Astro Subscriber Motorola Advanced Crypto Engine (MACE) - Security Level 2

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5531,
  "dgst": "bcd7dddaf951959e",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#817",
        "AES-GCMA2262",
        "HMAC-SHA2-384HMAC 1796",
        "RSA SigVer (FIPS186-2)RSA 396",
        "#A5253",
        "#A2266",
        "#A655",
        "#A2264",
        "#A6380",
        "ECDSA KeyGen (FIPS186-4)A655",
        "#A2260",
        "AES-CBCA2262",
        "#A2263",
        "AES-ECBA2262",
        "AES-OFBA2262",
        "SHA2-384SHS 2399",
        "AES-CFB8A2260",
        "#A2262",
        "SHA2-256SHS 817",
        "Counter DRBGA6380",
        "RSA SigVer (FIPS186-5)A5253",
        "KAS-ECC Sp800-56Ar3A2266",
        "#A2261",
        "#396",
        "AES-KWA2264"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "2"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 1,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC, AES-CFB8, AES-ECB, AES-OFB",
            "cavpCertName": "A2261, A2262, A2260",
            "properties": "Direction - Decrypt, Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A2262",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 256-512 Increment 128 AAD Length - AAD Length: 256-512 Increment 128",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A2263",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 256 Payload Length - Payload Length: 128-256 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A2264",
            "properties": "Direction - Decrypt Cipher - Cipher Key Length - 256 Payload Length - Payload Length: 128-256 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A6380",
            "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 256-1024 Increment 128 Nonce - Nonce: 128-512 Increment 128 Personalization String Length - Personalization",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "String Length: 0 Returned Bits - 128",
            "reference": ""
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-4)",
            "cavpCertName": "A655",
            "properties": "Curve - P-384 Secret Generation Mode - Extra Bits",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "HMAC 1796",
            "properties": "Key sizes \u003c block size - Yes Key sizes \u003e block size - No Key size = block size - No",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC Sp800- 56Ar3",
            "cavpCertName": "A2266",
            "properties": "Domain Parameter Generation Methods - P-384 Function - Key Pair Generation, Partial Validation iutId - A1B2C3D4E5 Scheme - ephemeralUnified - KAS Role - Initiator, Responder KDF Methods - oneStepKdf - Auxiliary Function Methods - Auxiliary Function Name - SHA2-384 Fixed Info Pattern - algorithmId||l||uPartyInfo||vPartyInfo Fixed Info Encoding - Concatenation Key Length - 384",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "RSA SigVer (FIPS186- 2)",
            "cavpCertName": "RSA 396",
            "properties": "Signature Type - PKCS 1.5 Modulo - 2048 Hash Pair - Hash Algorithm - SHA2-256",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186- 5)",
            "cavpCertName": "A5253",
            "properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048 Signature Type - pkcs1v1.5 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "SHS 817",
            "properties": "Message Length - Message Length: 0-51200 Increment 8 Supports Bit-Oriented Messages - No Supports Empty Message - Yes",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "SHS 2399",
            "properties": "Message Length - Message Length: 8-102400 Increment 8 Supports Bit-Oriented Messages - No Supports Empty Message - No",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Modify the currently active keyset used for selecting keys for encryption/decry ption services.",
            "indicator": "Approv ed mode",
            "inputs": "Keyset Index",
            "name": "Change Active Keyset",
            "outputs": "Changed the active keyset as requested. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Modify the current password used to identify and authenticate the CCO role using AM1.",
            "indicator": "Approv ed mode indicato r and service status output",
            "inputs": "Password",
            "name": "Change CCO Password (AM1)",
            "outputs": "Updated the CCO password. Success/fail ure status.",
            "rolesSspAccess": "Configuration Crypto Officer - CCO PWD (AM1): Z - KEK: Z - PEK: E - PWD Hash: W,Z - TEK: Z",
            "secFunImpl": "A2260 Decryption SHS817 KTS3"
          },
          {
            "description": "Modify the current password used to identify and authenticate the OCO role using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Password",
            "name": "Change OCO Password (AM2)",
            "outputs": "Updated the OCO password. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - KEK: Z - KPK: G,E,Z - OCO PWD (AM2): Z - PEK: E - PWD Hash: W,Z",
            "secFunImpl": "A2260 Encryption A2260 Decryption KeyGen1 SHS817"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- TEK: Z - UKKPK: E",
            "secFunImpl": ""
          },
          {
            "description": "Clears the history of error events",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Clear Error Log",
            "outputs": "Success/Fail ure status.",
            "rolesSspAccess": "Configuration Crypto Officer Operational Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Decrypt digital voice or data using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Ciphertext",
            "name": "Decrypt",
            "outputs": "Plaintext. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - KPK: E - TEK: E",
            "secFunImpl": "A2260 Decryption A2261 Decryption A2262 Decryption A2262 Authentica ted Decryption KTS2"
          },
          {
            "description": "Encrypt digital voice or data using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Plaintext",
            "name": "Encrypt",
            "outputs": "Ciphertext. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - DRBG- EI/Seed: E - DRBG-State: E - KPK: E - TEK: E",
            "secFunImpl": "A2260 Encryption A2261 Encryption A2262 Authentica ted Encryption A2262 Encryption KTS2"
          },
          {
            "description": "Provide the history of error events.",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Extract Error Log",
            "outputs": "Error logs out. Success/Fail ure status.",
            "rolesSspAccess": "Configuration Crypto Officer Operational Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Generate Entropy for use inside the MACE",
            "indicator": "Approv ed mode",
            "inputs": "Power On",
            "name": "Generate Entropy",
            "outputs": "DRBG Seed",
            "rolesSspAccess": "Unauthentica ted - DRBG- EI/Seed: G - DRBG- nonce: G",
            "secFunImpl": "Entropy RNG"
          },
          {
            "description": "Generate Asymmetric keys",
            "indicator": "Approv ed mode",
            "inputs": "Command in",
            "name": "Generate Keypair",
            "outputs": "Key stored inside Module,",
            "rolesSspAccess": "Operational Crypto Officer",
            "secFunImpl": "A2263 Encryption"
          },
          {
            "description": "within the module using AM2.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "Success/Fail status.",
            "rolesSspAccess": "- BKK: E - DH-Priv: G - DH-Pub: G - DRBG-State: G,E - PKPK: E",
            "secFunImpl": "KeyGen2 KAS"
          },
          {
            "description": "Generate HMAC- SHA2-384 signature",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Generate Signature",
            "outputs": "Signature, Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - KPK: E - TEK: E",
            "secFunImpl": "A2260 Encryption A2260 Decryption SHS2399 HMAC"
          },
          {
            "description": "Imports keys into the MACE in plaintext using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Ciphertext",
            "name": "Import Keys Over KYLD Interface",
            "outputs": "Key Stored inside the Module. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - KEK: W,Z - KPK: E - TEK: W,Z",
            "secFunImpl": "A2260 Encryption A2260 Decryption"
          },
          {
            "description": "Obtain status information about a specific key",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Key/Keyset Check",
            "outputs": "Status information for key returned. Success/Fail ure Status",
            "rolesSspAccess": "Operational Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Provide module version, firmware version, FIPS status",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "MACE Status",
            "outputs": "Module HW version, Firmware version, and FIPS status",
            "rolesSspAccess": "Unauthentica ted",
            "secFunImpl": "None"
          },
          {
            "description": "Set configuration parameters used to specify module behavior using AM1 or AM2",
            "indicator": "Approv ed mode",
            "inputs": "Configurati on parameter s",
            "name": "Module Configurati on",
            "outputs": "Updated module configuratio n. Success/fail ure status.",
            "rolesSspAccess": "Configuration Crypto Officer - CCO PWD (AM1): Z - KEK: Z - KPK: G,Z - PWD Hash: Z - TEK: Z - UKKPK: E Operational Crypto Officer - KEK: Z - KPK: G,Z",
            "secFunImpl": "KeyGen1"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- OCO PWD (AM2): Z - PWD Hash: Z - TEK: Z - UKKPK: E",
            "secFunImpl": ""
          },
          {
            "description": "Perform on demand self- testing of algorithms within the MACE.",
            "indicator": "Approv ed Mode",
            "inputs": "Command In",
            "name": "On Demand Self Tests",
            "outputs": "Success/Fail ure status",
            "rolesSspAccess": "Operational Crypto Officer",
            "secFunImpl": "A2260 Decryption A2260 Encryption A2261 Decryption A2261 Encryption A2262 Authentica ted Decryption A2262 Authentica ted Encryption A2262 Decryption A2262 Encryption A2263 Decryption A2263 Encryption HMAC KAS KeyGen1 KeyGen2 KTS1 KTS2 KTS3 SHS2399 SHS817 SigVer1 SigVer2 (Legacy)"
          },
          {
            "description": "Perform a key agreement process to create",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Perform Key Agreement Process",
            "outputs": "Generate Keys stored in the Module.",
            "rolesSspAccess": "Operational Crypto Officer - BKK: E",
            "secFunImpl": "A2261 Encryption A2261 Decryption"
          },
          {
            "description": "an ECDH Shared Secret using AM2.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "Success/fail ure status",
            "rolesSspAccess": "- DH-CLI-Pub: W,E - DH-Priv: E - DH-SS: G,E - DRBG-State: G,E - PKPK: E",
            "secFunImpl": "A2262 Encryption A2262 Decryption KeyGen2 RNG KAS"
          },
          {
            "description": "Import, modify and query the keys using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Ciphertext",
            "name": "Privileged APCO OTAR",
            "outputs": "Store Keys internal to the Module. Success/Fail ure Indication.",
            "rolesSspAccess": "Operational Crypto Officer - DH-SS: - KEK: W,E - KPK: E - TEK: W,E",
            "secFunImpl": "KTS1 KTS2 OTAR AES MAC"
          },
          {
            "description": "Update the MACE firmware. Firmware upgrades are authenticated using a digital signature. The Program Update Public Signature Key is used to validate the signature of the firmware image being loaded before it is allowed to be executed.",
            "indicator": "Approv ed mode",
            "inputs": "Firmware image",
            "name": "Program Update",
            "outputs": "The MACE is upgraded to new firmware.",
            "rolesSspAccess": "Configuration Crypto Officer - BKK: Z - CCO PWD (AM1): Z - DH-CLI-Pub: Z - DH-Priv: Z - DH-Pub: Z - DH-SS: Z - DRBG- EI/Seed: Z - DRBG- nonce: Z - DRBG-State: Z - FW-LD-Pub: E,Z - IDK: E,Z - IDK Block: E,Z - KEK: Z - KPK: Z - PEK: Z - PKPK: Z - PWD Hash: Z - TEK: Z - UKKPK: Z Operational Crypto",
            "secFunImpl": "A2261 Decryption A2262 Decryption SigVer1 SigVer2 (Legacy)"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Officer - BKK: Z - DH-CLI-Pub: Z - DH-Priv: Z - DH-Pub: Z - DH-SS: Z - DRBG- EI/Seed: Z - DRBG- nonce: Z - DRBG-State: Z - FW-LD-Pub: E,Z - IDK: E,Z - IDK Block: E,Z - KEK: Z - KPK: Z - OCO PWD (AM2): Z - PEK: Z - PKPK: Z - PWD Hash: Z - TEK: Z",
            "secFunImpl": ""
          },
          {
            "description": "Reset/power cycle the MACE.",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Reset",
            "outputs": "Reset the MACE.",
            "rolesSspAccess": "- UKKPK: Z Unauthentica ted - DH-CLI-Pub: Z - DH-SS: Z - DRBG- EI/Seed: Z - DRBG- nonce: Z - DRBG-State:",
            "secFunImpl": "RNG KAS"
          },
          {
            "description": "Perform module self-tests comprised of cryptographic algorithm tests, firmware integrity test, and critical",
            "indicator": "Approv ed mode indicato r and service",
            "inputs": "Power on/Comma nd In",
            "name": "Self-Tests",
            "outputs": "Success/Res et.",
            "rolesSspAccess": "Z Unauthentica ted - FW-LD-Pub: E",
            "secFunImpl": "A2260 Decryption A2260 Encryption A2261 Decryption A2261"
          },
          {
            "description": "Description",
            "indicator": "Indicat or",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security"
          },
          {
            "description": "functions test. Initiated by module reset or transition from power off state to power on state using UA.",
            "indicator": "status output",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": "Functions Encryption A2262 Authentica ted Decryption A2262 Authentica ted Encryption A2262 Decryption A2262 Encryption A2263 Decryption A2263 Encryption Entropy KAS KeyGen1 KTS1 KTS2 SHS2399 SHS817 SigVer1 SigVer2 (Legacy)"
          },
          {
            "description": "Generate symmetric [135] keys within the Module using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Command in",
            "name": "Symmetric Key Generatio n",
            "outputs": "Key Stored inside Module. Success/fail ure status",
            "rolesSspAccess": "Operational Crypto Officer - BKK: E - DRBG-State: G,E - IDK: G,Z - IDK Block: E,Z - IDK ROM: E,Z - KPK: G,Z",
            "secFunImpl": "A2261 Encryption A2261 Decryption A2262 Encryption A2262 Decryption KeyGen1 IDKGen RNG"
          },
          {
            "description": "Validate the current password used to identify and authenticate the CCO role using AM1.",
            "indicator": "Approv ed mode",
            "inputs": "Password",
            "name": "Validate CCO Password (AM1)",
            "outputs": "Successful authenticati on will allow access to the services",
            "rolesSspAccess": "- PKPK: G,Z Unauthentica ted - CCO PWD (AM1): Z - KEK: Z - PEK: E",
            "secFunImpl": "A2260 Decryption SHS817 KTS3"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "allowed for CO role.",
            "rolesSspAccess": "- PWD Hash: W,Z - TEK: Z",
            "secFunImpl": ""
          },
          {
            "description": "Validate the current password used to identify and authenticate the OCO role using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Password",
            "name": "Validate OCO Password (AM2)",
            "outputs": "Successful authenticati on will allow access to the services allowed for User role",
            "rolesSspAccess": "Unauthentica ted - KEK: Z - KPK: G,E,Z - OCO PWD (AM2): Z - PEK: E - PWD Hash: W,Z - TEK: Z - UKKPK: E",
            "secFunImpl": "A2260 Encryption A2260 Decryption SHS817 KTS3"
          },
          {
            "description": "Zeroize the KPK and all keys and CSPs in the key database and causes a new KPK to be generated. Resets the passwords to the factory default.",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Zeroize all keys and passwords",
            "outputs": "Keys marked for deletion. Success/fail ure status",
            "rolesSspAccess": "Configuration Crypto Officer - CCO PWD (AM1): Z - DH-Priv: Z - DRBG-State: G,E - KEK: Z - KPK: G,Z - PKPK: Z - PWD Hash: Z - TEK: Z - UKKPK: E Operational Crypto Officer - DH-Priv: Z - DRBG-State: G,E - KEK: Z - KPK: G,Z - OCO PWD (AM2): Z - PKPK: Z - PWD Hash: Z - TEK: Z - UKKPK: E",
            "secFunImpl": "KeyGen1"
          },
          {
            "description": "Mark key for deletion using AM2.",
            "indicator": "Approv ed mode",
            "inputs": "Command In",
            "name": "Zeroize Keys",
            "outputs": "Key is marked for deletion. Success/fail ure status.",
            "rolesSspAccess": "Operational Crypto Officer - DRBG-State: G,E - KEK: Z - KPK: G,Z - TEK: Z - UKKPK: E",
            "secFunImpl": "KeyGen1"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "Identity-based. Configuration Crypto- Officer (CCO) Password: a 10-digit hexadecimal password is authenticated to gain access to CCO services. It should be noted that after authenticating, this password may be changed at any time through the EBI Port.",
            "mechanism": "SHA2-256 (SHS 817)",
            "name": "AM1",
            "perMinute": "After the CCO password has been incorrectly entered 15 consecutive times, the Module will erase all CSPs, reset all passwords back to their default and must be reinitialized. The strength per minute is 15 in 1,099,511,627,776",
            "strength": "The probability of a successful random attempt is 1 in {16^10} which is 1 in 1,099,511,627,776."
          },
          {
            "description": "Identity-based. Operational Crypto- Officer (OCO) Password: a 10-digit hexadecimal password is authenticated to gain access to OCO services. It should be noted that after authenticating, this password may be changed at any time through the EBI Port.",
            "mechanism": "SHA2-256 (SHS 817)",
            "name": "AM2",
            "perMinute": "After the OCO password has been incorrectly entered 15 consecutive times, the Module will erase all CSPs, reset the all passwords back to their default and must be reinitialized. The strength per minute is 15 in 1,099,511,627,776",
            "strength": "The probability of a successful random attempt is 1 in {16^10} which is 1 in 1,099,511,627,776."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-CFB8 (A2260) Decryption",
            "condition": "Bootup",
            "details": "AES-CFB8 256 Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CFB8 (A2260) Encryption",
            "condition": "Bootup",
            "details": "AES-CFB8 256 Encryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A2261) Decryption",
            "condition": "Bootup",
            "details": "AES-ECB 256 Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A2261) Encryption",
            "condition": "Bootup",
            "details": "AES-ECB 256 Encryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A2262) Decryption",
            "condition": "Bootup",
            "details": "AES-ECB 256 Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A2262) Encryption",
            "condition": "Bootup",
            "details": "AES-ECB 256 Encryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM 256 Authentication Decryption",
            "condition": "Bootup",
            "details": "AES-GCM 256 Authenticated Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM 256 Authentication Encryption",
            "condition": "Bootup",
            "details": "AES-GCM 256 Authenticated Encryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW (A2263) Decryption",
            "condition": "Bootup",
            "details": "Message Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW (A2263) Encryption",
            "condition": "Bootup",
            "details": "Message Encryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW (A2264) Decryption",
            "condition": "Bootup",
            "details": "Message Decryption",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A6380)",
            "condition": "Bootup",
            "details": "AES-256 CTR_DRBG instantiation, generate, and reseed KATs performed before the first random data generation.",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "AES-256 CTR",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-4) (A655)",
            "condition": "Bootup",
            "details": "ECDSA P-384 Pair-wise Consistency Test",
            "indicator": "Success or ES3 on failure",
            "testMethod": "PCT",
            "testProps": "ECDSA KeyGen",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "Entropy 90B Start-up Adaptive Proportion Test (APT)",
            "condition": "Bootup",
            "details": "Designed to detect a large loss of entropy that might occur as a result of some physical failure or environmental change affecting the noise source",
            "indicator": "Success or ES1 on failure",
            "testMethod": "Fault Detection",
            "testProps": "Adaptive Proportion Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy 90B Start-up Repetition Count Test (RCT)",
            "condition": "Bootup",
            "details": "Designed to quickly detect catastrophic failures that cause the noise source to become \\\"stuck\\\" on a single output value for a long period of time.",
            "indicator": "Success or ES1 on failure",
            "testMethod": "Fault Detection",
            "testProps": "Repetition Count Test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Firmware Load",
            "condition": "loading a new firmware image",
            "details": "A digital signature is generated over the code when it is built using",
            "indicator": "Success or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "2048-bit RSA Signature Verification/SHA2- 256 RSA (Cert. #A5253)",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "",
            "condition": "",
            "details": "SHA-256 and RSA-2048. The digital signature is verified upon download into the MACE.",
            "indicator": "",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 384 (HMAC 1796)",
            "condition": "Bootup",
            "details": "HMAC-SHA2- 384",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA2-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC Sp800-56Ar3 (A2266)",
            "condition": "Bootup",
            "details": "Per IG D.F, separately tested KAS Shared Secret generation with P-384 and SP800-56Cr2 one-step KDA.",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "KAS-ECC SP800- 56Ar3",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-5) (A5253)",
            "condition": "Bootup",
            "details": "2048-bit RSA PKCSv1.5 Signature Verification, performed before Pre- Operational FW integrity tests. Inclusive for 186-2 (Cert. #396)",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "RSA-2048 SigVer",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (SHS 817)",
            "condition": "Bootup",
            "details": "SHA2-256",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-384 (SHS 2399)",
            "condition": "Bootup",
            "details": "SHA2-384",
            "indicator": "Success or ES1 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-384",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "The MACE enters the critical error state. In this state, the MACE stores the status into the internal flash memory and then halts all further operation by entering an infinite loop.",
            "description": "The MACE fails a KAT.",
            "indicator": "Device will not respond to authentication requests.",
            "name": "ES1",
            "recoveryMethod": "Reboot/Power cycle the module"
          },
          {
            "conditions": "The MACE enters the firmware signature validation failure state. In this state, the MACE halts all further operations by entering the flash programming mode.",
            "description": "The MACE fails a firmware loading during program upgrade and/or firmware integrity pre-operational self-test.",
            "indicator": "Device will not respond to authentication requests.",
            "name": "ES2",
            "recoveryMethod": "Reboot/Power cycle the module or re- flashing a new image."
          },
          {
            "conditions": "The MACE enters a temporary error state. The generated key is not discarded.",
            "description": "The MACE fails an ECDSA PCT.",
            "indicator": "The MACE will return an error code (0x01) to the operator.",
            "name": "ES3",
            "recoveryMethod": "The error state is automatically cleared and the module resumes normal operation."
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "Periodically",
            "inspectGuidance": "Look for signs of tampering. Remove from service if tampering found.",
            "mechanism": "Covered with a hard-opaque epoxy coating that provides evidence of attempts to tamper with the MACE."
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [
          {
            "caveat": "No security claimed - AES MAC is used as part of OTAR but is considered obfuscation",
            "name": "AES MAC",
            "use": "[IG 2.4.A] P25 AES OTAR. AES MAC is applied directly to the plaintext OTAR key components and then KTS encryption is performed on the OTAR key components and decrypted within the module using AES KW Cert. #A2264"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [
          {
            "algoPropList": "key unwrapping only:Key establishment methodology provides 256 bits strength",
            "implName": "AES CBC or OFB Cert. #A2261 or #A2262",
            "name": "KTS2",
            "reference": "IG D.G"
          },
          {
            "algoPropList": "key unwrapping only:Key establishment methodology provides 256 bits strength",
            "implName": "AES CFB8 Cert. #A2260",
            "name": "KTS3",
            "reference": "IG D.G"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "The main physical port provided by the MACE. It provides access to the majority of the supported interfaces.",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "Serial Synchronous Interface (SSI)"
          },
          {
            "data": "This interface provides status output to indicate all power- up self-tests complete successfully.",
            "logicalInterface": "Status Output",
            "physicalPort": "Self-test Indicator"
          },
          {
            "data": "This interface powers all circuitries.",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          },
          {
            "data": "This interface provides the input and output to the Key Variable Loader (KVL)",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "Key Loading Port (KYLD)"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "AM1",
            "name": "Configuration Crypto Officer",
            "operatorType": "CCO",
            "type": "Identity"
          },
          {
            "authMethodList": "AM2",
            "name": "Operational Crypto Officer",
            "operatorType": "OCO",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "3",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "3",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Firmware integrity",
            "details": "A digital signature is generated over the Boot Block, Base firmware (Cert. #A5253), and all Drop-in algorithms (Cert. #396) when it is built using SHA2-256 (Cert. #817), and is stored with the code upon download into the MACE. When the MACE is powered up, the digital signature is verified. If the digital signature matches then the test passes otherwise it fails.",
            "indicator": "Success or ES2 on failure",
            "testMethod": "KAT",
            "testProps": "SHA2-256 (Cert. #817), RSA-2048 (Cert. #396, #A5253)",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Flash Memory (S2)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted on the IDK (A2261, A2262 AES-CBC) (I1)",
            "sfiAlgo": "KTS2",
            "source": "Application Software (outside)"
          },
          {
            "dest": "Flash Memory - Encrypted (S3)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted on the PEK using AES KTS (A2260 AES- CFB8) (I3).",
            "sfiAlgo": "KTS3",
            "source": "Application Software (outside)"
          },
          {
            "dest": "Flash Memory - Encrypted (S3)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted on the TEK (A2261, A2262 AES-OFB) (I5)",
            "sfiAlgo": "KTS2",
            "source": "Application Software (outside)"
          },
          {
            "dest": "Flash Memory - Encrypted (S3)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted using ECDH Key Agreement Process (I6).",
            "sfiAlgo": "KAS",
            "source": "Application Software (outside)"
          },
          {
            "dest": "Flash Memory - Encrypted (S3)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input encrypted using SP800-38F AES key transport by the KEK (A2264) (I4)",
            "sfiAlgo": "KTS1",
            "source": "OTAR (outside)"
          },
          {
            "dest": "Flash Memory (S2)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Input in plaintext through the KVL (I2)",
            "sfiAlgo": "",
            "source": "Application Software (outside)"
          },
          {
            "dest": "Application Software (outside)",
            "distribution": "N/A",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Output in plaintext public key (O1)",
            "sfiAlgo": "ECDSA KeyGen (FIPS186-4) (A655)",
            "source": "Flash Memory - Encrypted (S3)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroized by the \"Program Update\" service.*",
            "method": "Z1",
            "operatorId": "Yes",
            "rationale": "SSPs zeroized upon loading of new firmware."
          },
          {
            "description": "Zeroized by the \"CCO Validate Password\" service.",
            "method": "Z10",
            "operatorId": "Yes",
            "rationale": "CO password zeroized after too many failed login attempts"
          },
          {
            "description": "Zeroized by the \"CCO Change Password\" service.",
            "method": "Z11",
            "operatorId": "Yes",
            "rationale": "Old User password zeroized as new CO password set"
          },
          {
            "description": "Zeroized by module power cycle or hard reset.*",
            "method": "Z2",
            "operatorId": "Yes",
            "rationale": "SSPs in volatile memory zeroized."
          },
          {
            "description": "Zeroized by the \"Zeroize Keys\" service.",
            "method": "Z3",
            "operatorId": "Yes",
            "rationale": "TEK/KEKs zeroized upon request"
          },
          {
            "description": "Zeroized by the \"Zeroize all Keys and Password\" service.",
            "method": "Z4",
            "operatorId": "Yes",
            "rationale": "Old CO password zeroized as new CO password set"
          },
          {
            "description": "Zeroized by the \"OCO Validate Password\" service.",
            "method": "Z5",
            "operatorId": "Yes",
            "rationale": "CO password zeroized after too many failed login attempts"
          },
          {
            "description": "Zeroized by the \"OCO Change Password\" service.",
            "method": "Z6",
            "operatorId": "Yes",
            "rationale": "Old User password zeroized as new CO password set"
          },
          {
            "description": "Zeroized by the \"Module Configuration\" service.",
            "method": "Z7",
            "operatorId": "Yes",
            "rationale": "User password zeroized after too many failed login attempts"
          },
          {
            "description": "Zeroized by the \"Privileged APCO OTAR\" service.",
            "method": "Z8",
            "operatorId": "Yes",
            "rationale": "TEK/KEKs zeroized upon request"
          },
          {
            "description": "Zeroized by the \"KVL Import Key\" service.",
            "method": "Z9",
            "operatorId": "Yes",
            "rationale": "TEK/KEKs zeroized upon request"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Stored in the flash in plaintext, associated by memory location (pointer).",
            "name": "Flash Memory (S2)",
            "persistance": "Static"
          },
          {
            "description": "Stored in the flash in encrypted, associated by memory location (pointer).",
            "name": "Flash Memory - Encrypted (S3)",
            "persistance": "Static"
          },
          {
            "description": "Stored encrypted in volatile memory (RAM).",
            "name": "System Memory (S1)",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "N/A",
            "fwVersion": "R01.15.02 with [AES256 R01.00.00 or AES256 R01.00.01]",
            "hwVersion": "5185912",
            "modelPartNum": "5185912T05",
            "processors": "5185912 Family"
          },
          {
            "features": "N/A",
            "fwVersion": "R01.15.02 with [AES256 R01.00.00 or AES256 R01.00.01]",
            "hwVersion": "5185912",
            "modelPartNum": "5185912Y03",
            "processors": "5185912 Family"
          },
          {
            "features": "N/A",
            "fwVersion": "R01.15.02 with [AES256 R01.00.00 or AES256 R01.00.01]",
            "hwVersion": "5185912",
            "modelPartNum": "5185912Y05",
            "processors": "5185912 Family"
          },
          {
            "features": "",
            "fwVersion": "Base FW Version",
            "hwVersion": "Algorithm FW Version",
            "modelPartNum": "Algorithm*",
            "processors": "Cert. #"
          },
          {
            "features": "",
            "fwVersion": "R01.15.02",
            "hwVersion": "R01.00.00",
            "modelPartNum": "AES256",
            "processors": "A2261"
          },
          {
            "features": "",
            "fwVersion": "R01.15.02",
            "hwVersion": "R01.00.01",
            "modelPartNum": "AES256",
            "processors": "A2262"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Asymmetric and Symmetric",
            "implName": "N/A",
            "name": "CKG1",
            "reference": "SP800-133rev2 Sections 4, Example 1 and IG D.H"
          },
          {
            "algoPropList": "Key Type:Symmetric",
            "implName": "N/A",
            "name": "CKG - IDK",
            "reference": "SP800-133rev2 Sections 6.3 #2 and IG D.H"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 1
          },
          "ECDH": {
            "ECDH": 4
          },
          "ECDSA": {
            "ECDSA": 8
          }
        },
        "FF": {
          "DH": {
            "DH": 5,
            "Diffie-Hellman": 3
          }
        },
        "RSA": {
          "RSA-2048": 3
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 4
        },
        "CTR": {
          "CTR": 2
        },
        "GCM": {
          "GCM": 3
        },
        "OFB": {
          "OFB": 2
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 5
        },
        "MAC": {
          "MAC": 7
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-384": 8
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#2": 3,
          "#396": 3,
          "#817": 2
        }
      },
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 1,
          "AES 256": 1,
          "AES-256": 16,
          "AES-GCM 256": 6,
          "AES256": 8,
          "HMAC 1796": 8,
          "PKCS 1": 1,
          "RSA 396": 2,
          "SHA-256": 1,
          "SHA2-256": 11,
          "SHA2-384": 7,
          "SHS 2399": 5,
          "SHS 817": 6,
          "SHS2399": 5,
          "SHS817": 5
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 11,
          "Level 3": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA2": {
            "SHA-256": 1
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 6
        },
        "RNG": {
          "RBG": 3,
          "RNG": 9
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 13,
          "FIPS 1403": 1,
          "FIPS 180-4": 2,
          "FIPS 186-2": 2,
          "FIPS 186-4": 2,
          "FIPS 186-5": 1,
          "FIPS 198-1": 1,
          "FIPS186-2": 1,
          "FIPS186-4": 5,
          "FIPS186-5": 3
        },
        "NIST": {
          "SP 800-38A": 1,
          "SP 800-38D": 1,
          "SP 800-38F": 2,
          "SP 800-56A": 1,
          "SP 800-90A": 1
        },
        "PKCS": {
          "PKCS 1": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 28,
            "AES-": 3,
            "AES-256": 16,
            "AES256": 8
          },
          "CAST": {
            "CAST": 38
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 7
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 3
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-ECBA2262",
        "SHA2-256SHS 817",
        "Counter DRBGA6380",
        "AES-CBCA2262",
        "AES-OFBA2262",
        "RSA SigVer (FIPS186-5)A5253",
        "AES-GCMA2262",
        "KAS-ECC Sp800-56Ar3A2266",
        "SHA2-384SHS 2399",
        "ECDSA KeyGen (FIPS186-4)A655",
        "HMAC-SHA2-384HMAC 1796",
        "AES-KWA2264",
        "AES-CFB8A2260",
        "RSA SigVer (FIPS186-2)RSA 396"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A2263",
        "#A2266",
        "#A2262",
        "#A655",
        "#A2260",
        "#817",
        "#A2264",
        "#A2261",
        "#396",
        "#A6380",
        "#A5253"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260921105803-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260921105803-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 842511,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules",
          "https://support.motorolasolutions.com/"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 41
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "468733a6c1d3090fe7ee6316ac7957d0e287ecfd20db23a7a303b64b95afa058",
      "source_hash": "ee375a194358ab43bff91ff2703f1511d972152630a732fdcd29f8251335405e",
      "txt_hash": "738ffeea79b2ff1a6db4734afca4c47a9f956ad6b38840e05102f6ccee29782b"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy",
    "certificate_pdf_url": null,
    "date_sunset": "2031-09-23",
    "description": "The MACE cryptographic processor is used in security modules embedded in Motorola\u0027s Astro family of radio systems products. It provides secure voice and data capabilities as well as APCO Over-The-Air-Rekeying and advanced key management.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Software/Firmware security: Level 3",
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Self-tests: Level 3",
      "Life-cycle assurance: Level 3",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Astro Subscriber Motorola Advanced Crypto Engine (MACE) - Security Level 2",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-09-24",
        "lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Motorola Solutions, Inc.",
    "vendor_url": "http://www.motorolasolutions.com"
  }
}