This page was not yet optimized for use on mobile devices.
Oracle Linux 9 Kernel Crypto API Cryptographic Module
Known vulnerabilities detected
Our automated heuristics have identified vulnerabilities that may be associated with this certificate. See the CVEs section for details.Certificate details
| Certificate ID | #5036 |
|---|---|
| Status | active |
| Validation dates | 03.07.2025 |
| Sunset date | 02-07-2030 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Caveat | When operated in approved mode. The module generates random strings whose strengths are modified by available entropy. |
| Exceptions |
|
| Description | The Oracle Linux 9 Kernel Crypto API provides a C language API for use by other (kernel space and user space) processes that require cryptographic functionality |
| Vendor | Oracle Corporation http://www.oracle.com |
| Lab | atsec information security corporation |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-128, AES-192, AES-256, CAST, HMAC, HMAC-SHA-512, CMACAsymmetric Algorithms
ECDH, Diffie-Hellman, DHHash functions
SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA512, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHA-3, PBKDF2Schemes
MAC, Key Exchange, Key AgreementProtocols
TLS, IKEv2, IKE, IPsecRandomness
DRBG, RNG, RBGElliptic Curves
P-256, P-384Block cipher modes
ECB, CBC, CTR, CFB, GCM, CCM, XTSTrusted Execution Environments
PSP, SSCSecurity level
Level 1Standards
FIPS 140-3, FIPS PUB 140-3, FIPS 198-1, FIPS186-4, FIPS 186-4, FIPS186-5, FIPS 186-5, FIPS 180-4, FIPS 202, FIPS 197, SP 800-38A, SP 800-38C, SP 800-38B, SP 800-38D, SP 800-38E, SP 800-90A, SP 800-56A, SP 800-38F, SP 800-90B, SP 800-132, PKCS 1, PKCS#1, RFC 4106, RFC 7296, RFC 3526, RFC 5288, RFC 7919, RFC 8446Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.CPE matches
CVE matches
| ID | Links | Severity | CVSS Score | Published on |
|---|---|---|---|---|
| Base score | ||||
| CVE-2022-21505 | MEDIUM | 6.7 | 24.12.2024 | |
| CVE-2023-22024 | MEDIUM | 5.5 | 20.09.2023 | |
| CVE-2025-4598 | MEDIUM | 4.7 | 30.05.2025 |
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5036,
"dgst": "ca306090974ef372",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"SHA3-512A5279",
"SHA3-256A5279",
"AES-GCMA5290",
"#A5285",
"SHA2-256A5297",
"RSA SigVer (FIPS186-5)A5296",
"#A5282",
"KAS-FFC-SSC Sp800-56Ar3A5277",
"SHA3-224A5279",
"HMAC-SHA3-256A5279",
"AES-CBCA5288",
"SHA-1A5297",
"#A5291",
"AES-CFB128A5291",
"AES-CMACA5288",
"#A5288",
"#A5286",
"Safe Primes Key GenerationA5277",
"HMAC-SHA3-224A5279",
"#A5295",
"#A5277",
"AES-OFBA5292",
"#A5278",
"HMAC-SHA-1A5297",
"SHA3-384A5279",
"HMAC-SHA2-384A5296",
"HMAC DRBGA5296",
"HMAC-SHA3-384A5279",
"HMAC-SHA3-512A5279",
"AES-CCMA5288",
"#A5292",
"#A5293",
"AES-XTS Testing Revision 2.0A5288",
"AES-CTRA5288",
"#A5290",
"SHA2-224A5297",
"#A5283",
"#A5287",
"Hash DRBGA5296",
"#A5294",
"AES-GMACA5288",
"AES-CBC-CS3A5293",
"#A5296",
"#A5284",
"#A5280",
"SHA2-384A5296",
"HMAC-SHA2-256A5297",
"#A5297",
"SHA2-512A5296",
"#A5281",
"AES-ECBA5290",
"HMAC-SHA2-224A5297",
"#A5289",
"#A5279",
"Counter DRBGA5290",
"HMAC-SHA2-512A5296",
"RSA SigVer (FIPS186-4)A5296"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"9"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": {
"_type": "Set",
"elements": [
"CVE-2025-4598",
"CVE-2023-22024",
"CVE-2022-21505"
]
},
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A5278, A5285, A5288",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC-CS3",
"cavpCertName": "A5282, A5293",
"properties": "Direction - decrypt, encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A5278, A5288",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CFB128",
"cavpCertName": "A5280, A5291",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A5278, A5288",
"properties": "Direction - Generation, Verification Key Length - 128, 192, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A5278, A5285, A5288",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A5277, A5278, A5283, A5284, A5285, A5286, A5287, A5288, A5289, A5290",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A5278, A5284, A5285, A5287, A5288, A5290",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A5283, A5286, A5289",
"properties": "Direction - Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GMAC",
"cavpCertName": "A5278, A5288",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-OFB",
"cavpCertName": "A5281, A5292",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-XTS Testing Revision 2.0",
"cavpCertName": "A5278, A5285, A5288",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
"reference": "SP 800-38E"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A5277, A5278, A5283, A5284, A5285, A5286, A5287, A5288, A5289, A5290",
"properties": "Prediction Resistance - No, Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - Yes",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A5277, A5278, A5283, A5284, A5285, A5286, A5287, A5288, A5289, A5290, A5294, A5295, A5296",
"properties": "Prediction Resistance - No, Yes Mode - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A5277, A5278, A5283, A5284, A5285, A5286, A5287, A5288, A5289, A5290, A5294, A5295, A5296",
"properties": "Prediction Resistance - No, Yes Mode - SHA-1, SHA2-256, SHA2-512",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-224",
"cavpCertName": "A5279",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-256",
"cavpCertName": "A5279",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-384",
"cavpCertName": "A5279",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-512",
"cavpCertName": "A5279",
"properties": "Key Length - Key Length: 112-524288 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-FFC-SSC Sp800- 56Ar3",
"cavpCertName": "A5277",
"properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 Scheme - dhEphem -",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A5278, A5294, A5295, A5296",
"properties": "Signature Type - PKCS 1.5 Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A5278, A5294, A5295, A5296",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A5277",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296, A5297",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A5277, A5278, A5294, A5295, A5296",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A5279",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A5279",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A5279",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A5279",
"properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 2",
"reference": "FIPS 202"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Compute a message digest",
"indicator": "crypto_shash_init returns 0",
"inputs": "Message",
"name": "Message digest",
"outputs": "Digest value",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Hashing"
},
{
"description": "Wrap a key",
"indicator": "crypto_skcipher_setkey returns 0; crypto_shash_init returns 0",
"inputs": "AES key, key to be wrapped",
"name": "Key wrapping",
"outputs": "wrapped key",
"rolesSspAccess": "Crypto Officer - AES key: W,E - HMAC key: W,E",
"secFunImpl": "Key wrapping"
},
{
"description": "Unwrap a key",
"indicator": "crypto_skcipher_setkey returns 0; crypto_shash_init returns 0",
"inputs": "AES key, key to be unwrapped",
"name": "Key unwrapping",
"outputs": "unwrapped key",
"rolesSspAccess": "Crypto Officer - AES key: W,E - HMAC key: W,E",
"secFunImpl": "Key unwrapping"
},
{
"description": "Encrypt a plaintext",
"indicator": "crypto_skcipher_setkey returns 0",
"inputs": "AES key, plaintext",
"name": "Encryption",
"outputs": "Ciphertext",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Encryption with AES"
},
{
"description": "Decrypt a ciphertext",
"indicator": "crypto_skcipher_setkey returns 0",
"inputs": "AES key, ciphertext",
"name": "Decryption",
"outputs": "Plaintext",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Decryption with AES"
},
{
"description": "Encrypt and authenticate a plaintext",
"indicator": "For all modes except AES GCM: crypto_aead_setkey returns 0; For AES GCM: crypto_aead_get_flags(tfm) has the CRYPTO_TFM_ FIPS_COMPLIANCE flag set",
"inputs": "AES key, plaintext",
"name": "Authenticated encryption",
"outputs": "Ciphertext, MAC tag",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Authenticated encryption with AES"
},
{
"description": "Encrypt and authenticate a ciphertext",
"indicator": "For all modes except AES GCM: crypto_aead_setkey returns 0; For AES GCM: crypto_aead_get_flags(tfm) has the CRYPTO_TFM_ FIPS_COMPLIANCE flag set",
"inputs": "AES key, ciphertext, MAC tag",
"name": "Authenticated decryption",
"outputs": "Plaintext or failure",
"rolesSspAccess": "Crypto Officer - AES key: W,E",
"secFunImpl": "Authenticated decryption with AES"
},
{
"description": "Compute a MAC tag",
"indicator": "crypto_shash_init returns 0",
"inputs": "AES: AES key, message; HMAC: HMAC key, message",
"name": "Message authentication",
"outputs": "MAC tag",
"rolesSspAccess": "Crypto Officer - AES key: W,E - HMAC key: W,E",
"secFunImpl": "Message authentication"
},
{
"description": "Compute a shared secret",
"indicator": "crypto_kpp_compute_shared_secret returns 0",
"inputs": "DH private key, DH remote public key",
"name": "Shared Secret Computation",
"outputs": "Shared secret",
"rolesSspAccess": "Crypto Officer - DH private key: W,E - DH remote public key: W,E - Shared secret: G,R",
"secFunImpl": "KAS-FFC-SSC"
},
{
"description": "Key Pair Generation",
"indicator": "crypto_kpp_set_secret and crypto_kpp_generate_public_key return 0",
"inputs": "Group",
"name": "Key Pair Generation",
"outputs": "DH private key, DH remote public key",
"rolesSspAccess": "Crypto Officer - DH private key: G,R - DH remote public key: G,R - Intermediate",
"secFunImpl": "Safe Primes Key Generation"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key Generation Value: G",
"secFunImpl": ""
},
{
"description": "Generate random bytes",
"indicator": "crypto_rng_get_bytes returns",
"inputs": "Output length",
"name": "Random number generation",
"outputs": "Random bytes",
"rolesSspAccess": "Crypto Officer - Entropy input: W,E - DRBG seed: G,E - DRBG Internal state (V, Key): G,E - DRBG Internal state",
"secFunImpl": "Random number generation with DRBGs"
},
{
"description": "Compute an EDC (crc32, crct10dif)",
"indicator": "None",
"inputs": "Message",
"name": "Error detection",
"outputs": "EDC",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Compress data (deflate, lz4, lz4hc, lzo, zlibdeflate, zstd)",
"indicator": "None",
"inputs": "Data",
"name": "code Compression",
"outputs": "Compressed data",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Use the kernel to perform various non- cryptographic",
"indicator": "None",
"inputs": "Identifier, various arguments",
"name": "Generic system call",
"outputs": "Various return values",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Return the module name and version information",
"indicator": "None",
"inputs": "N/A",
"name": "Show version",
"outputs": "Module name and version",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Return the module status",
"indicator": "None",
"inputs": "N/A",
"name": "Show status",
"outputs": "Module status",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Perform the CASTs and integrity tests",
"indicator": "None",
"inputs": "N/A",
"name": "Self-test",
"outputs": "Pass/fail",
"rolesSspAccess": "Crypto Officer",
"secFunImpl": "Encryption with AES Decryption with AES Hashing Message authentication Random number generation with DRBGs Signature verification with RSA Authenticated encryption with AES Authenticated decryption with AES"
},
{
"description": "Zeroize all SSPs",
"indicator": "None",
"inputs": "Any SSP",
"name": "Zeroization",
"outputs": "N/A",
"rolesSspAccess": "Crypto Officer - AES key: Z - HMAC key: Z - Entropy input: Z - DRBG Internal state (V, Key): Z - DRBG Internal state",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(V, C): Z - DRBG seed: Z - DH remote public key: Z - DH private key: Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "Safe Primes Key Generation (A5277)",
"condition": "Key pair generation",
"details": "SP 800-56Ar3 Section 5.6.2.1.4",
"indicator": "crypto_kpp_g enerate_publi c_key returns 0",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "SHA-1 (A5278)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5294)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5295)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5296)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5278)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5294)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5295)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5296)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5278)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5294)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5295)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5296)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A5278)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A5294)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A5295)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A5296)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5278)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5294)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5295)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5296)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-224 (A5279)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 8, 448 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A5279)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "0, 8, 448 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-384 (A5279)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 8, 448 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-512 (A5279)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 8, 448 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5278)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5283)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5284)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5285)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5286)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5287)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5289)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5290)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5277)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB (A5288)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A5278)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A5285)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC-CS3 (A5293)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-OFB (A5292)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "128 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CFB128 (A5291)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A5278)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A5288)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A5288)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys; 128-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5278)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5283)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5284)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5285)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5286)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5287)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5288)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5289)",
"condition": "Module initialization",
"details": "Encryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A5290)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys, 96-bit IVs",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A5278)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128 and 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-XTS Testing Revision 2.0 (A5288)",
"condition": "Module initialization",
"details": "Encryption, Decryption",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128 and 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CMAC (A5288)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128 and 256 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5278)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5294)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5295)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5296)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5278)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5294)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5295)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5296)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5278)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5294)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5295)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5296)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A5278)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A5294)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A5295)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A5296)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A5278)",
"condition": "Module initialization. Before integrity test.",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A5294)",
"condition": "Module initialization. Before integrity test.",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA3-224 (A5279)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A5295)",
"condition": "Module initialization. Before integrity test.",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A5296)",
"condition": "Module initialization. Before integrity test.",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA3-256 (A5279)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA3-384 (A5279)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA3-512 (A5279)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A5277)",
"condition": "Module initialization",
"details": "Shared secret computation",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "ffdhe2048",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5278)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5283)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5284)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5285)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5286)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5287)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5288)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5289)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5290)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5278)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5283)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5284)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5285)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5286)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5287)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5288)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5289)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5290)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5294)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5295)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5296)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5278)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5283)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5284)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5285)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5286)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5287)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5288)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5289)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5290)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5294)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5295)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5296)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A5278)",
"condition": "Module initialization. Before integrity test.",
"details": "Verify",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "4096-bit key with SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A5294)",
"condition": "Module initialization. Before integrity test.",
"details": "Verify",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "4096-bit key with SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5)",
"condition": "Module initialization. Before integrity test.",
"details": "Verify",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "4096-bit key with SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "(A5295) RSA SigVer (FIPS186-5) (A5296)",
"condition": "Module initialization. Before integrity test.",
"details": "Verify",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "4096-bit key with SHA-256",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source (RCT Start-Up)",
"condition": "Entropy source initialization",
"details": "Entropy source start-up test",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "RCT",
"testProps": "1024 samples",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source (APT Start-Up)",
"condition": "Entropy source initialization",
"details": "Entropy source start-up test",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "APT",
"testProps": "1024 samples",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source (RCT Runtime)",
"condition": "Continuously",
"details": "Entropy source continuous test",
"indicator": "Entropy source is operational",
"testMethod": "RCT",
"testProps": "Cutoff C = 61",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source (APT Runtime)",
"condition": "Continuously",
"details": "Entropy source continuous test",
"indicator": "Entropy source is operational",
"testMethod": "APT",
"testProps": "Cutoff C = 355",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A5277)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "128, 192, 256 bit keys With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "Hash DRBG (A5277)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5277)",
"condition": "Module initialization",
"details": "Seed, Generate",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "SHA-256, SHA512 With/without PR; Health test per section 11.3 of SP 800-90Arev1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5277)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA-1 (A5297)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160, 200 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5277)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-224 (A5297)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5277)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-256 (A5297)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "256, 296 and 640 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-384 (A5277)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5277)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5297)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5277)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512, 1304 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A5297)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5277)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5297)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 512 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A5277)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5277)",
"condition": "Module initialization",
"details": "Message digest",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "0, 24, 448, 832, 896 and 8184 bit messages",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA2-512 (A5277)",
"condition": "Module initialization",
"details": "Message authentication",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "KAT",
"testProps": "160 and 1048 bit keys",
"type": "CAST"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Error State The Linux kernel immediately stops executing Any self-test failure Restart of the module Kernel Panic",
"description": "Error State The Linux kernel immediately stops executing Any self-test failure Restart of the module Kernel Panic",
"indicator": "Error State The Linux kernel immediately stops executing Any self-test failure Restart of the module Kernel Panic",
"name": "Error State The Linux kernel immediately stops executing Any self-test failure Restart of the module Kernel Panic",
"recoveryMethod": "Error State The Linux kernel immediately stops executing Any self-test failure Restart of the module Kernel Panic"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Automatically entered whenever an approved service is requested.",
"name": "Approved mode",
"statusIndicator": "Mapped to approved service indicator in section 4.3 for all approved algorithms except GCM: respective approved service function returns indicator 0. For GCM: crypto_aead_get_flags(tfm) has the CRYPTO_TFM_ FIPS_COMPLIANCE flag set",
"type": "Approved"
},
{
"description": "Automatically entered whenever a non-approved service is requested.",
"name": "Non- approved mode",
"statusIndicator": "No service indicator required for non-approved services per IG 2.4.C",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "AES GCM with external IV",
"use": "Encryption"
},
{
"name": "KBKDF (libkcapi)",
"use": "Key derivation"
},
{
"name": "HKDF (libkcapi)",
"use": "Key derivation"
},
{
"name": "PBKDF2 (libkcapi)",
"use": "Password-based key derivation"
},
{
"name": "RSA",
"use": "Encryption primitive; Decryption primitive"
},
{
"name": "RSA with PKCS#1 v1.5 padding Signature generation (pre-hashed message); Signature verification (pre-hashed message)",
"use": "RSA with PKCS#1 v1.5 padding Signature generation (pre-hashed message); Signature verification (pre-hashed message)"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "AES GCM with external IV",
"description": "Encrypt a plaintext using AES GCM with an external IV",
"name": "AES GCM external IV encryption",
"role": "CO"
},
{
"alg_accessed": "KBKDF (libkcapi) HKDF (libkcapi)",
"description": "Derive a key from a key-derivation key or a shared secret",
"name": "Key derivation",
"role": "CO"
},
{
"alg_accessed": "PBKDF2 (libkcapi)",
"description": "Derive a key from a password",
"name": "Password-based key derivation",
"role": "CO"
},
{
"alg_accessed": "RSA",
"description": "Compute the raw RSA encryption of a plaintext",
"name": "RSA encryption primitive",
"role": "CO"
},
{
"alg_accessed": "RSA",
"description": "Compute the raw RSA decryption of a cipertext",
"name": "RSA decryption primitive",
"role": "CO"
},
{
"alg_accessed": "RSA with PKCS#1 v1.5 padding",
"description": "Generate a digital signature for a pre-hashed message",
"name": "RSA signature generation (pre-hashed message)",
"role": "CO"
},
{
"alg_accessed": "RSA with PKCS#1 v1.5 padding",
"description": "Verify a digital signature for a pre-hashed message",
"name": "RSA signature verification (pre-hashed message)",
"role": "CO"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "API data input parameters, AF_ALG type sockets",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "API output parameters, AF_ALG type sockets",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "API function calls, API control input parameters, AF_ALG type sockets, kernel command line",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "API return values, AF_ALG type sockets, kernel logs",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "None",
"name": "Crypto Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "1",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC-SHA2-512 (A5296)",
"details": "Integrity test for vmlinuz, libkcapi components and sha512hmac binary",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "Message Authentication",
"testProps": "128-bit key",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A5278)",
"details": "Integrity test for kernel object files",
"indicator": "Module becomes operational and services are available for use.",
"testMethod": "Signature Verification",
"testProps": "3072-bit key with SHA-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "Cryptographic module",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API input parameters; AF_ALG_type sockets (input)",
"sfiAlgo": "",
"source": "Operator calling application (TOEPP)"
},
{
"dest": "Operator calling application (TOEPP)",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "API output parameters; AF_ALG type sockets (output)",
"sfiAlgo": "",
"source": "Cryptographic module"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroizes the SSPs contained within the cipher handle",
"method": "Free cipher handle",
"operatorId": "By calling the appropriate zeroization functions: AES key: crypto_free_skcipher and crypto_free_aead; HMAC key: crypto_free_shash and crypto_free_ahash; DRBG internal state: crypto_free_rng; DRBG seed: crypto_free_rng; Entropy input string: crypto_free_rng; DH remote public \u0026 private key: crypto_free_kpp",
"rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded."
},
{
"description": "De-allocates the volatile memory used to store SSPs",
"method": "Power off",
"operatorId": "By removing power",
"rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed. Module power off indicates that the zeroization procedure succeeded. The successful removal of power implicitly indicates that the zeroization is complete."
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Temporary storage for SSPs used by the module as part of service execution",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [
{
"features": "N/A",
"integrityTest": "HMAC-SHA-512; RSA signature verification",
"packageFileName": "/boot/vmlinuz-5.14.0-362.24.1.0.4.el9_3.x86_64; *.ko and *.ko.xz files in /usr/lib/modules/5.14.0- 362.24.1.0.4.el9_3.x86_64/kernel/crypto *.ko and *.ko.xz files in /usr/lib/modules/5.14.0- 362.24.1.0.4.el9_3.x86_64/kernel/arch/x86/crypto; /usr/lib64/libkcapi.so.1.3.1, /usr/bin/sha512hmac",
"swFwVersion": "5.14.0-362.24.1.0.4.el9_3; 1.3.1-3.0.1.el9"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "",
"hypervisorHostOs": "KVM on Oracle Linux 8",
"operatingSystem": "Oracle Linux 9 ORACLE SERVER X9-2c Intel Xeon Platinum 8358",
"paa_pai": "Yes",
"processors": "",
"version": "5.14.0-362.24.1.0.4.el9_3; 1.3.1-3.0.1.el9"
},
{
"hardwarePlatform": "AMD",
"hypervisorHostOs": "KVM on Oracle Linux 8",
"operatingSystem": "Oracle Linux 9 ORACLE SERVER E4-2c",
"paa_pai": "Yes",
"processors": "EPYC 7J13",
"version": "5.14.0-362.24.1.0.4.el9_3; 1.3.1-3.0.1.el9"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "X Series Servers",
"operatingSystem": "Oracle Linux 9"
},
{
"hardwarePlatform": "Oracle",
"operatingSystem": ""
},
{
"hardwarePlatform": "Oracle E Series Servers",
"operatingSystem": "Oracle Linux 9"
}
],
"found": true,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 2
}
},
"FF": {
"DH": {
"DH": 25,
"Diffie-Hellman": 8
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 2
},
"CCM": {
"CCM": 2
},
"CFB": {
"CFB": 1
},
"CTR": {
"CTR": 1
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 18
},
"XTS": {
"XTS": 11
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 1,
"IKEv2": 1
},
"IPsec": {
"IPsec": 6
},
"TLS": {
"TLS": {
"TLS": 4
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 1
},
"KEX": {
"Key Exchange": 1
},
"MAC": {
"MAC": 8
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 2,
"P-384": 2
}
},
"eval_facility": {
"atsec": {
"atsec": 3
}
},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"HMAC-SHA-1": 26,
"HMAC-SHA-512": 2,
"PKCS 1": 1,
"PKCS#1": 12,
"SHA- 512": 1,
"SHA-1": 19,
"SHA-224": 1,
"SHA-256": 33,
"SHA-3": 1,
"SHA-384": 1,
"SHA-512": 1,
"SHA2-224": 13,
"SHA2-256": 15,
"SHA2-384": 11,
"SHA2-512": 13,
"SHA3-224": 3,
"SHA3-256": 3,
"SHA3-384": 3,
"SHA3-512": 3,
"SHA512": 13
}
},
"fips_security_level": {
"Level": {
"Level 1": 2
}
},
"hash_function": {
"PBKDF": {
"PBKDF2": 3
},
"SHA": {
"SHA1": {
"SHA-1": 19
},
"SHA2": {
"SHA-224": 1,
"SHA-256": 33,
"SHA-384": 1,
"SHA-512": 1,
"SHA512": 13
},
"SHA3": {
"SHA-3": 1,
"SHA3-224": 3,
"SHA3-256": 3,
"SHA3-384": 3,
"SHA3-512": 3
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 107
},
"RNG": {
"RBG": 2,
"RNG": 1
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 7,
"FIPS 180-4": 6,
"FIPS 186-4": 5,
"FIPS 186-5": 1,
"FIPS 197": 1,
"FIPS 198-1": 10,
"FIPS 202": 5,
"FIPS PUB 140-3": 2,
"FIPS186-4": 4,
"FIPS186-5": 10
},
"NIST": {
"SP 800-132": 1,
"SP 800-38A": 8,
"SP 800-38B": 2,
"SP 800-38C": 2,
"SP 800-38D": 4,
"SP 800-38E": 3,
"SP 800-38F": 1,
"SP 800-56A": 2,
"SP 800-90A": 3,
"SP 800-90B": 1
},
"PKCS": {
"PKCS 1": 1,
"PKCS#1": 6
},
"RFC": {
"RFC 3526": 1,
"RFC 4106": 2,
"RFC 5288": 1,
"RFC 7296": 1,
"RFC 7919": 1,
"RFC 8446": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 68,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 273
}
},
"constructions": {
"MAC": {
"CMAC": 2,
"HMAC": 41,
"HMAC-SHA-512": 1
}
}
},
"tee_name": {
"AMD": {
"PSP": 1
},
"IBM": {
"SSC": 1
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"SHA3-512A5279",
"SHA3-256A5279",
"AES-GCMA5290",
"SHA2-256A5297",
"RSA SigVer (FIPS186-5)A5296",
"KAS-FFC-SSC Sp800-56Ar3A5277",
"SHA3-224A5279",
"HMAC-SHA3-256A5279",
"AES-CBCA5288",
"SHA-1A5297",
"AES-CFB128A5291",
"AES-CMACA5288",
"Safe Primes Key GenerationA5277",
"HMAC-SHA3-224A5279",
"AES-OFBA5292",
"HMAC-SHA-1A5297",
"SHA3-384A5279",
"HMAC-SHA2-384A5296",
"HMAC DRBGA5296",
"HMAC-SHA3-384A5279",
"HMAC-SHA3-512A5279",
"AES-CCMA5288",
"AES-XTS Testing Revision 2.0A5288",
"AES-CTRA5288",
"SHA2-224A5297",
"Hash DRBGA5296",
"AES-GMACA5288",
"AES-CBC-CS3A5293",
"SHA2-384A5296",
"HMAC-SHA2-256A5297",
"SHA2-512A5296",
"AES-ECBA5290",
"HMAC-SHA2-224A5297",
"Counter DRBGA5290",
"HMAC-SHA2-512A5296",
"RSA SigVer (FIPS186-4)A5296"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A5285",
"#A5282",
"#A5291",
"#A5288",
"#A5286",
"#A5295",
"#A5277",
"#A5278",
"#A5293",
"#A5290",
"#A5283",
"#A5287",
"#A5294",
"#A5296",
"#A5284",
"#A5280",
"#A5297",
"#A5281",
"#A5289",
"#A5292",
"#A5279"
]
},
"policy_metadata": {
"/Author": "",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20250701093007-04\u002700\u0027",
"/Creator": "Acrobat PDFMaker 25 for Word",
"/Keywords": "",
"/ModDate": "D:20250701093128-04\u002700\u0027",
"/Producer": "Adobe PDF Library 25.1.51",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 655210,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf",
"https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
"https://docs.oracle.com/en/operating-systems/oracle-linux/9/fips/index.html#Oracle-Linux-9",
"https://www.ietf.org/rfc/rfc3447.txt",
"https://www.ietf.org/rfc/rfc7919.txt",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
"https://www.ietf.org/rfc/rfc5288.txt",
"https://webstore.ansi.org/standards/ascx9/ansix9422001",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf",
"https://yum.oracle.com/repo/OracleLinux/OL9/3/security/validation/x86_64/index.html",
"https://datatracker.ietf.org/doc/html/rfc4106",
"http://www.oracle.com/",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-add.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf",
"https://datatracker.ietf.org/doc/html/rfc7296",
"https://www.ietf.org/rfc/rfc3526.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf",
"http://www.atsec.com/",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf",
"https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf",
"https://webstore.ansi.org/standards/ascx9/ansix9632001",
"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
"https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf",
"https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf",
"https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
"https://www.ietf.org/rfc/rfc8446.txt",
"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 44
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "44f6a9becd3f82c71ef462b4ea17f6f52a11bbf1b1dc7e5d26a5f2167b505848",
"source_hash": "97af7c304c66a581f0d885dadd7a40c70cbe46cddb4b570d4dc40a4767410ab0",
"txt_hash": "d66ad07628a7d9d96c803fdef03a127751f9c3d53b93b42b3e7ecd125e63e3e9"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. The module generates random strings whose strengths are modified by available entropy.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2025_110825_0311.pdf",
"date_sunset": "2030-07-02",
"description": "The Oracle Linux 9 Kernel Crypto API provides a C language API for use by other (kernel space and user space) processes that require cryptographic functionality",
"embodiment": "Multi-Chip Stand Alone",
"exceptions": [
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Oracle Linux 9 Kernel Crypto API Cryptographic Module",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-07-03",
"lab": "atsec information security corporation",
"validation_type": "Initial"
}
],
"vendor": "Oracle Corporation",
"vendor_url": "http://www.oracle.com"
}
}