Inline Crypto Engine (ICE)

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5565,
  "dgst": "c6ff2896411f8443",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "AES-GCMA7629",
        "#A7627",
        "AES-CMACA7627",
        "AES-GMACA7628",
        "#A7628",
        "KDF SP800-108A7627",
        "#A7629"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A7627",
            "properties": "Direction - Generation Key Length - 256 MAC Length - MAC Length: 128 Message Length - Message Length: 128",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7627",
            "properties": "Direction - Decrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 128, 192, 256, 384, 512, 640, 1024, 2048, 4096, 65536 AAD Length - AAD Length: 64, 96",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7628",
            "properties": "Direction - Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 128, 192, 256, 384, 512, 640, 1024, 2048, 4096, 65536 AAD Length - AAD Length: 64, 96",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7629",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 256 Tag Length - 128 IV Length - IV Length: 96",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Payload Length - Payload Length: 288 AAD Length - AAD Length: 0",
            "reference": ""
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A7627",
            "properties": "Direction - Decrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 AAD Length - AAD Length: 128, 192, 256, 384, 512, 640, 768, 896, 1024, 1152, 1280, 1408, 1536, 1664, 2048, 4096, 8192, 16384, 32768, 65536",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A7628",
            "properties": "Direction - Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 AAD Length - AAD Length: 128, 192, 256, 384, 512, 640, 768, 896, 1024, 1152, 1280, 1408, 1536, 1664, 2048, 4096, 8192, 16384, 32768, 65536",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A7627",
            "properties": "KDF Mode - Counter MAC Mode - CMAC-AES256 Supported Lengths - Supported Lengths: 128-256 Increment 128 Fixed Data Order - Before Fixed Data Counter Length - 32 Supports Empty IV - No Custom Key In Length - 0",
            "reference": "SP 800-108 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Egress packet payload encrypti on for ESP and PSP",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "Plaint ext payloa d",
            "name": "Payload encryption",
            "outputs": "Ciphertext",
            "rolesSspAccess": "Crypto Officer - ESP Encrypti on Key: W,E - PSP Encrypti on Key: W,E - ESP Authenti cation Key: W,E - AES GCM IV: G,E",
            "secFunImpl": "Egress Authenti cated Block Ciper Egress Mesage Authenti cation AES GCM IV Construc tion"
          },
          {
            "description": "Ingress packet payload decrypti on for ESP and PSP",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "Cipher text payloa d",
            "name": "Payload decryption",
            "outputs": "Plaintext",
            "rolesSspAccess": "Crypto Officer - ESP Decrypti on Key: W,E - PSP Decrypti on Key: W,E - ESP Authenti cation Key: W,E - AES GCM IV: G,E",
            "secFunImpl": "Ingress Authenti cated Block Cipher Ingress Message Authenti cation AES GCM IV Construc tion"
          },
          {
            "description": "Encrypt PSP and ESP keys",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "Keys to be encry pted",
            "name": "PSP and ESP Key encryption",
            "outputs": "Encrypted keys",
            "rolesSspAccess": "Crypto Officer - Secure SADB Key: W,E - ESP Encrypti on Key: W,E - PSP Encrypti",
            "secFunImpl": "KTS-1 AES GCM IV Construc tion"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "on Key: W,E - AES GCM IV: G,E",
            "secFunImpl": ""
          },
          {
            "description": "Derive PSP encrypti on key",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "PSP Maste r Key",
            "name": "PSP Key Derivation",
            "outputs": "PSP Encryption Key",
            "rolesSspAccess": "Crypto Officer - PSP Master Key: W,E - PSP Encrypti on Key: G",
            "secFunImpl": "Key Derivatio n"
          },
          {
            "description": "Show the current status of the module",
            "indicator": "Approved mode indicator and successful completion of service; register ICM_FATAL_EC R0.kat_fail set to 0 = Approved mode and register ICM_FATAL_EC R0.kat_fail set to 1 = Hard Error state",
            "inputs": "N/A",
            "name": "Show Status",
            "outputs": "Status (register ICM_FATAL_EC R0.kat_fail set to 0 or register ICM_FATAL_EC R0.kat_fail set to 1 to signify that the module is in the Approved mode and in the Hard Error state respectively)",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Show module ID and version (identifi er to be correlat ed to name)",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "N/A",
            "name": "Show module\u0027s versioning informatio n",
            "outputs": "Hardware version: 0x0000 (decimal: 0); Module ID: 0x494345 (ASCII: ICE)",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Perform the pre- operatio nal and conditio nal self- tests",
            "indicator": "Approved mode indicator and successful completion of service; register ICM_FATAL_EC R0.kat_fail set to 0 = success and register",
            "inputs": "N/A",
            "name": "Perform Self-Tests",
            "outputs": "KAT indicators",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "",
            "indicator": "ICM_FATAL_EC R0.kat_fail set to 1 = failure",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Zeroise; Clear all SSPs via module reset",
            "indicator": "Approved mode indicator and successful completion of service; KAT flags not set to 0 = operational; KAT bits set to 0 = Hard Error",
            "inputs": "Reset signal",
            "name": "Perform zeroisatio n",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer - Secure SADB Key: Z - ESP Encrypti on Key: Z - ESP Authenti cation Key: Z - PSP Encrypti on Key: Z - PSP Master Key: Z - ESP Decrypti on Key: Z - PSP Decrypti on Key: Z - AES GCM IV: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Module initializa tion",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "Reset signal",
            "name": "Initializatio n",
            "outputs": "Status of self-test execution at boot, indicator",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Diagosti c function s perform ed by the module",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "-",
            "name": "Diagnostic functions",
            "outputs": "Diagnosis/results",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          },
          {
            "description": "Plaintex t transmi ssion of packets through the module",
            "indicator": "Approved mode indicator and successful completion of service",
            "inputs": "Packe ts",
            "name": "Transmit/r eceive plaintext data plane packet",
            "outputs": "Packets",
            "rolesSspAccess": "Crypto Officer",
            "secFunImpl": "None"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES- GCM (A7627)",
            "condition": "On module boot",
            "details": "Decrypt",
            "indicator": "register ICM_FATAL_ECR0.kat _fail set to 0",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAS T"
          },
          {
            "algorithmOrTest": "KDF SP800- 108 (A7627)",
            "condition": "On module boot",
            "details": "Generate/Ver ify",
            "indicator": "register ICM_FATAL_ECR0.kat _fail set to 0",
            "testMethod": "KAT",
            "testProps": "CMAC 256-bit, Counter mode",
            "type": "CAS T"
          },
          {
            "algorithmOrTest": "AES- GCM (A7628)",
            "condition": "On module boot",
            "details": "Encrypt",
            "indicator": "register ICM_FATAL_ECR0.kat _fail set to 0",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAS T"
          },
          {
            "algorithmOrTest": "AES- GCM",
            "condition": "On module boot",
            "details": "Encrypt",
            "indicator": "register ICM_FATAL_ECR0.kat _fail set to 0",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAS T"
          },
          {
            "algorithmOrTest": "(A7629) - Encrypt AES- GCM (A7629) - Decrypt",
            "condition": "On module boot",
            "details": "Decrypt",
            "indicator": "register ICM_FATAL_ECR0.kat _fail set to 0",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAS T"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Conditional Cryptographic Algorithm Self- Test (CAST) failure (covers the Pre-Operational",
            "description": "If any of the conditional self- tests fail, the module will return an error code and",
            "indicator": "register ICM_FATAL_ECR0.kat_fail set to 1",
            "name": "Hard Error",
            "recoveryMethod": "An operator can attempt to reset the state by cycling the power; However, the"
          },
          {
            "conditions": "Firmware Integrity Test failure)",
            "description": "transition to an error state where no functions can be executed",
            "indicator": "",
            "name": "",
            "recoveryMethod": "failure of a self-test may require the module to be replaced"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "None",
            "inspectGuidance": "None",
            "mechanism": "Standard passivation applied on the IN762 SoC; The SOC/single chip is commercial grade in regard to power and voltage ranges, temperature, reliability, and shock and vibration"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Inbound AXI4-Stream Packet data and config packets; Inbound SA entries from DRAM; AXI CSR writes from NMF containing PSP Master Key and Secure SADB Key",
            "logicalInterface": "Data Input",
            "physicalPort": "AMBA (On- chip system bus)"
          },
          {
            "data": "Outbound SA entries to DRAM",
            "logicalInterface": "Data Output",
            "physicalPort": "AMBA (On- chip system bus)"
          },
          {
            "data": "AXI CSR writes from the NMF; Control bits in Ingress packet metadata (PMD) from CXP (crypto packet processor); Control bits in Egress packet metadata (PMD) from FXP (flexible packet processor)",
            "logicalInterface": "Control Input",
            "physicalPort": "AMBA (On- chip system bus)"
          },
          {
            "data": "AXI CSR status output to NMF; Status bits in packet metadata (PMD)",
            "logicalInterface": "Status Output",
            "physicalPort": "AMBA (On- chip system bus)"
          },
          {
            "data": "Provides power to the module",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "None",
            "name": "Crypto Officer",
            "operatorType": "Crypto Officer",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "1",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "N/A",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "1",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-GCM (CAVP Certs. #A7627, #A7628 and A7629) and KDF SP800- 108 (CAVP Cert. A7627) CASTs",
            "details": "AES-GCM and KDF SP800-108 CASTs performed in lieu of the pre- operational firmware integrity test in accordance with AS10.19",
            "indicator": "register ICM_FATAL_ECR0.kat_fail set to 0",
            "testMethod": "CAST",
            "testProps": "256-bits",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "SADB in external DRAM",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output to external DRAM",
            "sfiAlgo": "KTS-1",
            "source": "Internal memory (registers, register files, FIFO buffers, SRAM)"
          },
          {
            "dest": "Internal memory (registers, register files, FIFO buffers, SRAM)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input from SADB in external DRAM",
            "sfiAlgo": "KTS-1",
            "source": "SADB in external DRAM during data plane operations"
          },
          {
            "dest": "Internal memory (registers, register files, FIFO buffers, SRAM)",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Input from on- chip SRAM",
            "sfiAlgo": "KTS-1",
            "source": "On-chip SRAM"
          },
          {
            "dest": "On-chip SRAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Output to on-chip SRAM",
            "sfiAlgo": "KTS-1",
            "source": "Internal memory (registers, register files, FIFO buffers, SRAM)"
          },
          {
            "dest": "Internal memory (registers, register files, FIFO buffers, SRAM)",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Input via CSR write",
            "sfiAlgo": "",
            "source": "Within the SoC, outside the module via a direct internal CSR write"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "All storage points (SRAMs, RFs, Flop) are reset on core reset",
            "method": "Reset",
            "operatorId": "Operator Initiation",
            "rationale": "Memory is cleared on reset"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Ephemeral storage in the module\u0027s internal memory",
            "name": "Internal memory (registers, register files, FIFO buffers, SRAM)",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "None",
            "fwVersion": "N/A",
            "hwVersion": "0",
            "modelPartNum": "IN762 B1, C1 SoC",
            "processors": "N/A"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {},
      "certification_process": {},
      "cipher_mode": {
        "GCM": {
          "GCM": 19
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "IKE": {
          "IKE": 1
        },
        "IPsec": {
          "IPsec": 6
        }
      },
      "crypto_scheme": {
        "MAC": {
          "MAC": 5
        }
      },
      "device_model": {},
      "ecc_curve": {},
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES GCM IV 96": 1
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 4
        }
      },
      "hash_function": {},
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140": 1,
          "FIPS 140-3": 8
        },
        "NIST": {
          "NIST SP 800-108": 1,
          "NIST SP 800-38D": 3,
          "SP 800-108": 1,
          "SP 800-38B": 1,
          "SP 800-38D": 5
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 14,
            "AES-": 4
          },
          "CAST": {
            "CAST": 13
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 1
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 52
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-GCMA7629",
        "AES-CMACA7627",
        "AES-GMACA7628",
        "KDF SP800-108A7627"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A7627",
        "#A7629",
        "#A7628"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261021082222-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261021082222-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 698334,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "http://csrc.nist.gov/groups/STM/cmvp/index.html"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 29
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "5aa743e845f023187195cf6597fa29f8075265028ee975297ad48e3674d37061",
      "source_hash": "4df66f2f5b088d512c1cb908791d077b2482703a092e38b0d2e59da33fc9fd36",
      "txt_hash": "acb5ddf88067badc0cb274606218869fa14abf5c00eb7f5856f18fc10916c062"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-29",
    "description": "The Inline Crypto Engine (ICE) module is comprised of a sub-chip cryptographic subsystem in the Google IN763 SoC. The module provides a cryptographic engine supporting cryptographic offload for IPsec and PSP protocols. The ICE module processes network infrastructure packets in both the Ingress and Egress directions. In addition to providing the cryptographic primitives for the security protocols it also provides packet integrity authentication and anti-replay protection.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Software/Firmware security: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {},
    "module_name": "Inline Crypto Engine (ICE)",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-30",
        "lab": "Acumen Security",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Google, LLC",
    "vendor_url": "http://www.google.com"
  }
}