Defender 3000 USB Flash Drive

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5364,
  "dgst": "b346a1b3ea918897",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A5476",
        "KDA TwoStep SP800-56Cr2A5476",
        "AES-KWA5476",
        "ECDSA KeyVer (FIPS186-5)A5476",
        "AES-ECBA5476",
        "HMAC-SHA2-256A5476",
        "AES-XTS Testing Revision 2.0A5476",
        "SHA2-256A5476",
        "ECDSA KeyGen (FIPS186-5)A5476",
        "RSA SigVer (FIPS186-4)A5476",
        "KAS-ECC-SSC Sp800-56Ar3A5476",
        "HMAC DRBGA5476",
        "AES-CBCA5476",
        "PBKDFA5476"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "3000"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A5476",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A5476",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A5476",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "AES-XTS Testing Revision 2.0",
            "cavpCertName": "A5476",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38E"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186- 5)",
            "cavpCertName": "A5476",
            "properties": "Curve - P-256 Secret Generation Mode - extra bits",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186- 5)",
            "cavpCertName": "A5476",
            "properties": "Curve - P-256",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC DRBG",
            "cavpCertName": "A5476",
            "properties": "Prediction Resistance - Yes Mode - SHA2-256",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A5476",
            "properties": "Key Length - Key Length: 8-2040 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800- 56Ar3",
            "cavpCertName": "A5476",
            "properties": "Domain Parameter Generation Methods - P-256 Scheme - ephemeralUnified - KAS Role - responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDA TwoStep SP800- 56Cr2",
            "cavpCertName": "A5476",
            "properties": "MAC Salting Methods - default KDF Mode - counter Derived Key Length - 256 Shared Secret Length - Shared Secret Length: 256",
            "reference": "SP 800-56C Rev. 2"
          },
          {
            "algorithm": "PBKDF",
            "cavpCertName": "A5476",
            "properties": "Iteration Count - Iteration Count: 1024 Password Length - Password Length: 8-128 Increment 1",
            "reference": "SP 800-132"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A5476",
            "properties": "Signature Type - PKCS 1.5 Modulo - 2048",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A5476",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Secure communicatio n session",
            "indicator": "Return status via the API: 0x0000: success, 0x4002: session invalid",
            "inputs": "Host ECDH Public Key",
            "name": "(All CO/User Services)",
            "outputs": "Device ECDH Public Key",
            "rolesSspAccess": "Crypto Officer (CO) - Shared Secret (Z): G,E,Z - AES Session Key: G,E - MAC Session Key: G,E - Device ECDH Private Key: G,Z - Device ECDH Public Key: G,R,Z - Host ECDH Public Key: W,Z - DRBG Internal State (V and Key): G,E User - Shared Secret (Z): G,E,Z - AES Session Key: G,E - MAC Session Key: G,E - Device ECDH Private Key: G,Z - Device ECDH Public Key: G,R,Z - Host ECDH Public Key: W,Z",
            "secFunImpl": "Encryption HMAC KAS KTS Decryption KeyGen- Asymmetric"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- DRBG Internal State (V and Key): G,E",
            "secFunImpl": ""
          },
          {
            "description": "Load/Update CD Image to the CD-ROM partition",
            "indicator": "Return status via the API: 0x0000: success, 0x4002: session invalid, 0x4006: signature verification failed",
            "inputs": "API call with CD Image, Signature",
            "name": "CD Update",
            "outputs": "Status Out (success, session invalid, signature verification failed)",
            "rolesSspAccess": "Unauthenticate d - CD Update Public Key: E",
            "secFunImpl": "SigVer"
          },
          {
            "description": "Create new CO password",
            "indicator": "Return status via the API: 0x0000: success, 0x8102: configuratio n invalid",
            "inputs": "New CO password",
            "name": "Change CO Password",
            "outputs": "Status Out (success, session invalid, wrong password) LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "Crypto Officer (CO) - KEK_CO (Key Encryption Key - CO): G,E,Z - Crypto Officer Password: W,Z - CO Password Hash: Z,G - DRBG Internal State (V and Key): G,E",
            "secFunImpl": "DRBG Key Wrap PBKDF Hash Function"
          },
          {
            "description": "Creates new User Password",
            "indicator": "Return status via the API: 0x0000: success, 0x8102: configuratio n invalid",
            "inputs": "New User password",
            "name": "Change User Password",
            "outputs": "Status Out (success, session invalid, wrong password) LED blinks at",
            "rolesSspAccess": "User - KEK_U (Key Encryption Key - User): G,E,Z - User Password: W,Z - User Password",
            "secFunImpl": "DRBG Key Wrap PBKDF Hash Function"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "16Hz if fatal error",
            "rolesSspAccess": "Hash: Z,G - DRBG Internal State (V and Key): G,E",
            "secFunImpl": ""
          },
          {
            "description": "Logout. Locks drive",
            "indicator": "Return status via the API: 0x0000: success, 0x1602: session invalid, 0x1604: partition has been closed",
            "inputs": "N/A",
            "name": "Close Partition (Logout)",
            "outputs": "Status Out (success, session invalid, partition has been closed) LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "Crypto Officer (CO) - DEK_CO (Data Encryption Key - CO): Z - AES Session Key: Z - MAC Session Key: Z User - DEK_U (Data Encryption Key - User): Z - AES Session Key: Z - MAC Session",
            "secFunImpl": "None"
          },
          {
            "description": "Read partition data",
            "indicator": "Return status via the API: 0x0000: success",
            "inputs": "Partition Info",
            "name": "Decrypt",
            "outputs": "Data, Status",
            "rolesSspAccess": "Crypto Officer (CO) - DEK_CO (Data Encryption Key - CO): E User - DEK_U (Data Encryption Key - User): E",
            "secFunImpl": "Decryption"
          },
          {
            "description": "Write partition data",
            "indicator": "Return status via the API: 0x0000: success",
            "inputs": "Partition Info",
            "name": "Encrypt",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer (CO) - DEK_CO (Data Encryption Key - CO): E",
            "secFunImpl": "Encryption"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "User - DEK_U (Data Encryption Key - User): E",
            "secFunImpl": ""
          },
          {
            "description": "Create CO password and generate DEK",
            "indicator": "Return status via the API: 0x0000: success, 0x8102: configuratio n invalid",
            "inputs": "CO Password and the drive\u0027s partition configuratio n",
            "name": "Initialize",
            "outputs": "Status Out (success, configuratio n invalid) LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "Crypto Officer (CO) - DEK_CO (Data Encryption Key - CO): Z,G - KEK_CO (Key Encryption Key - CO): G,E,Z - Crypto Officer Password: W - CO Password Hash: G - Entropy Input: G,E - DRBG Nonce: G,E - DRBG Internal State (V and Key): G,E",
            "secFunImpl": "DRBG ESV PBKDF Hash Function KeyGen_Symmetr ic"
          },
          {
            "description": "Authenticates either the CO or User to the module",
            "indicator": "Return status via the API: 0x0000: success, 0x1402: session invalid, 0x1404: partition has been opened, 0x1406:",
            "inputs": "User ID \u0026 Password, and the selected partition",
            "name": "Open Partition (Login)",
            "outputs": "Status Out (success, session invalid, partition has been opened, wrong password) LED blinks at 16Hz if fatal error, the partition is",
            "rolesSspAccess": "Crypto Officer (CO) - Crypto Officer Password: W,E,Z - KEK_CO (Key Encryption Key - CO): G,E,Z - DEK_CO (Data Encryption Key - CO): E User - User Password:",
            "secFunImpl": "PBKDF Hash Function"
          },
          {
            "description": "",
            "indicator": "wrong password",
            "inputs": "",
            "name": "",
            "outputs": "opened if success",
            "rolesSspAccess": "W,E,Z - KEK_U (Key Encryption Key - User): G,E,Z - DEK_U (Data Encryption Key - User): E",
            "secFunImpl": ""
          },
          {
            "description": "Perform Pre- Operational and Conditional Self-Tests",
            "indicator": "LED Flashing",
            "inputs": "N/A",
            "name": "Perform Self-Tests",
            "outputs": "LED blinks at 3Hz if all tests complete LED blinks at 16Hz if failed",
            "rolesSspAccess": "Unauthenticate d - DRBG Internal State (V and Key): G,E",
            "secFunImpl": "None"
          },
          {
            "description": "Erase all files stored on the module and zeroizes all CSPs",
            "indicator": "Return status via the API: 0x0000: success, 0x8101: session invalid",
            "inputs": "N/A",
            "name": "Reset Drive",
            "outputs": "Status Out (success, session invalid) Internally zeroize all CSPs except the session keys and generate DEK_CO and configure to the single partition. LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "Unauthenticate d - DEK_CO (Data Encryption Key - CO): Z - DEK_U (Data Encryption Key - User): Z - CO Password Hash: Z - User Password Hash: Z - DRBG Internal State (V and Key): Z",
            "secFunImpl": "None"
          },
          {
            "description": "Create new User password",
            "indicator": "Return status via the API: 0x0000: success,",
            "inputs": "Current CO Password and new User Password",
            "name": "Setup User Password",
            "outputs": "Status Out (success, session invalid, wrong",
            "rolesSspAccess": "Crypto Officer (CO) - DEK_U (Data Encryption Key - User): G,Z",
            "secFunImpl": "DRBG Key Wrap PBKDF Hash Function"
          },
          {
            "description": "",
            "indicator": "0x8102: configuratio n invalid",
            "inputs": "",
            "name": "",
            "outputs": "password) LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "- KEK_U (Key Encryption Key - User): G,E,Z - User Password: W,E,Z - User Password Hash: G - DRBG Internal State (V and Key): G,E",
            "secFunImpl": "KeyGen_Symmetr ic"
          },
          {
            "description": "Get module ID and version",
            "indicator": "Return status via the API: 0x0000: success",
            "inputs": "N/A",
            "name": "Show Module Version",
            "outputs": "Returns module identifier [Defender 3000] and firmware version information [2.13.10], in addition to the approved mode indicator to API call",
            "rolesSspAccess": "Unauthenticate d",
            "secFunImpl": "None"
          },
          {
            "description": "Returns the most recent error details",
            "indicator": "Return status via the API: 0x0000: success",
            "inputs": "N/A",
            "name": "Show Error Status",
            "outputs": "Returns the error log to API call",
            "rolesSspAccess": "Unauthenticate d",
            "secFunImpl": "None"
          },
          {
            "description": "Get the module\u0027s status",
            "indicator": "Return status via the API:",
            "inputs": "N/A",
            "name": "Show Status",
            "outputs": "Reply the service status, the",
            "rolesSspAccess": "Unauthenticate d",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "0x0000: success",
            "inputs": "",
            "name": "",
            "outputs": "disk status, or the session establishme nt status to API call",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Zeroize all keys and CSPs",
            "indicator": "Return status via the API: 0x0000: success",
            "inputs": "N/A",
            "name": "Zeroizatio n",
            "outputs": "Status Out (success) Internally zeroize all CSPs. LED blinks at 16Hz if fatal error",
            "rolesSspAccess": "Unauthenticate d - DEK_CO (Data Encryption Key - CO): Z - DEK_U (Data Encryption Key - User): Z - CO Password Hash: Z - User Password Hash: Z - DRBG Internal State (V and Key): Z - AES Session Key: Z - MAC Session Key: Z",
            "secFunImpl": "None"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The password is at least 8 bytes in length and includes the numbers, the uppercase letters, the lowercase letters, and the special characters",
            "mechanism": "ID \u0026 Password combination used within a challenge/response mechanism",
            "name": "ID/Password",
            "perMinute": "The probability of the consecutive failed authentication attempts in one minute period is approximately 10/ 245 \u003c 1/100,000",
            "strength": "The upper bound for the probability of having the password guessed at random is: 1 / (10 * 26 * 26 * 955) ~= 1/245 \u003c 1/1,000,000"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-CBC Encrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Encrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Encryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC Decrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Decrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Decryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB Encrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Encrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Encryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB Decrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Decrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Decryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW Wrap (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Key Wrap KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Key Wrap KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW Unwrap (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Key Unwrap KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Key Unwrap KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Testing Revision 2.0 Encrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Encrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Encryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Testing Revision 2.0 Decrypt (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Decrypt KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit - Decryption KAT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XTS Key Gen (Ref: IG C.I)",
            "condition": "Generation of DEK_CO or DEK_U",
            "details": "Key1 is not equal to Key2",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "--",
            "testProps": "XTS Key Validity",
            "type": "Critical Function"
          },
          {
            "algorithmOrTest": "HMAC DRBG (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Instantiate, Generate and Reseed KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "Instantiate, Generate and Reseed",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Compares output with expected result",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "Private Key:256-bit Public Key: 256-bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDA TwoStep SP800-56Cr2 (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Compares output with expected result",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "Shared Secret: 256-bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy Source",
            "condition": "Continuous",
            "details": "Repetition Count Test and Adaptive Proportion Test",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "APT/RCT",
            "testProps": "APT/RCT",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 256 (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Compares output with expected result",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A5476)",
            "condition": "Performed immediately after key generation during key agreement",
            "details": "ECC CDH keypair generation during key agreement when \u0027Open Partition\u0027 service is called.",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "PCT",
            "testProps": "ECC CDH P-256 keypair pairwise consistency test.",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "ECDSA KeyVer (FIPS186-5) (A5476)",
            "condition": "Performed immediately after key generation during key agreement",
            "details": "Full Public Key Validation of host public key",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "PKV",
            "testProps": "ECC CDH P-256 Public Key Validation",
            "type": "Critical Function"
          },
          {
            "algorithmOrTest": "PBKDF (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Compares output with expected result",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "Salt 256-bit, Password: 8- bytes",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Compares output with expected result",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-4) (A5476)",
            "condition": "Power-on, On- demand \u0026 Periodically (11 mins)",
            "details": "Signature Verification KAT",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "KAT",
            "testProps": "RSA 2048 \u0026 SHA2-256",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Transitions to this state for all non- critical errors",
            "description": "Soft Error State",
            "indicator": "LED Blink Pattern, Error Code",
            "name": "Soft Error",
            "recoveryMethod": "Automatic"
          },
          {
            "conditions": "Transitions to this state for all self-test errors",
            "description": "Hard Error State",
            "indicator": "LED Blink Pattern, Error Code",
            "name": "Hard Error",
            "recoveryMethod": "Power- Cycle"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "Each time the module is used",
            "inspectGuidance": "Upon each use of the module the operator should examine the module for evidence of tamper.",
            "mechanism": "Tamper Evidence"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Only Approved services are supported",
            "name": "Approved Mode",
            "statusIndicator": "FIPS ACTIVE",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "The USB 3.0 port connects the module to the host computer. It is used to receive user data as well as API calls issued by the host via the USB protocol. The input is received by the module on the Rx line. The USB 3.0 port connects the module to the host computer. It is used to send user data as well as return codes upon completion of API calls issued by the host via the USB protocol. The input is received by the module on the Tx line. The USB 3.0 port connects the module to the host computer. It is used to receive commands as well as API calls issued by the host via the USB protocol. The input is received by the module on the Rx line. Error codes and other status is transmitted from the module to the host computer.",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "USB Port (Rx,Tx)"
          },
          {
            "data": "Error codes and other status is transmitted by the LED:- Active data transfer with host computer: LED blinks at 3Hz- Error state: LED blinks at rapidly at 16Hz- Pre- operational Self-test status output: LED blinks at 3Hz if all self-tests completed, LED blinks at 16Hz if failed- Continuous Self-test status output: LED blinks at 16Hz if failed- Periodic Self-test status output: LED blinks at 16Hz if failed",
            "logicalInterface": "Status Output",
            "physicalPort": "LED"
          },
          {
            "data": "The USB VBUS (+5VDC) powers the module",
            "logicalInterface": "Power",
            "physicalPort": "USB Port (VCC)"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "ID/Password",
            "name": "Crypto Officer (CO)",
            "operatorType": "Crypto Officer",
            "type": "Identity"
          },
          {
            "authMethodList": "ID/Password",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          },
          {
            "authMethodList": "None",
            "name": "Unauthenticated",
            "operatorType": "Unauthenticated",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "3",
            "section": "1",
            "title": "General"
          },
          {
            "level": "3",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "3",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "3",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "3",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "3",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "3",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "3",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-4) (A5476)",
            "details": "Performed During module power-on, on-demand, and on a periodic basis",
            "indicator": "Success: LED blinks at 3Hz Error: LED blinks at 16Hz",
            "testMethod": "RSA 2048 Digital Signature Verification",
            "testProps": "RSA 2048 PKCS1 v1.5 Digital Signature Verification",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "SSP_Input (Encrypted)",
            "sfiAlgo": "KTS",
            "source": "External"
          },
          {
            "dest": "RAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "SSP_Input (Plaintext)",
            "sfiAlgo": "KAS",
            "source": "External"
          },
          {
            "dest": "External",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "SSP_Output (Plaintext)",
            "sfiAlgo": "KAS",
            "source": "RAM"
          },
          {
            "dest": "eMMC",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Manufacturing",
            "sfiAlgo": "",
            "source": "External"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "SSPs are zeroized after use",
            "method": "After Use",
            "operatorId": "N/A",
            "rationale": "SSPs are zeroized after use when no longer needed."
          },
          {
            "description": "SSPs are zeroized by the operator upon resetting device",
            "method": "Reset Drive",
            "operatorId": "Initiated by operator",
            "rationale": "SSPs are zeroized by overwriting with all zeroes"
          },
          {
            "description": "SSPs are zeroized by the operator via the module\u0027s zeroization service. This service is not restricted and can be called at the operator\u0027s discretion.",
            "method": "Zeroization service",
            "operatorId": "Initiated by operator",
            "rationale": "All SSPs are immediately zeroized by overwriting with all zeroes."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Random Access Memory",
            "name": "RAM",
            "persistance": "Dynamic"
          },
          {
            "description": "Persistent memory storage",
            "name": "eMMC",
            "persistance": "Static"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "16GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000-16G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "32GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000-32G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "64GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000-64G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "128GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000- 128G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "256GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000- 256G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "512GB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000- 512G",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          },
          {
            "features": "1TB of user data storage",
            "fwVersion": "2.13.10",
            "hwVersion": "KDF3000",
            "modelPartNum": "KDF3000-1T",
            "processors": "Kanguru Defender 3000 Crypto Processor"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric and Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "NIST SP 800-133r2, Section 4 example 1, Section 5.2, and Section 6.1."
          },
          {
            "algoPropList": "Key Type:Symmetric",
            "implName": "N/A",
            "name": "CKG XTS",
            "reference": "NIST SP 800-133r2 and IG D.H per Section 6.3, approved method #1 and Section 4 example 1. Applicable to AES-XTS compliant to IG C.I because Key_1 and Key_2 are concatenated prior to usage."
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 5
          },
          "ECDH": {
            "ECDH": 20
          },
          "ECDSA": {
            "ECDSA": 10
          }
        },
        "RSA": {
          "RSA 2048": 5
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 1
        },
        "XTS": {
          "XTS": 2
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 1
        },
        "MAC": {
          "MAC": 12
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 18
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#1": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 1,
          "AES 256": 1,
          "DRBG 1024": 1,
          "DRBG 512": 1,
          "HMAC-SHA-256": 2,
          "PKCS 1": 3,
          "PKCS#1": 6,
          "PKCS1": 4,
          "RSA 2048": 5,
          "RSA PKCS#1": 4,
          "SHA2-256": 8,
          "SHA2256": 2
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 3": 4
        }
      },
      "hash_function": {
        "PBKDF": {
          "PBKDF": 19
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 34
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 8,
          "FIPS 180-4": 1,
          "FIPS 186-4": 2,
          "FIPS 186-5": 3,
          "FIPS 198-1": 1,
          "FIPS186-4": 6,
          "FIPS186-5": 7
        },
        "ISO": {
          "ISO/IEC 19790": 2,
          "ISO/IEC 19790:2012": 1
        },
        "NIST": {
          "NIST SP 800-132": 5,
          "NIST SP 800-140D": 1,
          "NIST SP 800-140E": 1,
          "NIST SP 800-38A": 3,
          "NIST SP 800-56A": 1,
          "NIST SP 800-90B": 1,
          "SP 800-132": 2,
          "SP 800-38A": 2,
          "SP 800-38E": 2,
          "SP 800-38F": 2,
          "SP 800-56A": 1,
          "SP 800-56C": 1,
          "SP 800-63B": 1,
          "SP 800-90A": 5,
          "SP 800-90B": 1
        },
        "PKCS": {
          "PKCS 1": 2,
          "PKCS#1": 5,
          "PKCS1": 2
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 13
          },
          "CAST": {
            "CAST": 32
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 9,
            "HMAC-SHA-256": 1
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 6
        },
        "IBM": {
          "SSC": 3
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "KDA TwoStep SP800-56Cr2A5476",
        "AES-KWA5476",
        "ECDSA KeyVer (FIPS186-5)A5476",
        "AES-ECBA5476",
        "HMAC-SHA2-256A5476",
        "AES-XTS Testing Revision 2.0A5476",
        "SHA2-256A5476",
        "ECDSA KeyGen (FIPS186-5)A5476",
        "RSA SigVer (FIPS186-4)A5476",
        "KAS-ECC-SSC Sp800-56Ar3A5476",
        "HMAC DRBGA5476",
        "AES-CBCA5476",
        "PBKDFA5476"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A5476"
      ]
    },
    "policy_metadata": {
      "/Author": "Herath",
      "/CreationDate": "D:20260629081002-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "f55df9e2-934c-4a3e-b694-d4c491f09573",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-06-29T11:35:37Z",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1",
      "/ModDate": "D:20260629081002-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 734725,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/195"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 43
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "95508538007f793da4c909e023ea66343f55575975a582601ca5086e86c35d25",
      "source_hash": "48e5317d747630da1673a36fb25626110aa3e6b742566a80bfe285f936f6c9bd",
      "txt_hash": "bd0938ae0fa34bd55b5d0c0c17cf7295526a6be2c2dfc8397b6caea9f2956038"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy.",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
    "date_sunset": "2031-06-29",
    "description": "The Kanguru Solutions Defender 3000 USB Flash Drive is an encrypted storage device designed as a multi-chip standalone cryptographic module. The module is designed to meet FIPS 140-3 Security Level 3 requirements.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 3,
    "mentioned_certs": {},
    "module_name": "Defender 3000 USB Flash Drive",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-06-30",
        "lab": "Penumbra Security, Inc.",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Kanguru Solutions",
    "vendor_url": "https://www.kanguru.com/"
  }
}