Motorola P25 KVL 7000 HSM

Certificate details

Certificate ID	#5549
Status	active
Validation dates	09.10.2026
Sunset date	08-10-2031
Standard	FIPS 140-3
Security level	2
Type	Hardware
Embodiment	SingleChip
Caveat	When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions	Roles, services, and authentication: Level 3 Software/Firmware security: Level 3 Operational environment: N/A Physical security: Level 3 Non-invasive security: N/A Life-cycle assurance: Level 3 Mitigation of other attacks: N/A
Description	The Module generates, loads and manages encryption and authentication keys securely into communication products directly from the palm of your hand. The KVL 7000 integrates with the Key Management Facility (KMF) by provisioning radios and consoles for centralized key management.
Vendor	Motorola Solutions Inc. http://www.motorolasolutions.com
Lab	Leidos Accredited Testing & Evaluation (AT&E) Lab
Algorithms	AES-CBCA7819 AES-CFB128A7818 AES-CFB8A7819 AES-CTRA7818 AES-ECBA7819 AES-GCMA7819 AES-GMACA7819 AES-KWA8087 AES-OFBA7819 Counter DRBGA8088 ECDSA SigVer (FIPS186-5)A8089 RSA SigVer (FIPS186-5)A5253 SHA2-256SHS 817 SHA2-384A8090
References	This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.
Webpage
Security policy

Security policy PDF TXT
Extracted keywords

Symmetric Algorithms

AES, AES128, AES256, AES-, AES-256, AES-128, CAST
Asymmetric Algorithms

RSA-2048, ECDSA, ECC
Hash functions

SHA2
Randomness

DRBG, RNG, RBG
Elliptic Curves

P-384
Block cipher modes

ECB, CBC, CTR, CFB, OFB, GCM
Trusted Execution Environments

PSP
Security level

Level 3, Level 2, level 2, level 3
Standards

FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 180-4, FIPS18, FIPS140-3, FIPS PUB 140-3, SP 800-38A, SP 800-38D, SP 800-38F, SP 800-90A, ISO/IEC 19790, ISO/IEC 24759
Creation date	D:20261006071329-04'00'
Modification date	D:20261006071329-04'00'
Pages	44
Creator	Microsoft® Word for Microsoft 365
Producer	Microsoft® Word for Microsoft 365
Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.
No automatically derived data are available in this section.
Cross-references

No references are available for this certificate.
Processing updates

12.10.2026

The certificate was first processed.
Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5549,
  "dgst": "b996521be9c996db",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A8087",
        "#A7817",
        "SHA2-384A8090",
        "#A8089",
        "AES-CFB128A7818",
        "#A5253",
        "AES-CBCA7819",
        "AES-GMACA7819",
        "#A8088",
        "AES-ECBA7819",
        "#A7819",
        "AES-GCMA7819",
        "AES-OFBA7819",
        "Counter DRBGA8088",
        "#A8090",
        "ECDSA SigVer (FIPS186-5)A8089",
        "AES-CFB8A7819",
        "SHA2-256SHS 817",
        "RSA SigVer (FIPS186-5)A5253",
        "AES-CTRA7818",
        "AES-KWA8087",
        "#A7818"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "7000"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC, AES-CFB128, AES-CFB8, AES-CTR, AES- ECB, AES-OFB",
            "cavpCertName": "A7818, A7819",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CBC, AES-CTR, AES- ECB, AES-OFB",
            "cavpCertName": "A7817",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM, AES-GMAC",
            "cavpCertName": "A7817",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1, 8.2.2 Key Length - 128",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM, AES-GMAC",
            "cavpCertName": "A7818, A7819",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1, 8.2.2 Key Length - 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A8087",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A8088",
            "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 256, 1024 Nonce - Nonce: 128, 512 Personalization String Length - Personalization String Length: 256, 512 Returned Bits - 128",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A8089",
            "properties": "Curve - P-384 Hash Algorithm - SHA2-384",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A5253",
            "properties": "Modulo - 2048 Signature Type - pkcs1v1.5",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "SHS 817",
            "properties": "Message Length - Message Length: 0-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256, SHA2-384",
            "cavpCertName": "A8090",
            "properties": "Message Length - Message Length: 8-2048 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Change current Crypto- Officer password.",
            "indicator": "Succes s or Fail",
            "inputs": "Password",
            "name": "Change CO Passwor d",
            "outputs": "Successful change the password will allow access to the services allowed for CO role.",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - CO PWD (AM): W,E,Z - IEK: E,Z - KPK: Z - PWD Hash: G,E,Z",
            "secFunImpl": "Common- SHA2 KTS-GCM"
          },
          {
            "description": "Change current User password.",
            "indicator": "Succes s or Fail",
            "inputs": "Password",
            "name": "Change User Passwor d",
            "outputs": "Successful change the password will allow access to the services allowed for User role.",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - IEK: E,Z - KPK: Z - PWD Hash: G,E,Z - User PWD (AM): W,E,Z",
            "secFunImpl": "Common- SHA2 KTS-GCM"
          },
          {
            "description": "Configure target device and retrieve key",
            "indicator": "Succes s or Fail",
            "inputs": "Command In",
            "name": "Configur e and Query Target Device",
            "outputs": "Target device information or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E - BKK: E - DRBG",
            "secFunImpl": "A7819 Encryption A7819 Authenticat"
          },
          {
            "description": "metadata and versions from the target device.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E User - AES-GCM IV : G,E - BKK: E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E",
            "secFunImpl": "ed RNG"
          },
          {
            "description": "Configure the module.",
            "indicator": "Succes s or Fail",
            "inputs": "Configurati on parameters",
            "name": "Configur e KVL",
            "outputs": "Updated module configuratio n, or failure.",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - CO PWD (AM): W,E,Z - IEK: W,E,Z - KPK: G,Z - PWD Hash: G,E,Z - User PWD (AM): W,E,Z",
            "secFunImpl": "Common- SHA2 KTS-GCM RNG"
          },
          {
            "description": "Decrypt Ciphertext data",
            "indicator": "Succes s or Fail",
            "inputs": "Ciphertext",
            "name": "Decrypt",
            "outputs": "Plaintext (success) or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - KEK: W,E,Z - KPK: E - TEK: W,E,Z User - AES-GCM IV : E - KEK: W,E,Z - KPK: E - TEK: W,E,Z",
            "secFunImpl": "A7817 Authenticat ed A7817 Decryption A7818 Authenticat ed A7818 Decryption A7819 Authenticat ed A7819"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "Decryption KTS-GCM"
          },
          {
            "description": "Encrypt plaintext data",
            "indicator": "Succes s or Fail",
            "inputs": "Plaintext",
            "name": "Encrypt",
            "outputs": "Ciphertext (success) or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: W,E,Z - KPK: E - TEK: W,E,Z User - AES-GCM IV : G,E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: W,E,Z - KPK: E - TEK: W,E,Z",
            "secFunImpl": "A7817 Encryption A7817 Authenticat ed A7818 Encryption A7818 Authenticat ed A7819 Encryption A7819 Authenticat ed RNG KTS-GCM"
          },
          {
            "description": "Reset the module to factory default",
            "indicator": "Succes s or Fail",
            "inputs": "Command In.",
            "name": "Factory Reset",
            "outputs": "Success or Fail",
            "rolesSspAccess": "Crypto Officer - BKK: Z - CO PWD (AM): Z - IEK: Z - KPK: Z - PWD Hash: Z - User PWD (AM): Z Unauthenticat ed - BKK: Z - CO PWD (AM): Z",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- IEK: Z - KPK: Z - PWD Hash: Z - User PWD (AM): Z User - BKK: Z - CO PWD (AM): Z - IEK: Z - KPK: Z - PWD Hash: Z - User PWD (AM): Z",
            "secFunImpl": ""
          },
          {
            "description": "Generate TEK/KEK",
            "indicator": "Succes s or Fail",
            "inputs": "Command In",
            "name": "Generat e Key",
            "outputs": "Encrypted keys (Success) or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: G,R - KPK: E - TEK: G,R User - AES-GCM IV : G,E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: G,R - KPK: E - TEK: G,R",
            "secFunImpl": "RNG KeyGen KTS-GCM"
          },
          {
            "description": "Generate random number",
            "indicator": "Succes s or Fail",
            "inputs": "Command In",
            "name": "Generat e Random Number",
            "outputs": "Random number or failure",
            "rolesSspAccess": "Crypto Officer - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: G,E - DRBG- nonce: G,E Unauthenticat ed - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: G,E - DRBG- nonce: G,E User - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: G,E - DRBG-",
            "secFunImpl": "RNG Entropy"
          },
          {
            "description": "Check the validity of a given key",
            "indicator": "Succes s or Fail",
            "inputs": "Encrypted key",
            "name": "Key Check",
            "outputs": "Success or failure",
            "rolesSspAccess": "nonce: G,E Crypto Officer - AES-GCM IV : E - KPK: E - KEK: W - TEK: W User - AES-GCM IV : E - KPK: E - KEK: W - TEK: W",
            "secFunImpl": "KTS-GCM"
          },
          {
            "description": "Combinati on of receive",
            "indicator": "Succes s or Fail",
            "inputs": "Command In",
            "name": "Key Sharing",
            "outputs": "Success or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E",
            "secFunImpl": "RNG KTS-GCM"
          },
          {
            "description": "and transfer TEK/KEK between two KVLs.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: R,W - KPK: E - TEK: R,W User - AES-GCM IV : G,E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: R,W - KPK: E - TEK: R,W",
            "secFunImpl": ""
          },
          {
            "description": "Validate current Crypto- Office passwords .",
            "indicator": "Succes s or Fail",
            "inputs": "Password",
            "name": "Login CO",
            "outputs": "Successful authenticati on will allow access to the services allowed for CO role.",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - CO PWD (AM): W,E,Z - IEK: E,Z - KPK: Z - PWD Hash: G,E,Z",
            "secFunImpl": "Common- SHA2 KTS-GCM"
          },
          {
            "description": "Validate current User passwords .",
            "indicator": "Succes s or Fail",
            "inputs": "Password",
            "name": "Login User",
            "outputs": "Successful authenticati on will allow access to the services allowed for User role.",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - IEK: E,Z - KPK: Z - PWD Hash: G,E,Z - User PWD (AM): W,E,Z",
            "secFunImpl": "Common- SHA2 KTS-GCM"
          },
          {
            "description": "Query module firmware, hardware version.",
            "indicator": "Succes s or Fail",
            "inputs": "Command In.",
            "name": "Module Info",
            "outputs": "HSM Firmware version; Hardware information and FIPS status",
            "rolesSspAccess": "Crypto Officer Unauthenticat ed User",
            "secFunImpl": "None"
          },
          {
            "description": "Power on the module",
            "indicator": "Succes s or Fail",
            "inputs": "N/A",
            "name": "Power On",
            "outputs": "Module is powered on",
            "rolesSspAccess": "Unauthenticat ed - RSA FW-LD- Pub: E",
            "secFunImpl": "SigVer1"
          },
          {
            "description": "Update the module firmware.",
            "indicator": "Succes s or Fail",
            "inputs": "Firmware image",
            "name": "Program Update",
            "outputs": "The module is upgraded to new firmware",
            "rolesSspAccess": "Crypto Officer - CO PWD (AM): Z - ECC FW-LD- Pub: E - IEK: Z - KPK: Z - PWD Hash: Z - User PWD (AM): Z",
            "secFunImpl": "SHA SigVer2"
          },
          {
            "description": "Receive TEK/KEK from KVL or KVL Host",
            "indicator": "Succes s or Fail",
            "inputs": "TEK/KEK",
            "name": "Receive Key",
            "outputs": "Encrypted keys (Success) or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : E - IEK: E - KEK: W - KPK: E - TEK: W User - AES-GCM IV : E - IEK: E - KEK: W - KPK: E - TEK: W",
            "secFunImpl": "KTS-GCM"
          },
          {
            "description": "Receive TEK/KEK from the KMF into the module (store), and then transfer them to the target device (forward).",
            "indicator": "Succes s or Fail",
            "inputs": "TEK/KEK",
            "name": "Store and Forward",
            "outputs": "Encrypted TEK/KEK (Success) or failure",
            "rolesSspAccess": "Crypto Officer - BKK: E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: G,E",
            "secFunImpl": "A7819 Encryption RNG KTS-GCM KTS-KW"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- KEK: R,W - KPK: E - TEK: R,W User - BKK: E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: G,E - DRBG- nonce: G,E - KEK: R,W - KPK: E - TEK: R,W",
            "secFunImpl": ""
          },
          {
            "description": "Transfer keys to target device.",
            "indicator": "Succes s or Fail",
            "inputs": "TEK/KEK",
            "name": "Transfer Key",
            "outputs": "Success or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E - BKK: E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E - KEK: R - KPK: E - TEK: R User - AES-GCM IV : G,E - BKK: E - DRBG Internal State - Key: G,E - DRBG Internal State - V: G,E - DRBG- EI/Seed: E - DRBG- nonce: E",
            "secFunImpl": "A7819 Encryption RNG KTS-GCM"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- KEK: R - KPK: E - TEK: R",
            "secFunImpl": ""
          },
          {
            "description": "Zeroize keys in the target device",
            "indicator": "Succes s or Fail",
            "inputs": "Command In",
            "name": "Zeroize Key",
            "outputs": "Success or failure",
            "rolesSspAccess": "Crypto Officer - AES-GCM IV : G,E - BKK: E - DRBG Internal State - Key: E - DRBG Internal State - V: E - DRBG- EI/Seed: E - DRBG- nonce: E User - AES-GCM IV : G,E - BKK: E - DRBG Internal State - Key: E - DRBG Internal State - V: E - DRBG- EI/Seed: E - DRBG- nonce: E",
            "secFunImpl": "A7819 Authenticat ed A7819 Encryption RNG"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "Identity-based. The password length is a minimum of 15 characters using any combination of ASCII printable characters and is padded to a 30-byte long hexadecimal number. After authenticating, the KVL user may change it any time through the SSI Port.",
            "mechanism": "SHA2-256 (A8090)",
            "name": "AM",
            "perMinute": "The Module limits the number of consecutive failed authentication attempts to a configurable number (Minimum 3, maximum 20). Upon exceeding the maximum number of login attempts, the module can be configured to either lock the device from further login attempts for a specified amount of time (configurable by the CO between 1- 30 minutes), or execute the Factory Reset service. The minimum probability of a successful random attempt during a one-",
            "strength": "Since the password length is a minimum of 15 characters using any combination of ASCII printable characters and is padded to a 30- byte long hexadecimal number; the probability of a successful random attempt is 1 in 95^15"
          },
          {
            "description": "",
            "mechanism": "",
            "name": "",
            "perMinute": "minute period is 20 in 95^15",
            "strength": ""
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-128 AES- CBC Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- CBC Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- CTR Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES-",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "CTR Encrypt",
            "condition": "",
            "details": "",
            "indicator": "ES1 on failure",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "AES-128 AES- ECB Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- ECB Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- GCM Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- GCM Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- OFB Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-128 AES- OFB Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-128",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- CBC Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- CBC Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- CTR Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- CTR Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- ECB Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- ECB Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- GCM Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- GCM Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- OFB Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-256 AES- OFB Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-Key Unwrap",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-Key Wrap",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- CBC Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- CBC Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- CFB8 Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES-",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "CFB8 Encrypt",
            "condition": "",
            "details": "",
            "indicator": "",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "AES256- Internal AES- ECB Decrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- ECB Encrypt",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- GCM Decrypti on",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- GCM Encrypt",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- OFB Decrypti on",
            "condition": "Bootup",
            "details": "Decrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES256- Internal AES- OFB Encrypti on",
            "condition": "Bootup",
            "details": "Encrypt",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A8088)",
            "condition": "Bootup",
            "details": "SP 800-90Arev1 Instantiate/Generate/Re seed Known Answer Tests",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256 CTR",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS18 6-5)",
            "condition": "Bootup",
            "details": "Verify",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "ECDSA P- 384 SigVer",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy E132 - Start-up",
            "condition": "Bootup",
            "details": "An RCT and APT as specified in [90B] section 4.4 are executed",
            "indicator": "Succes s or ES3 on failure",
            "testMethod": "Fault Detecti on",
            "testProps": "Start-up RCT and APT",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "RCT and APT",
            "condition": "",
            "details": "before generation of the DRBG entropy input",
            "indicator": "",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "Firmwar e Load",
            "condition": "loading a new firmware image",
            "details": "Verify the image by ECDSA P-384 upon download into the module.",
            "indicator": "Succes s or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "ECDSA P- 384 SigVer/SHA 2-384",
            "type": "SW/F W Load"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS18 6-5)",
            "condition": "Bootup",
            "details": "Verify",
            "indicator": "Succes s or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "RSA-2048 SigVer",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2- 256 (A8090)",
            "condition": "Bootup",
            "details": "Hash",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2- 256 (SHS 817)",
            "condition": "Bootup",
            "details": "Hash",
            "indicator": "Succes s or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2- 384 (A8090)",
            "condition": "Bootup",
            "details": "Hash",
            "indicator": "Succes s or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-384",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "The Module enters the critical error state, stores the status in non-volatile memory, and halts all further operations by entering an infinite loop.",
            "description": "The Module fails a KAT.",
            "indicator": "The Module will not respond to any requests.",
            "name": "ES1",
            "recoveryMethod": "Reboot or power cycle the Module."
          },
          {
            "conditions": "Following a firmware signature validation failure, the Module ceases normal operations and transitions to flash programming mode.",
            "description": "The Module fails a firmware loading during program upgrade and/or firmware integrity pre-operational self- test.",
            "indicator": "The Module will not respond to any requests.",
            "name": "ES2",
            "recoveryMethod": "Reboot or power cycle the module or re-flashing a new image."
          },
          {
            "conditions": "The Module enters the Fatal Error state.",
            "description": "The Module fails to acquire Entropy.",
            "indicator": "The Module stores the status into the internal flash memory and resets to attempt recovery.",
            "name": "ES3",
            "recoveryMethod": "Automatic"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "Periodically",
            "inspectGuidance": "Look for signs of tampering. Remove from service if tampering found.",
            "mechanism": "Covered with a hard-opaque epoxy coating that provides evidence of attempts to tamper with the KVL 7000 HSM (MACE)"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "This is the interface to the KVL 7000 Host Application. All SSPs exchanged over this interface are always encrypted.",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "Synchronous Serial Interface (SSI)"
          },
          {
            "data": "",
            "logicalInterface": "Control Input Status Output",
            "physicalPort": ""
          },
          {
            "data": "This is the interface to external devices. All SSPs exchanged over this interface are either encrypted or in plaintext when operating in approved mode.",
            "logicalInterface": "Data Input Data Output Control Input",
            "physicalPort": "KYLD (Keyload) Interface"
          },
          {
            "data": "Clock input.",
            "logicalInterface": "Control Input",
            "physicalPort": "Clock"
          },
          {
            "data": "This interface powers all circuitry.",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "AM",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "AM",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "3",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "3",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Firmware integrity",
            "details": "A digital signature is generated over the Boot Block, Base firmware, and all Drop-In Algorithms when it is built using RSA-2048 (Cert. # #A5253) SHA2-256 (Cert. #SHS817), and is stored with the code upon download into the Module.",
            "indicator": "Success or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "RSA-2048 (Cert. #A5253),SHA2- 256 (Cert. #SHS817)",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Host Software (outside)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted on KPK (I2)",
            "sfiAlgo": "KTS-GCM",
            "source": "Flash Memory (S2)"
          },
          {
            "dest": "Flash Memory (S2)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted on the IEK (I1)",
            "sfiAlgo": "KTS-GCM",
            "source": "Host Software (outside)"
          },
          {
            "dest": "Flash Memory (S2)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Input in plaintext (I3)",
            "sfiAlgo": "",
            "source": "Another KVL (outside)"
          },
          {
            "dest": "Target device (outside)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output encrypted on BKK (O1)",
            "sfiAlgo": "KTS-GCM",
            "source": "Flash Memory (S2)"
          },
          {
            "dest": "Target device (outside)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output encrypted on BKK (O2)",
            "sfiAlgo": "A7819 Encryption",
            "source": "Flash Memory (S2)"
          },
          {
            "dest": "KVL Host (outside)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output encrypted on KPK (O3)",
            "sfiAlgo": "KTS-GCM",
            "source": "Flash Memory (S2)"
          },
          {
            "dest": "Target device (outside)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Output in plaintext (O4)",
            "sfiAlgo": "",
            "source": "Flash Memory (S2)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroized by module power cycle or hard reset.",
            "method": "Z1",
            "operatorId": "Yes",
            "rationale": "SSPs in volatile memory zeroized."
          },
          {
            "description": "Zeroized by the \"Program Update\" service.",
            "method": "Z2",
            "operatorId": "Yes",
            "rationale": "SSPs zeroized upon loading of new firmware."
          },
          {
            "description": "Zeroized by the \"Configure KVL\" service.",
            "method": "Z3",
            "operatorId": "Yes",
            "rationale": "CO zeroizes the module when configuring into an Approved mode."
          },
          {
            "description": "Zeroized by the \"Login CO Password\" service.",
            "method": "Z4",
            "operatorId": "Yes",
            "rationale": "CO password zeroized after too many failed login attempts."
          },
          {
            "description": "Zeroized by the \"Change CO Password\" service.",
            "method": "Z5",
            "operatorId": "Yes",
            "rationale": "CO password zeroized after too many failed attempts."
          },
          {
            "description": "Zeroized by the \"Login User Password\" service.",
            "method": "Z6",
            "operatorId": "Yes",
            "rationale": "User password zeroized after too many failed login attempts."
          },
          {
            "description": "Zeroized by the \"Change User Password\" service.",
            "method": "Z7",
            "operatorId": "Yes",
            "rationale": "User password zeroized after too many failed attempts."
          },
          {
            "description": "Zeroized by the \"Factory Reset\" service.",
            "method": "Z8",
            "operatorId": "Yes",
            "rationale": "CO or User performs factory reset of the module."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Stored in the flash in plaintext, associated by memory location (pointer).",
            "name": "Flash Memory (S2)",
            "persistance": "Static"
          },
          {
            "description": "Stored in the volatile memory (RAM).",
            "name": "System Memory (S1)",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "",
            "fwVersion": "R70.01.01",
            "hwVersion": "5185912",
            "modelPartNum": "5185912T05",
            "processors": "MACE #5185912 family"
          },
          {
            "features": "",
            "fwVersion": "Base FW Version",
            "hwVersion": "Algorithm FW Version",
            "modelPartNum": "Algorithm*",
            "processors": "Cert. #"
          },
          {
            "features": "",
            "fwVersion": "R70.01.01",
            "hwVersion": "R01.00.06",
            "modelPartNum": "AES128",
            "processors": "A7817"
          },
          {
            "features": "",
            "fwVersion": "R70.01.01",
            "hwVersion": "R01.00.09",
            "modelPartNum": "AES256",
            "processors": "A7818"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type :AES 128 Symmetric Key Type :AES 256 Symmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "SP800-133rev2 Section4, example 1 and IG D.H"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 3
          },
          "ECDSA": {
            "ECDSA": 10
          }
        },
        "RSA": {
          "RSA-2048": 3
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 7
        },
        "CFB": {
          "CFB": 1
        },
        "CTR": {
          "CTR": 9
        },
        "ECB": {
          "ECB": 9
        },
        "GCM": {
          "GCM": 14
        },
        "OFB": {
          "OFB": 8
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {},
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-384": 6
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES-128": 30,
          "AES-256": 47,
          "AES128": 1,
          "AES256": 1,
          "SHA2": 8,
          "SHA2- 256": 3,
          "SHA2- 384": 1,
          "SHA2-256": 9,
          "SHA2-384": 4,
          "SHS 817": 4
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 7,
          "Level 3": 3,
          "level 2": 1,
          "level 3": 3
        }
      },
      "hash_function": {
        "SHA": {
          "SHA2": {
            "SHA2": 8
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 58
        },
        "RNG": {
          "RBG": 3,
          "RNG": 15
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 8,
          "FIPS 180-4": 2,
          "FIPS 186-5": 2,
          "FIPS PUB 140-3": 1,
          "FIPS140-3": 1,
          "FIPS18": 2,
          "FIPS186-5": 6
        },
        "ISO": {
          "ISO/IEC 19790": 2,
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "SP 800-38A": 2,
          "SP 800-38D": 2,
          "SP 800-38F": 1,
          "SP 800-90A": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 9,
            "AES-": 13,
            "AES-128": 30,
            "AES-256": 46,
            "AES128": 1,
            "AES256": 1
          },
          "CAST": {
            "CAST": 77
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 4
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-ECBA7819",
        "AES-CFB8A7819",
        "AES-CBCA7819",
        "SHA2-256SHS 817",
        "SHA2-384A8090",
        "AES-GMACA7819",
        "RSA SigVer (FIPS186-5)A5253",
        "AES-GCMA7819",
        "AES-CTRA7818",
        "AES-OFBA7819",
        "AES-KWA8087",
        "AES-CFB128A7818",
        "Counter DRBGA8088",
        "ECDSA SigVer (FIPS186-5)A8089"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A8087",
        "#A7817",
        "#A7819",
        "#A8088",
        "#A8089",
        "#A7818",
        "#A8090",
        "#A5253"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261006071329-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261006071329-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 957040,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 44
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "1a9b2eda2c0d4be38d710f4f8e4af612a20c13d441033230ed7c3dcb9287629b",
      "source_hash": "82b835429f18e74f96dfc753dd12f4f372aeb2d203d2f260c7f4352028432803",
      "txt_hash": "410b10ce5c4f6ea564e3c6649a1345ee0cd71bb76dbec4a36c690cffe3de5dd3"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-08",
    "description": "The Module generates, loads and manages encryption and authentication keys securely into communication products directly from the palm of your hand. The KVL 7000 integrates with the Key Management Facility (KMF) by provisioning radios and consoles for centralized key management.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Software/Firmware security: Level 3",
      "Operational environment: N/A",
      "Physical security: Level 3",
      "Non-invasive security: N/A",
      "Life-cycle assurance: Level 3",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Motorola P25 KVL 7000 HSM",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-09",
        "lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Motorola Solutions Inc.",
    "vendor_url": "http://www.motorolasolutions.com"
  }
}
Sections

Motorola P25 KVL 7000 HSM

Certificate details

Security policy

Extracted keywords

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Randomness

Elliptic Curves

Block cipher modes

Trusted Execution Environments

Security level

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

New certificate

Raw data

Sections

Motorola P25 KVL 7000 HSM

Certificate details

Security policy

Extracted keywords

Cryptography

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Randomness

Elliptic Curves

Block cipher modes

Device

Trusted Execution Environments

Security

Security level

Other

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Raw data

Toggle raw data
