TM400ENB

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5566,
  "dgst": "be41b7f1fa56ba2b",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A7386",
        "AES-CTRC1410",
        "#A7384",
        "Counter DRBGA7386",
        "SHA2-224A7386",
        "HMAC-SHA2-384A7386",
        "#A7385",
        "AES-GCMA7386",
        "HMAC-SHA2-512A7386",
        "AES-GMACC1410",
        "SHA2-384A7386",
        "AES-CBCA7386",
        "HMAC-SHA2-256A7386",
        "#C1410",
        "SHA2-256A7386",
        "KDF SSHA7386",
        "RSA SigGen (FIPS186-5)A7386",
        "KAS-ECC-SSC Sp800-56Ar3A7386",
        "ECDSA KeyGen (FIPS186-5)A7386",
        "RSA KeyGen (FIPS186-5)A7386",
        "RSA SigVer (FIPS186-5)A7386",
        "SHA2-512A7386",
        "HMAC-SHA2-224A7386",
        "KDF SP800-108A7384"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A7386",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "A7386",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "C1410",
            "properties": "Direction - Encrypt Key Length - 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7386",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 192, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "C1410",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A7386",
            "properties": "Prediction Resistance - No, Yes Mode - AES-256 Derivation Function Enabled - No, Yes",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7386",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA2-224",
            "cavpCertName": "A7386",
            "properties": "Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A7386",
            "properties": "Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A7386",
            "properties": "Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A7386",
            "properties": "Key Length - Key Length: 8-524288 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800- 56Ar3",
            "cavpCertName": "A7386",
            "properties": "Domain Parameter Generation Methods - P-256, P- 384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A7384",
            "properties": "KDF Mode - Counter Supported Lengths - Supported Lengths: 8-4096 Increment 8",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A7386",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186- 5)",
            "cavpCertName": "A7386",
            "properties": "Key Generation Mode - probableWithProbableAux Modulo - 2048, 3072, 4096, 8192 Primality Tests - 2powSecStr Private Key Format - standard",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186- 5)",
            "cavpCertName": "A7386",
            "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186- 5)",
            "cavpCertName": "A7385",
            "properties": "Modulo - 2048, 4096 Signature Type - pkcs1v1.5",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186- 5)",
            "cavpCertName": "A7386",
            "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA2-224",
            "cavpCertName": "A7386",
            "properties": "Message Length - Message Length: 0-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7385",
            "properties": "Message Length - Message Length: 8-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7386",
            "properties": "Message Length - Message Length: 0-51200 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A7386",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A7386",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "This service requires several steps: 1. It is necessary to create the user in the controller card. 2. The user shall log in to the controller card and establish a new password according to the authentication rules of the module. 3. Reset the module (This will make sure that once the app is running, it copies the shadow file from the controller card to the module). After that, the user can log in to the module either using SSH or a serial",
            "indicator": "Successful completion and possibility of user authentication",
            "inputs": "Username , password, and user class in the RCP and restart to copy the shadow file into the module",
            "name": "Create new user",
            "outputs": "There is no output. The new user can log in and run his/her associate d services",
            "rolesSspAccess": "User - User_pw d: W",
            "secFunImpl": "None"
          },
          {
            "description": "connection. Show the current status of the module according to FSM. It is automatically executed by the module depending on its current state according to the FSM.",
            "indicator": "Serial port and log file indicating the current status of the module",
            "inputs": "N/A",
            "name": "Show status",
            "outputs": "The module shows automatic ally without the user interventi on the current module status via the serial port and log file",
            "rolesSspAccess": "User",
            "secFunImpl": "None"
          },
          {
            "description": "Show module hardware and firmware",
            "indicator": "The module outputs the following information through",
            "inputs": "Command to show the",
            "name": "Show version",
            "outputs": "Shows the module name and",
            "rolesSspAccess": "User",
            "secFunImpl": "None"
          },
          {
            "description": "version. The module version can be obtained from the module as detailed below: 1. Connecting to the module via SSH and using the \"ver\" command to obtain the module name and software version. 2. Using the \"run show chassis inventory slot- \u003cslot_number\u003e\" where \u003cslot_number\u003e indicates the slot chassis.",
            "indicator": "the shell for each case (additional information that is not included here is given): \"1. Application Version: V13.5.1.0.+; Inventory info for slot- \u003cslot_number\u003e: | Type: TM400ENB (34267) | Hardware Revision: D.1\"",
            "inputs": "module version",
            "name": "",
            "outputs": "software and hardware versions among additional informati on",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Execute pre- operational self-tests. Automatically performed by SW during power-up. The System-Card may initiate Reset using the \"run request chassis power reset\" command.",
            "indicator": "Response in shell detailing the following: \"Running FIPS POST (power-on self-tests) ... Successfully passed all FIPS self-tests\"",
            "inputs": "Command to cause the reset of the module",
            "name": "Perform Self- Test",
            "outputs": "If the module executes the self- tests with success, it returns a message via the serial port, otherwise , the module indicates the error state and additional informati on related to via the serial port and log file",
            "rolesSspAccess": "System- Card",
            "secFunImpl": "None"
          },
          {
            "description": "Configuration of the period in days to execute",
            "indicator": "This function returns a message (as shown in the example below)",
            "inputs": "Command indicating : - The",
            "name": "Configure period for",
            "outputs": "Confirmat ion message",
            "rolesSspAccess": "User",
            "secFunImpl": "None"
          },
          {
            "description": "the periodic self-tests. The specific command is \"set chassis slot \u003cslot_number\u003e tm400enb-m self-test- options self- test-years X self-test-time YY:YY\", where \u003cslot_number\u003e indicates the slot to be configured, \"X\" indicates the years (between 1 and 5) and the \"YY:YY\" indicates the",
            "indicator": "via the serial port that indicates the remaining seconds for the following periodic self-test execution (\"self_test_remaining_ seconds\") among other data",
            "inputs": "period in days (between 1-5 years) - The time to execute it using two digits for hours and two digits for minutes",
            "name": "Periodic Self- Test",
            "outputs": "via serial port. Moreover , once the period ends, the software initiates a module power cycle, which ends up in a pre- operation al self- test",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "hour. Negotiation of the symmetric key with remote peer module, resultant from an ECDH key establishment. Upon the configuration of an end-to-end un-encrypted link by the Human Operator, the module performs this as part of link establishment. For this purpose, the following command shall be used: \"set chassis slot \u003cslot_number\u003e tm400enb-m port",
            "indicator": "When the peer is authenticated, the AES Key is established, and, the module starts sending and receiving encrypted traffic via the configured port, the TX LED associated with this port is on (with green color)",
            "inputs": "The establish ment of HEK and HDK requires to exchange the required informati on to authentic ate the peer module based on RSA signature authentic ation and to perform the key agreemen t based on ECDH",
            "name": "AES key establishment",
            "outputs": "The establish ment of HEK and HDK requires to exchange the required informati on to authentic ate the peer module based on RSA signature authentic ation and to perform the key agreemen t based on ECDH",
            "rolesSspAccess": "User - ECDH_Pri v_K: G,E - ECDH_Pu b_K: G,E - KBKDF_ MK: G,E - KH_Key: G,E - DRBG Seed: G,E - DRBG Internal Value: G,E - DRBG Key: G,E - HEK: G,W - HDK: G,W",
            "secFunImpl": "KAS-ECC (KBKDF) CKG"
          },
          {
            "description": "\u003cport_number\u003e oduc 1 odu odu2-TPN1 encryption enabled\"",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Negotiation of the symmetric key to establish an SSH session when an operator is accessing to the module via SSH",
            "indicator": "The operator is logged with success to the module via SSH",
            "inputs": "It requires operator to be logged using the serial port and SSH protocol",
            "name": "SSH key establisment",
            "outputs": "Successful access to the module",
            "rolesSspAccess": "User - ECDH_Pri v_K: G,E - ECDH_Pu b_K: G,E - DRBG Seed: G,E - DRBG Internal Value: G,E - DRBG Key: G,E - SSH_KDF _K: G,E - SSH_K:",
            "secFunImpl": "KAS-ECC (SSH) CKG"
          },
          {
            "description": "Encryption of incoming data on client ports. Upon the configuration of an end-to-end un-encrypted link, the module encrypts user data with the HEK AES key. For this purpose, the following command shall be sent: \"set chassis slot \u003cslot_number\u003e tm400enb-m port \u003cport_number\u003e oduc 1 odu odu2-TPN1 encryption enabled\".",
            "indicator": "When the peer is authenticated, the AES Key is established, and, the module starts sending and receiving encrypted traffic via the configured port, the TX LED associated with this port is on (with green color)",
            "inputs": "Client- side payloads received from the client ports",
            "name": "Datapath Encryption",
            "outputs": "Client- side payloads are encrypted using AES- CTR and AES- GMAC algorithm and sent to the peer via the line ports",
            "rolesSspAccess": "G User - HEK: R,E",
            "secFunImpl": "Traffic Encryptio n and Decryptio n Traffic Authentic ation"
          },
          {
            "description": "Decryption of outgoing data on client ports. Upon the configuration of an end-to-end un-encrypted link, the module decrypts user data with the HDK AES key. For this purpose, the following command shall be sent: \"set chassis slot \u003cslot_number\u003e tm400enb-m port \u003cport_number\u003e oduc 1 odu odu2-TPN1 encryption enabled\".",
            "indicator": "When the peer is authenticated, the AES Key is established, and, the module starts sending and receiving encrypted traffic via the configured port, the TX LED associated with this port is on (with green color)",
            "inputs": "Line port traffic encrypted with AES- CTR and AES- GMAC",
            "name": "Datapath Decryption",
            "outputs": "Decrypte d line port traffic is output via the required client port",
            "rolesSspAccess": "User - HDK: R,E",
            "secFunImpl": "Traffic Encryptio n and Decryptio n Traffic Authentic ation"
          },
          {
            "description": "Configuration of CO_pwd for authentication into the module. There are two possible methods of using the serial port: - During initial configuration, the module detects that CO user does not exist in the module and offers the possibility of creating one by pressing \"P\" when it is required by the module. - When the CO",
            "indicator": "In both situations the module outputs the following message via the serial port: \"Password configured. Please remember your password.\"",
            "inputs": "The CO_pwd to be configure d or modified",
            "name": "CO Password Configuration",
            "outputs": "Confirmat ion via CO-Shell",
            "rolesSspAccess": "Crypto Officer - CO_pwd: W",
            "secFunImpl": "None"
          },
          {
            "description": "user already exists, the module offers the possibility of changing the current CO_pwd every time it is powered-on. This can be done by pressing \"P\" when it is required by the module. Note: Both cases require to be connected to the module via serial port.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Zeroization of the SSPs stored within the module. This is done by using CO-Shell command via serial port. The specific command is \"zeroize\". Note: In addition, the module offers automatic zeroization when the HEK and HDK keys are rotated and in case of tamper detection as detailed in the \"9.3 SSP Zeroization Methods\" section.",
            "indicator": "During zeroization process, the security LEDs on the front panel blink in Red with the pattern 1 sec on/1 sec off and the following response via CO-Shell: \"Please wait !!!Zeroize command in process DeleteCaCert Successful. Delete RSA Key pair Successful. Format Flash Successful. Zeroize LED Set. passwd, shadow files removed. Line and Client port Laser off successfully. Zeroization command Successful.\" After completion of the zeroization process, the Security LED blink in Orange with the pattern 2.5 sec on/2.5 sec off.",
            "inputs": "Command to execute the zeroizatio n",
            "name": "Zeroization service",
            "outputs": "While performin g the zeroizato n, the security LED blinks in Red with the 1 sec on/1 sec off pattern and the message specified in indicator column. After completin g the zeroizatio n, the security LED blinks in Orange with the 2.5 sec on/2.5",
            "rolesSspAccess": "Crypto Officer - M_Privat e: Z - M_Public : Z - M_cert: Z - CA_cert: Z - KEK: Z - User_pw d: Z",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "sec off pattern",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Enable/disable bypass on specific client ports upon the configuration of an end-to-end un-encrypted link by the Human Operator. For this purpose, the Human Operator sends the following command via the serial port: \"set chassis slot \u003cslot_number\u003e tm400enb-m port \u003cport_number\u003e oduc 1 odu odu2-TPN1 encryption",
            "indicator": "An indication for this service is recorded in the log file detailing \"\u003cChannelId port_id\u003e Enable PassthruModencryptio n\". Moreover, the module will start sending traffic to the peer via the conjured link",
            "inputs": "Client- side payloads received from the client ports",
            "name": "Selective Bypass",
            "outputs": "Client- side payloads are sent without encryptio n via the line ports to the peer",
            "rolesSspAccess": "User",
            "secFunImpl": "None"
          },
          {
            "description": "disabled\". Perform SW \u0026 FW integrity and authenticity tests based on RSA signature verification based on 4096 modulus withs SHA-256 message digest. Automatically performed by the Boot-ROM during power- up. System- Card may initiate Reset using the \"run request chassis power reset\" command or resetting the",
            "indicator": "Considering that the firmware integrity check is successfully performed if the module executes the pre-operational self- tests, the output provided by the module via serial port is the same as for the \"Perform self-test\" service: \"Running FIPS POST (power-on self- tests) ... Successfully passed all FIPS self- tests\"",
            "inputs": "Same as performin g the self- test service",
            "name": "Firmware integrity check",
            "outputs": "If the module executes the self- tests with success, it returns a message via the serial port, otherwise , the module enters in error state. Moreover , the current error state and additional",
            "rolesSspAccess": "System- Card - Boot_Pu blic: R,E",
            "secFunImpl": "Firmware integrity verificatio n"
          },
          {
            "description": "module, by which self-test is performed automatically.",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "informati on related to it are output via the serial port and log file",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Generate Key Encryption Key and store it in memory- backed-up RAM. It is automatically executed by the module after performing \"Generate RSA keys\" or \"SSP external upload\" services to encrypt the generated/load ed key pair.",
            "indicator": "Successful completion and the fact that the module does not go either to \"General error state\" in RSA PCT fails or \"SSPs Entry or Generation\" state if an error occurs during the generation or loading of the RSA key pair",
            "inputs": "M_privat e, Mpublic, and M_Cert in the case they are loaded into the module instead of being generated",
            "name": "Generate KEK",
            "outputs": "Same as Generate RSA Keys or SSP external upload services",
            "rolesSspAccess": "Crypto Officer - DRBG Seed: G,E - DRBG Internal Value: G,E - DRBG Key: G,E - KEK: G,W",
            "secFunImpl": "CKG"
          },
          {
            "description": "Generate RSA module key pair via the CO-Shell using the \"GenerateKeyP air\" command to generate the key pair.",
            "indicator": "Response in the CO- Shell showing the following message: \"Keys generated successfully\"",
            "inputs": "N/A",
            "name": "Generate RSA keys",
            "outputs": "Response via the CO-shell",
            "rolesSspAccess": "Crypto Officer - DRBG Seed: G,E - DRBG Internal Value: G,E - DRBG Key: G,E - M_Privat e: G,W - M_Public : G,W",
            "secFunImpl": "RSA module\u0027s key pair generatio n CKG"
          },
          {
            "description": "Upload SSPs via the CO-Shell on the Serial port console via an SSH channel using the \"LoadCaCertific ate\" command to load the",
            "indicator": "Response in the CO- Shell for each specific command: CA Certificate loaded successfully Public Certificate loaded successfully Private Key successfully loaded",
            "inputs": "CA_Cert, M_privat e, M_Public, and M_Cert are loaded",
            "name": "SSP external upload",
            "outputs": "Response via the CO-shell",
            "rolesSspAccess": "Crypto Officer - CA_cert: W - M_cert: W - M_Privat",
            "secFunImpl": "None"
          },
          {
            "description": "CA_Cert, the \"LoadPublicCert ificate\" command to load the M_Cert, and \"LoadPrivateKe y\" command to load the M_private key.",
            "indicator": "",
            "inputs": "into the module",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "e: W - M_Public : W",
            "secFunImpl": ""
          },
          {
            "description": "Peer authentication based on generating a challenge by performing digital signature generation and digital signature verification. It is an automated process that occurs in every key exchange as part of link establishment. For this purpose, the Human operator sends the following command: \"set chassis slot \u003cslot_number\u003e tm400enb-m port \u003cport_number\u003e oduc 1 odu odu2-TPN1 encryption enabled\".",
            "indicator": "When the peer is authenticated, the AES Key is established, and, the module starts sending and receiving encrypted traffic via the configured port, the TX LED associated with this port is on (with green color)",
            "inputs": "Peer M_Cert is received to perform the authentic ation",
            "name": "Peer authentication",
            "outputs": "M_Cert is sent to the peer",
            "rolesSspAccess": "User - M_Privat e: R,E - CA_cert: R,E",
            "secFunImpl": "Peer module authentic ation"
          },
          {
            "description": "Encryption of the SSH traffic when an operator is accessing to the module via SSH after performing the",
            "indicator": "The CO or Human Operator is logged with success to the module via SSH",
            "inputs": "It requires the CO or human user to be logged using the serial port and SSH protocol",
            "name": "SSH session encryption",
            "outputs": "Successful access to the module",
            "rolesSspAccess": "User - SSH_K: R,E",
            "secFunImpl": "SSH traffic encryptio n"
          },
          {
            "description": "key establishment",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "This service is used to encrypt/decrypt the M_private key using KEK. By default, AES- CBC is used by default although AES- GCM could also be utilized. It occurs as part of the loading/generat ion of the M_private key. Once it is loaded using the \"LoadPrivateKe y\" command or generated using the \"GenerateKeyP air\" command the module encrypts it using the KEK.",
            "indicator": "Same as Generate RSA Keys and SSPs External Upload services because when the keys are either generated or uploaded, they are automatically encrypted and the output of both services means that the keys are stored in an encrypted form in the module",
            "inputs": "The M_privat e key to be encrypted",
            "name": "Symmetric Encryption/Dec ryption",
            "outputs": "Same as Generate RSA Keys or SSP external upload services",
            "rolesSspAccess": "Crypto Officer - M_Privat e: R,E - KEK: R,E",
            "secFunImpl": "SSPs encryptio n SSPs Auth Encryptio n"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "Identity-based authentication for the CO role.",
            "mechanism": "The CO_pwd must be [8,20] characters in length, with at least 1 upper case, 1 lower case, and 1 number. With 102 possible values per character, it provides adequately low odds of a random match as per the FIPS specification.",
            "name": "CO Authentication",
            "perMinute": "Moreover, for the CO, after the first authentication failure, the module will take 3 seconds after allowing the CO to perform a new authentication attempt. After the second authentication failure, the module will take 6 seconds after allowing the CO to perform the third authentication attempt. Finally, after the third authentication failure, the module will take 9 seconds to close the CO-Shell and open a new one. Taking into account that this process takes a total amount of 18 seconds (without considering the tipping time), the maximum number of authentication attempts within a minute is 9, therefore, the possibility that a random attempt succeeds or a false acceptance occurs P_max=9/(102)^8 and P_min=9/(102)^20.",
            "strength": "The crypto officer is authenticated by the module using a password of [8, 20] characters in length allowing to choose between 102 possible values for each character (26 upper-case, 26 lower- case, 10 numbers and 40 additional characters provided by 20 keys on the ASCII keyboard (with or without SHIFT) leads to 26+26+40+10 = 102) of the password, hence, the minimum and the maximum possibility that a random attempt succeeds or a false acceptance occurs is P_max=1/(102)^8 and P_min=1/(102)^20. This authentication method complies with the stated in the [SP 800-63B] document for memorized secret authentication."
          },
          {
            "description": "System-Card Authentication",
            "mechanism": "As the system card monitors the module\u0027s status and provisioned services, performs self-tests and firmware integrity tests, not executing any approved cryptographic algorithm nor managing any CSPs/SSPs - there is",
            "name": "System-Card Authentication",
            "perMinute": "N/A",
            "strength": "N/A"
          },
          {
            "description": "",
            "mechanism": "no need for authentication as per FIPS 140-3 IG 4.1.A Resolution section bullet d) and e).",
            "name": "",
            "perMinute": "",
            "strength": ""
          },
          {
            "description": "Identity-based authentication for the User role.",
            "mechanism": "The user password must be at least 8 characters in length, with at least 1 upper case, 1 lower case, and 1 number. With 102 possible values per character, it provides adequately low odds of a random match as per the FIPS specification.",
            "name": "Human Operator authentication",
            "perMinute": "After configuring the lockout policy as indicated in section 11. The configuration for the authentication failures within a minute is the same as for the CO, therefore, during a minute, the maximum number of authentication attempts is 9, therefore, the possibility that a random attempt succeeds of false acceptance occurs in one minute period is P_max=9/102^8",
            "strength": "This user is authenticated by the module using a password with at least 8 characters in length allowing to choose between 102 possible values for each character (26 upper-case, 26 lower- case, 10 numbers and 40 additional characters provided by 20 keys on the ASCII keyboard (with or without SHIFT) leads to 26+26+40+10 = 102) of the password, hence, the possibility that a random attempt succeeds or a false acceptance occurs is P_max=1/(102)^8. This authentication method complies with the stated in the [SP 800-63B] document for memorized secret authentication."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-5) (A7385)",
            "condition": "Prior to executing the firmware integrity test, the Boot-ROM execute this KAT required to perform the firmware integrity signature verification",
            "details": "RSA signature verification",
            "indicator": "In case of success the module executes the firmware integrity test. In case of failure, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "RSA with modulus 2048 and 4096 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A7385)",
            "condition": "Prior to execute the firmware integrity test, the Boot-ROM execute this KAT required to perform the firmware integrity signature verification",
            "details": "SHA 256 verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "SHA256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 224 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "HMAC verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA224",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 256 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "HMAC verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 384 (A7386)",
            "condition": "This test is executed in a group of tests",
            "details": "HMAC verification",
            "indicator": "In case of success, the module",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "",
            "condition": "after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "",
            "indicator": "continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "HMAC-SHA2- 512 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "HMAC verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Encryption KAT",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "AES GCM encryption KAT",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "AES-256-GCM",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Decryption KAT",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "AES GCM decryption KAT",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "AES-256-GCM",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC Encryption KAT",
            "condition": "This test is executed in a group of tests after the module",
            "details": "AES CBC encryption KAT",
            "indicator": "In case of success, the module continues with the execution",
            "testMethod": "KAT",
            "testProps": "AES-256-CBC",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "",
            "condition": "executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "",
            "indicator": "of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "AES-CBC Decryption KAT",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "AES CBC decryption KAT",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "AES-256-CBC",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "ECDH verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "ECDH with the P-256 curve",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SP800-108 (A7384)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "KBKDF verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "KBKDF counter mode with HMAC-SHA256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigGen (FIPS186-5) (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational",
            "details": "RSA signature generation",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the",
            "testMethod": "KAT",
            "testProps": "RSA with modulus (2048, 3072, 4096, 8192)",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Algorithm or Test",
            "condition": "Conditions self-tests and enters in conditional self- tests for the",
            "details": "Details",
            "indicator": "Indicator module enters in General Error state",
            "testMethod": "Test Method",
            "testProps": "Test Properties",
            "type": "Test Type"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186-5) (A7386)",
            "condition": "first time This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the",
            "details": "RSA signature verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "RSA with modulus (2048, 3072, 4096, 8192)",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-224 (A7386)",
            "condition": "first time This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "SHA verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "SHA2-224",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "SHA verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-384 (A7386)",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in",
            "details": "SHA verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters",
            "testMethod": "KAT",
            "testProps": "SHA2-384",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Algorithm or Test",
            "condition": "Conditions conditional self- tests for the",
            "details": "Details",
            "indicator": "Indicator in General Error state",
            "testMethod": "Test Method",
            "testProps": "Test Properties",
            "type": "Test Type"
          },
          {
            "algorithmOrTest": "SHA2-512 (A7386)",
            "condition": "first time This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time",
            "details": "SHA verification",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "KAT",
            "testProps": "SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RCT",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time when the ENT is initialized for the first time",
            "details": "The Repetition Count Test is performed as specified in section 4.4.1 of the [SP 800- 90B]",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "SP 800-90B Health tests; start- up and conditional",
            "testProps": "RCT",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "APT",
            "condition": "This test is executed in a group of tests after the module executes all the pre-operational self-tests and enters in conditional self- tests for the first time when the ENT is initialized for the first time",
            "details": "The Adaptative Proportion Test is performed as specified in section 4.4.2 of the [SP 800- 90B]",
            "indicator": "In case of success, the module continues with the execution of CAST. Otherwise, the module enters in General Error state",
            "testMethod": "SP 800-90B Health tests; start- up and conditional",
            "testProps": "APT",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "Counter DRBG (A7386)",
            "condition": "This test is executed in a group of tests after the module",
            "details": "Instantiate, generate, and reseed health tests for",
            "indicator": "In case of success, the module completes the execution of",
            "testMethod": "KAT",
            "testProps": "CTR_DRBG",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "",
            "condition": "executes all the pre-operational self-tests and enters in conditional self- tests for the first time when the CTR_DRBG is initialized for the first time",
            "details": "CTR_DRBG as stated in section 11.3 of the [SP 800- 90Arev1]",
            "indicator": "CAST. Otherwise, the module enters in General Error state",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A7386)",
            "condition": "This test is executed when a new ECDSA key pair is generated as part of the ECDHE key establishment processes",
            "details": "ECDSA key pair generation with P-256, P-384 and P-521 curves",
            "indicator": "If it is executed with success the module generates ECDSA key pair as part of the ECDHE key establishment. Otherwise, the module enters in General Error state",
            "testMethod": "PCT",
            "testProps": "P-256, P-384 and P-521",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "RSA KeyGen (FIPS186-5) (A7386)",
            "condition": "This test is executed when a new RSA key pair is generated or loaded into the module",
            "details": "RSA key pair signature generation and verification with modulus (2048, 3072, 4096, 8192)",
            "indicator": "If it is executed with success the module executes the M_Public and M_Private keys correspondenc e test. Otherwise, the module enters in General Error state",
            "testMethod": "PCT",
            "testProps": "RSA with modulus (2048, 3072, 4096, 8192)",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "M_Public and M_Private keys correspondenc e test",
            "condition": "This test is executed when a new RSA key pair is generated or loaded into the module (after the execution of the RSA PCT)",
            "details": "Additional informatio n provided below the table",
            "indicator": "In case of success, the module executes the M_Cert verification test. Otherwise, the module enters in General Error state",
            "testMethod": "PCT",
            "testProps": "The correspondenc e between M_private, M_public and M_cert is verified",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "M_Cert verification test",
            "condition": "This test is executed when a new RSA key pair is generated or",
            "details": "Additional informatio n provided below the table",
            "indicator": "In case of success, the module executes the CA_Cert",
            "testMethod": "Signature Verificatio n",
            "testProps": "The integrity of the module\u0027s X.509 certificate is verified",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "",
            "condition": "loaded into the module (after the execution of the M_Public and M_Private keys correspondenc e test)",
            "details": "",
            "indicator": "verification test. Otherwise, the module enters in General Error state",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "CA_Cert verification test",
            "condition": "This test is executed when a new RSA key pair is generated or loaded into the module (after the execution of the M_Cert verification test)",
            "details": "Additional informatio n provided below the table",
            "indicator": "In case of success, the module goes to Ready state. Otherwise, the module enters in General Error state",
            "testMethod": "Signature Verificatio n",
            "testProps": "The Cryptographic Authority\u0027s X.509 certificate CA_Cert is verified",
            "type": "Critical Functio n"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "An error is detecting during self-test execution.",
            "description": "A general error is detected",
            "indicator": "The module prints the following message \"STATE: GENERAL ERROR\" in the error log and the serial port and it is automatically reset.",
            "name": "General Error State",
            "recoveryMethod": "Power-cycling and execution of the self-test"
          },
          {
            "conditions": "A tamper event occurred on the module",
            "description": "A tamper event is detected",
            "indicator": "The Security LED is on Red Colour. The SW-U LED, IS LED and FAIL LED are off. Moreover, the module prints the following message \"Main Tamper Cover Breach\" in the serial port",
            "name": "Tamper Detection Error state",
            "recoveryMethod": "Non-recoverable"
          },
          {
            "conditions": "The battery of the module is close to running out",
            "description": "A low battery or tamper event is detected while the module is off",
            "indicator": "The Security LED turns to red (2.5 seconds on/ 2.5 seconds off). The SW-U LED, IS LED and FAIL LED are off. Moreover, the module prints the following message \"System Halted - Low battery or tamper event suspected\" in the serial port",
            "name": "Low- Battery/PO- Tamper error state",
            "recoveryMethod": "Power-cycling and execution of the self-test"
          },
          {
            "conditions": "No CO_pwd is detected in the module",
            "description": "The CO_pwd is missing.",
            "indicator": "The Security LED turns 1.5 second on in green and 2.5 seconds on in RED. The SW-U LED, the IS LED and FAIL LED are off. Moreover, the module prints the following message \"Firmware password invalid/missing\" in the serial port",
            "name": "Missing CO- Password State",
            "recoveryMethod": "The CO must perform the initial configuration process"
          },
          {
            "conditions": "Temperature and/or voltage out of the operating rage",
            "description": "The module enters in this error when either the temperature and/or the input voltage are outside of the defined operation ranges",
            "indicator": "The module outputs the following message via the serial port:\"STATE: Env. Failure\". After that, it is automatically reset.",
            "name": "Env. Failure state",
            "recoveryMethod": "The module will keep on power cycling until the temperature and/or voltage are back to the values into the operating range"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "Every month",
            "inspectGuidance": "The CO must perform a visual inspection of the metallic cover to ensure it has not been manipulated or damaged.",
            "mechanism": "Strong tamper cover"
          },
          {
            "inspectFreq": "Every month",
            "inspectGuidance": "The CO must perform a visual inspection of the tamper seals to ensure it has not been manipulated, damaged, or replaced (Verifying they are correctly encoded).",
            "mechanism": "Tamper seals"
          },
          {
            "inspectFreq": "Every month",
            "inspectGuidance": "The CO must check that the module is working under normal conditions. This will require the CO to authenticate into the module (ensuring the module has not been tampered with and that the battery has not lost power).",
            "mechanism": "Tamper detection and zeroization circuitry"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "The module only supports approved services",
            "name": "Approved Mode",
            "statusIndicator": "The module only supports this mode of operation. Therefore, it works in this mode once it is correctly installed and initialized by the CO.",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "These ports are located on the front panel. Users may provision all or only a subset of client ports at a given time. Each provisioned client port runs data traffic to a customer\u0027s premises without encryption. Traffic from a client port is cross-connected to the line port of the module",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "Client Port 1-36. See the table below to consult the specific connectors"
          },
          {
            "data": "This port is located on the front panel. The port exchanges OTN data traffic with a remote-peer. This traffic is encrypted (except for the bypass mode) using AES-CTR in conjuction with AES-GMAC",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "Line Port (0). Connector (J7101)"
          },
          {
            "data": "Used to configure the CO_pwd, CSPs, and certificates",
            "logicalInterface": "Control Input",
            "physicalPort": "Serial. Connector (J10)"
          },
          {
            "data": "This is a TCP/IP-based logical control messaging channel that uses the management Ethernet physical link between the system card and the module. It is used by the software application to control de module. There can be up to 2 System cards in a chassis (active \u0026 standby). Only one is active at a given time. There is a point-to-point Ethernet link between each system card and a given module. In other words, the module has 2 management Ethernet ports (one to each System card), only one of which can be active at any given time",
            "logicalInterface": "Control Input",
            "physicalPort": "Backplane port - Ethernet /Logical Control Channel. Connector (J4)"
          },
          {
            "data": "The system card can perform certain control operations on the module by exercising control signals such as reset and shutdown. In addition, there are few lines to connect to the adjacent TM400ENB module for 1:1 module protection signalling through which each module sends its failure status to the other module",
            "logicalInterface": "Control Input Status Output",
            "physicalPort": "Backplane port - Control Signals. Connector (J4)"
          },
          {
            "data": "The serial port is utilized by the module for several purposes: - Indicate the state of the module every time it reaches a new state with the following format: \"STATE: State_name\"; - Provide the operator with additional information such as causes of error or indications",
            "logicalInterface": "Status Output",
            "physicalPort": "Serial. Connector (J10)"
          },
          {
            "data": "This is a green-coloured LED on the front panel utilized by the module to indicate the kind of error according to the table of Error States. Moreover, this LED also blinks depending on the module\u0027s internal operativity",
            "logicalInterface": "Status Output",
            "physicalPort": "IS LED. Connector (DS33(G))"
          },
          {
            "data": "This is a yellow-coloured LED on the front panel utilized by the module to indicate the kind of error according to the table of Error States. Moreover, this LED also blinks depending on the module\u0027s internal operativity",
            "logicalInterface": "Status Output",
            "physicalPort": "SW-U LED. Connector (DS33(Y))"
          },
          {
            "data": "This is a multi-coloured LED on the front panel utilized by the module to indicate kind of error according to the table of Error States. Moreover, this LED also blinks depending on the module\u0027s internal operativity",
            "logicalInterface": "Status Output",
            "physicalPort": "FAIL LED. Connector (DS33(R))"
          },
          {
            "data": "This is a multi-coloured LED on the front panel utilized by the module to indicate kind of error according to the table of Error States. Moreover, this LED also blinks depending on the module\u0027s internal operativity",
            "logicalInterface": "Status Output",
            "physicalPort": "Security LED. Connector (CR6)"
          },
          {
            "data": "This is a software-controlled green-coloured LED. It is off until the associated port is configured and enabled.",
            "logicalInterface": "Status Output",
            "physicalPort": "Tx (One LED per port). See the table below to consult the specific connectors"
          },
          {
            "data": "This is a red-coloured LED. It\u0027s off during normal operation. When on, it indicates associated port failure conditions (voltage/temperature out-of- range, Loss-Of-Signal).",
            "logicalInterface": "Status Output",
            "physicalPort": "F/L (One LED per port). See the table below to consult the specific connectors"
          },
          {
            "data": "Power supply voltage 48V DC",
            "logicalInterface": "Power",
            "physicalPort": "Backplane port - Power input. Connector (J4))"
          },
          {
            "data": "Port Tx LED",
            "logicalInterface": "Port Connector Number",
            "physicalPort": "Port number"
          },
          {
            "data": "CR23",
            "logicalInterface": "J7101",
            "physicalPort": "0"
          },
          {
            "data": "CR21",
            "logicalInterface": "J7103",
            "physicalPort": "1-4"
          },
          {
            "data": "CR19",
            "logicalInterface": "J7105",
            "physicalPort": "5-8"
          },
          {
            "data": "CR17",
            "logicalInterface": "J7107",
            "physicalPort": "9-12"
          },
          {
            "data": "CR15",
            "logicalInterface": "J7109",
            "physicalPort": "13-16"
          },
          {
            "data": "CR13",
            "logicalInterface": "J7102",
            "physicalPort": "17-20"
          },
          {
            "data": "DS17",
            "logicalInterface": "J7111-T",
            "physicalPort": "21"
          },
          {
            "data": "DS1",
            "logicalInterface": "J7111-B",
            "physicalPort": "22"
          },
          {
            "data": "DS19",
            "logicalInterface": "J7112-T",
            "physicalPort": "23"
          },
          {
            "data": "DS3",
            "logicalInterface": "J7112-B",
            "physicalPort": "24"
          },
          {
            "data": "DS21",
            "logicalInterface": "J7113-T",
            "physicalPort": "25"
          },
          {
            "data": "DS5",
            "logicalInterface": "J7113-B",
            "physicalPort": "26"
          },
          {
            "data": "DS23",
            "logicalInterface": "J7114-T",
            "physicalPort": "27"
          },
          {
            "data": "DS7",
            "logicalInterface": "J7114-B",
            "physicalPort": "28"
          },
          {
            "data": "DS25",
            "logicalInterface": "J7115-T",
            "physicalPort": "29"
          },
          {
            "data": "DS9",
            "logicalInterface": "J7115-B",
            "physicalPort": "30"
          },
          {
            "data": "DS27",
            "logicalInterface": "J7116-T",
            "physicalPort": "31"
          },
          {
            "data": "DS11",
            "logicalInterface": "J7116-B",
            "physicalPort": "32"
          },
          {
            "data": "DS29",
            "logicalInterface": "J7117-T",
            "physicalPort": "33"
          },
          {
            "data": "DS13",
            "logicalInterface": "J7117-B",
            "physicalPort": "34"
          },
          {
            "data": "DS31",
            "logicalInterface": "J7118-T",
            "physicalPort": "35"
          },
          {
            "data": "DS15",
            "logicalInterface": "J7118-B",
            "physicalPort": "36"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "CO Authentication",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "System-Card Authentication",
            "name": "System-Card",
            "operatorType": "System-Card (User Role)",
            "type": "Identity"
          },
          {
            "authMethodList": "Human Operator authentication",
            "name": "User",
            "operatorType": "Human Operator",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "3",
            "section": "1",
            "title": "General"
          },
          {
            "level": "3",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "3",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "3",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "3",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "3",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "3",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "3",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Critical Functions Test - Tamper test",
            "details": "Indicated below the table",
            "indicator": "If the test is passed with success the module executes the critical function tests called Power Failures or tampering test detailed in the row below. In case of failure, the module enters in tamper detection error state and the module\u0027s LEDs blink according to the table of Error States",
            "testMethod": "On-board tamper detection circuitry checks if a tamper event has occurred prior to initializing the module",
            "testProps": "Checks if there was a tamper event prior to the ongoing initialization",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "Critical Functions Test - Power Failures or tampering test",
            "details": "Indicated below the table",
            "indicator": "If the test is passed with success the module executes the critical function tests called CO_pwd test. In case of failure, the module enters in Low-Battery/PO-",
            "testMethod": "Check for power failures or tamper while the module was powered-off",
            "testProps": "Check for tamper event/low battery event",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "",
            "details": "",
            "indicator": "Tamper error state and the module\u0027s LEDs blink according to the table of Error States",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "Critical Functions Test - CO password test",
            "details": "Indicated below the table",
            "indicator": "If the test is passed with success the module executes the Software/Firmware integrity test. In case of failure, the module enters in Missing CO- Password state and the module\u0027s LEDs blink according to the table of Error States",
            "testMethod": "The custom logic checks if there is a valid CO_pwd configured in the module",
            "testProps": "Check if the CO_pwd is missing",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "Software/Firmware integrity test",
            "details": "Signature verificatio n to verify the firmware integrity. More details are provided below the table",
            "indicator": "If the test is passed with success the module executes the critical function tests called H/W Encryption/Decryptio n verification detailed below. In case of failure, the module enters in General Error state",
            "testMethod": "Firmware integrity test based on Signature Verification",
            "testProps": "RSA PKCS v1.5 with 4096 modulus and SHA256 using Boot_Public key",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "Critical Functions Test - H/W Encryption/Decryptio n verification",
            "details": "Indicated below the table",
            "indicator": "If the test is passed with success the module executes the bypass test detailed below. . In case of failure, the module enters in General Error state",
            "testMethod": "H/W Encryption/Decryptio n verification.",
            "testProps": "Check the correct operativity of the encryption channels",
            "type": "Critical Functio n"
          },
          {
            "algorithmOrTest": "Bypass Test",
            "details": "Indicated below the table",
            "indicator": "If the test is passed with success the module starts the execution of the conditional self-tests. In case of failure, the module enters in General Error state",
            "testMethod": "Creating a bidirectional client channel with a local loopback in the line port",
            "testProps": "Check the correct functioning of the Bypass functionalit y",
            "type": "Bypass"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "CPLD flash memory",
            "distribution": "Manual",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "M_Private and M_Public (RSA private Key)",
            "sfiAlgo": "SSH traffic encryption",
            "source": "Loaded from the exterior by the CO in encrypted form via SSH session during the module installation and initialization. Note: No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs"
          },
          {
            "dest": "SPI flash memory",
            "distribution": "Manual",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "M_cert (X.509 cert)",
            "sfiAlgo": "SSH traffic encryption",
            "source": "Loaded from the exterior by the CO in encrypted form via SSH session. Note: No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs"
          },
          {
            "dest": "SPI flash memory",
            "distribution": "Manual",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "CA_cert (X.509 cert)",
            "sfiAlgo": "SSH traffic encryption",
            "source": "Loaded from the exterior by the CO in encrypted form via SSH session. Note: No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs"
          },
          {
            "dest": "CPU_ROM",
            "distribution": "Manual",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Boot_Public",
            "sfiAlgo": "",
            "source": "Integrated to Boot code image that is burnt into CPU_ROM during the manufacturing process"
          },
          {
            "dest": "CPLD flash memory",
            "distribution": "Manual",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "CO_pwd",
            "sfiAlgo": "",
            "source": "Entered by the CO during the installation/initializatio n of the module or updated anytime by the CO, via the serial port console"
          },
          {
            "dest": "Shadow file",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "User_pwd",
            "sfiAlgo": "SHA2-512 (A7386)",
            "source": "From System Card (RCP)"
          },
          {
            "dest": "Peer module as part of its associated module certificate M_Cert",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Output to the peer module",
            "sfiAlgo": "Peer module authenticatio n",
            "source": "CPLD flash memory"
          },
          {
            "dest": "Either the peer module in case of key establishmen t for line- traffic encryption or the device",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "ECDH_Pub_ K",
            "sfiAlgo": "KAS-ECC-SSC Sp800-56Ar3 (A7386)",
            "source": "RAM (from TCPM-2)"
          },
          {
            "dest": "from which SSH session is established",
            "distribution": "",
            "entry": "",
            "format": "",
            "name": "",
            "sfiAlgo": "",
            "source": ""
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "AES-256-CBC Key Encryption Key (KEK) and IV are overwritten in the TOD-RAM with all \u00270\u0027s. Encrypted RSA private key \"M_Private\" in the CPLD flash memory is overwritten with all \u00271\u0027s. Certificates \"M_Cert\" (containing RSA public key \"M_Public\") and \"CA_Cert\" in the SPI flash memory are overwritten with all \u00271\u0027s. Shadow file containing the user passwords is deleted from the file system. During the execution of the service, the security LED blinks in red with the pattern 1 sec on/1 sec off, and, once completed the zeroization is completed, the operation is logged in the log file. The security LED blinks in orange with the 2.5 sec on/2.5 sec off pattern and the message specified in the table of Approved Services is output via the CO Shell",
            "method": "Zeroization service",
            "operatorId": "Zeroization request by the CO using the \"zeroize\" command",
            "rationale": "Zeroization of all the CSPs stored into the module except the CO_pwd because it will cause the module to result inoperable"
          },
          {
            "description": "In the case of reset/reboot, all the HEKs and HDKs (for all encrypted service channels) are removed from the SPI boot flash attached to the Digi-G5, and all temporary SSPs that might reside in RAM (potentially in the middle of channel establishments) are also wiped off. HEKs and HEKs",
            "method": "Partial zeroization",
            "operatorId": "Reset/Reboot",
            "rationale": "Traffic encryption keys are zeroized, requiring to be re-negotiated after to allow the module encrypting or"
          },
          {
            "description": "for the services are required to be re- renegotiated with peers to carry out the traffic encryption through the client and line ports",
            "method": "",
            "operatorId": "",
            "rationale": "decrypting traffic via de line-port"
          },
          {
            "description": "In case of tampering during operational time (not when the module is not powered), the KEK and CO_pwd are zeroized as detailed in the \"7 Physical Security\" section, and the event is reported in the error log. This causes the M_private and M_public to be permanently lost since they are encrypted with KEK. In this case, the security LED blinks according to the indicated in the table of Error States",
            "method": "Tamper response",
            "operatorId": "Tamper Event",
            "rationale": "Those CSPs are zeroized not to be available to any attacker. Moreover, the module results inoperable requiring to be repaired at Ribbon facilities"
          },
          {
            "description": "The SSPs stored in RAM are zeorized after their usage",
            "method": "Zeroization after use",
            "operatorId": "",
            "rationale": "Zeroization of all CSPs stored in RAM"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Most CSPs and PSPs are stored in plaintext here",
            "name": "RAM (from TCPM-2)",
            "persistance": "Dynamic"
          },
          {
            "description": "It is a battery Backed-Up RAM that is utilized by the module to store CSPs and to store a flag for tamper indication",
            "name": "TOD-RAM",
            "persistance": "Dynamic"
          },
          {
            "description": "Flash memory placed into the CPLD component",
            "name": "CPLD flash memory",
            "persistance": "Static"
          },
          {
            "description": "ROM memory placed into the TCPM-2 CPU",
            "name": "CPU_ROM",
            "persistance": "Static"
          },
          {
            "description": "It is an SPI flash memory attached to the Digi-G5 module",
            "name": "SPI boot flash",
            "persistance": "Static"
          },
          {
            "description": "Is an SPI flash memory controlled by the CPLD that incorporates several data protection methods",
            "name": "SPI flash memory",
            "persistance": "Static"
          },
          {
            "description": "File that contains the user_pwds related to the user operators",
            "name": "Shadow file",
            "persistance": "Static"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "TM400ENB is a muxponder module with line side encryption capability. A client signal is encrypted before it\u0027s transmitted out of the line port.",
            "fwVersion": "V13.5.1.0.+",
            "hwVersion": "D.1",
            "modelPartNum": "TM400ENB",
            "processors": "LS1026A(ARM64)"
          },
          {
            "features": "Similarly, in the reverse direction the client signal retrieved from OTN frames is decrypted before it\u0027s forwarded to the client-side port. The only exception to this is bypass-mode configurable per- client signal. In the bypass mode client signals are directly mapped-to/ de-mapped-from line signal without encryption/ decryption.",
            "fwVersion": "",
            "hwVersion": "",
            "modelPartNum": "",
            "processors": ""
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric and Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "According to SP800-133r2 Section 4, example 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 1
          },
          "ECDH": {
            "ECDH": 11,
            "ECDHE": 6
          },
          "ECDSA": {
            "ECDSA": 11
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 3
        },
        "CTR": {
          "CTR": 2
        },
        "GCM": {
          "GCM": 3
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "OpenSSL": {
          "OpenSSL": 3
        }
      },
      "crypto_protocol": {
        "SSH": {
          "SSH": 57,
          "SSHv2": 4
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 2
        },
        "MAC": {
          "MAC": 2
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 22,
          "P-384": 10,
          "P-521": 22
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES-128": 1,
          "AES-192": 1,
          "AES-256": 5,
          "HMAC-SHA224": 2,
          "HMAC-SHA256": 6,
          "HMAC-SHA384": 2,
          "HMAC-SHA512": 2,
          "PKCS 1": 2,
          "SHA 256": 1,
          "SHA-256": 2,
          "SHA2- 384": 2,
          "SHA2- 512": 1,
          "SHA2-224": 7,
          "SHA2-256": 13,
          "SHA2-384": 8,
          "SHA2-512": 10,
          "SHA256": 4
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 3": 2,
          "level 3": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA2": {
            "SHA-256": 2,
            "SHA256": 4
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 32
        },
        "RNG": {
          "RBG": 3
        },
        "TRNG": {
          "TRNG": 1
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 90,
          "FIPS 1403": 1,
          "FIPS 180-4": 14,
          "FIPS 186-5": 11,
          "FIPS 198-1": 10,
          "FIPS186-5": 17
        },
        "NIST": {
          "NIST SP 800-131A": 1,
          "SP 800-108": 3,
          "SP 800-131A": 1,
          "SP 800-133": 1,
          "SP 800-135": 1,
          "SP 800-140F": 1,
          "SP 800-38A": 3,
          "SP 800-38D": 2,
          "SP 800-56A": 1,
          "SP 800-63B": 4,
          "SP 800-90A": 1,
          "SP 800-90B": 7
        },
        "PKCS": {
          "PKCS 1": 1
        },
        "X509": {
          "X.509": 13
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 14,
            "AES-": 6,
            "AES-128": 1,
            "AES-192": 1,
            "AES-256": 5
          },
          "CAST": {
            "CAST": 58
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 8
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 6
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CTRC1410",
        "Counter DRBGA7386",
        "SHA2-224A7386",
        "HMAC-SHA2-384A7386",
        "AES-GCMA7386",
        "HMAC-SHA2-512A7386",
        "AES-GMACC1410",
        "SHA2-384A7386",
        "AES-CBCA7386",
        "HMAC-SHA2-256A7386",
        "SHA2-256A7386",
        "KDF SSHA7386",
        "RSA SigGen (FIPS186-5)A7386",
        "KAS-ECC-SSC Sp800-56Ar3A7386",
        "ECDSA KeyGen (FIPS186-5)A7386",
        "RSA KeyGen (FIPS186-5)A7386",
        "RSA SigVer (FIPS186-5)A7386",
        "SHA2-512A7386",
        "HMAC-SHA2-224A7386",
        "KDF SP800-108A7384"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A7386",
        "#A7384",
        "#C1410",
        "#A7385"
      ]
    },
    "policy_metadata": {
      "/Author": "Hawes, David J. (Fed)",
      "/CreationDate": "D:20261022122658-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "1c434341-d669-4d88-8da5-3e0134e21756",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-10-22T16:22:47Z",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
      "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1",
      "/ModDate": "D:20261022122659-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 1982287,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "http://www.jtsec.es/"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 76
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "c3b7b222f2d84c38f1373fd22bbc4030854f6e0f23dccbb0435a6835c9826c69",
      "source_hash": "af6708f08b389e088929b3d87e2181b159b5e226dc0da4dc08f5a3c092618191",
      "txt_hash": "a60b892a8de63e1b91208bb7012d68ca8387f06eabf24715cf7c1943aba262a2"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-29",
    "description": "Ribbon Communications Encryption Module TM400ENB is a hardware cryptographic module implemented as a multiple chip embedded module that operates as a line card in Ribbon Communications \u0027s Apollo product line. In the networking parlance it\u0027s a transponder with multiplexing and encryption capabilities.",
    "embodiment": "MultiChipEmbed",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 3,
    "mentioned_certs": {},
    "module_name": "TM400ENB",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-30",
        "lab": "DEKRA Cybersecurity Certification Laboratory",
        "validation_type": "Initial"
      }
    ],
    "vendor": "ECI Telecom Ltd / Ribbon communications Operating company, Inc.",
    "vendor_url": "https://ribboncommunications.com/"
  }
}