This page was not yet optimized for use on mobile devices.
RUCKUS R770-US Access Point, R770-WW Access Point, R670-US Access Point, R670-WW Access Point, T670-US Access Point, T670-WW Access Point and T670sn-US Access Point
Certificate details
| Certificate ID | #5363 |
|---|---|
| Status | active |
| Validation dates | 30.06.2026 |
| Sunset date | 29-06-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy. |
| Exceptions |
|
| Description | Ruckus WiFi 7 access point portfolio comprises of indoor and outdoor APs that brings higher capacity, efficiency, and performance to enterprises, distributed offices, and small businesses. Ruckus WiFi 7 portfolio offers dual-band, dual-concurrent APs that supports up to eight spatial streams (4x4:4 in 5GHz, 4x4:4 in 2.4GHz). Equipped with OFDMA and MU-MIMO capabilities, the APs efficiently manage up to 1024 client connections with increased capacity, improved coverage and performance in ultra-high dense environments. |
| Vendor | Ruckus Wireless LLC http://www.commscope.com/ruckus |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-128, AES-192, AES-256, AES-, CAST, HMACAsymmetric Algorithms
RSA 3072, RSA 4096, ECDH, ECDSA, ECC, Diffie-Hellman, DHE, DHHash functions
SHA-1Schemes
MAC, Key AgreementProtocols
SSHv2, SSH, TLS v1.2, TLS v1.3, TLSv1.2, TLSv1.3, TLS, TLS 1.2, IKEv2, IKERandomness
DRBG, RBGLibraries
OpenSSLElliptic Curves
P-256, P-384, P-521Block cipher modes
GCMTrusted Execution Environments
PSPVendor
QualcommSecurity level
Level 2Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, SP 800-140, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-108, SP 800-38C, SP 800-140B, SP 800-52, RFC7627, RFC 5288, RFC8446, RFC 7296, RFC 7627, RFC 3526, ISO/IEC 19790Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5363,
"dgst": "c426adaef99b6ea2",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"#A6768",
"SHA-1A6768",
"ECDSA SigGen (FIPS186-5)A6768",
"SHA2-256A6769",
"HMAC-SHA2-384A6769",
"SHA2-384A6769",
"HMAC-SHA2-512A6769",
"Safe Primes Key GenerationA6768",
"AES-CCMA3239",
"RSA SigVer (FIPS186-5)A6768",
"#A3239",
"#A8586",
"Counter DRBGA6768",
"ECDSA SigVer (FIPS186-5)A6768",
"KDF IKEv2A6768",
"HMAC-SHA-1A6768",
"KAS-ECC-SSC Sp800-56Ar3A6768",
"TLS v1.3 KDFA6768",
"KAS-FFC-SSC Sp800-56Ar3A6768",
"SHA2-512A6769",
"KDF SP800-108A6768",
"HMAC-SHA2-256A6769",
"KDF SNMPA6768",
"AES-GCMA6768",
"TLS v1.2 KDF RFC7627A6768",
"#A3235",
"KDF SSHA6768",
"RSA KeyGen (FIPS186-5)A6768",
"AES-CFB128A6768",
"AES-CBCA6769",
"AES-CTRA6768",
"#A6769",
"RSA SigGen (FIPS186-5)A8586"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6768",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A6768",
"properties": "Key Length - 128",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6768",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A6768",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A6768",
"properties": "Prediction Resistance - No, Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6768",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6768",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A6768",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A6768",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A6768",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A6768",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A6768",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, MODP-2048, MODP- 3072, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A6768",
"properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 2048-8192 Increment 8 Derived Keying Material Length - Derived Keying Material Length: 1056-3072 Increment 8 Hash Algorithm - SHA-1, SHA2-224, SHA2- 256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A6768",
"properties": "Password Length - Password Length: 64, 128",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A6768",
"properties": "KDF Mode - Counter Supported Lengths - Supported Lengths: 256",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A6768",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6768",
"properties": "Modulo - 3072",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6768",
"properties": "Modulo - 3072",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6768",
"properties": "Modulo - 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A6768",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, MODP-2048, MODP-3072, MODP-6144, MODP-8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A6768",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6768",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6768",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6768",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A6768",
"properties": "Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A6768",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A6769",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192",
"reference": "SP 800-38A"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A6769",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A6769",
"properties": "Key Length - Key Length: 384",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A6769",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6769",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6769",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6769",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3235",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3235",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3239",
"properties": "Key Length - 128, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3239",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A8586",
"properties": "Modulo - 3072 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Provide Module\u0027s current status (return codes and/or syslog messages)",
"indicator": "N/A",
"inputs": "Command s used to show Module\u0027s Status",
"name": "Show Status",
"outputs": "Module\u0027s Operationa l Status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Provide Module\u0027s name and version information",
"indicator": "N/A",
"inputs": "Command s `get boarddata` and `get fips- version`",
"name": "Show Version",
"outputs": "Module\u0027s ID and versioning information",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform Self-Tests (Pre- operational self-test and Conditiona l Self- Tests)",
"indicator": "N/A",
"inputs": "Command to trigger Self-Test",
"name": "Perform Self-Tests",
"outputs": "Status of the self- tests results",
"rolesSspAccess": "Crypto Officer Unauthentic ated",
"secFunImpl": "None"
},
{
"description": "Perform Zeroization",
"indicator": "Syslog message",
"inputs": "Command to zeroize the module",
"name": "Perform Zeroization",
"outputs": "Status of the SSPs zeroization",
"rolesSspAccess": "Crypto Officer - DRBG Entropy Input: Z - DRBG Seed: Z - DRBG Internal State V value: Z - DRBG Key: Z - Crypto Officer Password: Z - Firmware Load Test Key: Z - SSHv2 ECDH",
"secFunImpl": "None"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: Z - SSHv2 ECDH Public Key: Z - SSHv2 Peer ECDH Public Key: Z - SSHv2 ECDH Shared Secret: Z - SSHv2 RSA Private Key: Z - SSHv2 RSA Public Key: Z - SSHv2 RSA Peer Public Key: Z - SSHv2 ECDSA Private Key: Z - SSHv2 ECDSA Public Key: Z - SSHv2 ECDSA Peer Public Key: Z - SSHv2 Session Encryption Key: Z - SSHv2 Session Authenticati on Key: Z - TLSv1.2 ECDH Private Key: Z - TLSv1.2",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDH Public Key: Z - TLSv1.2 Peer ECDH Public Key: Z - TLSv1.2 ECDH Shared Secret: Z - Locally generated TLSv1.2 RSA Private Key: Z - Locally generated TLSv1.2 RSA Public Key: Z - TLSv1.2 RSA Private Key: Z - TLSv1.2 RSA Public Key: Z - TLSv1.2 RSA Peer Public Key: Z - TLSv1.2 ECDSA Private Key: Z - TLSv1.2 ECDSA Public Key: Z - TLSv1.2 ECDSA Peer Public Key: Z - TLSv1.2 Master Secret: Z - TLSv1.2 Session Encryption",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: Z - TLSv1.3 ECDH Private Key: Z - TLSv1.3 ECDH Public Key: Z - TLSv1.3 Peer ECDH Public Key: Z - TLSv1.3 ECDH Shared Secret: Z - Locally generated TLSv1.3 RSA Private Key: Z - Locally generated TLSv1.3 RSA Public Key: Z - TLSv1.3 RSA Private Key: Z - TLSv1.3 RSA Public Key: Z - TLSv1.3 RSA Peer Public Key: Z - TLSv1.3 ECDSA Private Key: Z - TLSv1.3 ECDSA Public Key: Z - TLSv1.3 ECDSA Peer Public Key: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLSv1.3 Master Secret: Z - TLSv1.3 Session Encryption Key: Z - IPsec/IKEv2 DH Private Key: Z - IPsec/IKEv2 DH Public Key: Z - IPsec/IKEv2 Peer DH Public Key: Z - IPsec/IKEv2 DH Shared Secret: Z - IPsec/IKEv2 ECDH Private Key: Z - IPsec/IKEv2 ECDH Public Key: Z - IPsec/IKEv2 Peer ECDH Public Key: Z - IPsec/IKEv2 ECDH Shared Secret: Z - IPsec/IKEv2 RSA Private Key: Z -",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "IPsec/IKEv2 RSA Public Key: Z - IPsec/IKEv2 RSA Peer Public Key: Z - IPsec/IKEv2 ECDSA Private Key: Z - IPsec/IKEv2 ECDSA Public Key: Z - IPsec/IKEv2 ECDSA Peer Public Key: Z - IPsec/IKEv2 Pre-shared Secret: Z - SKEYSEED: Z - IPsec/IKEv2 Session Encryption Key: Z - IPsec/IKEv2 Authenticati on Key: Z - SNMPv3 Shared Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticati on Key: Z - 802.11i",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Pre-Shared Secret: Z - 802.11i Pairwise Master Key (PMK): Z - 802.11i Pairwise Transient Key (PTK): Z - 802.11i Temporal Key (TK): Z - 802.11i Group Master Key (GMK): Z - 802.11i Group Temporal Key (GTK): Z",
"secFunImpl": ""
},
{
"description": "Sets configurati on of the systems",
"indicator": "None",
"inputs": "Command s to configure the network",
"name": "Configure Network",
"outputs": "Status of the completion of network configurati on status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "CO Role Authentica tion",
"indicator": "N/A",
"inputs": "CO Authentica tion Request",
"name": "Crypto Officer Authentica tion",
"outputs": "Status of the CO authenticat ion",
"rolesSspAccess": "Crypto Officer - Crypto Officer Password: W - SSHv2 RSA Peer Public Key: W,E - SSHv2 ECDSA Peer Public Key: W,E",
"secFunImpl": "None"
},
{
"description": "User (Wireless Client) Role",
"indicator": "N/A",
"inputs": "User (Wireless Client) Authentica",
"name": "User (Wireless Client) Authentica tion",
"outputs": "Status of the User (Wireless Client)",
"rolesSspAccess": "User (Wireless Client) - User (Wireless",
"secFunImpl": "None"
},
{
"description": "Authentica tion",
"indicator": "",
"inputs": "tion Request",
"name": "",
"outputs": "Authenticat ion",
"rolesSspAccess": "Client) Password: W",
"secFunImpl": ""
},
{
"description": "The module will generate a signature to attest to the Controller during initializatio n",
"indicator": "The module is successfu lly connecte d to the controller",
"inputs": "Command s to connect to the controller",
"name": "Initializatio n Attestation",
"outputs": "Outcome of the attestation attempt",
"rolesSspAccess": "Crypto Officer - Factory Device Certificate: E",
"secFunImpl": "Generate Attestation Signature"
},
{
"description": "Configure SSHv2 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and SSHv2 configurat ion success status message",
"inputs": "Command s to configure SSHv2",
"name": "Configure SSHv2 Function",
"outputs": "Status of the completion of the SSHv2 configurati on",
"rolesSspAccess": "Crypto Officer - SSHv2 RSA Private Key: W - SSHv2 RSA Public Key: W - SSHv2 ECDSA Private Key: W - SSHv2 ECDSA Public Key: W",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)"
},
{
"description": "Configure TLSv1.2 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and TLSv1.2 configurat ion success status message",
"inputs": "Command s to configure TLSv1.2",
"name": "Configure TLSv1.2 Function",
"outputs": "Status of the completion of TLSv1.2 configurati on",
"rolesSspAccess": "Crypto Officer - Locally generated TLSv1.2 RSA Private Key: G,W - Locally generated TLSv1.2 RSA Public Key: G,W - TLSv1.2 RSA Private Key: W - TLSv1.2 RSA Public Key: W - TLSv1.2",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (TLSv1.2 and TLSv1.3) DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDSA Private Key: W - TLSv1.2 ECDSA Public Key: W - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,Z - DRBG Key: G,W,E",
"secFunImpl": ""
},
{
"description": "Configure TLSv1.3 Function.",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and TLSv1.3 configurat ion success status message.",
"inputs": "API commands to configur TLSv1.3",
"name": "Configure TLSv1.3 Function",
"outputs": "Status of the completion of TLSv1.3 configurati on.",
"rolesSspAccess": "Crypto Officer - Locally generated TLSv1.3 RSA Private Key: G,W - Locally generated TLSv1.3 RSA Public Key: G,W - TLSv1.3 RSA Private Key: W - TLSv1.3 RSA Public Key: W - TLSv1.3 ECDSA Private Key: W - TLSv1.3 ECDSA Public Key: W - DRBG Entropy",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) RSA KeyGen (TLSv1.2 and TLSv1.3) DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": ""
},
{
"description": "Configure IPsec/IKEv 2 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and IPsec/IKE v2 configurat ion success status message",
"inputs": "Command s to configure IPsec/IKEv 2",
"name": "Configure IPsec/IKEv 2 Function",
"outputs": "Status of the completion of IPsec/IKEv 2 configurati on",
"rolesSspAccess": "Crypto Officer - IPsec/IKEv2 RSA Private Key: W - IPsec/IKEv2 RSA Public Key: W - IPsec/IKEv2 ECDSA Private Key: W - IPsec/IKEv2 ECDSA Public Key: W - IPsec/IKEv2 Pre-shared Secret: W",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)"
},
{
"description": "Configure SNMPv3 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and SNMPv3 configurat ion success status message",
"inputs": "Command s to configure SNMPv3",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completion of SNMPv3 configurati on",
"rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W - SNMPv3 Encryption Key: G,W - SNMPv3 Authenticati on Key: G,W",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM) SNMPv3 Keying Materials Developme nt"
},
{
"description": "Configure 802.11i Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and 802.11i configurat ion success status message",
"inputs": "API commands to configure 802.11i",
"name": "Configure 802.11i Function",
"outputs": "API commands to configure 802.11i",
"rolesSspAccess": "Crypto Officer - 802.11i Pre-Shared Secret: W - 802.11i Pairwise Master Key (PMK): G - 802.11i Pairwise Transient Key (PTK): G - 802.11i Temporal Key (TK): G - 802.11i Group Master Key (GMK): G - 802.11i Group Temporal Key (GTK):",
"secFunImpl": "KTS (SSHv2 with AES and HMAC) KTS (SSHv2 with AES-GCM)"
},
{
"description": "Execute SSHv2 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and successfu l SSHv2 log message",
"inputs": "Initiate SSHv2 tunnel establishm ent",
"name": "Run SSHv2 Function",
"outputs": "Status of SSHv2 tunnel establishm ent",
"rolesSspAccess": "G Crypto Officer - SSHv2 ECDH Private Key: G,W,E - SSHv2 ECDH Public Key: G,R,W - SSHv2 Peer ECDH Public Key: W,E - SSHv2 ECDH Shared Secret: G,W,E - SSHv2 RSA Private Key: W,E - SSHv2",
"secFunImpl": "KAS-ECC (SSHv2) RSA SigGen (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA SigGen (SSHv2 and IPsec/IKEv2 ) RSA SigVer (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "RSA Public Key: R,W - SSHv2 RSA Peer Public Key: R,W,E - SSHv2 ECDSA Private Key: W,E - SSHv2 ECDSA Public Key: R,W - SSHv2 ECDSA Peer Public Key: R,W,E - SSHv2 Session Encryption Key: G,W,E - SSHv2 Session Authenticati on Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": "SigVer (SSHv2 and IPsec/IKEv2 ) SSHv2 Session Encrypt/Dec rypt SSHv2 Session Authenticati on SSHv2 Keying Materials Developme nt DRBG Function"
},
{
"description": "Execute TLSv1.2 function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and successfu",
"inputs": "Initiate TLSv1.2 tunnel establishm ent request",
"name": "Run TLSv1.2 Function",
"outputs": "Status of TLSv1.2 tunnel establishm ent",
"rolesSspAccess": "Crypto Officer - TLSv1.2 ECDH Private Key: G,W,E - TLSv1.2 ECDH",
"secFunImpl": "KAS-ECC (TLSv1.2) RSA SigGen (SSHv2, TLSv1.2, TLSv1.3, and"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "l TLSv1.2 log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: G,R,W - TLSv1.2 Peer ECDH Public Key: W,E - TLSv1.2 ECDH Shared Secret: G,E - Locally generated TLSv1.2 RSA Private Key: G,W,E - Locally generated TLSv1.2 RSA Public Key: G,R,W - TLSv1.2 RSA Private Key: W,E - TLSv1.2 RSA Public Key: R,W - TLSv1.2 RSA Peer Public Key: R,W,E - TLSv1.2 ECDSA Private Key: W,E - TLSv1.2 ECDSA Public Key: R,W - TLSv1.2 ECDSA Peer Public Key: R,W,E - TLSv1.2 Master Secret: G,W,E - TLSv1.2 Session Encryption",
"secFunImpl": "Functions IPsec/IKEv2 ) ECDSA SigGen (TLSv1.2 and TLSv1.3) RSA SigVer (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA SigVer (TLSv1.2 and TLSv1.3) TLSv1.2 Session Encrypt/Dec rypt TLSv1.2 Keying Materials Developme nt DRBG Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": ""
},
{
"description": "Execute TLSv1.3 Function.",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and successfu l TLSv1.3 log message.",
"inputs": "API command to execute TLSv1.3 service.",
"name": "Run TLSv1.3 Function",
"outputs": "Status of TLSv1.3 establishm ent.",
"rolesSspAccess": "Crypto Officer - TLSv1.3 ECDH Private Key: G,W,E - TLSv1.3 ECDH Public Key: G,R,W - TLSv1.3 Peer ECDH Public Key: W,E - TLSv1.3 ECDH Shared Secret: G,W,E - Locally generated TLSv1.3 RSA Private Key: G,W,E - Locally generated TLSv1.3 RSA Public Key: G,R,W - TLSv1.3 RSA Private Key: W,E - TLSv1.3 RSA Public",
"secFunImpl": "KAS-ECC (TLSv1.3) RSA SigGen (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA SigGen (TLSv1.2 and TLSv1.3) RSA SigVer (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA SigVer (TLSv1.2 and TLSv1.3) TLSv1.3 Session Encrypt/Dec rypt TLSv1.3 Keying Materials"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Key: R,W - TLSv1.3 RSA Peer Public Key: R,W,E - TLSv1.3 ECDSA Private Key: W,E - TLSv1.3 ECDSA Public Key: R,W - TLSv1.3 ECDSA Peer Public Key: R,W,E - TLSv1.3 Master Secret: G,W,E - TLSv1.3 Session Encryption Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG",
"secFunImpl": "Developme nt DRBG Function"
},
{
"description": "Execute IPsec/IKEv 2 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and succesful IPsec/IKE",
"inputs": "Initiate IPsec/IKEv 2 tunnel establishm ent request",
"name": "Run IPsec/IKEv 2 Function",
"outputs": "Status of IPsec/IKEv 2 tunnel establishm ent",
"rolesSspAccess": "Key: G,W,E Crypto Officer - IPsec/IKEv2 DH Private Key: G,W,E - IPsec/IKEv2 DH Public Key: G,R,W",
"secFunImpl": "KAS-ECC (IKEv2) KAS-FFC (IKEv2) RSA SigGen (SSHv2, TLSv1.2, TLSv1.3, and"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "n",
"indicator": "v2 log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPsec/IKEv2 Peer DH Public Key: W,E - IPsec/IKEv2 DH Shared Secret: G,W,E - IPsec/IKEv2 ECDH Private Key: G,W,E - IPsec/IKEv2 ECDH Public Key: G,R,W - IPsec/IKEv2 Peer ECDH Public Key: W,E - IPsec/IKEv2 ECDH Shared Secret: G,W,E - IPsec/IKEv2 RSA Private Key: W,E - IPsec/IKEv2 RSA Public Key: R,W - IPsec/IKEv2 RSA Peer Public Key: R,W,E - IPsec/IKEv2 ECDSA Private Key: W,E",
"secFunImpl": "IPsec/IKEv2 ) ECDSA SigGen (SSHv2 and IPsec/IKEv2 ) RSA SigVer (SSHv2, TLSv1.2, TLSv1.3, and IPsec/IKEv2 ) ECDSA SigVer (SSHv2 and IPsec/IKEv2 ) IPsec/IKEv2 Session Encrypt/Dec rypt IPsec/IKEv2 Session Authenticati on IPsec/IKEv2 Keying Materials Developme nt DRBG Function"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPsec/IKEv2 ECDSA Public Key: R,W - IPsec/IKEv2 ECDSA Peer Public Key: R,W,E - IPsec/IKEv2 Pre-shared Secret: G,W,E - SKEYSEED: G,W,E - IPsec/IKEv2 Session Encryption Key: G,W,E - IPsec/IKEv2 Authenticati on Key: G,W,E - DRBG Entropy Input: G,W,E - DRBG Seed: G,W,E - DRBG Internal State V value: G,W,E - DRBG Key: G,W,E",
"secFunImpl": "Functions"
},
{
"description": "Execute SNMPv3 Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and",
"inputs": "Initiate SNMPv3 tunnel establishm ent request",
"name": "Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel establishm ent",
"rolesSspAccess": "Crypto Officer - SNMPv3 Shared Secret: W,E - SNMPv3 Encryption",
"secFunImpl": "SNMPv3 Session Encrypt/Dec rypt SNMPv3 Session Authenticati"
},
{
"description": "",
"indicator": "successfu l SNMPv3 log message",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G,W,E - SNMPv3 Authenticati on Key: G,W,E",
"secFunImpl": "on SNMPv3 Keying Materials Developme nt"
},
{
"description": "Execute 802.11i Function",
"indicator": "Status Mode indicator \"FIPS mode is enabled.\" and successfu l 802.11i log message",
"inputs": "Initiate 802.11i tunnel establishm ent request",
"name": "Run 802.11i Function",
"outputs": "Status of 802.11i tunnel establishm ent",
"rolesSspAccess": "User (Wireless Client) - 802.11i Pre-Shared Secret: G,R,W - 802.11i Pairwise Master Key (PMK): G,R,W,E - 802.11i Pairwise Transient Key (PTK): G,R,W,E - 802.11i Temporal Key (TK): G,R,W,E - 802.11i Group Master Key (GMK): G,R,W,E - 802.11i Group Temporal Key (GTK): G,R,W",
"secFunImpl": "802.11i Session Encrypt/ Decrypt 802.11i Keying Materials Developme nt"
},
{
"description": "Execute the Firmware Load Test",
"indicator": "Successf ul Firmware Loading status message",
"inputs": "Command s to load new firmware image",
"name": "Firmware Load Test",
"outputs": "Outcome of the Firmware Load Test",
"rolesSspAccess": "Crypto Officer - Firmware Load Test Key: R,E",
"secFunImpl": "Firmware Load Test"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The minimum length is fifteen (15) characters (94 possible characters).",
"mechanism": "Password Based",
"name": "Password",
"perMinute": "The probability of successfully authenticating to the module within one minute is 10/(94^15), which is less than 1/100,000.",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^15) which is less than 1/1,000,000."
},
{
"description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 3072 bits, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "RSA SigVer (FIPS186-5) (A6768)",
"name": "RSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^128). Please refer to Description section in this table for more details"
},
{
"description": "The modules support ECDSA public-key based authentication",
"mechanism": "ECDSA SigVer",
"name": "ECDSA- Based Certificate",
"perMinute": "The probability of successfully authenticating to the",
"strength": "The probability that a random attempt will"
},
{
"description": "mechanism using a minimum of curve P- 256, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one- minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "(FIPS186-5) (A6768)",
"name": "",
"perMinute": "module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details",
"strength": "succeed is 1/(2^128) which is less than 1/1,000,000. Please refer to Description section in this table for more details"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC encrypt KAT (A6768)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC decrypt KAT (A6768)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC encrypt KAT (A6769)",
"condition": "Power Up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC decrypt KAT (A6769)",
"condition": "Power Up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM authenticated encrypt KAT (A3235)",
"condition": "Power up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM authenticated decrypt KAT (A3235)",
"condition": "Power up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM authenticated encrypt KAT (A3239)",
"condition": "Power up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM authenticated decrypt KAT (A3239)",
"condition": "Power up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM authenticated encrypt KAT (A6768)",
"condition": "Power up",
"details": "Authenticat ed Encrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM authenticated decrypt KAT (A6768)",
"condition": "Power up",
"details": "Authenticat ed Decrypt",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG Instantiate/Generate/Re seed KAT (A6768)",
"condition": "Power Up",
"details": "Instantiate, Generate, and Reseed KATs",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "AES-128",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) KAT (A6768)",
"condition": "Power Up",
"details": "ECDSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) KAT (A6768)",
"condition": "Power Up",
"details": "ECDSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 curve with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Start-up Health Tests",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source RCT Continuous Health Tests",
"condition": "Performed continuou sly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "RCT",
"testProps": "Repetitio n Count Test (RCT)",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source APT Continuous Health Tests",
"condition": "Performed continuou sly as entropy source is active",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "APT",
"testProps": "Adaptive Proportio n Test (APT)",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A6768)",
"condition": "Power Up",
"details": "HMAC- SHA-1",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 KAT (A6769)",
"condition": "Power up",
"details": "HMAC- SHA-1",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 KAT (A6768)",
"condition": "Power Up",
"details": "HMAC- SHA2-256",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 KAT (A6769)",
"condition": "Power up",
"details": "HMAC- SHA2-256",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 KAT (A6769)",
"condition": "Power Up",
"details": "HMAC- SHA2-384",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 KAT (A6768)",
"condition": "Power Up",
"details": "HMAC- SHA2-512",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 KAT (A6769)",
"condition": "Power up",
"details": "HMAC- SHA2-512",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "SHA2- 512",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 KAT (A6768)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "P-256 Curve",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 KAT (A6768)",
"condition": "Power Up",
"details": "Primitive Z KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SNMP KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800-108 KAT (A6768)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 5) KAT (A8586)",
"condition": "Power Up",
"details": "RSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "RSA 3072 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 5) KAT (A6768)",
"condition": "Power Up",
"details": "RSA SigGen KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186- 5) KAT (A6768)",
"condition": "Power Up",
"details": "RSA SigVer KAT",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "2048 bit modulus with SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Output size: 384 bits",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.3 KDF KAT (A6768)",
"condition": "Power Up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186- 5) PCT (A6768)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "2048 bit Modulus",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-ECC-SSC Sp800- 56Ar3 PCT (A6768)",
"condition": "Performs all required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "PCT",
"testProps": "Curve P- 256 with SHA2- 256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800- 56Ar3 PCT (A6768)",
"condition": "Performs all",
"details": "N/A",
"indicator": "Module is in",
"testMethod": "PCT",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "",
"condition": "required pair-wise consisten cy tests on the newly generated key pairs before the first operation al use.",
"details": "",
"indicator": "normal state",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "When firmware has been uploaded to the module",
"details": "RSA 4096 SigVer with SHA2-384",
"indicator": "Module is in normal state",
"testMethod": "Signatur e Verificati on",
"testProps": "RSA 4096 SigVer with SHA2- 384",
"type": "SW/F W Load"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Pre-Operational Firmware Integrity Test AES-CBC encrypt KAT (A6768) AES-CBC decrypt KAT (A6768) AES-CBC encrypt KAT (A6769) AES-CBC decrypt KAT (A6769) AES-CCM authenticated encrypt KAT (A3235) AES-CCM authenticated decrypt KAT (A3235) AES-CCM authenticated encrypt KAT (A3239) AES-CCM authenticated decrypt KAT (A3239) AES-GCM authenticated encrypt KAT (A6768) AES-GCM authenticated",
"description": "If self-test tests fail, the module is put into the hard error state and the module automatically reboots",
"indicator": "System Halt",
"name": "Hard Error State",
"recoveryMethod": "Reboot the module"
},
{
"conditions": "decrypt KAT (A6768) Counter DRBG Instantiate/Generate/Reseed KAT (A6768) ECDSA SigGen (FIPS186-5) KAT (A6768) ECDSA SigVer (FIPS186-5) KAT (A6768) HMAC-SHA-1 KAT (A6768) HMAC-SHA-1 KAT (A6769) HMAC-SHA2-256 KAT (A6768) HMAC-SHA2-256 KAT (A6769) HMAC-SHA2-384 KAT (A6769) HMAC-SHA2-512 KAT (A6768) HMAC-SHA2-512 KAT (A6769) KAS-ECC-SSC Sp800-56Ar3 KAT (A6768) KAS-FFC-SSC Sp800-56Ar3 KAT (A6768) KDF IKEv2 KAT (A6768) KDF SNMP KAT (A6768) KDF SP800-108 KAT (A6768) KDF SSH KAT (A6768) RSA SigGen (FIPS186-5) KAT (A8586) RSA SigGen (FIPS186-5) KAT (A6768) RSA SigVer (FIPS186-5) KAT (A6768) SHA2-384 KAT (A6768) TLS v1.2 KDF RFC7627 KAT (A6768)",
"description": "",
"indicator": "",
"name": "",
"recoveryMethod": ""
},
{
"conditions": "TLS v1.3 KDF KAT (A6768) Entropy Source RCT Start-up Health Tests Entropy Source APT Start-up Health Tests Entropy Source RCT Continuous Health Tests Entropy Source APT Continuous Health Tests RSA KeyGen (FIPS186-5) PCT (A6768) KAS-ECC-SSC Sp800-56Ar3",
"description": "If any of the less severe self-tests fail, the module will be put into the soft error state where the failed self-tests are retried until passed and an error indicator provided.",
"indicator": "Log message",
"name": "Soft Error State",
"recoveryMethod": "The self- test will be retried."
},
{
"conditions": "PCT (A6768) KAS-FFC-SSC Sp800-56Ar3 PCT (A6768) Firmware Load Test",
"description": "",
"indicator": "",
"name": "",
"recoveryMethod": ""
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of platform for residual evidence of tampering",
"mechanism": "Tamper labels"
},
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of platform for evidence of tampering, removal or access",
"mechanism": "Strong Enclosure"
},
{
"inspectFreq": "Recommended 30 days",
"inspectGuidance": "Visible inspection of components for evidence of tampering, removal or access",
"mechanism": "Production Grade Components"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module is always in the approved mode of operation after initial operations are performed.",
"name": "Approved Mode of Operation",
"statusIndicator": "Approved mode indicator: \"FIPS mode is enabled.\"",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data input into the module for all the services defined in Approved Services Table, including SSHv2, TLSv1.2, TLSv1.3, IPsec/IKEv2and SNMPv3 service data.",
"logicalInterface": "Data Input",
"physicalPort": "Ethernet Port and RF Interface"
},
{
"data": "Data output from the module for all the services defined in Approved Services Table, including SSHv2, TLSv1.2, TLSv1.3, IPsec/IKEv2and SNMPv3 service data.",
"logicalInterface": "Data Output",
"physicalPort": "Ethernet Port and RF Interface"
},
{
"data": "Control Data input into the module for all the services defined in Approved Services Table, including SSHv2, TLSv1.2, TLSv1.3, IPsec/IKEv2and SNMPv3 service data.",
"logicalInterface": "Control Input",
"physicalPort": "Ethernet Port and RESET"
},
{
"data": "Status Information output from the module.",
"logicalInterface": "Status Output",
"physicalPort": "Ethernet Port and LED"
},
{
"data": "N/A",
"logicalInterface": "Control Output",
"physicalPort": "N/A"
},
{
"data": "Provide the Power Supply to the module.",
"logicalInterface": "Power",
"physicalPort": "Power"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password RSA-Based Certificate ECDSA-Based Certificate",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
},
{
"authMethodList": "Password",
"name": "User (Wireless Client)",
"operatorType": "User",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "2",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6768)",
"details": "RSA SigVer",
"indicator": "Module is in normal state",
"testMethod": "RSA signature verification",
"testProps": "RSA 4096 SigVer with SHA2-384",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via SSHv2 encrypted by AES and HMAC",
"sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Secret Input via SSHv2 encrypted by GCM",
"sfiAlgo": "KTS (SSHv2 with AES- GCM)",
"source": "External (Outside of the Module\u0027s Boundary)"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service via Controller",
"method": "Zeroization Method",
"operatorId": "`zeroize-all csp` or Zeroization method via Controller",
"rationale": "The zeroization method will erase all SSPs stored in the DRAM or in the Flash of the module."
},
{
"description": "Zeroization upon session termination",
"method": "Session Termination",
"operatorId": "Terminate session",
"rationale": "Session termination will automatically zeroize all session based temporary SSPs"
},
{
"description": "Zeroization upon rebooting the module",
"method": "Reboot",
"operatorId": "Reboot",
"rationale": "Reboot to zeroize all temporary SSPs stored in volatile memory"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile Memory",
"name": "DRAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile Memory",
"name": "Flash",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-R670-US00",
"modelPartNum": "R670-US Access Point",
"processors": "QCA IPQ5332"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-R670-WW00",
"modelPartNum": "R670-WW Access Point",
"processors": "QCA IPQ5332"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-R770-US00",
"modelPartNum": "R770-US Access Point",
"processors": "QCA IPQ9570"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-R770-WW00",
"modelPartNum": "R770-WW Access Point",
"processors": "QCA IPQ9570"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-T670-US01",
"modelPartNum": "T670-US Access Point",
"processors": "QCA IPQ5332"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-T670-WW00",
"modelPartNum": "T670-WW Access Point",
"processors": "QCA IPQ5332"
},
{
"features": "",
"fwVersion": "7.1.1.3",
"hwVersion": "9F1-T670-US51",
"modelPartNum": "T670sn-US Access Point",
"processors": "QCA IPQ5332"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per section 4 example 1 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG (A6768)"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 4
},
"ECDH": {
"ECDH": 104
},
"ECDSA": {
"ECDSA": 107
}
},
"FF": {
"DH": {
"DH": 28,
"DHE": 1,
"Diffie-Hellman": 1
}
},
"RSA": {
"RSA 3072": 2,
"RSA 4096": 5
}
},
"certification_process": {},
"cipher_mode": {
"GCM": {
"GCM": 25
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 3
}
},
"crypto_protocol": {
"IKE": {
"IKE": 2,
"IKEv2": 24
},
"SSH": {
"SSH": 4,
"SSHv2": 223
},
"TLS": {
"TLS": {
"TLS": 5,
"TLS 1.2": 1,
"TLS v1.2": 6,
"TLS v1.3": 6,
"TLSv1.2": 179,
"TLSv1.3": 178
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 5
},
"MAC": {
"MAC": 3
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 32,
"P-384": 16,
"P-521": 8
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 3,
"#3": 1
}
},
"fips_certlike": {
"Certlike": {
"AES-128": 3,
"AES-192": 2,
"AES-256": 2,
"DRBG 384": 1,
"HMAC- SHA-1": 2,
"HMAC-SHA-1": 14,
"RSA 3072": 2,
"RSA 4096": 5,
"SHA-1": 8,
"SHA2- 256": 9,
"SHA2- 384": 2,
"SHA2- 512": 5,
"SHA2-224": 1,
"SHA2-256": 9,
"SHA2-384": 16,
"SHA2-512": 5,
"SHA3- 256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 3
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 8
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 75
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 11,
"FIPS 180-4": 7,
"FIPS 186-5": 10,
"FIPS 198-1": 6,
"FIPS186-5": 33
},
"ISO": {
"ISO/IEC 19790": 2
},
"NIST": {
"SP 800-108": 1,
"SP 800-135": 5,
"SP 800-140": 1,
"SP 800-140B": 1,
"SP 800-38A": 4,
"SP 800-38C": 2,
"SP 800-38D": 3,
"SP 800-52": 1,
"SP 800-56A": 3,
"SP 800-90A": 1
},
"RFC": {
"RFC 3526": 2,
"RFC 5288": 1,
"RFC 7296": 1,
"RFC 7627": 1,
"RFC7627": 4,
"RFC8446": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 43,
"AES-": 1,
"AES-128": 3,
"AES-192": 2,
"AES-256": 2
},
"CAST": {
"CAST": 72
}
},
"constructions": {
"MAC": {
"HMAC": 32
}
}
},
"tee_name": {
"AMD": {
"PSP": 28
}
},
"tls_cipher_suite": {},
"vendor": {
"Qualcomm": {
"Qualcomm": 6
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"SHA-1A6768",
"ECDSA SigGen (FIPS186-5)A6768",
"SHA2-256A6769",
"HMAC-SHA2-384A6769",
"SHA2-384A6769",
"HMAC-SHA2-512A6769",
"Safe Primes Key GenerationA6768",
"AES-CCMA3239",
"RSA SigVer (FIPS186-5)A6768",
"Counter DRBGA6768",
"ECDSA SigVer (FIPS186-5)A6768",
"KDF IKEv2A6768",
"HMAC-SHA-1A6768",
"KAS-ECC-SSC Sp800-56Ar3A6768",
"TLS v1.3 KDFA6768",
"KAS-FFC-SSC Sp800-56Ar3A6768",
"SHA2-512A6769",
"KDF SP800-108A6768",
"HMAC-SHA2-256A6769",
"KDF SNMPA6768",
"AES-GCMA6768",
"TLS v1.2 KDF RFC7627A6768",
"KDF SSHA6768",
"RSA KeyGen (FIPS186-5)A6768",
"AES-CFB128A6768",
"AES-CBCA6769",
"AES-CTRA6768",
"RSA SigGen (FIPS186-5)A8586"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6768",
"#A3235",
"#A6769",
"#A3239",
"#A8586"
]
},
"policy_metadata": {
"/Author": "Calis, Alexander H. (Fed)",
"/CreationDate": "D:20260626082025-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260626082025-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1256121,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 81
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "d03e0b922e43603a6e85fae9f4e4375455c0cfa517f9e0e9668a9b54b1614173",
"source_hash": "17694955aeb45f9aaccfef023ee5f641cb48c6e118fcec3af4a19d84d3899138",
"txt_hash": "b6f722c9343d8c7d358ce53a89fba7557bb9bd328abb13bb5f764b7dbc18a74f"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section Life-Cycle Assurance of the Security Policy.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/June 2026_080726_0648.pdf",
"date_sunset": "2031-06-29",
"description": "Ruckus WiFi 7 access point portfolio comprises of indoor and outdoor APs that brings higher capacity, efficiency, and performance to enterprises, distributed offices, and small businesses. Ruckus WiFi 7 portfolio offers dual-band, dual-concurrent APs that supports up to eight spatial streams (4x4:4 in 5GHz, 4x4:4 in 2.4GHz). Equipped with OFDMA and MU-MIMO capabilities, the APs efficiently manage up to 1024 client connections with increased capacity, improved coverage and performance in ultra-high dense environments.",
"embodiment": "MultiChipStand",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "RUCKUS R770-US Access Point, R770-WW Access Point, R670-US Access Point, R670-WW Access Point, T670-US Access Point, T670-WW Access Point and T670sn-US Access Point",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-06-30",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Ruckus Wireless LLC",
"vendor_url": "http://www.commscope.com/ruckus"
}
}