self-Tests.................................................................................................. 38
10.3 Periodic Self-Test Information ..................................................................................... 41
10.4 Error States.................................................................................................................. 42
10.5 Operator Initiation of Self-Tests .................................................................................. 43
11 Life-Cycle Assurance .......................................................................................................... 44
11.1 Installation, Initialization, and Startup Procedures ..................................................... 44
11.2 Administrator Guidance............................................................................................... 44
11.3 Non-Administrator Guidance ....................................................................................... 44
11.4 Design and Rules......................................................................................................... 44
11.5 Maintenance Requirements......................................................................................... 44
11.6 End of Life.................................................................................................................... 44
12 Mitigation of Other Attacks ................................................................................................ 45
A Glossary and Abbreviations ................................................................................................. 46
B References ........................................................................................................................... 47
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 4 of 48
List of Tables
Table 1: Security Levels ............................................................................................................ 5
Table 2: Tested Module Identification – Hardware.................................................................... 8
Table 3: Modes List and Description ......................................................................................... 8
Table 4: Approved Algorithms................................................................................................. 10
Table 5: Vendor-Affirmed Algorithms...................................................................................... 10
Table 6: Non-Approved, Allowed Algorithms with No Security Claimed ................................. 10
Table 7: Non-Approved, Not Allowed Algorithms.................................................................... 11
Table 8: Security Function Implementations .......................................................................... 13
Table 9: Entropy Certificates................................................................................................... 14
Table 10: Entropy Sources ...................................................................................................... 14
Table 11: Ports and Interfaces ................................................................................................ 16
Table 12: Roles........................................................................................................................ 17
Table 13: Approved Services .................................................................................................. 25
Table 14: Non-Approved Services........................................................................................... 27
Table 15: Mechanisms and Actions Required ......................................................................... 30
Table 16: Storage Areas.......................................................................................................... 32
Table 17: SSP Input-Output Methods ...................................................................................... 32
Table 18: SSP Zeroization Methods......................................................................................... 33
Table 19: SSP Table 1.............................................................................................................. 35
Table 20: SSP Table 2.............................................................................................................. 37
Table 21: Pre-Operational Self-Tests....................................................................................... 38
Table 22: Conditional Self-Tests.............................................................................................. 41
Table 23: Pre-Operational Periodic Information...................................................................... 41
Table 24: Conditional Periodic Information............................................................................. 42
Table 25: Error States ............................................................................................................. 43
List of Figures
Figure 1: AMD EPYC 9B45 SoC .................................................................................................. 7
Figure 2: Block Diagram............................................................................................................ 7
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 5 of 48
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy for the AMD ASP
Cryptographic CoProcessor ("Turin") cryptographic module. It contains the security rules
under which the module must operate and describes how this module meets the requirements
as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3)
for an overall Security Level 1 module.
This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and
intact and including this notice.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 3
6 Operational environment 1
7 Physical security 1
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 2
12 Mitigation of other attacks N/A
Overall Level 1
Table 1: Security Levels
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 6 of 48
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The AMD ASP Cryptographic CoProcessor ("Turin") cryptographic module (hereafter referred
to as “the module”) is defined as a sub-chip hardware module in a single chip embodiment,
with hardware and firmware components implementing general purpose cryptographic
algorithms.
Module Type: Hardware
Module Embodiment: SingleChip
Module Characteristics: SubChip
Cryptographic Boundary:
The module consists primarily of the ARM Cortex-A5, Random Bit Generation hardware,
Security Infrastructure Block, Cryptographic CoProcessor, and OTP fuses. These hardware
components are sub-components of the “IOD” (EPYC EIOD2.0), which itself is a smaller die in
the larger single chip embodiment, the EPYC SoC.
OTP fuses are used to persistently store FIPS support enablement and versioning information,
security state information, and Entropy Source configuration values (sample rate, sample
count, RCT and APT cutoffs).
In addition, there is a ROM firmware component (“libROM”) permanently stored inside the
EPYC SoC, and an overlay firmware component (“overlay firmware”) permanently stored
inside SPI flash storage, outside the EPYC SoC, which is loaded into the IOD SRAM on startup.
The block diagram in Figure 2 shows the design of the module when the module is operational
and the firmware components are loaded into the SRAM. In this diagram, the physical
boundary of the module, defined by the perimeter of the EPYC SoC (i.e., the enclosure of the
SoC), is indicated by a dashed purple line. The cryptographic boundary is represented by the
components painted in orange blocks. Solid orange lines indicate the flow of data within the
cryptographic module (i.e., internal paths). Dashed green lines are used to denote the logical
interfaces defined in Section 3.
Components in white are only included in the diagram for informational purposes. They are
not included in the cryptographic boundary (and therefore not part of the module’s validation).
Tested Operational Environment’s Physical Perimeter (TOEPP):
The TOEPP is the EPYC SoC (shown in Figure 1), a rectangular enclosure measuring
approximately 72 mm x 75.4 mm x 5.30 mm.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 7 of 48
Figure 1: AMD EPYC 9B45 SoC
Figure 2: Block Diagram
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 8 of 48
2.2 Tested and Vendor Affirmed Module Version and
Identification
Tested Module Identification – Hardware:
Model and/or Part Number Hardware
Version
Firmware
Version
Processors Features
AMD EPYC 9B45 containing EPYC
EIOD2.0
C1-1-3D0A 003D0306 ARM Cortex-
A5
N/A
Table 2: Tested Module Identification – Hardware
2.3 Excluded Components
There are no components excluded from the requirements of the FIPS 140-3 standard.
2.4 Modes of Operation
Modes List and Description:
Mode
Name
Description Type Status Indicator
Approved
mode
Automatically entered
whenever an approved
service is requested
Approved Equivalent to the indicator of the
requested service
(FipsIndicatorStatus is set to 2)
Non-
approved
mode
Automatically entered
whenever a non-approved
service is requested
Non-
Approved
Equivalent to the indicator of the
requested service
(FipsIndicatorStatus is not set to 2)
Table 3: Modes List and Description
After passing all pre-operational self-tests and conditional self-tests executed on startup, the
module automatically transitions to the approved mode. No operator intervention is required
to reach this point. In the operational state, the module accepts service requests from calling
applications through its logical interfaces. The operator can verify that the module is
operational by requesting the RL_ARCL_GetState service and comparing the returned
ArclState value with 4.
Mode Change Instructions and Status:
The module automatically switches between the approved and non-approved modes
depending on the services requested by the operator. The status indicator of the mode of
operation is equivalent to the indicator of the service that was requested.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP
Cert
Properties Reference
AES-CBC A5794 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CMAC A5794 Direction - Generation, Verification
Key Length - 128, 192, 256
SP 800-38B
AES-CTR A5794 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A5794 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 9 of 48
Algorithm CAVP
Cert
Properties Reference
AES-ECB A5795 Direction - Encrypt
Key Length - 256
SP 800-38A
Conditioning
Component AES-CBC-
MAC SP800-90B
A5337 Key Length - 256 SP 800-90B
Counter DRBG A5795 Prediction Resistance - No
Mode - AES-256
Derivation Function Enabled - No
SP 800-90A
Rev. 1
ECDSA KeyGen
(FIPS186-5)
A5794 Curve - P-384
Secret Generation Mode - extra bits
FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A5794 Curve - P-384
Hash Algorithm - SHA2-224, SHA2-
256, SHA2-384, SHA2-512, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
Component - No
FIPS 186-5
ECDSA SigVer
(FIPS186-4)
A5794 Component - No
Curve - P-384
Hash Algorithm - SHA-1
FIPS 186-4
ECDSA SigVer
(FIPS186-5)
A5794 Curve - P-384
Hash Algorithm - SHA2-224, SHA2-
256, SHA2-384, SHA2-512, SHA3-224,
SHA3-256, SHA3-384, SHA3-512
FIPS 186-5
HMAC-SHA-1 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-224 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-256 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-384 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA2-512 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-224 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-256 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-384 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
HMAC-SHA3-512 A5794 Key Length - Key Length: 112-524288
Increment 8
FIPS 198-1
KDF SP800-108 A5794 KDF Mode - Counter
Supported Lengths - Supported
Lengths: 112-4096 Increment 8
SP 800-108
Rev. 1
RSA KeyGen (FIPS186-
5)
A5794 Key Generation Mode - probable
Modulo - 2048, 3072, 4096
Primality Tests - 2powSecStr
Private Key Format - standard
FIPS 186-5
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 10 of 48
Algorithm CAVP
Cert
Properties Reference
RSA SigGen (FIPS186-
5)
A5794 Modulo - 2048, 3072, 4096
Signature Type - pss
FIPS 186-5
RSA SigVer (FIPS186-2) A5794 Signature Type - PKCSPSS
Modulo - 1536
FIPS 186-4
RSA SigVer (FIPS186-4) A5794 Signature Type - PKCSPSS
Modulo - 1024, 2048, 3072, 4096
FIPS 186-4
RSA SigVer (FIPS186-5) A5794 Modulo - 2048, 3072, 4096
Signature Type - pss
FIPS 186-5
SHA-1 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 180-4
SHA2-224 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 180-4
SHA2-256 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 180-4
SHA2-384 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 180-4
SHA2-512 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 180-4
SHA3-224 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 202
SHA3-256 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 202
SHA3-384 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 202
SHA3-512 A5794 Message Length - Message Length: 0-
65536 Increment 8
FIPS 202
SHAKE-128 A5794 Output Length - Output Length: 1344 FIPS 202
SHAKE-256 A5794 Output Length - Output Length: 1088 FIPS 202
Table 4: Approved Algorithms
Vendor-Affirmed Algorithms:
Name Properties Implementation Reference
CKG
(asymmetric)
Key
Type:Asymmetric
N/A SP 800-133r2, Section 4,
example 1
Table 5: Vendor-Affirmed Algorithms
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
Name Caveat Use and
Function
RTL key de-
obfuscation
When used to de-obfuscate data using the weak
RTL key
De-
obfuscation
Table 6: Non-Approved, Allowed Algorithms with No Security Claimed
Non-Approved, Not Allowed Algorithms:
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 11 of 48
Name Use and Function
HMAC with key
lengths less than
112 bits
Message authentication
Deterministic
ECDSA key pair
generation
Key pair generation
Deterministic RSA
key pair generation
Key pair generation
ECDSA (pre-hashed
message)
Signature generation, Signature verification
ECDSA with SHA-1 Signature generation
RSA with 1024 or
1536 bits modulus
Key pair generation, Signature generation
RSA (pre-hashed
message)
Signature generation, Signature verification
RSA with SHA-1 Signature generation
SHA-384 with non-
standard initial hash
value
PCR-based memory measurement
CCP_HAL algorithm Message digest (SHA-1, SHA-224, SHA-256, SHA-384, SHA-512,
SHA3-224, SHA3-256, SHA3-384, SHA3-512), XOF (SHAKE128,
SHAKE256), encryption, decryption (AES ECB, CBC, OFB, CFB, CTR,
GCTR, IAPM, XTS), message authentication (AES CMAC)
SIB_HAL algorithm Random number generation
Table 7: Non-Approved, Not Allowed Algorithms
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Encryption BC-UnAuth Encrypt a
plaintext
AES-CBC:
(A5794)
AES-CTR:
(A5794)
AES-ECB:
(A5794)
Decryption BC-UnAuth Decrypt a
ciphertext
AES-CBC:
(A5794)
AES-CTR:
(A5794)
AES-ECB:
(A5794)
Message digest SHA Compute a
message digest
SHA-1: (A5794)
SHA2-224:
(A5794)
SHA2-256:
(A5794)
SHA2-384:
(A5794)
SHA2-512:
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 12 of 48
Name Type Description Properties Algorithms
(A5794)
SHA3-224:
(A5794)
SHA3-256:
(A5794)
SHA3-384:
(A5794)
SHA3-512:
(A5794)
XOF XOF Compute an
extendable
output message
digest
SHAKE-128:
(A5794)
SHAKE-256:
(A5794)
MAC MAC Compute a MAC
tag
AES-CMAC:
(A5794)
HMAC-SHA-1:
(A5794)
HMAC-SHA2-
224: (A5794)
HMAC-SHA2-
256: (A5794)
HMAC-SHA2-
384: (A5794)
HMAC-SHA2-
512: (A5794)
HMAC-SHA3-
224: (A5794)
HMAC-SHA3-
256: (A5794)
HMAC-SHA3-
384: (A5794)
HMAC-SHA3-
512: (A5794)
Random
number
generation
DRBG Generate
random bytes
Conditioning
Component
AES-CBC-MAC
SP800-90B:
(A5337)
AES-ECB:
(A5795)
Counter DRBG:
(A5795)
Key derivation KBKDF Derive a key
from a key
derivation key
KDF SP800-108:
(A5794)
Key pair
generation
AsymKeyPair-
KeyGen
CKG
Generate a key
pair
ECDSA KeyGen
(FIPS186-5):
(A5794)
RSA KeyGen
(FIPS186-5):
(A5794)
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 13 of 48
Name Type Description Properties Algorithms
CKG
(asymmetric): ()
Signature
generation
DigSig-SigGen Generate a
digital signature
ECDSA SigGen
(FIPS186-5):
(A5794)
RSA SigGen
(FIPS186-5):
(A5794)
Signature
verification
DigSig-SigVer Verify a digital
signature
ECDSA SigVer
(FIPS186-5):
(A5794)
RSA SigVer
(FIPS186-5):
(A5794)
Signature
verification
(Legacy)
DigSig-SigVer Verify a digital
signature
Publications:FIPS
140-3 IG C.M
legacy
algorithms
RSA Key:1024 or
1536 bit
modulus; 2048,
3072, 4096 bit
modulus with
SHA-1
ECDSA Key:P-
384 with SHA-1
RSA SigVer
(FIPS186-4):
(A5794)
RSA SigVer
(FIPS186-2):
(A5794)
ECDSA SigVer
(FIPS186-4):
(A5794)
Table 8: Security Function Implementations
2.7 Algorithm Specific Information
SHA-1:
Digital signature generation using SHA-1 is non-approved and not allowed in approved
services.
RSA:
For RSA key pair generation, signature generation, and signature verification, the module
supports modulus sizes 2048, 3072, and 4096 bits. Additionally, the module supports a
modulus size of 1024 and 1536 bits for RSA signature verification. All supported modulus sizes
have been CAVP tested.
Legacy use and FIPS 186-5:
In compliance with FIPS 140-3 IG C.K, the digital signature algorithm implementations have
been CAVP tested against FIPS 186-5 where possible.
FIPS 186-2 CAVP testing was performed for RSA signature verification with a 1536-bit modulus.
FIPS 186-4 CAVP testing was performed for digital signature verification using SHA-1 and RSA
signature verification with a 1024-bit modulus. These algorithms are allowed for legacy use
only.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 14 of 48
2.8 RBG and Entropy
Cert
Number
Vendor Name
E173 Advanced Micro Devices (AMD)
Table 9: Entropy Certificates
Name Type Operational
Environment
Sample
Size
Entropy
per
Sample
Conditioning
Component
AMD TRNG Entropy
Source
Physical EPYC EIOD2.0 128 128 AES-CBC-MAC
(A5337)
Table 10: Entropy Sources
The module provides an SP800-90Ar1-compliant Deterministic Random Bit Generator (DRBG)
using CTR_DRBG mechanism with AES-256 for generation of key components of asymmetric
keys, and random number generation. The module complies with the Public Use Document
for ESV certificate E173 by reading entropy data from the 2048-bit FIFO, which corresponds
to the GetEntropy() function. This function outputs 128 bits of entropy. The module constructs
the 384-bit entropy input for the DRBG by requesting GetEntropy() three times and
concatenating the result.
The DRBG does not employ a derivation function, does not support a personalization string,
and does not support additional input. Consequently, the 384-bit entropy input is used directly
as the DRBG seed, for both seeding and reseeding.
The operational environment on the ESV certificate is identical to the IOD in the EPYC SoC, in
which the sub-chip components are contained. Thus, the module is compliant with scenario 1
of IG 9.3.A. There are no maintenance requirements for the entropy source.
2.9 Key Generation
The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant
with SP 800-133r2. When random values are required, they are obtained from the SP 800
90Ar1 approved DRBG, compliant with Section 4 of SP 800-133r2. The following methods are
implemented:
• ECDSA key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to
FIPS 186-5. The method described in Appendix A.2.1 of FIPS 186-5 (“ECDSA Key Pair
Generation using Extra Random Bits”) is used.
• RSA key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to FIPS
186-5. The method described in Appendix A.1.3 of FIPS 186-5 (“Generation of Random
Primes that are Probably Prime”) is used.
Intermediate key generation values are not output from the module and are explicitly zeroized
after processing the service.
Additionally, the module implements an SP 800-108r1 compliant KBKDF, using the HMAC SHA-
256 PRF and a 32-bit counter. This implementation can be used to derive secret keys when
provided with a pre-existing key-derivation key.
The resulting SSPs can be stored by the module in the Key Storage Block (if specified by the
operator) or output as an API output parameter.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 15 of 48
2.10 Key Establishment
The module does not implement any automated key establishment methods.
2.11 Industry Protocols
The module does not implement any industry protocol.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 16 of 48
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
SRAM Data Input API input parameters for data.
SRAM Data Output API output parameters for data.
SRAM Control Input API function calls, API input parameters for control.
SRAM Status Output API return codes, status values.
Power port Power Power port or pin on the SoC.
Table 11: Ports and Interfaces
The logical interfaces are logically separated from each other by the API design. The module
does not implement a control output interface. The power interface is physically separated
from any other interface.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 17 of 48
4 Roles, Services, and Authentication
4.1 Authentication Methods
The module does not implement any authentication methods.
4.2 Roles
Name Type Operator Type Authentication
Methods
Crypto Officer Role CO None
Table 12: Roles
No support is provided for multiple concurrent operators.
4.3 Approved Services
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
RL_ARCL_Sha Generate
a
(extenda
ble
output)
message
digest
FipsIndica
torStatus
is set to 2
Message,
output
length
(XOF)
Message
digest
Mess
age
digest
XOF
Crypto
Officer
RL_ARCL_Aes Perform
an AES
operation
(encrypt/
decrypt)
FipsIndica
torStatus
is set to 2
Plaintext/ci
phertext,
AES key,
IV (if
applicable)
Plaintext/c
iphertext
Encry
ption
Decry
ption
Crypto
Officer
- AES
key:
W,E
RL_ARCL_Mac Generate
a MAC
tag
FipsIndica
torStatus
is set to 2
Message,
AES/HMAC
key
MAC tag MAC Crypto
Officer
- AES
key:
W,E
-
HMAC
key:
W,E
RL_ARCL_EcdsaGener
ateKeyPair
Generate
an
ECDSA
key pair
FipsIndica
torStatus
is set to 2
Curve ECDSA
key pair
Key
pair
gener
ation
Crypto
Officer
-
ECDSA
private
key:
G,R
-
ECDSA
public
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 18 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
key:
G,R
-
Interm
ediate
key
genera
tion
value:
G,E,Z
RL_ARCL_RsaGenerat
eKeyPair
Generate
an RSA
key pair
FipsIndica
torStatus
is set to 2
Modulus
size
RSA key
pair
Key
pair
gener
ation
Crypto
Officer
- RSA
private
key:
G,R
-
ECDSA
public
key:
G,R
-
Interm
ediate
key
genera
tion
value:
G,E,Z
RL_ARCL_Sign Sign a
message
FipsIndica
torStatus
is set to 2
Message,
hash
algorithm,
private key
Signature Signa
ture
gener
ation
Crypto
Officer
-
ECDSA
private
key:
W,E
- RSA
private
key:
W,E
RL_ARCL_Verify Verify a
message
signature
FipsIndica
torStatus
is set to 2
Message,
hash
algorithm,
signature,
public key
Pass/fail Signa
ture
verific
ation
Signa
ture
verific
ation
Crypto
Officer
-
ECDSA
public
key:
W,E
- RSA
public
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 19 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
(Lega
cy)
key:
W,E
RL_ARCL_X509CertCr
eate
Create
and sign
an X.509
certificat
e
FipsIndica
torStatus
is set to 2
X.509
informatio
n, hash
algorithm,
private key
Signed
X.509
certificate
Signa
ture
gener
ation
Crypto
Officer
-
ECDSA
private
key:
W,E
RL_ARCL_DeriveKeyU
singPRF
Derive a
key using
SP 800-
108r1
KDF
FipsIndica
torStatus
is set to 2
Key-
derivation-
key,
derived
key length
Derived
key
Key
deriv
ation
Crypto
Officer
- Key-
derivat
ion
key:
W,E
-
Derive
d key:
G,R
RL_ARCL_GenerateRa
ndom
Generate
random
bytes
FipsIndica
torStatus
is set to 2
Output
length
Random
bytes
Rand
om
numb
er
gener
ation
Crypto
Officer
-
Entrop
y
input:
G,E,Z
-
DRBG
seed:
G,E,Z
-
Intern
al
state
(V,
Key):
W,E
RL_ARCL_FwImageLo
adValidateWithKey
Verify
the
signature
of a
firmware
image
using a
provided
key
FipsIndica
torStatus
is set to 2
Firmware
image,
public key
Pass/fail Signa
ture
verific
ation
Signa
ture
verific
ation
(Lega
cy)
Crypto
Officer
- RSA
public
key:
W,E
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 20 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
RL_ARCL_FwImageLo
adValidate
Verify
the
signature
of a
firmware
image
using an
embedde
d key
FipsIndica
torStatus
is set to 2
Firmware
image
Pass/fail Signa
ture
verific
ation
Signa
ture
verific
ation
(Lega
cy)
Crypto
Officer
- RSA
public
key:
W,E
RL_ARCL_KeyDbInstal
l
Verify
the
signature
of a key
database
image
using an
embedde
d key
FipsIndica
torStatus
is set to 2
Key
database
image
Pass/fail Signa
ture
verific
ation
Signa
ture
verific
ation
(Lega
cy)
Crypto
Officer
- RSA
public
key:
W,E
RL_ARCL_KeyImageV
alidate
Verify
the
signature
of a key
image
using an
embedde
d key
FipsIndica
torStatus
is set to 2
Key image Pass/fail Signa
ture
verific
ation
Signa
ture
verific
ation
(Lega
cy)
Crypto
Officer
- RSA
public
key:
W,E
RL_ARCL_SelfTest Perform
on-
demand
self-tests
FipsIndica
torStatus
is set to 2
None Pass/fail None Crypto
Officer
RL_ARCL_RtlDeobfusc
ate
De-
obfuscat
e some
data
using the
RTL key
FipsIndica
torStatus
is set to 2
Obfuscate
d input
data
De-
obfuscate
d output
data
None Crypto
Officer
RL_ARCL_Reconfig Update
the ASP
register
base
address
None Register
base
address
None None Crypto
Officer
RL_ARCL_GetState
(Show Status / Show
Version)
Show the
module
status,
None None Module
status,
version,
None Crypto
Officer
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 21 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
version,
and
service
indicator
service
indicator
RL_ARCL_Scrap Zeroize
the KSB
and
prepare
the
module
for end-
of-life
None None None None Crypto
Officer
- AES
key: Z
-
HMAC
key: Z
- Key-
derivat
ion
key: Z
-
Derive
d key:
Z
-
ECDSA
private
key: Z
-
ECDSA
public
key: Z
- RSA
private
key: Z
- RSA
public
key: Z
RL_ARCL_Shutdown Zeroize
the KSB
and shut
down the
module
None None None None Crypto
Officer
- AES
key: Z
-
HMAC
key: Z
- Key-
derivat
ion
key: Z
-
Derive
d key:
Z
-
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 22 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
ECDSA
private
key: Z
-
ECDSA
public
key: Z
- RSA
private
key: Z
- RSA
public
key: Z
RL_ARCL_KeyDbRetir
e
Disable
the
installed
key
database
image
None None None None Crypto
Officer
RL_ARCL_ReinitHw Reinitializ
e CCP
hardware
None None None None Crypto
Officer
RL_ARCL_GetShaInfo Get SHA
IV,
message
block
size, and
output
hash
length
None SHA type IV,
message
block size,
output
hash
length
None Crypto
Officer
RL_ARCL_ModExp Perform
a
modular
exponent
iation
None Base,
exponent,
modulus
Result None Crypto
Officer
RL_ARCL_RtlDisableK
eyUsage
Disable
usage of
the RTL
key
None None None None Crypto
Officer
RL_ARCL_AddAddress
Map
Register
a new
device
address
map
None Device
address
map
None None Crypto
Officer
RL_ARCL_GetRuntime
Profile
Get the
runtime
profile
address
None None Runtime
profile
address
None Crypto
Officer
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 23 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
RL_ARCL_GetReadOnl
yRegions
Get list of
read-only
regions
None None List of
read-only
regions
None Crypto
Officer
RL_ARCL_CcpDma Copy
data
from a
source to
a
destinati
on using
the CCP
None SRAM
address or
KSB slot
handle
SRAM
address or
KSB slot
handle
None Crypto
Officer
RL_ARCL_KsbAlloc Allocate
a slot in
the KSB
None Length,
allocation
type
KSB slot
handle
None Crypto
Officer
RL_ARCL_KsbChange
Usage
Change
attribute
s for a
KSB slot
None KSB slot,
attributes
None None Crypto
Officer
RL_ARCL_KsbGetAttri
butes
Retrieve
attribute
s for a
KSB slot
None KSB slot Attributes None Crypto
Officer
RL_ARCL_KsbClear Set the
first 64
bytes of
a KSB
slot to
zero
None KSB slot None None Crypto
Officer
RL_ARCL_KsbLock Lock a
KSB slot
None KSB slot None None Crypto
Officer
RL_ARCL_KsbFree Free and
zeroize a
previousl
y
allocated
KSB slot
None KSB slot None None Crypto
Officer
- AES
key: Z
-
HMAC
key: Z
- Key-
derivat
ion
key: Z
-
Derive
d key:
Z
-
ECDSA
private
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 24 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
key: Z
-
ECDSA
public
key: Z
- RSA
private
key: Z
- RSA
public
key: Z
RL_ARCL_ZlibDecomp
ress
Decompr
ess zlib
data
None Compresse
d data
Uncompre
ssed data
None Crypto
Officer
RL_ARCL_ClearInterru
pt
Clear
CCP
interrupt
for the
flags
None Flags None None Crypto
Officer
RL_ARCL_GetInterrupt
State
Check if
CCP
interrupt
is
signaled
for the
flags
None Flags Interrupt
state
None Crypto
Officer
RL_ARCL_EnableInterr
upt
Enable
CCP
interrupt
for the
flags
None Flags None None Crypto
Officer
RL_ARCL_GetKeyUsag
eHistory
Check
key
usage so
far in
boot
None None Key usage
counters
None Crypto
Officer
RL_ARCL_RngReinit Reinitializ
e the
Entropy
Source
and
DRBG
None None None Rand
om
numb
er
gener
ation
Crypto
Officer
-
Entrop
y
input:
G,E,Z
-
DRBG
seed:
G,E,Z
-
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 25 of 48
Name Descript
ion
Indicator Inputs Outputs Secu
rity
Func
tions
SSP
Acces
s
Intern
al
state
(V,
Key):
G
RL_ARCL_RngReseed Reseed
the
DRBG
None None None Rand
om
numb
er
gener
ation
Crypto
Officer
-
Entrop
y
input:
G,E,Z
-
DRBG
seed:
G,E,Z
-
Intern
al
state
(V,
Key):
W,E
RL_ARCL_DeInitVcq Disable
and clear
the
virtual
queue
VCQ0
None None None None Crypto
Officer
RL_ARCL_QueryRootK
ey
Check
whether
the
provided
key
reference
is one of
the root
keys
None Key
reference
True/false None Crypto
Officer
Table 13: Approved Services
For the above table, the convention below applies when specifying the access permissions
(types) that the service has for each SSP.
• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 26 of 48
• Zeroize (Z): The module zeroizes the SSP.
• N/A: The module does not access any SSP or key during its operation.
The module provides three different API layers, each with distinct services:
1. The ARCL layer, which provides high-level cryptographic (both approved and non-
approved) and non-cryptographic functionality.
2. The CCP HAL layer, which provides non-approved, low-level cryptographic
functionality.
3. The SIB HAL layer, which provides non-approved, low-level functionality to interact with
the Key Storage Block, Entropy Source, DRBG, and Security State.
The ARCL API layer provides the RL_ARCL_GetState function which returns the ArclState,
ArclVersion, and FipsIndicatorStatus values:
• The ArclState value serves as the module’s status indicator and is used to indicate the
error states.
• The ArclVersion value contains the module’s versioning information.
The FipsIndicatorStatus value serves as the approved service indicator. If this value is set to
2, the previously requested ARCL service was approved. If this value is set to any other value,
the service was non-approved. The CCP HAL and SIB HAL layers only provide non-approved
services.
4.4 Non-Approved Services
Name Description Algorithms Role
RL_ARCL_Mac Generate a MAC tag HMAC with key
lengths less than 112
bits
Crypto
Officer
RL_ARCL_EcdsaGenerateKeyPair Generate an ECDSA
key pair
Deterministic ECDSA
key pair generation
Crypto
Officer
RL_ARCL_RsaGenerateKeyPair Generate an RSA
key pair
Deterministic RSA
key pair generation
RSA with 1024 or
1536 bits modulus
Crypto
Officer
RL_ARCL_Sign Sign a message ECDSA with SHA-1
RSA with 1024 or
1536 bits modulus
RSA with SHA-1
Crypto
Officer
RL_ARCL_X509CertCreate Create and sign an
X.509 certificate
ECDSA with SHA-1 Crypto
Officer
RL_ARCL_EcdsaSignDigest Sign a pre-hashed
message
ECDSA (pre-hashed
message)
Crypto
Officer
RL_ARCL_RsaPssSignDigest Sign a pre-hashed
message
RSA (pre-hashed
message)
Crypto
Officer
RL_ARCL_EcdsaVerifySignature Verify a pre-hashed
message signature
ECDSA (pre-hashed
message)
Crypto
Officer
RL_ARCL_RsaPssVerifySignature Verify a pre-hashed
message signature
RSA (pre-hashed
message)
Crypto
Officer
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 27 of 48
Name Description Algorithms Role
RL_ARCL_MeasureMemoryPerPcr PCR-based memory
measurement
SHA-384 with non-
standard initial hash
value
Crypto
Officer
CCP_HAL API Any API in the
CCP_HAL API layer
CCP_HAL algorithm Crypto
Officer
SIB_HAL API Any API in the
SIB_HAL API layer
SIB_HAL algorithm Crypto
Officer
Table 14: Non-Approved Services
4.5 External Software/Firmware Loaded
Upon startup, the libROM firmware component loads the overlay firmware from external
storage (SPI flash) into the sub-chip cryptographic subsystem. The integrity of the overlay
firmware is determined by verifying an RSA-PSS 4096 with SHA-384 signature stored in the
firmware that was computed at build time. If the signature verification fails, the firmware load
test fails. The public key used to verify this signature is stored inside the libROM firmware
component of the module, the private key associated with this public key is controlled by the
vendor.
All data output is inhibited during the execution of the firmware load test and the firmware
loading process.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 28 of 48
5 Software/Firmware Security
5.1 Integrity Techniques
The integrity of the libROM component of the module is verified by comparing a SHA-384
digest value calculated at runtime with the SHA-384 digest value stored in the module that
was computed at build time.
The integrity of the overlay firmware component of the module is discussed in Section 4.5.
5.2 Initiate on Demand
The module provides the RL_ARCL_SelfTest service to perform self-tests on demand. Among
those self-tests is the integrity test, as part of the pre-operational self-tests. More details on
the API are provided by the vendor in its developer’s manual.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 29 of 48
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Limited
How Requirements are Satisfied:
Any SSPs contained within the module are protected by the hardware and firmware
restrictions implemented by the Key Storage Block. Only the module has access to these SSPs,
and access is only possible through the defined interfaces.
6.2 Configuration Settings and Restrictions
No configuration of the operational environment is required for the module to operate in an
approved mode. Therefore, there are no rules, settings, or restrictions to the configuration of
the operational environment.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 30 of 48
7 Physical Security
7.1 Mechanisms and Actions Required
Mechanism Inspection Frequency Inspection Guidance
Opaque sealing
coat
No actions are required to
maintain the physical security of
the module
No actions are required to
maintain the physical security of
the module
Table 15: Mechanisms and Actions Required
The module provides no additional physical security techniques.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 31 of 48
8 Non-Invasive Security
The module does not implement any non-invasive security mechanisms.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 32 of 48
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage Area
Name
Description Persistence
Type
Hardware registers Hardware registers store the SSPs used by the
hardware DRBG
Dynamic
Key Storage Block
(KSB)
Hardware block used to securely store SSPs while the
module is operational
Dynamic
SRAM Temporary storage for SSPs used by the module as
part of service execution
Dynamic
Table 16: Storage Areas
The Key Storage Block (KSB) maintains internal separation of the SSPs (including CSPs) in
approved and non-approved modes of operation using a “virtual queue” mechanism: virtual
queue 0 is exclusively used for approved services, whereas virtual queue 1 is always used for
non- approved services.
The module does not perform persistent storage of SSPs; SSPs in use by the module exist in
volatile memory only.
9.2 SSP Input-Output Methods
Name From To Format
Type
Distributio
n Type
Entry
Type
SFI or
Algorith
m
API input
parameter
s
Operator
calling
application
(TOEPP)
Cryptographi
c module
Plaintex
t
Manual Electroni
c
API output
parameter
s
Cryptographi
c module
Operator
calling
application
(TOEPP)
Plaintex
t
Manual Electroni
c
Table 17: SSP Input-Output Methods
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator Initiation
RL_ARCL_KsbFree Zeroize a single
KSB slot
Memory occupied by the
SSP is overwritten with
zeroes, which renders the
SSP value irretrievable.
Completion of the
function indicates that
the zeroization procedure
succeeded.
By calling the
RL_ARCL_KsbFree
function
RL_ARCL_Shutdown Zeroize all data
stored in the
KSB
Memory occupied by the
SSPs is overwritten with
zeroes, which renders the
By calling the
RL_ARCL_Shutdown
function
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 33 of 48
Zeroization
Method
Description Rationale Operator Initiation
SSP values irretrievable.
Completion of the
function indicates that
the zeroization procedure
succeeded.
RL_ARCL_Scrap Zeroize all data
stored in the
KSB
Memory occupied by the
SSPs is overwritten with
zeroes, which renders the
SSP values irretrievable.
Completion of the
function indicates that
the zeroization procedure
succeeded.
By calling the
RL_ARCL_Scrap
function
Remove power from
the SoC
De-allocates the
volatile memory
used to store
SSPs
Volatile memory used by
the module is overwritten
within nanoseconds when
power is removed
By removing power
Automatic Automatically
zeroized by the
module when no
longer needed
Every service overwrites
its temporary memory
upon completion, which
renders any SSP values
used by the service
irretrievable. Completion
of the service indicates
that the zeroization
procedure succeeded.
N/A
Table 18: SSP Zeroization Methods
All data output is inhibited during zeroization.
9.4 SSPs
Name Descriptio
n
Size -
Strengt
h
Type -
Category
Generate
d By
Establishe
d By
Used By
AES key Symmetric
key used
for AES
operations
128,
192, 256
bits -
128,
192, 256
bits
Symmetric
- CSP
Encryptio
n
Decryptio
n
MAC
HMAC key Symmetric
key used
for HMAC
operations
112-256
bits -
112-256
bits
Symmetric
- CSP
MAC
Key-
derivation
key
Symmetric
key used to
derive
other
112-256
bits -
112-256
bits
Symmetric
- CSP
Key
derivation
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 34 of 48
Name Descriptio
n
Size -
Strengt
h
Type -
Category
Generate
d By
Establishe
d By
Used By
symmetric
keys
Derived
key
Symmetric
key derived
from a key-
derivation
key
112-256
bits -
112-256
bits
Symmetric
- CSP
Key
derivation
Entropy
input
Entropy
input used
to seed the
DRBG
384 bits
- 384
bits
Entropy
input - CSP
Random
number
generation
Random
number
generatio
n
DRBG seed DRBG seed
derived
from
entropy
input
384 bits
- 256
bits
DRBG seed
- CSP
Random
number
generation
Random
number
generatio
n
Internal
state (V,
Key)
Internal
state of the
CTR_DRBG
instance
384 bits
- 256
bits
Internal
state - CSP
Random
number
generation
Random
number
generatio
n
ECDSA
private key
Private key
used for
ECDSA
P-384 -
192 bits
Private key
- CSP
Key pair
generation
Signature
generatio
n
ECDSA
public key
Public key
used for
ECDSA
P-384 -
192 bits
Public key -
PSP
Key pair
generation
Signature
verificatio
n
Signature
verificatio
n
(Legacy)
RSA private
key
Private key
used for
RSA
2048,
3072,
4096
bits -
112,
128, 150
bits
Private key
- CSP
Key pair
generation
Signature
generatio
n
RSA public
key
Public key
used for
RSA
1024,
1536,
2048,
3072,
4096
bits - 80,
96, 112,
128, 150
bits
Public key -
PSP
Key pair
generation
Signature
verificatio
n
Signature
verificatio
n
(Legacy)
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 35 of 48
Name Descriptio
n
Size -
Strengt
h
Type -
Category
Generate
d By
Establishe
d By
Used By
Intermediat
e key
generation
value
Temporary
value
generated
during key
pair
generation
services
384-
4096
bits -
112-256
bits
Intermediat
e value -
CSP
Key pair
generation
Table 19: SSP Table 1
Name Input -
Output
Storage Storage
Duration
Zeroization Related
SSPs
AES key API input
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
HMAC key API input
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
Key-
derivation
key
API input
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
Derived
key
API output
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
Key-
derivation
key:Derived
From
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 36 of 48
Name Input -
Output
Storage Storage
Duration
Zeroization Related
SSPs
ends its
operation;
SRAM: for
the
duration of
the service
from the SoC
Automatic
Entropy
input
Hardware
registers:Plainte
xt
From
generation
until DRBG
seed is
created
Remove power
from the SoC
DRBG seed Hardware
registers:Plainte
xt
While the
DRBG is
instantiate
d
Remove power
from the SoC
Entropy
input:Derive
d From
Internal
state (V,
Key)
Hardware
registers:Plainte
xt
From
DRBG
instantiatio
n until
DRBG
terminatio
n
Remove power
from the SoC
DRBG
seed:Derive
d From
ECDSA
private key
API input
paramete
rs
API output
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
ECDSA
public
key:Paired
With
ECDSA
public key
API input
paramete
rs
API output
paramete
rs
SRAM:Plaintext For the
duration of
the service
Remove power
from the SoC
Automatic
ECDSA
private
key:Paired
With
RSA private
key
API input
paramete
rs
API output
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
RSA public
key:Paired
With
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 37 of 48
Name Input -
Output
Storage Storage
Duration
Zeroization Related
SSPs
RSA public
key
API input
paramete
rs
API output
paramete
rs
Key Storage
Block
(KSB):Plaintext
SRAM:Plaintext
KSB: until
explicitly
removed
or the
module
ends its
operation;
SRAM: for
the
duration of
the service
RL_ARCL_KsbFree
RL_ARCL_Shutdo
wn
RL_ARCL_Scrap
Remove power
from the SoC
Automatic
RSA private
key:Paired
With
Intermediat
e key
generation
value
SRAM:Plaintext For the
duration of
the service
Remove power
from the SoC
Automatic
Table 20: SSP Table 2
9.5 Transitions
The SHA-1 algorithm as implemented by the module will be non-approved for all purposes,
starting January 1, 2030.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 38 of 48
10 Self-Tests
While the module is executing the self-tests, services are not available, and data output (via
the data output interface) is inhibited until the tests are successfully completed. The module
does not return control to the calling application until the tests are completed.
10.1 Pre-Operational Self-Tests
Algorith
m or Test
Test
Propertie
s
Test
Metho
d
Test
Type
Indicator Details
SHA2-384
(A5794)
N/A Messag
e digest
SW/FW
Integrit
y
RomIntegrityState is set to
ARCL_SELFTEST_STATE_PASSE
D
Integrity
test on
the
libROM
firmware
componen
t at power
up
Table 21: Pre-Operational Self-Tests
The pre-operational firmware integrity test on the libROM firmware component is performed
automatically when the module is initialized. If this test fails, the module transitions to the
hard error state.
10.2 Conditional Self-Tests
As part of the initialization, the libROM firmware component loads the overlay firmware
component and performs the firmware load test on the overlay firmware. Only if this test
succeeds, will the module move to the operational state. Similar to the pre-operational
integrity test, if the firmware load test fails, the module transitions to the hard error state.
Algorit
hm or
Test
Test
Properti
es
Test
Method
Test
Type
Indicator Details Conditio
ns
RSA
SigVer
(FIPS186
-5)
(A5794)
4096-bit
key,
SHA-384
Signatur
e
verificati
on
SW/F
W
Load
FwIntegrityState is set to
ARCL_SELFTEST_STATE_P
ASSED
Firmware
load test
on the
overlay
firmware
compone
nt
Power up
SHA-1
(A5794)
0-bit
message
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
KAT
message
digest
Prior to
first
approved
use of
SHA-1
SHA2-
256
(A5794)
0-bit
message
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Message
digest
Prior to
first
approved
use of
SHA-224
or SHA-
256
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 39 of 48
Algorit
hm or
Test
Test
Properti
es
Test
Method
Test
Type
Indicator Details Conditio
ns
SHA2-
512
(A5794)
0-bit
message
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Message
digest
Prior to
libROM
firmware
integrity
test
SHA3-
512
(A5794)
0-bit
message
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Message
digest
Prior to
first
approved
use of
SHA-3 or
SHAKE
AES-ECB
(A5794)
encrypti
on
128-bit
key
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Encryptio
n
Prior to
first
approved
use of
AES ECB,
CBC, or
CTR
AES-ECB
(A5794)
decrypti
on
128-bit
key
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Decryptio
n
Prior to
first
approved
use of
AES ECB,
CBC, or
CTR
AES-
CMAC
(A5794)
128-bit
key
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
MAC tag
generatio
n
Prior to
first
approved
use of
AES
CMAC
HMAC-
SHA2-
384
(A5794)
384-bit
key,
SHA-384
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
MAC tag
generatio
n
Prior to
first
approved
use of
HMAC
KDF
SP800-
108
(A5794)
256-bit
key-
derivatio
n key,
128-bit
derived
key
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Key-
based
key
derivatio
n
Prior to
first
approved
use of
KBKDF
Entropy
Source
start-up
RCT
Cutoff: 5
samples
RCT CAST Entropy Source is
operational
SP 800-
90B
start-up
health
test ran
over
Initializati
on of the
Entropy
Source
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 40 of 48
Algorit
hm or
Test
Test
Properti
es
Test
Method
Test
Type
Indicator Details Conditio
ns
4096
samples
Entropy
Source
start-up
APT
Cutoff:
16
samples
APT CAST Entropy Source is
operational
SP 800-
90B
start-up
health
test ran
over
4096
samples
Initializati
on of the
Entropy
Source
Entropy
Source
continuo
us RCT
Cutoff: 5
samples
RCT CAST Entropy Source produces
entropy
SP 800-
90B
continuo
us health
test
DRBG
seeding
Entropy
Source
continuo
us APT
Cutoff:
16
APT CAST Entropy Source produces
entropy
SP 800-
90B
continuo
us health
test
DRBG
seeding
Counter
DRBG
(A5795)
AES-256 KAT CAST TrngState is set to
ARCL_SELFTEST_STATE_P
ASSED
SP 800-
90Ar1
(instantia
te,
reseed,
generate
) health
test
Prior to
first
approved
use of
the
CTR_DRB
G
ECDSA
SigGen
(FIPS186
-5)
(A5794)
P-384
with
SHA-384
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
generatio
n
Prior to
first
approved
use of
ECDSA
signature
generatio
n
ECDSA
SigVer
(FIPS186
-5)
(A5794)
P-384
with
SHA-384
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
verificati
on
Prior to
first
approved
use of
ECDSA
signature
verificati
on
RSA
SigGen
(FIPS186
-5)
(A5794)
2048-bit
key with
SHA-384
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
generatio
n
Prior to
first
approved
use of
RSA-PSS
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 41 of 48
Algorit
hm or
Test
Test
Properti
es
Test
Method
Test
Type
Indicator Details Conditio
ns
signature
generatio
n
RSA
SigVer
(FIPS186
-5)
(A5794)
2048-bit
key with
SHA-384
KAT CAST KatState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
verificati
on
Prior to
overlay
firmware
load test
ECDSA
KeyGen
(FIPS186
-5)
(A5794)
SHA-384 PCT PCT EcdsaPctState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
generatio
n &
verificati
on
ECDSA
key pair
generatio
n
RSA
KeyGen
(FIPS186
-5)
(A5794)
SHA-384 PCT PCT RsaPctState is set to
ARCL_SELFTEST_STATE_P
ASSED
Signature
generatio
n &
verificati
on
RSA key
pair
generatio
n
Table 22: Conditional Self-Tests
Upon generation of an ECDSA or RSA key pair, the module will perform a pair-wise consistency
test (PCT) as shown in the table above, which provides some assurance that the generated
key pair is well formed.
10.3 Periodic Self-Test Information
Algorithm or
Test
Test Method Test Type Period Periodic
Method
SHA2-384
(A5794)
Message digest SW/FW Integrity On demand Manually
Table 23: Pre-Operational Periodic Information
Algorithm or
Test
Test Method Test Type Period Periodic
Method
RSA SigVer
(FIPS186-5)
(A5794)
Signature
verification
SW/FW Load On demand Manually
SHA-1 (A5794) KAT CAST On demand Manually
SHA2-256
(A5794)
KAT CAST On demand Manually
SHA2-512
(A5794)
KAT CAST On demand Manually
SHA3-512
(A5794)
KAT CAST On demand Manually
AES-ECB
(A5794)
encryption
KAT CAST On demand Manually
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 42 of 48
Algorithm or
Test
Test Method Test Type Period Periodic
Method
AES-ECB
(A5794)
decryption
KAT CAST On demand Manually
AES-CMAC
(A5794)
KAT CAST On demand Manually
HMAC-SHA2-
384 (A5794)
KAT CAST On demand Manually
KDF SP800-108
(A5794)
KAT CAST On demand Manually
Entropy Source
start-up RCT
RCT CAST On demand Manually
Entropy Source
start-up APT
APT CAST On demand Manually
Entropy Source
continuous RCT
RCT CAST Every sample Manually
Entropy Source
continuous APT
APT CAST Every sample Manually
Counter DRBG
(A5795)
KAT CAST On demand Manually
ECDSA SigGen
(FIPS186-5)
(A5794)
KAT CAST On demand Manually
ECDSA SigVer
(FIPS186-5)
(A5794)
KAT CAST On demand Manually
RSA SigGen
(FIPS186-5)
(A5794)
KAT CAST On demand Manually
RSA SigVer
(FIPS186-5)
(A5794)
KAT CAST On demand Manually
ECDSA KeyGen
(FIPS186-5)
(A5794)
PCT PCT On demand Manually
RSA KeyGen
(FIPS186-5)
(A5794)
PCT PCT On demand Manually
Table 24: Conditional Periodic Information
10.4 Error States
Name Description Conditions Recovery Method Indicator
Soft
Error
The module only
responds to status,
zeroization, and self-
test service requests
Cryptographic
algorithm self-test
error or Pair-wise
consistency test error
Invoke
RL_ARCL_SelfTest
service
ArclState
= 8
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 43 of 48
Name Description Conditions Recovery Method Indicator
Hard
Error
The module does not
respond to any
service requests and
must be reset
FW integrity test error
or FW load test error
Power off the
module
ArclState
= 16
Table 25: Error States
In the Soft Error state, the module outputs the error type through the status indicator and
status output interface. Moreover, the data input and data output interfaces are inhibited, and
the module only accepts control input.
In the Hard Error state, no input or output is possible at all.
10.5 Operator Initiation of Self-Tests
The operator can request on-demand self-tests by invoking the RL_ARCL_SelfTest service. This
service executes all self-tests listed above.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 44 of 48
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
To detect any potential tampering during delivery of the module, the user can verify the
Thermoform or JEDEC tray is securely strapped and vacuum sealed in the moisture barrier
bag. Additionally, the SoC itself provides tamper evidence as specified in Section 7.
Upon delivery, no further installation or configuration is required for the hardware to operate
as the validated module in conformance with the rules in this Security Policy document. The
module implicitly transitions between the approved mode and the non-approved mode when
appropriate.
11.2 Administrator Guidance
All the functions, ports and logical interfaces described in this document are available to the
Crypto Officer. The module implicitly transitions between the approved mode and the non-
approved mode contingent on the service that is invoked. Therefore, there are no special
procedures to administer the approved or non-approved modes.
11.3 Non-Administrator Guidance
The module implements only the Crypto Officer. There are no requirements for non-
administrator operators.
11.4 Design and Rules
Not applicable.
11.5 Maintenance Requirements
Not applicable.
11.6 End of Life
The process for performing “End of Life” occurs at the chronological point of 10 years starting
from manufacturing date of the module.
The module does not possess persistent storage of SSPs. The SSP value only exists in volatile
memory and that value vanishes when the module is powered off. The procedure for secure
sanitization of the module at the end of life is simply to power it off, which is the action of
zeroization of the SSPs. As a result of this sanitization via power-off, the SSP is removed from
the module, so that the module may either be distributed to other operators or disposed.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 45 of 48
12 Mitigation of Other Attacks
The module does not implement security mechanisms to mitigate other attacks.
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 46 of 48
A Glossary and Abbreviations
AES Advanced Encryption Standard
API Application Programming Interface
ARCL AMD Root of Trust Crypto Library
ASP AMD Secure Processor
CAST Cryptographic Algorithm Self-Test
CAVP Cryptographic Algorithm Validation Program
CBC Cipher Block Chaining
CBC-MAC Cipher Block Chaining Message Authentication Code
CCP Cryptographic Co-Processor
CFB Cipher Feedback
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
CTR Counter
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECDSA Elliptic Curve Digital Signature Algorithm
FIPS Federal Information Processing Standards
GCTR Galois Counter
HAL Hardware Abstraction Layer
HMAC Keyed-Hash Message Authentication Code
IAPM Integrity-Aware Parallelizable Mode
IV Initialization Vector
JEDEC Joint Electron Device Engineering Council
KAT Known Answer Test
KSB Key Storage Block
MAC Message Authentication Code
NIST National Institute of Science and Technology
OFB Output Feedback
OTP One-Time Programmable
PCT Pair-wise Consistency Test
PKI Public Key Infrastructure
PSP Public Security Parameter
PSS Probabilistic Signature Scheme
ROM Read-Only Memory
RSA Rivest Shamir Adleman
RTL Register-Transfer Level
SHA Secure Hash Algorithm
SHAKE Secure Hash Algorithm with Keccak
SIB Security Infrastructure Block
SoC System on Chip
SRAM Static Random-Access Memory
SSP Sensitive Security Parameter
TRNG True Random Number Generator
XOF Extendable Output Function
XTS XEX-based Tweaked-codebook mode with cipher text Stealing
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 47 of 48
B References
FIPS 140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic
Modules
March 2019
https://doi.org/10.6028/NIST.FIPS.140-3
FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the
Cryptographic Module Validation Program
https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-
validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf
FIPS 180-4 Secure Hash Standard (SHS)
August 2015
https://doi.org/10.6028/NIST.FIPS.180-4
FIPS 186-2 Digital Signature Standard (DSS)
January 2000
https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf
FIPS 186-4 Digital Signature Standard (DSS)
July 2013
https://doi.org/10.6028/NIST.FIPS.186-4
FIPS 186-5 Digital Signature Standard (DSS)
February 2023
https://doi.org/10.6028/NIST.FIPS.186-5
FIPS 197 Advanced Encryption Standard (AES)
November 2001; Updated May 2023
https://doi.org/10.6028/NIST.FIPS.197-upd1
FIPS 198-1 The Keyed-Hash Message Authentication Code (HMAC)
July 2008
https://doi.org/10.6028/NIST.FIPS.198-1
FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-
Output Functions
August 2015
https://doi.org/10.6028/NIST.FIPS.202
SP 800-38A Recommendation for Block Cipher Modes of Operation:
Methods and Techniques
December 2001
https://doi.org/10.6028/NIST.SP.800-38A
SP 800-38B Recommendation for Block Cipher Modes of Operation: the
CMAC Mode for Authentication
May 2005; Updated October 2016
https://doi.org/10.6028/NIST.SP.800-38B
SP 800-38D Recommendation for Block Cipher Modes of Operation:
Galois/Counter Mode (GCM) and GMAC
November 2007
https://doi.org/10.6028/NIST.SP.800-38D
SP 800-38E Recommendation for Block Cipher Modes of Operation: the
XTS-AES Mode for Confidentiality on Storage Devices
January 2010
https://doi.org/10.6028/NIST.SP.800-38E
SP 800-90Ar1 Recommendation for Random Number Generation Using
Deterministic Random Bit Generators
June 2015
https://doi.org/10.6028/NIST.SP.800-90Ar1
SP 800-90B Recommendation for the Entropy Sources Used for Random Bit
Generation
AMD ASP Cryptographic CoProcessor ("Turin") FIPS 140-3 Non-Proprietary Security Policy
© 2025 Advanced Micro Devices (AMD), atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 48 of 48
January 2018
https://doi.org/10.6028/NIST.SP.800-90B
SP 800-108r1 Recommendation for Key Derivation Using Pseudorandom
Functions
August 2022; Updated February 2024
https://doi.org/10.6028/NIST.SP.800-108r1-upd1
SP 800-131Ar2 Transitioning the Use of Cryptographic Algorithms and Key
Lengths
March 2019
https://doi.org/10.6028/NIST.SP.800-131Ar2
SP 800-133r2 Recommendation for Cryptographic Key Generation
June 2020
https://doi.org/10.6028/NIST.SP.800-133r2
SP 800-140Br1 Cryptographic Module Validation Program (CMVP) Security
Policy Requirements: CMVP Validation Authority Updates to
ISO/IEC 24759 and ISO/IEC 19790 Annex B
November 2023
https://doi.org/10.6028/NIST.SP.800-140Br1