Canonical Ltd. Ubuntu 22.04 Strongswan Cryptographic Module

Certificate details

Certificate ID #4911
Status historical
Historical reason Moved to historical list due to dependency on certificate #4894
Validation dates 03.12.2024
Standard FIPS 140-3
Security level 1
Type Software
Embodiment Multi-Chip Stand Alone
Caveat Interim validation. When installed, initialized and configured as specified in Section 11.1 of the Security Policy with module Canonical Ltd. Ubuntu 22.04 OpenSSL Cryptographic Module validated to FIPS 140-3 under Cert. #4794, operating in the approved mode, and with module Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module validated to FIPS 140-3 under Cert. #4894, operating in the approved mode.
Exceptions
  • Physical security: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description Strongswan IKE daemon implementing the IKEv2 protocol to negotiate the key material for IPSec.
Tested configurations
  • Ubuntu 22.04 on IBM z15 with IBM z15 processor with PAI
  • Ubuntu 22.04 on IBM z15 with IBM z15 processor without PAI
  • Ubuntu 22.04 running on Amazon Web Services (AWS) c6g.metal with AWS Graviton2 processor with PAA
  • Ubuntu 22.04 running on Amazon Web Services (AWS) c6g.metal with AWS Graviton2 processor without PAA
  • Ubuntu 22.04 running on Supermicro SYS-1019P-WTR with Intel Xeon Gold 6226 processor with PAA
  • Ubuntu 22.04 running on Supermicro SYS-1019P-WTR with Intel Xeon Gold 6226 processor without PAA
Vendor Canonical Ltd. http://www.canonical.com
Lab atsec information security corporation
Algorithms
  • AES-CBCA3982
  • AES-CCMA3982
  • AES-GCMA4002
  • Counter DRBGA3970
  • ECDSA KeyGen (FIPS186-4)A4005
  • ECDSA KeyVer (FIPS186-4)A4005
  • ECDSA SigGen (FIPS186-4)A4005
  • ECDSA SigVer (FIPS186-4)A4005
  • HMAC-SHA-1A4017
  • HMAC-SHA2-224A4005
  • HMAC-SHA2-256A4017
  • HMAC-SHA2-384A4017
  • HMAC-SHA2-512/224A4005
  • HMAC-SHA2-512/256A4004
  • HMAC-SHA2-512A4017
  • KAS-ECC-SSC Sp800-56Ar3A4005
  • KAS-FFC-SSC Sp800-56Ar3A3992
  • KDF IKEv2A4017
  • RSA SigGen (FIPS186-4)A4005
  • RSA SigVer (FIPS186-4)A4005
  • Safe Primes Key GenerationA3992
  • Safe Primes Key VerificationA3992
  • SHA-1A4017
  • SHA2-224A4005
  • SHA2-256A4017
  • SHA2-384A4017
  • SHA2-512/224A4005
  • SHA2-512/256A4005
  • SHA2-512A4017
References

This certificate's webpage directly references 2 certificates, transitively this expands into 2 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES, AES-128, AES-192, AES-256, CAST, HMAC, HMAC-SHA-256
Asymmetric Algorithms
ECDH, ECDSA, ECC, DH, Diffie-Hellman
Hash functions
SHA-1, SHA-256, SHA-512, SHA-384, SHA-224, SHA3-224, SHA3-256, SHA3-384, SHA3-512
Schemes
Key Exchange, Key exchange, Key Agreement
Protocols
SSH, TLS, IKEv2, IKE
Randomness
DRBG, RNG
Libraries
OpenSSL
Elliptic Curves
P-224, P-256, P-384, P-521, B-233
Block cipher modes
CBC, CTR, GCM, CCM

Trusted Execution Environments
PSP, SSC

Security level
Level 1

Cross-references

Outgoing
  • 4794 - active - Canonical Ltd. Ubuntu 22.04 OpenSSL Cryptographic Module
  • 4894 - historical - Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module
Title FIPS 140-3 Non-Proprietary Security Policy
Author David Cornwell
Creation date D:20241127183955+00'00'
Modification date D:20241127183955+00'00'
Pages 40
Creator Microsoft Word

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 4911,
  "dgst": "cfce868ee5f75c8b",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "#A3996",
        "AES-CBCA3982",
        "Counter DRBGA3970",
        "HMAC-SHA2-256A4017",
        "Safe Primes Key VerificationA3992",
        "#A3964",
        "#A3972",
        "#A3989",
        "#A3970",
        "SHA2-512/224A4005",
        "RSA SigGen (FIPS186-4)A4005",
        "#A3850",
        "#A3995",
        "#A3975",
        "#A4001",
        "Safe Primes Key GenerationA3992",
        "#A3961",
        "HMAC-SHA2-512/256A4004",
        "#A3962",
        "#A3976",
        "#A3980",
        "#A4005",
        "#A3852",
        "#A3958",
        "#A3857",
        "SHA-1A4017",
        "KDF IKEv2A4017",
        "AES-GCMA4002",
        "#A3994",
        "#A3977",
        "#A3813",
        "ECDSA KeyGen (FIPS186-4)A4005",
        "SHA2-512A4017",
        "KAS-FFC-SSC Sp800-56Ar3A3992",
        "#A3997",
        "HMAC-SHA2-224A4005",
        "#A3812",
        "#A3960",
        "#A3988",
        "HMAC-SHA2-384A4017",
        "#A3963",
        "SHA2-384A4017",
        "SHA2-512/256A4005",
        "#A3851",
        "#A4017",
        "#A3992",
        "ECDSA SigVer (FIPS186-4)A4005",
        "#A3973",
        "#A3999",
        "#A3993",
        "#A4002",
        "ECDSA KeyVer (FIPS186-4)A4005",
        "#A3853",
        "KAS-ECC-SSC Sp800-56Ar3A4005",
        "#A4000",
        "#A3974",
        "RSA SigVer (FIPS186-4)A4005",
        "#A3990",
        "HMAC-SHA2-512/224A4005",
        "#A3979",
        "#A3981",
        "SHA2-224A4005",
        "#A4003",
        "#A3983",
        "HMAC-SHA-1A4017",
        "#A3858",
        "#A3959",
        "SHA2-256A4017",
        "#A3814",
        "HMAC-SHA2-512A4017",
        "#A3998",
        "#A4004",
        "#A3982",
        "#A3832",
        "ECDSA SigGen (FIPS186-4)A4005",
        "AES-CCMA3982"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "22.04"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "4794",
          "4894"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "4794",
          "4894"
        ]
      }
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": [
        "4794",
        "4894"
      ]
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "4794",
          "4894"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "4794",
          "4894"
        ]
      }
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": [
        "4794",
        "4894"
      ]
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 11,
    "br1_tables": null,
    "is_br1_format": false,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 1
          },
          "ECDH": {
            "ECDH": 9
          },
          "ECDSA": {
            "ECDSA": 12
          }
        },
        "FF": {
          "DH": {
            "DH": 25,
            "Diffie-Hellman": 7
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 3
        },
        "CCM": {
          "CCM": 3
        },
        "CTR": {
          "CTR": 1
        },
        "GCM": {
          "GCM": 8
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "OpenSSL": {
          "OpenSSL": 75
        }
      },
      "crypto_protocol": {
        "IKE": {
          "IKE": 23,
          "IKEv2": 45
        },
        "SSH": {
          "SSH": 1
        },
        "TLS": {
          "TLS": {
            "TLS": 1
          }
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 1
        },
        "KEX": {
          "Key Exchange": 3,
          "Key exchange": 2
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "B-233": 1,
          "P-224": 26,
          "P-256": 32,
          "P-384": 24,
          "P-521": 24
        }
      },
      "eval_facility": {
        "atsec": {
          "atsec": 40
        }
      },
      "fips_cert_id": {
        "Cert": {
          "#4794": 1,
          "#4894": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES-128": 1,
          "AES-192": 1,
          "AES-256": 1,
          "HMAC SHA- 256": 2,
          "HMAC SHA-256": 4,
          "HMAC SHA-512": 2,
          "HMAC- SHA-1": 1,
          "HMAC-SHA-256": 6,
          "PKCS#1": 11,
          "RSA PKCS#1": 1,
          "SHA- 224": 2,
          "SHA- 256": 10,
          "SHA- 384": 9,
          "SHA- 512": 7,
          "SHA-1": 16,
          "SHA-224": 6,
          "SHA-256": 18,
          "SHA-384": 5,
          "SHA-512": 9,
          "SHA3- 224": 1,
          "SHA3-224": 1,
          "SHA3-256": 2,
          "SHA3-384": 2,
          "SHA3-512": 2
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA1": {
            "SHA-1": 16
          },
          "SHA2": {
            "SHA-224": 6,
            "SHA-256": 18,
            "SHA-384": 5,
            "SHA-512": 9
          },
          "SHA3": {
            "SHA3-224": 1,
            "SHA3-256": 2,
            "SHA3-384": 2,
            "SHA3-512": 2
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 7
        },
        "RNG": {
          "RNG": 7
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 48,
          "FIPS 180-4": 4,
          "FIPS 186-4": 10,
          "FIPS 186-5": 2,
          "FIPS 1864": 1,
          "FIPS 197": 4,
          "FIPS 198-1": 1,
          "FIPS PUB 140-3": 2
        },
        "ISO": {
          "ISO/IEC 24759": 2
        },
        "NIST": {
          "NIST SP 800-135": 3,
          "SP 800-140B": 1,
          "SP 800-38A": 4,
          "SP 800-38C": 1,
          "SP 800-38D": 3,
          "SP 800-38F": 2,
          "SP 800-90B": 1
        },
        "PKCS": {
          "PKCS#1": 6
        },
        "RFC": {
          "RFC 3526": 1,
          "RFC5282": 1,
          "RFC7296": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 8,
            "AES-128": 1,
            "AES-192": 1,
            "AES-256": 1
          },
          "CAST": {
            "CAST": 12
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 29,
            "HMAC-SHA-256": 3
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 8
        },
        "IBM": {
          "SSC": 3
        }
      },
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-CBCA3982",
        "Counter DRBGA3970",
        "Safe Primes Key VerificationA3992",
        "HMAC-SHA2-256A4017",
        "SHA2-512/224A4005",
        "RSA SigGen (FIPS186-4)A4005",
        "Safe Primes Key GenerationA3992",
        "HMAC-SHA2-512/256A4004",
        "SHA-1A4017",
        "KDF IKEv2A4017",
        "AES-GCMA4002",
        "ECDSA KeyGen (FIPS186-4)A4005",
        "SHA2-512A4017",
        "KAS-FFC-SSC Sp800-56Ar3A3992",
        "HMAC-SHA2-224A4005",
        "HMAC-SHA2-384A4017",
        "SHA2-512/256A4005",
        "SHA2-384A4017",
        "ECDSA SigVer (FIPS186-4)A4005",
        "ECDSA KeyVer (FIPS186-4)A4005",
        "KAS-ECC-SSC Sp800-56Ar3A4005",
        "RSA SigVer (FIPS186-4)A4005",
        "HMAC-SHA2-512/224A4005",
        "SHA2-224A4005",
        "HMAC-SHA-1A4017",
        "SHA2-256A4017",
        "HMAC-SHA2-512A4017",
        "ECDSA SigGen (FIPS186-4)A4005",
        "AES-CCMA3982"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A3996",
        "#A3964",
        "#A3972",
        "#A3989",
        "#A3970",
        "#A3850",
        "#A3995",
        "#A3975",
        "#A4001",
        "#A3961",
        "#A3962",
        "#A3976",
        "#A3958",
        "#A3980",
        "#A4005",
        "#A3857",
        "#A3852",
        "#A3994",
        "#A3977",
        "#A3813",
        "#A3997",
        "#A3812",
        "#A3960",
        "#A3988",
        "#A3963",
        "#A3851",
        "#A4017",
        "#A3992",
        "#A3973",
        "#A3999",
        "#A3993",
        "#A4002",
        "#A3853",
        "#A4000",
        "#A3974",
        "#A3990",
        "#A3979",
        "#A3981",
        "#A4003",
        "#A3983",
        "#A3858",
        "#A3959",
        "#A3814",
        "#A3998",
        "#A4004",
        "#A3982",
        "#A3832"
      ]
    },
    "policy_metadata": {
      "/Author": "David Cornwell",
      "/CreationDate": "D:20241127183955+00\u002700\u0027",
      "/Creator": "Microsoft Word",
      "/ModDate": "D:20241127183955+00\u002700\u0027",
      "/Title": "FIPS 140-3 Non-Proprietary Security Policy",
      "pdf_file_size_bytes": 632165,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf",
          "https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
          "https://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf",
          "http://www.ietf.org/rfc/rfc3447.txt",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf",
          "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf",
          "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-add.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf",
          "http://www.canonical.com/",
          "https://www.ietf.org/rfc/rfc3526.txt",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf",
          "http://www.atsec.com/",
          "https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf",
          "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf",
          "https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf",
          "https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 40
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "d763f5914b37601cd9ac032e830f136d46fd696cca63e19b5d75a1e0f1f49394",
      "source_hash": "5d7091d711f736c65db6638585bca7b32eb8e7d8538d2abb948631cf55aa9db8",
      "txt_hash": "865474c4e06f3f0007efe6be9e5d2704153e24ab5a48856822a60a65c8eaad0e"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "Interim validation. When installed, initialized and configured as specified in Section 11.1 of the Security Policy with module Canonical Ltd. Ubuntu 22.04 OpenSSL Cryptographic Module validated to FIPS 140-3 under Cert. #4794, operating in the approved mode, and with module Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module validated to FIPS 140-3 under Cert. #4894, operating in the approved mode.",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/December 2024_060125_0402.pdf",
    "date_sunset": null,
    "description": "Strongswan IKE daemon implementing the IKEv2 protocol to negotiate the key material for IPSec.",
    "embodiment": "Multi-Chip Stand Alone",
    "exceptions": [
      "Physical security: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": "Moved to historical list due to dependency on certificate #4894",
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {
      "4794": 1,
      "4894": 1
    },
    "module_name": "Canonical Ltd. Ubuntu 22.04 Strongswan Cryptographic Module",
    "module_type": "Software",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "historical",
    "sw_versions": "5.9.5-2ubuntu2.1+Fips1",
    "tested_conf": [
      "Ubuntu 22.04 on IBM z15 with IBM z15 processor with PAI",
      "Ubuntu 22.04 on IBM z15 with IBM z15 processor without PAI",
      "Ubuntu 22.04 running on Amazon Web Services (AWS) c6g.metal with AWS Graviton2 processor with PAA",
      "Ubuntu 22.04 running on Amazon Web Services (AWS) c6g.metal with AWS Graviton2 processor without PAA",
      "Ubuntu 22.04 running on Supermicro SYS-1019P-WTR with Intel Xeon Gold 6226 processor with PAA",
      "Ubuntu 22.04 running on Supermicro SYS-1019P-WTR with Intel Xeon Gold 6226 processor without PAA"
    ],
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2024-12-03",
        "lab": "atsec information security corporation",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Canonical Ltd.",
    "vendor_url": "http://www.canonical.com"
  }
}