This page was not yet optimized for use on mobile devices.
BIG-IP Tenant Cryptographic Module
Certificate details
| Certificate ID | #5388 |
|---|---|
| Status | active |
| Validation dates | 09.07.2026 |
| Sunset date | 08-07-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Firmware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. The tamper evident labels contained in F5-ADD-BIG-FIPS140 kit and installed as indicated in the Security Policy section 7. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | BIG-IP Tenant Cryptographic Module, Application Delivery Controller and Firewall software running on running on F5 hardware and the underlying platform layer. |
| Vendor | F5, Inc. f5.com |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-256, AES-128, AES-192, AES, CAST, DES, Triple-DES, TDES, TDEA, Camellia, SEED, HMAC, HMAC-SHA-384, CMACAsymmetric Algorithms
ECDH, ECDSA, EdDSA, ECC, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA-256, SHA3-256, SHA-3Schemes
MAC, Key Exchange, Key agreement, Key AgreementProtocols
SSH, SSHv2, SSL, TLS v1.2, TLS, TLS 1.2, IKEv2, IPsecRandomness
DRBG, RNG, RBGElliptic Curves
P-256, P-384, Ed25519Block cipher modes
ECB, CBC, CTR, CFB, OFB, GCM, CCM, XTSTrusted Execution Environments
PSP, SSCSecurity level
Level 2Standards
FIPS 140-3, FIPS PUB 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS 197, FIPS 1403, FIPS140-3, FIPS180-4, FIPS186-4, FIPS197, FIPS198-1, FIPS202, SP 800-38A, SP 800-38C, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-140F, PKCS #1, PKCS#1, RFC7627, RFC5288, RFC 5288, RFC 4253, RFC 6668, RFC3394, RFC5649Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5388,
"dgst": "b797d397acb6b79e",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA7018",
"Counter DRBGA7018",
"#A7017",
"ECDSA SigGen (FIPS186-5)A7018",
"RSA SigVer (FIPS186-5)A7018",
"KAS-ECC-SSC Sp800-56Ar3A7018",
"ECDSA KeyGen (FIPS186-5)A7018",
"KDF SSHA7017",
"HMAC-SHA2-384A7018",
"RSA KeyGen (FIPS186-5)A7017",
"KAS-FFC-SSC Sp800-56Ar3A7018",
"SHA2-256A7018",
"AES-CBCA7018",
"RSA SigGen (FIPS186-5)A7018",
"ECDSA SigVer (FIPS186-5)A7018",
"AES-CCMA7018",
"ECDSA KeyVer (FIPS186-5)A7018",
"TLS v1.2 KDF RFC7627A7018",
"#A7018",
"Safe Primes Key GenerationA7018",
"AES-CTRA7017",
"HMAC-SHA2-256A7018",
"AES-GCMA7018",
"SHA2-384A7018",
"HMAC-SHA-1A7017"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A7017",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A7018",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A7017",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A7018",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A7017",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A7017",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A7018",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A7017",
"properties": "Prediction Resistance - No, Yes Mode - AES-256 Derivation Function Enabled - No, Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A7018",
"properties": "Prediction Resistance - No Mode - AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A7017, A7018",
"properties": "Curve - P-256, P-384 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A7017, A7018",
"properties": "Curve - P-256, P-384",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A7017, A7018",
"properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A7017, A7018",
"properties": "Curve - P-256, P-384 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A7017",
"properties": "Key Length - Key Length: 8, 16, 64, 128, 1024",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A7017, A7018",
"properties": "Key Length - Key Length: 8, 16, 64, 128, 1024",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A7017, A7018",
"properties": "Key Length - Key Length: 8, 16, 64, 128, 1024",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800- 56Ar3",
"cavpCertName": "A7017, A7018",
"properties": "Domain Parameter Generation Methods - P-256, P-384 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800- 56Ar3",
"cavpCertName": "A7017, A7018",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A7017",
"properties": "Cipher - AES-128, AES-256 Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186- 5)",
"cavpCertName": "A7017",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186- 5)",
"cavpCertName": "A7017",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186- 5)",
"cavpCertName": "A7018",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186- 5)",
"cavpCertName": "A7017",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186- 5)",
"cavpCertName": "A7018",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A7017, A7018",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A7017, A7018",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A7017, A7018",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A7017, A7018",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A7017, A7018",
"properties": "Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Display all User accounts",
"indicator": "None",
"inputs": "None",
"name": "List users",
"outputs": "List of all user accounts including self",
"rolesSspAccess": "Administrato r User Manager Resource Manager Auditor",
"secFunImpl": "None"
},
{
"description": "Create additional User",
"indicator": "None",
"inputs": "Username / password",
"name": "Create additional User",
"outputs": "Confirmation of account creation",
"rolesSspAccess": "Administrato r - Password: W User Manager - Password: W",
"secFunImpl": "None"
},
{
"description": "Modify existing Users",
"indicator": "None",
"inputs": "Username",
"name": "Modify existing Users",
"outputs": "Confirmation of account modification",
"rolesSspAccess": "Administrato r",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "User Manager",
"secFunImpl": ""
},
{
"description": "Delete User",
"indicator": "None",
"inputs": "Username",
"name": "Delete User",
"outputs": "Confirmation of deletion",
"rolesSspAccess": "Administrato r User Manager",
"secFunImpl": "None"
},
{
"description": "Remove lock from user who has exceeded login attempts",
"indicator": "None",
"inputs": "Username",
"name": "Unlock User",
"outputs": "Confirmation of unlock",
"rolesSspAccess": "Administrato r User",
"secFunImpl": "None"
},
{
"description": "Update own password",
"indicator": "None",
"inputs": "Own password",
"name": "Update own password",
"outputs": "Confirmation of update of password",
"rolesSspAccess": "Manager Administrato r - Password: W Auditor - Password: W Application Editor - Password: W Guest - Password: W Log Manager - Password: W Manager - Password: W Certificate Manager - Password: W Firewall Manager - Password: W iRule Manager - Password: W Operator - Password:",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Resource Manager - Password: W User Manager - Password: W",
"secFunImpl": ""
},
{
"description": "Update others password",
"indicator": "None",
"inputs": "Username / password",
"name": "Update others password",
"outputs": "Confirmation of update",
"rolesSspAccess": "Administrato r - Password: W User Manager - Password: W",
"secFunImpl": "None"
},
{
"description": "Set password policy features",
"indicator": "None",
"inputs": "New password policy",
"name": "Configure Password Policy",
"outputs": "Confirmation of configuration change",
"rolesSspAccess": "Administrato r",
"secFunImpl": "None"
},
{
"description": "Self-signed certificate creation",
"indicator": "Service Indicator: Approved",
"inputs": "Certificate identification information",
"name": "Create TLS Certificate",
"outputs": "Confirmation of certificate creation",
"rolesSspAccess": "Administrato r - TLS RSA private key: E - TLS ECDSA private key: E Certificate Manager - TLS RSA private key: E - TLS ECDSA private key: E Resource Manager - TLS RSA private key: E - TLS ECDSA",
"secFunImpl": "Signature generation"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: E",
"secFunImpl": ""
},
{
"description": "Used for the SSL Certificate key file",
"indicator": "Service Indicator: Approved",
"inputs": "Key identification information",
"name": "Create TLS Key",
"outputs": "Confirmation of key creation",
"rolesSspAccess": "Administrato r - TLS RSA private key: G - TLS RSA public key: G - TLS ECDSA private key: G - TLS ECDSA public key: G - DRBG seed : E - DRBG internal state (V and key values) : E,W - Entropy input string: E Resource Manager - TLS RSA private key: G - TLS RSA public key: G - TLS ECDSA private key: G - TLS ECDSA public key: G - DRBG seed : E - DRBG internal state (V and key values) : E,W - Entropy",
"secFunImpl": "Key pair generation Random Number Generation in Control Plane Random Number Generation in Data Plane"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "input string: E Certificate Manager - TLS RSA private key: G - TLS RSA public key: G - TLS ECDSA private key: G - TLS ECDSA public key: G - DRBG seed : E - DRBG internal state (V and key values) : E,W - Entropy input string:",
"secFunImpl": ""
},
{
"description": "Self-signed certificate / key deletion",
"indicator": "None",
"inputs": "Key identification information",
"name": "Delete TLS Certificate /Key",
"outputs": "Confirmation of key / certificate deletion",
"rolesSspAccess": "Administrato r - TLS RSA private key: Z - TLS RSA public key: Z - TLS ECDSA private key: Z - TLS ECDSA public key: Z Resource Manager - TLS RSA private key: Z - TLS RSA public key: Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS ECDSA private key: Z - TLS ECDSA public key: Z Certificate Manager - TLS RSA private key: Z - TLS RSA public key: Z - TLS ECDSA private key: Z - TLS ECDSA public key: Z",
"secFunImpl": ""
},
{
"description": "Display expiration/creatio n dates, certificate key size, generator of installed certificates",
"indicator": "None",
"inputs": "List of certificates to display",
"name": "List Certificate",
"outputs": "Certificate expiration information",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Log Manager Resource Manager",
"secFunImpl": "None"
},
{
"description": "List private key information (name, size, type)",
"indicator": "None",
"inputs": "List of private keys to display",
"name": "List Private Keys",
"outputs": "TLS private key information",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Log Manager Resource",
"secFunImpl": "None"
},
{
"description": "SSH session Key authentication, Key Exchange",
"indicator": "SSH connectio n successful",
"inputs": "User / address / password / algorithms / key sizes / key derivation",
"name": "Establish SSH session",
"outputs": "Confirmation of SSH session authenticatio n, Confirmation of SSH session key exchange",
"rolesSspAccess": "Administrato r - SSH ECDSA public key: E - SSH RSA public key: E - Password:",
"secFunImpl": "Signature generation Signature verification SSH Handshake"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E Auditor - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E Certificate Manager - SSH ECDSA public key: E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E Firewall Manager - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E iRule",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Manager - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E Operator - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "session key : E Resource Manager - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E - SSH shared secret: G - SSH derived session key : E User Manager - SSH ECDSA public key: E - SSH RSA public key: E - Password: W,E - SSH EC Diffie- Hellman public key: G,R,W,E - SSH EC Diffie- Hellman private key: G,R,W,E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH shared secret: G - SSH derived session key : E",
"secFunImpl": ""
},
{
"description": "SSH data encryption, decryption, integrity",
"indicator": "SSH connectio n successful",
"inputs": "SSH Derived Session key",
"name": "Maintain SSH Session",
"outputs": "SSH session information",
"rolesSspAccess": "Administrato r - SSH derived session key : E Auditor - SSH derived session key : E Certificate Manager - SSH derived session key : E Firewall Manager - SSH derived session key : E iRule Manager - SSH derived session key : E Operator - SSH derived session key : E Resource Manager - SSH derived session key : E",
"secFunImpl": "Key Wrapping/Unwrappi ng with encryption and authentication in SSH"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "User Manager - SSH derived session key : E",
"secFunImpl": ""
},
{
"description": "TLS session signature generation and verification, key exchange",
"indicator": "Service Indicator: Approved",
"inputs": "Address / algorithms/ keys",
"name": "Establish TLS Session",
"outputs": "Confirmation of digital signature verification of TLS session, Confirmation of establishment of TLS session",
"rolesSspAccess": "Administrato r - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Auditor - TLS RSA public key: R - TLS ECDSA",
"secFunImpl": "Message Digest Signature verification TLS Handshake (ECC) TLS Handshake (FFC)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Certificate Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Firewall Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS derived session key: G - TLS primary secret: G iRule Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Operator - TLS RSA public key: R",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Guest - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Log Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "derived session key: G - TLS primary secret: G Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Application Editor - TLS RSA public key: R - TLS",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G Resource Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key:",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G - TLS derived session key: G - TLS primary secret: G User Manager - TLS RSA public key: R - TLS ECDSA public key: R - TLS EC Diffie- Hellman private key: E - TLS EC Diffie- Hellman public key: W - TLS Diffie- Hellman private key: E - TLS Diffie- Hellman public key: W - TLS pre- primary secret : E,G",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS derived session key: G - TLS primary secret: G",
"secFunImpl": ""
},
{
"description": "TLS data encryption, authentication",
"indicator": "Service Indicator: Approved",
"inputs": "TLS Derived Session key",
"name": "Maintain TLS Session",
"outputs": "TLS session information",
"rolesSspAccess": "Administrato r - TLS derived session key: E Auditor - TLS derived session key: E Certificate Manager - TLS derived session key: E Firewall Manager - TLS derived session key: E iRule Manager - TLS derived session key: E Operator - TLS derived session key: E Guest - TLS derived session key: E",
"secFunImpl": "Key Wrapping/Unwrappi ng with encryption followed by authentication and authenticated encryption in TLS"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Log Manager - TLS derived session key: E Manager - TLS derived session key: E Application Editor - TLS derived session key: E Resource Manager - TLS derived session key: E User Manager - TLS derived session key:",
"secFunImpl": ""
},
{
"description": "Utility service delete ssh keys",
"indicator": "None",
"inputs": "SSH key to delete",
"name": "Delete ssh- keyswap",
"outputs": "Confirmation of SSH key deletion",
"rolesSspAccess": "Administrato r - SSH ECDSA public key: Z - SSH ECDSA private key: Z - SSH RSA public key: Z - SSH RSA private key: Z Resource Manager - SSH ECDSA",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: Z - SSH ECDSA private key: Z - SSH RSA public key: Z - SSH RSA private key: Z",
"secFunImpl": ""
},
{
"description": "Restart the cryptographic module",
"indicator": "Module reboots",
"inputs": "None",
"name": "Reboot System",
"outputs": "Confirmation of system reboot",
"rolesSspAccess": "Administrato r - TLS primary secret: Z - TLS derived session key:",
"secFunImpl": "None"
},
{
"description": "Full system zeroization",
"indicator": "Module end of life",
"inputs": "Selection option",
"name": "Zeroization",
"outputs": "Confirmation of full system zeroization",
"rolesSspAccess": "Administrato r - SSH RSA private key: Z - SSH ECDSA private key: Z - SSH ECDSA public key: Z - SSH RSA public key: Z - TLS RSA private key: Z - TLS ECDSA private key: Z - TLS ECDSA public key: Z - TLS RSA public key: Z",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access - Password:",
"secFunImpl": "Security Functions"
},
{
"description": "Return the HW and FW versions and the module\u0027s name",
"indicator": "N/A",
"inputs": "N/A",
"name": "Show version",
"outputs": "Module name and version",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule Manager Operator Guest Log Manager Manager Application Editor Resource Manager",
"secFunImpl": "None"
},
{
"description": "Return the module status",
"indicator": "N/A",
"inputs": "N/A",
"name": "Show Status",
"outputs": "Module status",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule Manager Operator Guest Log Manager Manager Application Editor Resource Manager User Manager",
"secFunImpl": "None"
},
{
"description": "Closing TLS / SSH session",
"indicator": "N/A",
"inputs": "N/A",
"name": "Close TLS / SSH session",
"outputs": "Confirmation of TLS/SSH session closure",
"rolesSspAccess": "Administrato r - TLS EC Diffie- Hellman",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: Z - TLS EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z Auditor - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie-",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Certificate Manager - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Firewall Manager - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z iRule Manager - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Operator - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Guest - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Log Manager - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Application Editor - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z Manager - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Hellman public key: Z - TLS Diffie- Hellman private key: Z Resource Manager - TLS EC Diffie- Hellman public key: Z - TLS EC Diffie- Hellman private key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH shared secret: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Hellman private key: Z User Manager - TLS EC Diffie- Hellman private key: Z - TLS EC Diffie- Hellman public key: Z - TLS pre- primary secret : Z - TLS primary secret: Z - TLS derived session key: Z - SSH derived session key : Z - SSH EC Diffie- Hellman private key: Z - SSH EC Diffie- Hellman public key: Z - TLS Diffie- Hellman public key: Z - TLS Diffie- Hellman private key: Z",
"secFunImpl": ""
},
{
"description": "Execute integrity test. Execute the CASTs",
"indicator": "Integrity test, CASTs from section 10",
"inputs": "N/A",
"name": "Self-tests",
"outputs": "Pass or fail",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule Manager Operator Guest Log Manager Manager Application Editor Resource Manager User Manager",
"secFunImpl": "Random Number Generation in Control Plane Signature generation Signature verification Key pair verification Random Number Generation in Data Plane"
},
{
"description": "Return license indication",
"indicator": "N/A",
"inputs": "N/A",
"name": "Show license",
"outputs": "FIPS license information",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule Manager Operator Guest Log Manager Manager Application Editor Resource Manager User Manager",
"secFunImpl": "None"
},
{
"description": "Import TLS Certificate",
"indicator": "None",
"inputs": "Certificate to import",
"name": "Import TLS Certificate",
"outputs": "Confirmation of import of certificate",
"rolesSspAccess": "Administrato r - TLS RSA public key: W - TLS ECDSA",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "public key: W Resource Manager - TLS RSA public key: W - TLS ECDSA public key: W Certificate Manager - TLS RSA public key: W - TLS ECDSA public key:",
"secFunImpl": ""
},
{
"description": "Export Certificate File",
"indicator": "None",
"inputs": "Certificate to export",
"name": "Export Certificate File",
"outputs": "Exported Certificate file",
"rolesSspAccess": "Administrato r - TLS ECDSA public key: R - TLS RSA public key: R Resource Manager - TLS ECDSA public key: R - TLS RSA public key: R Certificate Manager - TLS RSA public key: R - TLS ECDSA public key: R",
"secFunImpl": "None"
},
{
"description": "Utility service create ssh keys",
"indicator": "Service Indicator: Approved",
"inputs": "SSH key to create",
"name": "Create ssh- keyswap",
"outputs": "Confirmation of SSH key creation",
"rolesSspAccess": "Administrato r - SSH ECDSA",
"secFunImpl": "Key pair generation"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "private key: G - SSH RSA private key: G - SSH ECDSA public key: G - SSH RSA public key: G Resource Manager - SSH ECDSA private key: G - SSH RSA private key: G - SSH ECDSA public key: G - SSH RSA public key: G",
"secFunImpl": ""
},
{
"description": "Set policy rules, and address lists for use by firewall rules",
"indicator": "None",
"inputs": "Policy rules, address lists",
"name": "Configure Firewall",
"outputs": "Confirmation of policy configuration",
"rolesSspAccess": "Administrato r Firewall Manager Resource Manager",
"secFunImpl": "None"
},
{
"description": "Set firewall user",
"indicator": "None",
"inputs": "Firewall user and configuration information",
"name": "Configure Firewall Users",
"outputs": "Confirmation of configuration",
"rolesSspAccess": "Administrato r Firewall Manager User Manager",
"secFunImpl": "None"
},
{
"description": "Display the current system- wide state of firewall rules",
"indicator": "None",
"inputs": "N/A",
"name": "Show firewall state",
"outputs": "Display the current system wide state of the firewall rules.",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Operator Guest Log Manager Manager Application Editor Resource Manager User Manager",
"secFunImpl": ""
},
{
"description": "Shows statistics of firewall rules on the BIG-IP system",
"indicator": "None",
"inputs": "N/A",
"name": "Shows statistics",
"outputs": "List of statistics of firewall rules",
"rolesSspAccess": "Administrato r Auditor Certificate Manager Firewall Manager iRule Manager Operator Guest Log Manager Manager Application Editor Resource Manager User Manager",
"secFunImpl": "None"
},
{
"description": "Display logs/files of configuration changes",
"indicator": "None",
"inputs": "N/A",
"name": "View System Audit Log",
"outputs": "Display of system audit logs",
"rolesSspAccess": "Administrato r Auditor Manager Log Manager iRule Manager Resource Manager",
"secFunImpl": "None"
},
{
"description": "Export Analytics Logs System",
"indicator": "None",
"inputs": "N/A",
"name": "Export Analytics Logs System",
"outputs": "Display System Analytics Logs",
"rolesSspAccess": "Administrato r User Manager",
"secFunImpl": "None"
},
{
"description": "Enable/ Disable Audit",
"indicator": "None",
"inputs": "N/A",
"name": "Enable/ Disable Audit",
"outputs": "Confirmation of enabling or disabling of audit",
"rolesSspAccess": "Administrato r Resource Manager",
"secFunImpl": "None"
},
{
"description": "Enable Quiet boot, Manage boot locations",
"indicator": "None",
"inputs": "Boot options",
"name": "Configure Boot Options",
"outputs": "Confirmation of configuration of boot options",
"rolesSspAccess": "Administrato r Resource Manager",
"secFunImpl": "None"
},
{
"description": "Enable / Disable SSH access, Configure IP address allow list",
"indicator": "None",
"inputs": "SSH access / IP address list",
"name": "Configure SSH access options",
"outputs": "Confirmation of configuration of SSH access options",
"rolesSspAccess": "Administrato r Resource Manager",
"secFunImpl": "None"
},
{
"description": "Update ssh/ authorized_keys file for user authentication",
"indicator": "None",
"inputs": "ssh/ authorized_ke ys file",
"name": "Configure SSH user configuratio n",
"outputs": "Confirmation of configuration of SSH user configuration",
"rolesSspAccess": "Administrato r - SSH ECDSA public key: W - SSH RSA public key: W",
"secFunImpl": "None"
},
{
"description": "Enable / Disable nodes and pool members",
"indicator": "None",
"inputs": "Which nodes and pool members to modify",
"name": "Modify nodes and pool members",
"outputs": "Confirmation of modification of nodes and pool members",
"rolesSspAccess": "Administrato r Manager Resource Manager",
"secFunImpl": "None"
},
{
"description": "Create, delete nodes",
"indicator": "None",
"inputs": "List of nodes to create / view / delete",
"name": "Configure nodes",
"outputs": "Confirmation of creation / deletion of nodes",
"rolesSspAccess": "Administrato r Manager Resource Manager",
"secFunImpl": "None"
},
{
"description": "Create, delete, iRules",
"indicator": "None",
"inputs": "List of iRules to create / delete",
"name": "Configure iRules",
"outputs": "Confirmation of creation / deletion of iRules",
"rolesSspAccess": "Administrato r iRule Manager Manager Resource Manager",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The password must consist of a minimum of 8 characters with at least one from each of the three-character classes. Character classes are defined as: digits (0-9), ASCII lowercase letters (a-z), ASCII uppercase letters (A-Z). Assuming a worst-case scenario where the password contains six numerical digits, one ASCII lowercase letter and one ASCII uppercase letter. The probability of guessing every character successfully is (1/10)^6 * (1/26)^1 * (1/26)^1 = 1/676,000,000. Note: this is less than 1/1,000,000. The maximum number of login attempts is limited to 3 after which the account is locked. This means that, in the worst case, an attacker has the probability of guessing the password in one minute as 3/676,000,000. Note: This is less than 1/100,000.",
"mechanism": "Password-based authentication",
"name": "Role-based authentication with Password (CLI or WebUI)",
"perMinute": "3/676,000,000",
"strength": "1/676,000,000"
},
{
"description": "The ECDSA using P-256 or P-384 curves for key based authentication yields a minimum security-strength of 128 bits. The chance of a random authentication attempt falsely succeeding is at most 1/(2^128) that is less than 1/1,000,000. The maximum number of login attempts is limited to 1 after which the account switches to password authentication. Then the attacker\u0027s probability to establish the connection depends on the probability of guessing the password and it is, as above, 3/676,000,000 less than 1/100,000.",
"mechanism": "ECDSA SigVer",
"name": "Role-based authentication with SSH ECDSA key-pair (CLI only)",
"perMinute": "3/676,000,000",
"strength": "1/(2^128)"
},
{
"description": "The RSA using 2048, 3092 or 4096 moduli for key based authentication yields a minimum security-strength of 112 bits. The chance of a random authentication attempt falsely succeeding is at most 1/(2^112) that is less than 1/1,000,000. The maximum number of login attempts is limited to 1 after which the account switches to password authentication. Then the attacker\u0027s probability to establish the connection depends on the probability of",
"mechanism": "RSA SigVer",
"name": "Role-based authentication with SSH RSA key-pair (CLI only)",
"perMinute": "3/676,000,000",
"strength": "1/(2^112)"
},
{
"description": "guessing the password and it is, as above, 3/676,000,000 less than 1/100,000.",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "Counter DRBG",
"condition": "Test runs at power on",
"details": "SP800-90ARev1 section 11.3 instantiate, generate and reseed health tests",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "AES-256 in CTR mode, with and without derivation function, prediction resistance disabled",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC encrypt",
"condition": "Test runs at power on",
"details": "Encryption",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC decrypt",
"condition": "Test runs at power on",
"details": "Decryption",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "128-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM encrypt",
"condition": "Test runs at power on",
"details": "Encrypt operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM decrypt",
"condition": "Test runs at power on",
"details": "Decrypt operation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "256-bit key",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5)",
"condition": "Test runs at power on",
"details": "Signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "2048 bit key and SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5)",
"condition": "Test runs at power on",
"details": "Signature verification",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "2048 bit key and SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5)",
"condition": "Key generation",
"details": "Calculation and verification of a digital signature",
"indicator": "Asymmetric algorithm is performed",
"testMethod": "PCT",
"testProps": "Requested modulus size, SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5)",
"condition": "Test runs at power on",
"details": "Signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256 and SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5)",
"condition": "Test runs at power on",
"details": "Signature generation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256 and SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5)",
"condition": "Key generation",
"details": "Calculation and verification of a digital signature",
"indicator": "Asymmetric algorithm is performed",
"testMethod": "PCT",
"testProps": "Requested curve size, SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3",
"condition": "Test runs at power on",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "P-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3",
"condition": "Test runs at power on",
"details": "Shared secret computation",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "fdhe2048",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA- 1 (A7017)",
"condition": "Test runs at power on",
"details": "MAC",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "HMAC-SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256",
"condition": "Test runs at power on",
"details": "MAC",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "HMAC-SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-384",
"condition": "Test runs at power on",
"details": "MAC",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "HMAC-SHA-384",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627",
"condition": "Test runs at power on",
"details": "Key derivation used in the TLS protocol",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH",
"condition": "Test runs at power on",
"details": "Key derivation used in the SSH protocol",
"indicator": "Module becomes operational",
"testMethod": "KAT",
"testProps": "SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "Safe Primes Key Generation",
"condition": "Key generation",
"details": "Calculation and verification of a digital signature",
"indicator": "Asymmetric algorithm is performed",
"testMethod": "PCT",
"testProps": "Requested curve size",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "HMAC-SHA2-384 KAT failure or HMAC-SHA2- 384 integrity test failure Failure of any of the CASTs",
"description": "Module is no longer operational. The data output is inhibited.",
"indicator": "For integrity, CAST and health test failures the module will not load. For PCT failures the module will halt and enter the error state",
"name": "Halt Error",
"recoveryMethod": "The module must be re- loaded"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "Production grade enclosure (SL1)"
},
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "Opaque enclosure (SL2)"
},
{
"inspectFreq": "Once per month",
"inspectGuidance": "The Administrator checks the quality of the tamper evident labels for any sign of removal, replacement, tearing, etc. If any label is found to be damaged or missing, a kit providing 25 tamper labels is available for purchase (P/N: F5- ADD-BIG-FIPS140).",
"mechanism": "Tamper Evident Labels (SL2)"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Automatically entered whenever an approved service is requested",
"name": "Approved mode",
"statusIndicator": "Service Indicator : Approved",
"type": "Approved"
},
{
"description": "Only non-approved security functions can be used",
"name": "Non-Approved mode",
"statusIndicator": "Service Indicator : Not Approved",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-512",
"use": "Message authentication TLS (not CAVP tested)"
},
{
"name": "Triple-DES, Camellia, SEED",
"use": "Symmetric encryption and decryption TLS"
},
{
"name": "HMAC-SHA2-256, HMAC-SHA2-512, AES-GCM",
"use": "Message authentication in IPsec/ IKEv2 protocol"
},
{
"name": "PKCS #1 v1.5 scheme with modulus other than 2048, 3072 or 4096 bits, for all SHA sizes; PKCS #1 v1.5 and PSS schema with modulus size 2048, 3072, 4096 bits with SHA-1, SHA2- 224, SHA2-512; with ANS X9.31 standard;",
"use": "RSA signature generation and verification (not CAVP tested)"
},
{
"name": "ECDSA with curves P-256/ P-384 with SHA-1/SHA2-224, ECDSA using curves other than P-256 and P-384 with all SHA sizes",
"use": "ECDSA signature generation and verification (not CAVP tested)"
},
{
"name": "RSA with modulus sizes up to 16384 bits",
"use": "RSA encrypt / decrypt (not CAVP tested)"
},
{
"name": "DSA with all key and SHA sizes",
"use": "DSA domain parameter generation, domain parameter verification, key pair generation, signature generation and verification (not compliant with FIPS 186-5)"
},
{
"name": "Diffie-Hellman using MODP1024, MODP2048 groups",
"use": "Shared secret computation in IPsec/IKE protocol"
},
{
"name": "MD5/ SHA-1/ SHA2-224 / SHA2-512",
"use": "Key Derivation function in the context of TLS KDF (not CAVP tested)"
},
{
"name": "EdDSA with Ed25519",
"use": "EdDSA digital signature (not CAVP tested)"
},
{
"name": "SHA-1, AES-ECB, RSA- signature verification",
"use": "SNMP"
},
{
"name": "TLS ciphersuites implemented by f5-rest-node",
"use": "TLS used in SSL Orchestrator (SSLO)"
},
{
"name": "RSA keypair with 2048, 3072 and 4096 (REST API)",
"use": "iControl representation state transfer (REST) access"
},
{
"name": "EC Diffie-Hellman Ephemeral Unified with curves other than P-256, P-384. EC Diffie-Hellman using onePassDH / StaticUnified schemes. Diffie-Hellman using groups other than ffdhe2048, ffdhe3072, ffdhe4096",
"use": "Shared secret computation (not compliant with SP800-56Ar3)"
},
{
"name": "Triple-DES, AES-GCM-128, AES-192, AES-256",
"use": "Symmetric encryption and decryption in IPsec /IKEv2"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-512 Triple-DES, Camellia, SEED DSA with all key and SHA sizes",
"description": "Data encryption, Data authentication",
"name": "Maintain TLS session",
"role": "CO / User"
},
{
"alg_accessed": "TLS ciphersuites implemented by f5-rest-node",
"description": "Management of the module protected by iApplx authentication",
"name": "SSLO Configuration and usage",
"role": "CO / User"
},
{
"alg_accessed": "RSA keypair with 2048, 3072 and 4096 (REST API)",
"description": "Access to the system through REST API",
"name": "iControl REST access",
"role": "CO / User"
},
{
"alg_accessed": "HMAC-SHA2-256, HMAC-SHA2-512, AES-GCM Diffie-Hellman using MODP1024, MODP2048 groups Triple-DES, AES-GCM-128, AES-192, AES-256",
"description": "Protocol configuration",
"name": "IPsec /IKEv2",
"role": "CO / User"
},
{
"alg_accessed": "SHA-1, AES-ECB, RSA- signature verification",
"description": "Protocol configuration",
"name": "Simple network management protocol (SNMP)",
"role": "CO / User"
},
{
"alg_accessed": "PKCS #1 v1.5 scheme with modulus other than 2048, 3072 or 4096 bits, for all SHA sizes; PKCS #1 v1.5 and PSS schema with modulus size 2048, 3072, 4096 bits with SHA-1, SHA2-224, SHA2-512; with ANS X9.31 standard; ECDSA with curves P-256/ P-384 with SHA-1/SHA2- 224, ECDSA using curves other than P-256 and P-384 with all SHA sizes RSA with modulus sizes up to 16384 bits EdDSA with Ed25519 MD5/ SHA-1/ SHA2-224 / SHA2-512 EC Diffie-Hellman Ephemeral Unified with curves other than P-256, P-384. EC Diffie-Hellman using onePassDH / StaticUnified schemes. Diffie-Hellman using groups other than ffdhe2048, ffdhe3072, ffdhe4096",
"description": "Signature generation and verification, Key Exchange",
"name": "Establish TLS session",
"role": "CO / User"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "TLS/SSH protocol input messages; Configuration commands for interface management",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "TLS/SSH protocol output messages; Status log",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API which control system state (e.g. reset system, power-off system)",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "API which provides system status information",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Administrator",
"operatorType": "Crypto Officer (CO)",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Auditor",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Certificate Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Firewall Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "User Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "iRule Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Operator",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Resource Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Guest",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Log Manager",
"operatorType": "User",
"type": "Role"
},
{
"authMethodList": "Role-based authentication with Password (CLI or WebUI) Role-based authentication with SSH ECDSA key-pair (CLI only) Role-based authentication with SSH RSA key-pair (CLI only)",
"name": "Application Editor",
"operatorType": "User",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "2",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC- SHA2-384 (A7017)",
"details": "Integrity of the module is verified by comparing the HMAC-SHA2-384 value calculated at runtime with the HMAC- SHA2-384 value stored in the module that was computed at build time",
"indicator": "Module becomes operational",
"testMethod": "Message Authentication",
"testProps": "HMAC key: 384-bits",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "HMAC- SHA2-384 (A7018)",
"details": "Integrity of the module is verified by comparing the HMAC-SHA2-384 value calculated at runtime with the HMAC- SHA2-384 value stored in the module that was computed at build time",
"indicator": "Module becomes operational",
"testMethod": "Message Authentication",
"testProps": "HMAC key: 384-bits",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "User",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Public key output during protocol handshake",
"sfiAlgo": "Key Wrapping/Unwrapping with encryption and authentication in SSH",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Public key input during protocol handshake",
"sfiAlgo": "Key Wrapping/Unwrapping with encryption followed by authentication and authenticated encryption in TLS",
"source": "User"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input over encrypted TLS/SSH session",
"sfiAlgo": "Key Wrapping/Unwrapping with encryption and authentication in SSH",
"source": "User"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Single pass zeroization erasing the entire module",
"method": "Zeroization",
"operatorId": "The Crypto Officer is calling the Zeroization service",
"rationale": "All SSPs present in the module are erased including the one in the non-volatile memory"
},
{
"description": "Clear the SSPs present in RAM memory",
"method": "Reboot System",
"operatorId": "The Crypto Officer is calling Reboot System service",
"rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed."
},
{
"description": "Destruction of the selected SSH authentication keys",
"method": "Delete SSH keyswap",
"operatorId": "The Administrator or Resource Manager are calling the Delete SSH keyswap service",
"rationale": "Zeroization service overwrites the memory occupied by keys with \"zeros\" or pre-defined values."
},
{
"description": "Zeroization of temporary values",
"method": "Closing TLS Connection / SSH Session",
"operatorId": "Closing TLS Connection / SSH Session",
"rationale": "SSP temporary values generated during key generation services are zeroized by the module"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "The keys and the password hash are stored in plaintext form and are only accessible to the authenticated operator, to which the SSPs are associated",
"name": "RAM",
"persistance": "Dynamic"
},
{
"description": "The keys stored in plaintext will remain on the system across power cycle and are only accessible to the authenticated operator to which the SSPs are associated",
"name": "SSD",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "r4800",
"hypervisorHostOs": "F5OS-A 1.5.3",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.5.3)",
"paa_pai": "No",
"processors": "Intel\u00ae Atom\u00ae P5342 Snow Ridge NS",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r4800",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Atom\u00ae P5342 Snow Ridge NS",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r5900",
"hypervisorHostOs": "F5OS-A 1.5.3",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.5.3)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r5900",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r5920-DF",
"hypervisorHostOs": "F5OS-A 1.5.3",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.5.3)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r5920-DF",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Silver 4314 Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r10900",
"hypervisorHostOs": "F5OS-A 1.5.3",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.5.3)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r10900",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r10920-DF",
"hypervisorHostOs": "F5OS-A 1.5.3",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.5.3)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r10920-DF",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Gold 6312U Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "r12900",
"hypervisorHostOs": "F5OS-A 1.8.0",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-A 1.8.0)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae Platinum 8351N Ice Lake-SP",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "VELOS CX410- BX110",
"hypervisorHostOs": "F5OS-C 1.8.1",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-C 1.8.1)",
"paa_pai": "No",
"processors": "Intel\u00ae Xeon\u00ae D-2177NT Skylake-D",
"version": "17.5.0 EHF"
},
{
"hardwarePlatform": "Hardware Platform",
"hypervisorHostOs": "Version(s)",
"operatingSystem": "Operating System",
"paa_pai": "PAA/PAI Hypervisor or Host OS",
"processors": "Processors",
"version": ""
},
{
"hardwarePlatform": "VELOS CX410- BX520",
"hypervisorHostOs": "17.5.0 EHF",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-C 1.8.1)",
"paa_pai": "No F5OS-C 1.8.1",
"processors": "Intel\u00ae Xeon\u00ae Gold 6330N Ice Lake",
"version": ""
},
{
"hardwarePlatform": "VELOS CX1610- BX520",
"hypervisorHostOs": "17.5.0 EHF",
"operatingSystem": "BIG-IP 17.5.0 EHF Tenant (Host OS F5OS-C 1.8.1)",
"paa_pai": "No F5OS-C 1.8.1",
"processors": "Intel\u00ae Xeon\u00ae Gold 6330N Ice Lake",
"version": ""
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 11
},
"ECDH": {
"ECDH": 2
},
"ECDSA": {
"ECDSA": 101
},
"EdDSA": {
"EdDSA": 3
}
},
"FF": {
"DH": {
"DH": 2,
"Diffie-Hellman": 12
},
"DSA": {
"DSA": 4
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 1
},
"CCM": {
"CCM": 2
},
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 3
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 3
},
"OFB": {
"OFB": 1
},
"XTS": {
"XTS": 2
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKEv2": 1
},
"IPsec": {
"IPsec": 2
},
"SSH": {
"SSH": 243,
"SSHv2": 2
},
"TLS": {
"SSL": {
"SSL": 2
},
"TLS": {
"TLS": 363,
"TLS 1.2": 4,
"TLS v1.2": 5
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 1,
"Key agreement": 3
},
"KEX": {
"Key Exchange": 2
},
"MAC": {
"MAC": 4
}
},
"device_model": {},
"ecc_curve": {
"Edwards": {
"Ed25519": 2
},
"NIST": {
"P-256": 40,
"P-384": 38
}
},
"eval_facility": {
"atsec": {
"atsec": 2
}
},
"fips_cert_id": {
"Cert": {
"#1": 6
}
},
"fips_certlike": {
"Certlike": {
"AES-128": 1,
"AES-192": 2,
"AES-256": 7,
"DRBG 384": 1,
"HMAC-SHA- 1": 2,
"HMAC-SHA-1": 10,
"HMAC-SHA-384": 4,
"PKCS #1": 8,
"PKCS#1": 2,
"SHA-1": 5,
"SHA-256": 2,
"SHA-3": 1,
"SHA2- 224": 1,
"SHA2- 256": 2,
"SHA2-224": 3,
"SHA2-256": 10,
"SHA2-384": 10,
"SHA2-512": 6,
"SHA3-256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 3
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 5
},
"SHA2": {
"SHA-256": 2
},
"SHA3": {
"SHA-3": 1,
"SHA3-256": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 27
},
"RNG": {
"RBG": 2,
"RNG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 97,
"FIPS 1403": 1,
"FIPS 180-4": 2,
"FIPS 186-5": 11,
"FIPS 197": 2,
"FIPS 198-1": 3,
"FIPS PUB 140-3": 2,
"FIPS140-3": 1,
"FIPS180-4": 1,
"FIPS186-4": 1,
"FIPS186-5": 24,
"FIPS197": 1,
"FIPS198-1": 1,
"FIPS202": 1
},
"NIST": {
"SP 800-135": 2,
"SP 800-140F": 1,
"SP 800-38A": 3,
"SP 800-38C": 2,
"SP 800-38D": 2,
"SP 800-56A": 4,
"SP 800-90A": 2
},
"PKCS": {
"PKCS #1": 4,
"PKCS#1": 1
},
"RFC": {
"RFC 4253": 1,
"RFC 5288": 1,
"RFC 6668": 1,
"RFC3394": 1,
"RFC5288": 1,
"RFC5649": 1,
"RFC7627": 3
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 10,
"AES-128": 1,
"AES-192": 2,
"AES-256": 7
},
"CAST": {
"CAST": 33
}
},
"DES": {
"3DES": {
"TDEA": 1,
"TDES": 1,
"Triple-DES": 4
},
"DES": {
"DES": 1
}
},
"constructions": {
"MAC": {
"CMAC": 2,
"HMAC": 11,
"HMAC-SHA-384": 2
}
},
"miscellaneous": {
"Camellia": {
"Camellia": 2
},
"SEED": {
"SEED": 2
}
}
},
"tee_name": {
"AMD": {
"PSP": 7
},
"IBM": {
"SSC": 1
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"Safe Primes Key VerificationA7018",
"Counter DRBGA7018",
"ECDSA SigGen (FIPS186-5)A7018",
"RSA SigVer (FIPS186-5)A7018",
"KAS-ECC-SSC Sp800-56Ar3A7018",
"ECDSA KeyGen (FIPS186-5)A7018",
"KDF SSHA7017",
"HMAC-SHA2-384A7018",
"RSA KeyGen (FIPS186-5)A7017",
"KAS-FFC-SSC Sp800-56Ar3A7018",
"SHA2-256A7018",
"AES-CBCA7018",
"RSA SigGen (FIPS186-5)A7018",
"ECDSA SigVer (FIPS186-5)A7018",
"AES-CCMA7018",
"ECDSA KeyVer (FIPS186-5)A7018",
"TLS v1.2 KDF RFC7627A7018",
"Safe Primes Key GenerationA7018",
"AES-CTRA7017",
"HMAC-SHA2-256A7018",
"AES-GCMA7018",
"SHA2-384A7018",
"HMAC-SHA-1A7017"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A7017",
"#A7018"
]
},
"policy_metadata": {
"/CreationDate": "D:20260709070833-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260709070833-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1114880,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
"https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
"http://www.ietf.org/rfc/rfc3447.txt",
"https://www.f5.com/",
"http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf",
"https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/74",
"http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
"http://www.ietf.org/rfc/rfc5649.txt",
"http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf",
"http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf",
"http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
"http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
"http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
"http://www.ietf.org/rfc/rfc3394.txt",
"http://www.atsec.com/",
"http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf",
"http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf",
"http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
"http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
"https://support.f5.com/csp/article/K7752",
"http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf",
"http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
"http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 95
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "685572455dde9f19b97e0d80dddf10d0c26692522621556e297cb9b99cf47c0b",
"source_hash": "b46cb9b8f9b873e5685d6bae3e578994744781d07314f6f9e0ad1183383fcaa9",
"txt_hash": "b7f61b87e825e3d4b411930905104e31e7eaa4c034276a92118b6bc17b06437b"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. The tamper evident labels contained in F5-ADD-BIG-FIPS140 kit and installed as indicated in the Security Policy section 7. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
"date_sunset": "2031-07-08",
"description": "BIG-IP Tenant Cryptographic Module, Application Delivery Controller and Firewall software running on running on F5 hardware and the underlying platform layer.",
"embodiment": "MultiChipStand",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "BIG-IP Tenant Cryptographic Module",
"module_type": "Firmware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-07-09",
"lab": "atsec information security corporation",
"validation_type": "Initial"
}
],
"vendor": "F5, Inc.",
"vendor_url": "f5.com"
}
}