RA8M1 Security Management Module

Certificate details

Certificate ID #5556
Status active
Validation dates 19.10.2026 , 27.10.2026
Sunset date 18-10-2031
Standard FIPS 140-3
Security level 2
Type Hardware
Embodiment SingleChip
Caveat No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs; When installed, initialized, and configured as specified in Section 11.1 of the Security Policy
Exceptions
  • Roles, services, and authentication: Level 3
  • Operational environment: N/A
  • Non-invasive security: N/A
  • Sensitive security parameter management: Level 3
  • Life-cycle assurance: Level 3
  • Mitigation of other attacks: N/A
Description RA8M1 Security Management Module is a hardware cryptographic module certified at FIPS 140-3 Security Level 2. RA8M1 is general-purpose microcontroller designed for industrial, IOT, and infrastructure applications, embedded with robust security features. This module is provided as a reference for developing FIPS 140-3-compliant modules using the RA8M1. By referring to the design of this module, it becomes easier to address FIPS requirements when developing cryptographic modules using the RA8M1 in customer environments.
Vendor Renesas Electronics Corporation https://www.renesas.com
Lab ECSEC Laboratory Inc.
Algorithms
  • AES-CBCA7184
  • AES-CCMA7184
  • AES-CMACA7184
  • AES-CTRA7184
  • AES-ECBA7184
  • AES-GCMA7184
  • AES-KWA7184
  • Conditioning Component AES-CBC-MAC SP800-90BA7184
  • Counter DRBGA7184
  • ECDSA KeyGen (FIPS186-5)A7184
  • ECDSA SigGen (FIPS186-5)A7184
  • ECDSA SigVer (FIPS186-5)A7184
  • HMAC-SHA2-256A7184
  • HMAC-SHA2-384A7184
  • HMAC-SHA2-512A7184
  • KDF SP800-108A7184
  • RSA KeyGen (FIPS186-5)A7184
  • RSA SigGen (FIPS186-5)A7184
  • RSA SigVer (FIPS186-5)A7184
  • SHA2-256A7184
  • SHA2-384A7184
  • SHA2-512A7184
References

This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.

Security policy

Extracted keywords

Symmetric Algorithms
AES-256, AES256, AES-128, AES, AES-, CAST, HMAC, CMAC, CBC-MAC
Asymmetric Algorithms
ECDSA
Schemes
MAC
Randomness
DRBG, RNG, RBG
Elliptic Curves
P-256, P-384, P-521
Block cipher modes
CCM

Trusted Execution Environments
PSP

Security level
Level 2

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

No references are available for this certificate.

Processing updates

Feed
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5556,
  "dgst": "cf7dd1665f80520a",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CTRA7184",
        "Counter DRBGA7184",
        "#A7184",
        "HMAC-SHA2-384A7184",
        "RSA SigGen (FIPS186-5)A7184",
        "AES-CMACA7184",
        "AES-CBCA7184",
        "AES-CCMA7184",
        "HMAC-SHA2-256A7184",
        "ECDSA SigVer (FIPS186-5)A7184",
        "AES-GCMA7184",
        "SHA2-256A7184",
        "SHA2-512A7184",
        "ECDSA KeyGen (FIPS186-5)A7184",
        "HMAC-SHA2-512A7184",
        "ECDSA SigGen (FIPS186-5)A7184",
        "SHA2-384A7184",
        "KDF SP800-108A7184",
        "AES-KWA7184",
        "AES-ECBA7184",
        "Conditioning Component AES-CBC-MAC SP800-90BA7184",
        "RSA SigVer (FIPS186-5)A7184",
        "RSA KeyGen (FIPS186-5)A7184"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC, AES-CTR, AES-ECB",
            "cavpCertName": "A7184",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CCM",
            "cavpCertName": "A7184",
            "properties": "Key Length - 128, 256",
            "reference": "SP 800-38C"
          },
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A7184",
            "properties": "Direction - Generation, Verification Key Length - 128, 256",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7184",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A7184",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 256 Payload Length - Payload Length: 128, 256",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Conditioning Component AES-CBC-MAC SP800- 90B",
            "cavpCertName": "A7184",
            "properties": "Key Length - 256 Payload Length - Payload Length: 1024",
            "reference": "SP 800-90B"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A7184",
            "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0 Returned Bits - 128",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A7184",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - extra bits",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A7184",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A7184",
            "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A7184",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 256",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A7184",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 384",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A7184",
            "properties": "MAC - MAC: 512 Key Length - Key Length: 512",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KDF SP800-108",
            "cavpCertName": "A7184",
            "properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC- AES256 Supported Lengths - Supported Lengths: 128, 256 Fixed Data Order - Before Fixed Data Counter Length - 8",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Supports Empty IV - No Requires Empty IV - No Custom Key In Length - 0",
            "reference": ""
          },
          {
            "algorithm": "RSA KeyGen (FIPS186- 5)",
            "cavpCertName": "A7184",
            "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2pow100 q mod 8 - 0 Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186- 5)",
            "cavpCertName": "A7184",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A7184",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "SHA2-256, SHA2-384, SHA2-512",
            "cavpCertName": "A7184",
            "properties": "Message Length - Message Length: 0- 65536 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Initialize the module and Enables use of services.",
            "indicator": "\"Crypt o Firmw are initializ ed succes sfully\" via UART",
            "inputs": "-",
            "name": "Open",
            "outputs": "-",
            "rolesSspAccess": "CO - RTL Key: E - KEK for HUK: G,E,Z - HUK: W - DRBG seed: G - DRBG internal state (V, Key): G,W,E User - RTL Key: E - KEK for HUK: G,E,Z - HUK: W - DRBG seed: G - DRBG internal state (V, Key): G,W,E Unauthenticated - RTL Key: E - KEK for HUK: G,E,Z - HUK: W - DRBG seed: G - DRBG internal state (V, Key): G,W,E",
            "secFunImpl": "KEK for HUK deriving"
          },
          {
            "description": "Disables use of services.",
            "indicator": "none",
            "inputs": "-",
            "name": "Close",
            "outputs": "-",
            "rolesSspAccess": "CO User Unauthenticated",
            "secFunImpl": "None"
          },
          {
            "description": "Challenge response authentication using ECDSA P- 256 Signature verification.",
            "indicator": "P600 Set High",
            "inputs": "User ID; signat ure",
            "name": "User authent ication",
            "outputs": "-",
            "rolesSspAccess": "Unauthenticated - ECDSA-P256-USER- PUBLIC-KEY: E - ECDSA-P256-CO- PUBLIC-KEY: E - DRBG internal state (V, Key): W,E - HUK: E",
            "secFunImpl": "User Authenticati on"
          },
          {
            "description": "Add the new user.",
            "indicator": "none",
            "inputs": "User ID; encry pted ECDS A- P256- USER - PUBLI C- KEY",
            "name": "Add User",
            "outputs": "-",
            "rolesSspAccess": "CO - ECDSA-P256-USER- PUBLIC-KEY: W - KEY-UPDATE-KEY: E - HUK: E - AES-CBC-MAC-KEY: E",
            "secFunImpl": "User key decryption for key update"
          },
          {
            "description": "Delete specified user data",
            "indicator": "none",
            "inputs": "User ID",
            "name": "Delete User",
            "outputs": "-",
            "rolesSspAccess": "CO - ECDSA-P256-CO- PUBLIC-KEY: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Display User List",
            "indicator": "none",
            "inputs": "-",
            "name": "Display User List",
            "outputs": "-",
            "rolesSspAccess": "CO User",
            "secFunImpl": "None"
          },
          {
            "description": "Update the Security Management Firmware",
            "indicator": "none",
            "inputs": "new firmwa re; signat ure",
            "name": "Firmwa re update",
            "outputs": "-",
            "rolesSspAccess": "CO - MCUBOOT_IMAGE_SI GNING_LOAD_KEY: E",
            "secFunImpl": "FW update"
          },
          {
            "description": "Show module version",
            "indicator": "none",
            "inputs": "-",
            "name": "Show module version",
            "outputs": "modu le id / versi on",
            "rolesSspAccess": "CO User Unauthenticated",
            "secFunImpl": "None"
          },
          {
            "description": "Show current module status, logged-in user and error log for self-test.",
            "indicator": "none",
            "inputs": "-",
            "name": "Show module status",
            "outputs": "modu le statu s",
            "rolesSspAccess": "CO User Unauthenticated",
            "secFunImpl": "None"
          },
          {
            "description": "Perform Random number generation",
            "indicator": "\"rando m numbe r:\" via UART",
            "inputs": "-",
            "name": "Rando m numbe r genera tion",
            "outputs": "Rand om numb ers",
            "rolesSspAccess": "CO - DRBG internal state (V, Key): W,E User - DRBG internal state (V, Key): W,E",
            "secFunImpl": "Random Number Generation"
          },
          {
            "description": "Generate AES or HMAC key",
            "indicator": "\"Wrap ped",
            "inputs": "-",
            "name": "Symm etric",
            "outputs": "Wrap ped",
            "rolesSspAccess": "CO - DRBG internal state",
            "secFunImpl": "AES Key Generation"
          },
          {
            "description": "",
            "indicator": "AES- 128 key:\", \"Wrap ped AES- 256 key:\", \"Wrap ped HMAC -256 key:\", \"Wrap ped HMAC -384 key:\", \"Wrap ped HMAC -512 key:\" via UART",
            "inputs": "",
            "name": "key genera tion",
            "outputs": "AES- KEY, Wrap ped HMA C- KEY",
            "rolesSspAccess": "(V, Key): W,E - AES-KEY: G - HMAC-KEY: G - HUK: E",
            "secFunImpl": "HMAC Key Generation KTS User key wrapping"
          },
          {
            "description": "Generate RSA or ECDSA key",
            "indicator": "\"Wrap ped rsa- 2048 private key:\", Wrapp ed rsa- 2048 public key:\", \"Wrap ped rsa- 3072 private key:\", \"Wrap ped rsa- 3072 public key:\", \"Wrap",
            "inputs": "-",
            "name": "Asymm etric key genera tion",
            "outputs": "Wrap ped RSA- PRIV ATE- KEY, Wrap ped RSA- PUB LIC- KEY, Wrap ped ECD SA- PRIV ATE- KEY, Wrap ped ECD SA- PUB",
            "rolesSspAccess": "CO - DRBG internal state (V, Key): W,E - RSA-PRIVATE-KEY: G - RSA-PUBLIC-KEY: G - ECDSA-PRIVATE- KEY: G - ECDSA-PUBLIC-KEY: G - HUK: E",
            "secFunImpl": "RSA Key Pair Generation ECDSA Key Pair Generation KTS User key wrapping"
          },
          {
            "description": "Description",
            "indicator": "Indica tor",
            "inputs": "Input",
            "name": "Name",
            "outputs": "Outp uts",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security"
          },
          {
            "description": "",
            "indicator": "ped rsa- 4096 private key:\", \"Wrap ped rsa- 4096 public key:\", \"Wrap ped ecdsa- p256 private key:\", \"Wrap ped ecdsa- p256 public key:\", \"Wrap ped ecdsa- p384 private key:\", \"Wrap ped ecdsa- p384 public key:\", \"Wrap ped ecdsa- p521 private key:\", \"Wrap ped ecdsa- p521 public key:\" via UART",
            "inputs": "s",
            "name": "",
            "outputs": "LIC- KEY",
            "rolesSspAccess": "",
            "secFunImpl": "Functions"
          },
          {
            "description": "Update the keys(AES/HMA C/RSA/ECDSA) stored in Data Flash",
            "indicator": "None",
            "inputs": "encry pted AES- KEY, encry pted HMAC -KEY, encry pted RSA- PRIV ATE- KEY, encry pted RSA- PUBLI C- KEY, encry pted ECDS A- PRIV ATE- KEY, encry pted ECDS A- PUBLI C-",
            "name": "Key update",
            "outputs": "Wrap ped AES- KEY, Wrap ped HMA C- KEY, Wrap ped RSA- PRIV ATE- KEY, Wrap ped RSA- PUB LIC- KEY, Wrap ped ECD SA- PRIV ATE- KEY, Wrap ped ECD SA- PUB",
            "rolesSspAccess": "CO - AES-KEY: W - HMAC-KEY: W - RSA-PRIVATE-KEY: W - RSA-PUBLIC-KEY: W - ECDSA-PRIVATE- KEY: W - ECDSA-PUBLIC-KEY: W - KEY-UPDATE-KEY: E - HUK: E - AES-CBC-MAC-KEY: E",
            "secFunImpl": "User key decryption for key update KTS User key wrapping"
          },
          {
            "description": "Performe AES ECB/CBC/CTR/ CCM/GCM encryption",
            "indicator": "\"aes enc result:\" , \"aescc m enc result:\" , \"aesgc m enc result:\" via UART",
            "inputs": "KEY Wrapp ed AES- KEY; plain text",
            "name": "AES encrypt ion",
            "outputs": "LIC- KEY ciphe r text",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "AES encryption/ decryption Authenticat ed AES encryption/ decryption KTS User key unwrapping"
          },
          {
            "description": "Performe AES ECB/CBC/CTR/ CCM/GCM decryption",
            "indicator": "\"aes dec result:\" , \"aescc m dec result:\" , \"aesgc m dec result:\" via UART",
            "inputs": "Wrapp ed AES- KEY; cipher text",
            "name": "AES decrypt ion",
            "outputs": "plain text",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "AES encryption/ decryption Authenticat ed AES encryption/ decryption KTS User key unwrapping"
          },
          {
            "description": "Performe AES key wrap",
            "indicator": "\"aesk w wrap result:\" via UART",
            "inputs": "AES- CCM wrapp ed AES- KEY used for wrappi ng, AES- CCM wrapp ed AES- KEY to be wrapp ed",
            "name": "AES KeyWr ap",
            "outputs": "AES- KW wrap ped AES- KEY",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "KTS User key unwrapping KTS Keywrap"
          },
          {
            "description": "Performe AES key unwrap",
            "indicator": "\"aesk w unwra p result:\" via UART",
            "inputs": "AES- CCM wrapp ed AES- KEY used for unwra pping, AES- KW wrapp ed AES- KEY to be",
            "name": "AES KeyUn wrap",
            "outputs": "AES- CCM wrap ped AES- KEY",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "KTS User key wrapping KTS User key unwrapping KTS Keyunwrap"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "unwra pped",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "",
            "secFunImpl": ""
          },
          {
            "description": "Perform AES CMAC generation",
            "indicator": "\"MAC: \" via UART",
            "inputs": "Wrapp ed AES- KEY; messa ge",
            "name": "AES CMAC Genera tion",
            "outputs": "MAC value",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "AES-CMAC generation/ verification KTS User key unwrapping"
          },
          {
            "description": "Perform AES CMAC verification",
            "indicator": "\"MAC: \" via UART",
            "inputs": "Wrapp ed AES- KEY; messa ge; MAC value",
            "name": "AES CMAC Verifica tion",
            "outputs": "\"True \" or \"Fals e\"",
            "rolesSspAccess": "CO - AES-KEY: W,E - HUK: E User - AES-KEY: W,E - HUK: E",
            "secFunImpl": "AES-CMAC generation/ verification KTS User key unwrapping"
          },
          {
            "description": "Perform RSA Signature Generation",
            "indicator": "\"signat ure:\" via UART",
            "inputs": "Wrapp ed RSA- PRIV ATE- KEY; messa ge",
            "name": "RSA Signat ure Genera tion",
            "outputs": "signa ture",
            "rolesSspAccess": "CO - RSA-PRIVATE-KEY: W,E - HUK: E User - RSA-PRIVATE-KEY: W,E - HUK: E",
            "secFunImpl": "RSA Signature Generation and Verification KTS User key unwrapping"
          },
          {
            "description": "Perform RSA Signature Verification",
            "indicator": "\"signat ure:\" via UART",
            "inputs": "Wrapp ed RSA- PUBLI C- KEY; messa ge; signat ure",
            "name": "RSA Signat ure Verifica tion",
            "outputs": "\"True \" or \"Fals e\"",
            "rolesSspAccess": "CO - RSA-PUBLIC-KEY: W,E - HUK: E User - RSA-PUBLIC-KEY: W,E - HUK: E",
            "secFunImpl": "RSA Signature Generation and Verification KTS User key unwrapping"
          },
          {
            "description": "Perform ECDSA Signature Generation",
            "indicator": "\"signat ure:\" via UART",
            "inputs": "Wrapp ed ECDS A- PRIV ATE- KEY; messa ge",
            "name": "ECDS A Signat ure Genera tion",
            "outputs": "signa ture",
            "rolesSspAccess": "CO - ECDSA-PRIVATE- KEY: W,E - HUK: E User - ECDSA-PRIVATE- KEY: W,E - HUK: E",
            "secFunImpl": "ECDSA Signature Generation and Verification KTS User key unwrapping"
          },
          {
            "description": "Perform ECDSA Signature Verification",
            "indicator": "\"signat ure:\" via UART",
            "inputs": "Wrapp ed ECDS A- PUBLI",
            "name": "ECDS A Signat ure",
            "outputs": "\"True \" or \"Fals e\"",
            "rolesSspAccess": "CO - ECDSA-PUBLIC-KEY: W,E - HUK: E User",
            "secFunImpl": "ECDSA Signature Generation and Verification"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "C- KEY; messa ge; signat ure",
            "name": "Verifica tion",
            "outputs": "",
            "rolesSspAccess": "- ECDSA-PUBLIC-KEY: W,E - HUK: E",
            "secFunImpl": "KTS User key unwrapping"
          },
          {
            "description": "Perform HMAC Generation",
            "indicator": "\"MAC: \" via UART",
            "inputs": "Wrapp ed HMAC -KEY; messa ge",
            "name": "HMAC Genera tion",
            "outputs": "MAC value",
            "rolesSspAccess": "CO - HMAC-KEY: W,E - HUK: E User - HMAC-KEY: W,E - HUK: E",
            "secFunImpl": "HMAC generation/ verification KTS User key unwrapping"
          },
          {
            "description": "Perform HMAC Verification",
            "indicator": "\"MAC: \" via UART",
            "inputs": "Wrapp ed HMAC -KEY; messa ge; MAC value",
            "name": "HMAC Verifica tion",
            "outputs": "\"True \" or \"Fals e\"",
            "rolesSspAccess": "CO - HMAC-KEY: W,E - HUK: E User - HMAC-KEY: W,E - HUK: E",
            "secFunImpl": "HMAC generation/ verification KTS User key unwrapping"
          },
          {
            "description": "Perform SHA Hash Generation",
            "indicator": "\"mess age digest: \" via UART",
            "inputs": "messa ge",
            "name": "SHA Hash Genera tion",
            "outputs": "diges t",
            "rolesSspAccess": "CO User",
            "secFunImpl": "SHA"
          },
          {
            "description": "Perform CSP Zeroization",
            "indicator": "P414 Set High",
            "inputs": "-",
            "name": "Zeroiza tion",
            "outputs": "-",
            "rolesSspAccess": "CO - RTL Key: Z - MCUBOOT_IMAGE_SI GNING_LOAD_KEY: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Performe ondemand pre- operational self test",
            "indicator": "none",
            "inputs": "-",
            "name": "pre operati onal self test",
            "outputs": "-",
            "rolesSspAccess": "CO - RTL Key: E - KEK for HUK: G,E - HUK: W User - RTL Key: E - KEK for HUK: G,E - HUK: W Unauthenticated - RTL Key: E - KEK for HUK: G,E - HUK: W",
            "secFunImpl": "KEK for HUK deriving"
          },
          {
            "description": "Perform ondemand conditional self test",
            "indicator": "\"Condi tional test compl eted\"",
            "inputs": "-",
            "name": "On- deman d selftest",
            "outputs": "-",
            "rolesSspAccess": "CO - RTL Key: E - KEK for HUK: G,E,Z - HUK: W - DRBG seed: G - DRBG internal state",
            "secFunImpl": "KEK for HUK deriving"
          },
          {
            "description": "",
            "indicator": "via UART",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "(V, Key): G,W,E User - RTL Key: E - KEK for HUK: G,E,Z - HUK: W - DRBG seed: G - DRBG internal state (V, Key): G,W,E",
            "secFunImpl": ""
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The challenge- response method is implemented for user authentication. When the user authentication service is executed, the module sends a 128-bit challenge. The ECDSA P-256 signature is sent back in response to",
            "mechanism": "User Authentication",
            "name": "Challenge response authentication",
            "perMinute": "The target strength is 1/100,000. Since the module generates a 1 ms wait for each authentication attempt. Therefore, the probability that multiple attacks within a given",
            "strength": "The target strength is 1/1,000,000. The probability that a random attempt will succeed, or a false acceptance will occur depends on the ECDSA P-256 strength."
          },
          {
            "description": "this challenge, and if the signature is correct, the authentication is successful.",
            "mechanism": "",
            "name": "",
            "perMinute": "minute will be successful is 60,000/2^128, which is less than 1/100,000.",
            "strength": "Therefore, the probability is 1/2^128, which is less than 1/1,000,000."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "KDF SP800-108 (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "KDF",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 256 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES CCM enc (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Encrypt",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 128 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES CCM dec (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Decrypt",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 128 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "instantiate function, generate function",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Entropy Source Health Test",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "health test",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "fault detection test",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Encrypt",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 128 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-ECB (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Decrypt",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 128 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigGen (FIPS186- 5) (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Sign",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Signature Type: RSASSA- PKCS1- V1_5, Modulo: 2048, Hash: SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186- 5) (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Verify",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Signature Type: RSASSA- PKCS1- V1_5, Modulo: 2048, Hash: SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Hash",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-512 (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Hash",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-256 (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "HMAC Gen, HMAC Verify",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Key length: 256 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186- 5) (A7184)",
            "condition": "Execution of Open or Execution of On-demand selftest",
            "details": "Sign",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Curve: P- 256, Hash: SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186- 5) (A7184)",
            "condition": "Before Pre- Operational Self-Tests, and Execution of Open or Execution of On-demand selftest",
            "details": "Verify",
            "indicator": "\"Conditional test completed.\" via UART",
            "testMethod": "KAT",
            "testProps": "Curve: P- 256, Hash: SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA KeyGen",
            "condition": "Execution of RSA key pair",
            "details": "Key Pair Gen",
            "indicator": "Output tested key",
            "testMethod": "PCT",
            "testProps": "Key length: 2048, 3072, 4096 bit",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "(FIPS186- 5) (A7184)",
            "condition": "generation services",
            "details": "",
            "indicator": "pair via UART.",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186- 5) (A7184)",
            "condition": "Execution of ECDSA key pair generation services",
            "details": "Key Pair Gen",
            "indicator": "Output tested key pair via UART.",
            "testMethod": "PCT",
            "testProps": "Key length: 256, 384, 521 bit",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "FW Load Test",
            "condition": "Execution of fwupdate command",
            "details": "FW Load Test",
            "indicator": "\"fwupdate success\" via UART",
            "testMethod": "Signature Verify",
            "testProps": "ECDSA p256 signature",
            "type": "SW/FW Load"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "In the case where the self-test executed by FSBL or MCUboot encounters an error.",
            "description": "Error state caused by failure of self-test executed by FSBL or MCUboot",
            "indicator": "P107 Set High",
            "name": "PO Self- Test Error State",
            "recoveryMethod": "power off/on"
          },
          {
            "conditions": "In the case where the self-test executed by User Application encounters an error.",
            "description": "Error state caused by failure of self-test executed by User Application",
            "indicator": "P107 toggles between low and high at 0.5 second intervals",
            "name": "CO Self- Test Error State",
            "recoveryMethod": "power off/on"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "Every month",
            "inspectGuidance": "Confirmation that there is no visual damage",
            "mechanism": "Tamper-evident coating on chip"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [
          {
            "caveat": "no security claimed",
            "name": "AES-128 CBC- MAC",
            "use": "For interoperability, performed along with inputting User key."
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Output of Service Execution",
            "logicalInterface": "Data Output Status Output",
            "physicalPort": "UART TXD"
          },
          {
            "data": "Input for Service Execution",
            "logicalInterface": "Data Input Control Input",
            "physicalPort": "UART RXD"
          },
          {
            "data": "Set High means that Operator is authenticated.",
            "logicalInterface": "Status Output",
            "physicalPort": "P600"
          },
          {
            "data": "Set High means that zeroization is completed.",
            "logicalInterface": "Status Output",
            "physicalPort": "P414"
          },
          {
            "data": "This port is error indicator, Toggle: CO Self-Test Error, Set High: PO Self-Test Error",
            "logicalInterface": "Status Output",
            "physicalPort": "P107"
          },
          {
            "data": "Reset",
            "logicalInterface": "Control Input",
            "physicalPort": "Reset"
          },
          {
            "data": "Clock",
            "logicalInterface": "Control Input",
            "physicalPort": "Clock"
          },
          {
            "data": "3.3V power",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Challenge response authentication",
            "name": "CO",
            "operatorType": "Crypto Officer",
            "type": "Identity"
          },
          {
            "authMethodList": "Challenge response authentication",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "3",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "CRC-32",
            "details": "Firmware integrity test for MCUboot is performed by using CRC32 at every power-on-reset.",
            "indicator": "Input via UART can be accepted",
            "testMethod": "Error Detection Code",
            "testProps": "32 bit",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "ECDSA P256",
            "details": "Firmware integrity test for Security Management Firmware, excluding the",
            "indicator": "Input via UART can",
            "testMethod": "ECDSA P256",
            "testProps": "ECDSA P256, SHA2-256",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "",
            "details": "MCUboot itself, is performed by using ECDSA P256 signaturte verification at every power-on-reset.",
            "indicator": "be accepted",
            "testMethod": "signature verification",
            "testProps": "",
            "type": ""
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Data Flash",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Key update (input)",
            "sfiAlgo": "User key decryption",
            "source": "UART"
          },
          {
            "dest": "",
            "distribution": "",
            "entry": "",
            "format": "",
            "name": "",
            "sfiAlgo": "for key update",
            "source": ""
          },
          {
            "dest": "UART",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Key update (output)",
            "sfiAlgo": "KTS User key wrapping",
            "source": "Data Flash"
          },
          {
            "dest": "RAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Cryptographic service parameter (input)",
            "sfiAlgo": "KTS User key unwrapping",
            "source": "UART"
          },
          {
            "dest": "Data Flash",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Add User (input)",
            "sfiAlgo": "User key decryption for key update",
            "source": "UART"
          },
          {
            "dest": "UART",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Key generation (output)",
            "sfiAlgo": "KTS User key wrapping",
            "source": "RSIP- E51 Internal register"
          },
          {
            "dest": "UART",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES KeyWrap(output)",
            "sfiAlgo": "KTS Keywrap",
            "source": "UART"
          },
          {
            "dest": "UART",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "AES KeyUnwrap(input)",
            "sfiAlgo": "KTS Keyunwrap",
            "source": "UART"
          },
          {
            "dest": "Data Flash",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Initialization Process (input)",
            "sfiAlgo": "User key decryption for key update",
            "source": "UART"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Erase the Code Flash area containing the RSIP driver that includes the \u0027RTL Key\u0027, which serves as the root of SSP protection. Additionally, erase the Data Flash area containing the \u0027MCUBOOT_IMAGE_SIGNING_LOAD_KEY\u0027, which is a public key for the firmware load test.",
            "method": "Zeroization Service",
            "operatorId": "CO",
            "rationale": "Overwrite the flash area with 0xFF."
          },
          {
            "description": "The SSP held in the RSIP-E51 internal register is volatilized by cutting power with power off/on. Additionally, when the initialization process is performed, RSIP-E51 internal register is set to \"0\". Turning the power off and on triggers the initialization process as zeroization.",
            "method": "power off/on",
            "operatorId": "CO, User",
            "rationale": "Clear RSIP-E51 internal register to 0"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Flash memory for code store",
            "name": "Code Flash",
            "persistance": "Static"
          },
          {
            "description": "Flash memory for data store",
            "name": "Data Flash",
            "persistance": "Static"
          },
          {
            "description": "Access Restricted Flash Memory",
            "name": "Extra Flash",
            "persistance": "Static"
          },
          {
            "description": "Internal registers of RSIP",
            "name": "RSIP-E51 Internal register",
            "persistance": "Dynamic"
          },
          {
            "description": "RAM",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "",
            "fwVersion": "Security Management Firmware version: 1.01, FSBL: R7FA8M1AHECBD, Boot Firmware Version: V3.6.32",
            "hwVersion": "R7FA8M1AHECBD",
            "modelPartNum": "RA8M1 Security Management Module",
            "processors": "Arm\u00ae Cortex\u00ae- M85"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Symmetric and Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "SP800-133r2 Section 4, example1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECDSA": {
            "ECDSA": 47
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CCM": {
          "CCM": 8
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {},
      "crypto_scheme": {
        "MAC": {
          "MAC": 12
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 14,
          "P-384": 10,
          "P-521": 10
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES- 128": 1,
          "AES- 256": 1,
          "AES-128": 4,
          "AES-256": 3,
          "AES256": 1,
          "HMAC -256": 2,
          "HMAC -384": 2,
          "HMAC -512": 2,
          "SHA2-224": 4,
          "SHA2-256": 11,
          "SHA2-384": 4,
          "SHA2-512": 5
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 3
        }
      },
      "hash_function": {},
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 32
        },
        "RNG": {
          "RBG": 2,
          "RNG": 1
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 8,
          "FIPS 180-4": 1,
          "FIPS 186-5": 6,
          "FIPS 198-1": 3,
          "FIPS186-5": 11
        },
        "NIST": {
          "SP 800-108": 1,
          "SP 800-38A": 1,
          "SP 800-38B": 1,
          "SP 800-38C": 1,
          "SP 800-38D": 1,
          "SP 800-38F": 1,
          "SP 800-90A": 1,
          "SP 800-90B": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 39,
            "AES-": 28,
            "AES-128": 4,
            "AES-256": 3,
            "AES256": 1
          },
          "CAST": {
            "CAST": 28
          }
        },
        "constructions": {
          "MAC": {
            "CBC-MAC": 1,
            "CMAC": 6,
            "HMAC": 21
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 6
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CTRA7184",
        "Counter DRBGA7184",
        "HMAC-SHA2-384A7184",
        "RSA SigGen (FIPS186-5)A7184",
        "AES-CMACA7184",
        "AES-CBCA7184",
        "AES-CCMA7184",
        "HMAC-SHA2-256A7184",
        "ECDSA SigVer (FIPS186-5)A7184",
        "AES-GCMA7184",
        "SHA2-256A7184",
        "SHA2-512A7184",
        "ECDSA KeyGen (FIPS186-5)A7184",
        "HMAC-SHA2-512A7184",
        "ECDSA SigGen (FIPS186-5)A7184",
        "SHA2-384A7184",
        "KDF SP800-108A7184",
        "AES-KWA7184",
        "AES-ECBA7184",
        "Conditioning Component AES-CBC-MAC SP800-90BA7184",
        "RSA SigVer (FIPS186-5)A7184",
        "RSA KeyGen (FIPS186-5)A7184"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A7184"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261015082316-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261015082316-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 621111,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://www.renesas.com/en/products/microcontrollers-microprocessors/ra-cortex-m-mcus/ek-ra6m4-evaluation-kit-ra6m4-mcu-group"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 38
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "7dff966049c3152fa1f131d5de732f86f1b503192914597970ebe743ee5d183c",
      "source_hash": "ff2182edaa1f0ae96805cea948f467b426aac94fa6c0e27d1e19cc4bc3b61699",
      "txt_hash": "8a7b03119f585b7abb634f5d951f68342a9e2ab0261d123069f3d94c797609dc"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs; When installed, initialized, and configured as specified in Section 11.1 of the Security Policy",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-18",
    "description": "RA8M1 Security Management Module is a hardware cryptographic module certified at FIPS 140-3 Security Level 2. RA8M1 is general-purpose microcontroller designed for industrial, IOT, and infrastructure applications, embedded with robust security features. This module is provided as a reference for developing FIPS 140-3-compliant modules using the RA8M1. By referring to the design of this module, it becomes easier to address FIPS requirements when developing cryptographic modules using the RA8M1 in customer environments.",
    "embodiment": "SingleChip",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Sensitive security parameter management: Level 3",
      "Life-cycle assurance: Level 3",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "RA8M1 Security Management Module",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-19",
        "lab": "ECSEC Laboratory Inc.",
        "validation_type": "Initial"
      },
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-27",
        "lab": "ECSEC Laboratory Inc.",
        "validation_type": "Update"
      }
    ],
    "vendor": "Renesas Electronics Corporation",
    "vendor_url": "https://www.renesas.com"
  }
}