© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 1 of 82
Ctrl IQ, Inc.
Rocky Linux 8 and 9 NSS Cryptographic Module
FIPS 140-3 Non-Proprietary Security Policy
Prepared by:
atsec information security corporation
4516 Seton Center Pkwy, Suite 250
Austin, TX 78759 Document version: 1.4
www.atsec.com Last update: 2026-05-08
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 2 of 82
Table of Contents
1 General .............................................................................................................................................................5
1.1 Overview.....................................................................................................................................................5
1.2 Security Levels ............................................................................................................................................5
2 Cryptographic Module Specification ...............................................................................................................6
2.1 Description ..................................................................................................................................................6
2.2 Tested and Vendor Affirmed Module Version and Identification ...........................................................7
2.3 Excluded Components ................................................................................................................................8
2.4 Modes of Operation ....................................................................................................................................8
2.5 Algorithms...................................................................................................................................................9
2.6 Security Function Implementations.........................................................................................................19
2.7 Algorithm Specific Information ...............................................................................................................23
2.7.1 AES-GCM IV................................................................................................................................23
2.7.2 Key Derivation using SP 800-132 PBKDF2 ................................................................................24
2.7.3 SP 800-56Ar3 Assurances............................................................................................................25
2.7.4 RSA Approved Modulus Size ......................................................................................................25
2.7.5 Legacy Use....................................................................................................................................25
2.8 RBG and Entropy......................................................................................................................................25
2.9 Key Generation .........................................................................................................................................26
2.10 Key Establishment................................................................................................................................27
2.11 Industry Protocols ................................................................................................................................27
3 Cryptographic Module Interfaces ..................................................................................................................28
3.1 Ports and Interfaces ..................................................................................................................................28
4 Roles, Services, and Authentication...............................................................................................................29
4.1 Authentication Methods...........................................................................................................................29
4.2 Roles...........................................................................................................................................................29
4.3 Approved Services.....................................................................................................................................29
4.4 Non-Approved Services............................................................................................................................37
4.5 External Software/Firmware Loaded .......................................................................................................38
5 Software/Firmware Security ..........................................................................................................................39
5.1 Integrity Techniques.................................................................................................................................39
5.2 Initiate on Demand...................................................................................................................................39
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 3 of 82
6 Operational Environment ..............................................................................................................................40
6.1 Operational Environment Type and Requirements................................................................................40
6.2 Configuration Settings and Restrictions ..................................................................................................40
7 Physical Security ............................................................................................................................................41
7.1 Mechanisms and Actions Required..........................................................................................................41
7.2 EFP/EFT Information ...............................................................................................................................41
7.3 Hardness Testing Temperature Ranges....................................................................................................41
8 Non-Invasive Security....................................................................................................................................42
9 Sensitive Security Parameters Management..................................................................................................43
9.1 Storage Areas.............................................................................................................................................43
9.2 SSP Input-Output Methods ......................................................................................................................43
9.3 SSP Zeroization Methods..........................................................................................................................44
9.4 SSPs............................................................................................................................................................44
9.5 Transitions.................................................................................................................................................51
10 Self-Tests ....................................................................................................................................................53
10.1 Pre-Operational Self-Tests ...................................................................................................................53
10.2 Conditional Self-Tests ..........................................................................................................................54
10.3 Periodic Self-Test Information.............................................................................................................67
10.4 Error States............................................................................................................................................72
10.5 Operator Initiation of Self-Tests ..........................................................................................................73
11 Life-Cycle Assurance .................................................................................................................................74
11.1 Installation, Initialization, and Startup Procedures ............................................................................74
11.2 Administrator Guidance.......................................................................................................................74
11.3 Non-Administrator Guidance ..............................................................................................................74
11.4 End of Life.............................................................................................................................................75
12 Mitigation of Other Attacks.......................................................................................................................76
12.1 Attack List.............................................................................................................................................76
Appendix A Glossary and Abbreviations................................................................................................................77
Appendix B References...........................................................................................................................................79
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 4 of 82
List of Tables
Table 1: Security Levels................................................................................................................................................5
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets) ...............................7
Table 3: Tested Operational Environments - Software, Firmware, Hybrid ..............................................................8
Table 4: Modes List and Description ...........................................................................................................................9
Table 5: Approved Algorithms...................................................................................................................................17
Table 6: Vendor-Affirmed Algorithms......................................................................................................................17
Table 7: Non-Approved, Not Allowed Algorithms...................................................................................................19
Table 8: Security Function Implementations............................................................................................................23
Table 9: Entropy Certificates .....................................................................................................................................25
Table 10: Entropy Sources..........................................................................................................................................26
Table 11: Ports and Interfaces....................................................................................................................................28
Table 12: Roles............................................................................................................................................................29
Table 13: Approved Services......................................................................................................................................36
Table 14: Non-Approved Services .............................................................................................................................38
Table 15: EFP/EFT Information.................................................................................................................................41
Table 16: Hardness Testing Temperatures ................................................................................................................41
Table 17: Storage Areas ..............................................................................................................................................43
Table 18: SSP Input-Output Methods .......................................................................................................................43
Table 19: SSP Zeroization Methods...........................................................................................................................44
Table 20: SSP Table 1 .................................................................................................................................................48
Table 21: SSP Table 2 .................................................................................................................................................51
Table 22: Pre-Operational Self-Tests.........................................................................................................................53
Table 23: Conditional Self-Tests ................................................................................................................................66
Table 24: Pre-Operational Periodic Information......................................................................................................67
Table 25: Conditional Periodic Information .............................................................................................................72
Table 26: Error States .................................................................................................................................................72
List of Figures
Figure 1: Block Diagram...............................................................................................................................................7
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 5 of 82
1 General
1.1 Overview
This document is the non-proprietary FIPS 140-3 Security Policy for version rocky8.20240909 and
rocky9.20240909 of the Rocky Linux 8 and 9 NSS Cryptographic Module. It contains the security rules under
which the module must operate and describes how this module meets the requirements as specified in FIPS
PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1
module.
This Non-Proprietary Security Policy may be reproduced and distributed, but only whole and intact and
including this notice. Other documentation is proprietary to their authors.
1.2 Security Levels
Section Title Security Level
1 General 1
2 Cryptographic module specification 1
3 Cryptographic module interfaces 1
4 Roles, services, and authentication 1
5 Software/Firmware security 1
6 Operational environment 1
7 Physical security N/A
8 Non-invasive security N/A
9 Sensitive security parameter management 1
10 Self-tests 1
11 Life-cycle assurance 1
12 Mitigation of other attacks 1
Overall Level 1
Table 1: Security Levels
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 6 of 82
2 Cryptographic Module Specification
2.1 Description
Purpose and Use:
The Rocky Linux 8 and 9 NSS Cryptographic Module (hereafter referred to as “the module”) is defined as a
software module in a multi-chip standalone embodiment. It provides a C language application program
interface (API) designed to support cross-platform development of security-enabled client and server
applications. Applications built with NSS can support SSLv3, TLS, IKEv2, PKCS#5, PKCS#7, PKCS#11,
PKCS#12, S/MIME, X.509 v3 certificates, and other security standards supporting FIPS 140-3 validated
cryptographic algorithms. It combines a vertical stack of Linux components intended to limit the external
interface each separate component may provide.
Module Type: Software
Module Embodiment: Multi-Chip Standalone
Cryptographic Boundary:
The cryptographic boundary consists only of the libsoftokn3.so and libfreeblpriv3.so libraries along with their
associated integrity check values as listed in Section 2.2. If any other NSS API outside of these two libraries is
invoked, the user is not interacting with the module specified in this Security Policy.
Tested Operational Environment’s Physical Perimeter (TOEPP):
The TOEPP of the module is defined as the general-purpose computer on which the module is installed.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 7 of 82
Figure 1: Block Diagram
2.2 Tested and Vendor Affirmed Module Version and Identification
Tested Module Identification – Hardware:
N/A for this module.
Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets):
Package or File Name Software/ Firmware
Version
Features Integrity Test
libsoftokn3.so,
libfreeblpriv3.so on
Rocky Linux 8
rocky8.20240909 N/A HMAC-SHA-256
libsoftokn3.so,
libfreeblpriv3.so on
Rocky Linux 9
rocky9.20240909 N/A HMAC-SHA-256
Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets)
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 8 of 82
Tested Module Identification – Hybrid Disjoint Hardware:
N/A for this module.
Tested Operational Environments - Software, Firmware, Hybrid:
Operating
System
Hardware Platform Processors PAA/PAI Hypervisor
or Host OS
Version(s)
Rocky
Linux 8
SuperMicro
SuperServer 5039MS
Intel Kaby Lake Xeon
E3-1270 v6
Yes N/A rocky8.20240909
Rocky
Linux 9
SuperMicro
SuperServer 5039MS
Intel Kaby Lake Xeon
E3-1270 v6
Yes N/A rocky9.20240909
Rocky
Linux 8
SuperMicro
SuperServer 5039MS
Intel Kaby Lake Xeon
E3-1270 v6
No N/A rocky8.20240909
Rocky
Linux 9
SuperMicro
SuperServer 5039MS
Intel Kaby Lake Xeon
E3-1270 v6
No N/A rocky9.20240909
Table 3: Tested Operational Environments - Software, Firmware, Hybrid
Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid:
N/A for this module.
2.3 Excluded Components
There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.
2.4 Modes of Operation
Modes List and Description:
Mode
Name
Description Type Status Indicator
Approved Automatically entered
whenever an approved
service is requested.
Approved Equivalent to the indicator of the requested service
(“CKR_OK” for approved DRBG service and
NSC_NSSGetFIPSStatus returns CKS_NSS_FIPS_OK
(1) for all other approved services).
Non-
Approved
Automatically entered
whenever a non-
Non-
Approved
Equivalent to the indicator of the requested service
(NSC_NSSGetFIPSStatus does not return
CKS_NSS_FIPS_OK (1)).
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 9 of 82
Mode
Name
Description Type Status Indicator
approved service is
requested.
Table 4: Modes List and Description
After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the
module automatically transitions to the approved mode. No operator intervention is required to reach this
point.
Mode Change Instructions and Status:
The module automatically switches between the approved and non-approved modes depending on the services
requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the
service that was requested.
2.5 Algorithms
Approved Algorithms:
Algorithm CAVP
Cert
Properties Reference
AES-CBC A5915 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A5917 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A5921 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC A5923 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC-CS1 A5915 Direction - decrypt, encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC-CS1 A5917 Direction - decrypt, encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CBC-CS1 A5921 Direction - decrypt, encrypt
Key Length - 128, 192, 256
SP 800-38A
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 10 of 82
Algorithm CAVP
Cert
Properties Reference
AES-CBC-CS1 A5923 Direction - decrypt, encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CMAC A5915 Direction - Generation
Key Length - 128, 192, 256
SP 800-38B
AES-CMAC A5917 Direction - Generation
Key Length - 128, 192, 256
SP 800-38B
AES-CMAC A5921 Direction - Generation
Key Length - 128, 192, 256
SP 800-38B
AES-CMAC A5923 Direction - Generation
Key Length - 128, 192, 256
SP 800-38B
AES-CTR A5915 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CTR A5917 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CTR A5921 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CTR A5923 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A5915 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A5917 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A5921 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-ECB A5923 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A5915 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 11 of 82
Algorithm CAVP
Cert
Properties Reference
AES-GCM A5917 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
AES-GCM A5918 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
AES-GCM A5921 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
AES-GCM A5923 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
AES-GCM A5924 Direction - Decrypt, Encrypt
IV Generation - External, Internal
Key Length - 128, 192, 256
IV Generation Mode - 8.2.1, 8.2.2
SP 800-38D
AES-KW A5915 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KW A5917 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KW A5921 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KW A5923 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KWP A5915 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KWP A5917 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 12 of 82
Algorithm CAVP
Cert
Properties Reference
AES-KWP A5921 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
AES-KWP A5923 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38F
ECDSA KeyGen
(FIPS186-5)
A5915 Curve - P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyGen
(FIPS186-5)
A5921 Curve - P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A5915 Curve - P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-
512
Component - No
FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A5921 Curve - P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-
512
Component - No
FIPS 186-5
ECDSA SigVer
(FIPS186-5)
A5915 Curve - P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-
512
FIPS 186-5
ECDSA SigVer
(FIPS186-5)
A5921 Curve - P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-
512
FIPS 186-5
Hash DRBG A5915 Prediction Resistance - No, Yes
Mode - SHA2-256
SP 800-90A
Rev. 1
Hash DRBG A5921 Prediction Resistance - No, Yes
Mode - SHA2-256
SP 800-90A
Rev. 1
HMAC-SHA2-
224
A5915 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
224
A5919 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
224
A5921 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 13 of 82
Algorithm CAVP
Cert
Properties Reference
HMAC-SHA2-
224
A5925 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
256
A5915 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
256
A5919 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
256
A5921 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
256
A5925 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
384
A5915 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
384
A5919 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
384
A5921 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
384
A5925 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
512
A5915 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
512
A5919 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
512
A5921 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
HMAC-SHA2-
512
A5925 Key Length - Key Length: 112-524288 Increment 8 FIPS 198-1
KAS-ECC-SSC
Sp800-56Ar3
A5915 Domain Parameter Generation Methods - P-256, P-384, P-521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 14 of 82
Algorithm CAVP
Cert
Properties Reference
KAS-ECC-SSC
Sp800-56Ar3
A5921 Domain Parameter Generation Methods - P-256, P-384, P-521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KAS-FFC-SSC
Sp800-56Ar3
A5915 Domain Parameter Generation Methods - ffdhe2048,
ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048,
MODP-3072, MODP-4096, MODP-6144, MODP-8192
Scheme -
dhEphem -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KAS-FFC-SSC
Sp800-56Ar3
A5921 Domain Parameter Generation Methods - ffdhe2048,
ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048,
MODP-3072, MODP-4096, MODP-6144, MODP-8192
Scheme -
dhEphem -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KDA HKDF
SP800-56Cr2
A5914 Derived Key Length - 2048
Shared Secret Length - Shared Secret Length: 224-8192
Increment 8
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,
SHA2-512
SP 800-56C
Rev. 2
KDA HKDF
SP800-56Cr2
A5920 Derived Key Length - 2048
Shared Secret Length - Shared Secret Length: 224-8192
Increment 8
HMAC Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,
SHA2-512
SP 800-56C
Rev. 2
KDF IKEv2
(CVL)
A5916 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared
Secret Length: 224, 2048, 8192
Derived Keying Material Length - Derived Keying Material
Length: 1056, 3072
Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,
SHA2-512
SP 800-135
Rev. 1
KDF IKEv2
(CVL)
A5922 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared
Secret Length: 224, 2048, 8192
Derived Keying Material Length - Derived Keying Material
Length: 1056, 3072
Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384,
SHA2-512
SP 800-135
Rev. 1
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 15 of 82
Algorithm CAVP
Cert
Properties Reference
KDF SP800-108 A5915 KDF Mode - Counter, Double Pipeline Iteration, Feedback
Supported Lengths - Supported Lengths: 112-4096 Increment
8
SP 800-108
Rev. 1
KDF SP800-108 A5921 KDF Mode - Counter, Double Pipeline Iteration, Feedback
Supported Lengths - Supported Lengths: 112-4096 Increment
8
SP 800-108
Rev. 1
PBKDF A5915 Iteration Count - Iteration Count: 1000-10000 Increment 1
Password Length - Password Length: 8-128 Increment 1
SP 800-132
PBKDF A5921 Iteration Count - Iteration Count: 1000-10000 Increment 1
Password Length - Password Length: 8-128 Increment 1
SP 800-132
RSA KeyGen
(FIPS186-5)
A5915 Key Generation Mode - probable
Modulo - 2048, 3072, 4096, 6144, 8192
Primality Tests - 2pow100
Private Key Format - standard
FIPS 186-5
RSA KeyGen
(FIPS186-5)
A5921 Key Generation Mode - probable
Modulo - 2048, 3072, 4096, 6144, 8192
Primality Tests - 2pow100
Private Key Format - standard
FIPS 186-5
RSA SigGen
(FIPS186-5)
A5915 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5, pss
FIPS 186-5
RSA SigGen
(FIPS186-5)
A5921 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5, pss
FIPS 186-5
RSA SigVer
(FIPS186-2)
A5915 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1536
FIPS 186-4
RSA SigVer
(FIPS186-2)
A5921 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1536
FIPS 186-4
RSA SigVer
(FIPS186-4)
A5915 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024
FIPS 186-4
RSA SigVer
(FIPS186-4)
A5921 Signature Type - PKCS 1.5, PKCSPSS
Modulo - 1024
FIPS 186-4
RSA SigVer
(FIPS186-5)
A5915 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5, pss
FIPS 186-5
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 16 of 82
Algorithm CAVP
Cert
Properties Reference
RSA SigVer
(FIPS186-5)
A5921 Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5, pss
FIPS 186-5
Safe Primes Key
Generation
A5915 Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096,
ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-
4096, MODP-6144, MODP-8192
SP 800-56A
Rev. 3
Safe Primes Key
Generation
A5921 Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096,
ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-
4096, MODP-6144, MODP-8192
SP 800-56A
Rev. 3
SHA2-224 A5915 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A5919 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A5921 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-224 A5925 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A5915 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A5919 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A5921 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-256 A5925 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A5915 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A5919 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-384 A5921 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 17 of 82
Algorithm CAVP
Cert
Properties Reference
SHA2-384 A5925 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A5915 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A5919 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A5921 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
SHA2-512 A5925 Message Length - Message Length: 0-65536 Increment 8
Large Message Sizes - 1, 2, 4, 8
FIPS 180-4
TLS v1.2 KDF
RFC7627 (CVL)
A5915 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 SP 800-135
Rev. 1
TLS v1.2 KDF
RFC7627 (CVL)
A5921 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 SP 800-135
Rev. 1
Table 5: Approved Algorithms
The table above lists all approved cryptographic algorithms of the module, including specific key lengths
employed for approved services in Section 4.3, and implemented modes or methods of operation of the
algorithms.
Vendor-Affirmed Algorithms:
Name Properties Implementation Reference
Symmetric Cryptographic Key
Generation (CKG)
Key
type:Symmetric
N/A SP 800-133r2, section 4,
example 1, and section 6.1
Asymmetric Cryptographic Key
Generation (CKG)
Key
type:Asymmetric
N/A SP 800-133r2, section 4,
example 1
Table 6: Vendor-Affirmed Algorithms
Non-Approved, Allowed Algorithms:
N/A for this module.
Non-Approved, Allowed Algorithms with No Security Claimed:
N/A for this module.
Non-Approved, Not Allowed Algorithms:
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 18 of 82
Name Use and Function
MD2, MD5, SHA-1 Message digest
RC2, RC4, DES, Triple-DES, CDMF, Camellia, SEED, ChaCha20(-
Poly1305)
Encryption, Decryption
AES GCM (external IV) Encryption
CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96 Message authentication
HMAC (MD2, MD5, SHA-1; < 112-bit keys) Message authentication
HMAC/SSLv3 MAC (constant-time implementation) Message authentication
MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512,
DES, Triple-DES, AES, Camellia, SEED, ANS X9.63 KDF, SSL 3
PRF, IKEv1 PRF, TLS 1.0/1.1 KDF, TLS KDF without extended
master secret
Key derivation
KBKDF, HKDF, TLS 1.2 KDF, IKEv2 PRF (< 112-bit keys) Key derivation
KBKDF (MD2, MD5) Key derivation
IKEv2 PRF (MD2, MD5) Key derivation
PKCS#5 PBE, PKCS#12 PBE Password-based key derivation
PBKDF2 (short password; short salt; insufficient iterations; < 112-
bit keys)
Password-based key derivation
J-PAKE Shared secret computation
KAS-FFC-SSC (FIPS 186-type groups) Shared secret computation
X25519 Shared secret computation
RSA (primitive; PKCS#1 v1.5 or PSS with MD2, MD5, SHA-1) Signature generation, Signature
verification
RSA (< 2048-bit keys) Signature generation
RSA (< 1024-bit keys) Signature verification
ECDSA (component) Signature generation, Signature
verification
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 19 of 82
Name Use and Function
RSA (data encryption / decryption) Asymmetric encryption, Asymmetric
decryption
DSA Parameter generation, Parameter
verification, Key pair generation,
Signature generation, Signature
verification
Diffie-Hellman (FIPS 186-type groups) Key pair generation
RSA (< 2048 bits; > 4096 bits) Key pair generation
Ed25519, X25519 Key pair generation
Symmetric key generation (< 112 bits) Secret key generation
Table 7: Non-Approved, Not Allowed Algorithms
The table above lists all the non-approved cryptographic algorithms of the module employed by the non-
approved services in Section 4.4.
2.6 Security Function Implementations
Name Type Description Properties Algorithms
Encryption with
AES
BC-UnAuth Encryption using
AES
Keys:128, 192, 256
bits with 128-256
bits of key strength
AES-CBC: (A5915,
A5917, A5921,
A5923)
AES-CBC-CS1:
(A5915, A5917,
A5921, A5923)
AES-CTR: (A5915,
A5917, A5921,
A5923)
AES-ECB: (A5915,
A5917, A5921,
A5923)
Decryption with
AES
BC-UnAuth Decryption using
AES
Keys:128, 192, 256
bits with 128-256
bits of key strength
AES-CBC: (A5915,
A5917, A5921,
A5923)
AES-CBC-CS1:
(A5915, A5917,
A5921, A5923)
AES-CTR: (A5915,
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 20 of 82
Name Type Description Properties Algorithms
A5917, A5921,
A5923)
AES-ECB: (A5915,
A5917, A5921,
A5923)
Authenticated
Encryption with
AES
BC-Auth Authenticated
encryption using
AES
Keys:128, 192, 256
bits with 128-256
bits of key strength
AES-GCM: (A5915,
A5917, A5918,
A5921, A5923,
A5924)
Authenticated
Decryption with
AES
BC-Auth Authenticated
decryption using
AES
Keys:128, 192, 256
bits with 128-256
bits of key strength
AES-GCM: (A5915,
A5917, A5918,
A5921, A5923,
A5924)
Key Derivation
with PBKDF2
PBKDF Key derivation
using PBKDF2
Derived keys:112-
256 bits
PBKDF: (A5915,
A5921)
Key Derivation
with KBKDF
KBKDF Key derivation
using KBKDF
Derived keys:112-
256 bits
KDF SP800-108:
(A5915, A5921)
Key Derivation
with HKDF
KAS-56CKDF Key derivation
using HKDF
Derived keys:112-
256 bits
KDA HKDF SP800-
56Cr2: (A5914,
A5920)
Key Derivation
with TLS 1.2 KDF
KAS-135KDF Key derivation
using TLS 1.2 KDF
Derived keys:112-
256 bits
TLS v1.2 KDF
RFC7627: (A5915,
A5921)
Key Derivation
with IKEv2 KDF
KAS-135KDF Key derivation
using IKEv2 KDF
Derived keys:112-
256 bits
KDF IKEv2:
(A5916, A5922)
Key Wrapping
with AES
KTS-Wrap Key wrapping
using AES
Keys:128, 192, 256
bits with 128-256
bits of key
strength;
Compliant with IG
D.G
AES-KW: (A5915,
A5917, A5921,
A5923)
AES-KWP: (A5915,
A5917, A5921,
A5923)
Key Unwrapping
with AES
KTS-Wrap Key unwrapping
using AES
Keys:128, 192, 256
bits with 128-256
bits of key
strength;
AES-KW: (A5915,
A5917, A5921,
A5923)
AES-KWP: (A5915,
A5917, A5921,
A5923)
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 21 of 82
Name Type Description Properties Algorithms
Compliant with IG
D.G
AES-GCM: (A5915,
A5917, A5918,
A5921, A5923,
A5924)
Message
Authentication
with HMAC
MAC Message
authentication
using HMAC
Keys:112-256 bits
with 112-256 bits
of key strength
HMAC-SHA2-224:
(A5915, A5919,
A5921, A5925)
HMAC-SHA2-256:
(A5915, A5919,
A5921, A5925)
HMAC-SHA2-384:
(A5915, A5919,
A5921, A5925)
HMAC-SHA2-512:
(A5915, A5919,
A5921, A5925)
Message
Authentication
with CMAC
MAC Message
authentication
using CMAC
Keys:128, 192, 256
bits with 128-256
bits of key strength
AES-CMAC:
(A5915, A5917,
A5921, A5923)
Random Number
Generation with
Hash_DRBG
DRBG Random number
generation using
Hash_DRBG
Hash:SHA2-256 Hash DRBG:
(A5915, A5921)
Shared Secret
Computation with
KAS-ECC-SSC
KAS-SSC Shared secret
computation using
KAS-ECC-SSC
Curves:P-256, P-
384, P-521 with
128, 192 and 256
bits of key
strength;
Compliant with IG
D.F scenario 2(1)
KAS-ECC-SSC
Sp800-56Ar3:
(A5915, A5921)
Shared Secret
Computation with
KAS-FFC-SSC
KAS-SSC Shared secret
computation using
KAS-FFC-SSC
Groups:MODP-
2048, MODP-3072,
MODP-4096,
MODP-6144,
MODP-8192,
ffdhe2048,
ffdhe3072,
ffdhe4096,
ffdhe6144,
ffdhe8192 with
112-200 bits of key
KAS-FFC-SSC
Sp800-56Ar3:
(A5915, A5921)
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 22 of 82
Name Type Description Properties Algorithms
strength;
Compliant with IG
D.F scenario 2(1)
Signature
Generation with
RSA
DigSig-SigGen Signature
generation using
RSA
Keys:2048, 3072,
4096 bits with 112-
150 bits of key
strength
RSA SigGen
(FIPS186-5):
(A5915, A5921)
Signature
Generation with
ECDSA
DigSig-SigGen Signature
generation using
ECDSA
Curves:P-256, P-
384, P-521 with
128, 192 and 256
bits of key strength
ECDSA SigGen
(FIPS186-5):
(A5915, A5921)
Signature
Verification with
RSA
DigSig-SigVer Signature
verification using
RSA
Keys:1024, 1280,
1536, 1792, 2048,
3072, 4096 bits
with 80-150 bits of
key strength
RSA SigVer
(FIPS186-2):
(A5915, A5921)
RSA SigVer
(FIPS186-4):
(A5915, A5921)
RSA SigVer
(FIPS186-5):
(A5915, A5921)
Signature
Verification with
ECDSA
DigSig-SigVer Signature
verification using
ECDSA
Curves:P-256, P-
384, P-521 with
128, 192, 256 bits
of key strength
ECDSA SigVer
(FIPS186-5):
(A5915, A5921)
Symmetric Key
Generation with
Hash_DRBG
CKG Direct symmetric
key generation
using Hash_DRBG
Keys:112-256 bits
with 112-256 bits
of key strength;
Compliant with
SP800-133r2
section 6.1
Hash DRBG:
(A5915, A5921)
Key Pair
Generation with
RSA
AsymKeyPair-
KeyGen
Key pair generation
using RSA
Keys:2048, 3072,
4096 bits with 112-
150 bits of key
strength
RSA KeyGen
(FIPS186-5):
(A5915, A5921)
Key Pair
Generation with
ECDSA
AsymKeyPair-
KeyGen
Key pair generation
using ECDSA
Curves:P-256, P-
384, P-521 with
128, 192 and 256
bits of key strength
ECDSA KeyGen
(FIPS186-5):
(A5915, A5921)
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 23 of 82
Name Type Description Properties Algorithms
Key Pair
Generation with
Safe Primes
AsymKeyPair-
KeyGen
Key pair generation
using Safe Primes
Groups:MODP-
2048, MODP-3072,
MODP-4096,
MODP-6144,
MODP-8192,
ffdhe2048,
ffdhe3072,
ffdhe4096,
ffdhe6144,
ffdhe8192 with
112-200 bits of key
strength
Safe Primes Key
Generation:
(A5915, A5921)
Message Digest
with SHA
SHA Message digest
using SHA
SHA2-224: (A5915,
A5919, A5921,
A5925)
SHA2-256: (A5915,
A5919, A5921,
A5925)
SHA2-384: (A5915,
A5919, A5921,
A5925)
SHA2-512: (A5915,
A5919, A5921,
A5925)
Table 8: Security Function Implementations
2.7 Algorithm Specific Information
2.7.1 AES-GCM IV
The Crypto Officer shall consider the following requirements and restrictions when using the module.
For TLS 1.2, the module offers the AES-GCM implementation and uses the context of Scenario 1 of FIPS 140-3
IG C.H. NSS is compliant with SP 800-52r2 Section 3.3.1 and the mechanism for IV generation is compliant
with RFC 5288.
The module does not implement the TLS protocol. The module’s implementation of AES-GCM is used together
with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol
implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number
of possible values for a given session key.
In the event the module’s power is lost and restored, the consuming application must ensure that a new key for
use with the AES-GCM key encryption or decryption under this scenario shall be established.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 24 of 82
Alternatively, the Crypto Officer can use the module’s API to perform AES-GCM encryption using internal IV
generation that complies with Scenario 2 of the IG C.H. These IVs are always at least 96 bits and generated
using the approved DRBG internal to the module’s boundary.
Additionally, the module offers an internal deterministic IV generation mode compliant with Scenario 3 of
FIPS 140-3 IG C.H. The size of the fixed (name) field used by this IV generation mode is at least 32 bits. The
module then internally generates a 32 bit or longer deterministic non-repetitive counter. The module explicitly
ensures that this counter is monotonically increasing at each invocation of the AES-GCM for the same
encryption key, and that this counter does not exhaust all its possible values. The generated GCM IV is at least
96 bits in length.
In case the module’s power is lost and then restored, a new key for use with the AES-GCM
encryption/decryption shall be established.
Finally, for TLS 1.3, the AES-GCM implementation uses the context of Scenario 5 of FIPS 140-3 IG C.H. The
protocol that provides this compliance is TLS 1.3, defined in RFC 8446 of August 2018, using the cipher-suites
that explicitly select AES-GCM as the encryption/decryption cipher (Appendix B.4 of RFC 8446). The module
supports acceptable AES-GCM cipher suites from Section 3.3.1 of SP800-52r2. TLS 1.3 employs separate 64-bit
sequence numbers, one for protocol records that are received, and one for protocol records that are sent to a
peer. These sequence numbers are set at zero at the beginning of a TLS 1.3 connection and each time when the
AES-GCM key is changed. After reading or writing a record, the respective sequence number is incremented by
one. The protocol specification determines that the sequence number should not wrap, and if this condition is
observed, then the protocol implementation must either trigger a re-key of the session (i.e., a new key for AES-
GCM), or terminate the connection.
In case the module’s power is lost and then restored, a new key for use with the AES-GCM
encryption/decryption shall be established.
2.7.2 Key Derivation using SP 800-132 PBKDF2
The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module
supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used
directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following
requirements shall be met:
• Derived keys shall only be used in storage applications. The MK shall not be used for other purposes.
The module enforces the length of the MK or DPK to be of 112 bits or
more for the service to be approved.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
• The minimum length of the password or passphrase accepted by the module is 8
characters. The probability of guessing the value is estimated to be at most 1/628
= 4 x 10-15
, when the
password is a combination of lowercase, uppercase, and numeric characters. If the password solely
consists of digits, the probability of guessing the value is estimated to be 10-8
. Combined with the
minimum iteration count as described below, this provides an acceptable trade-off between user
experience and security against brute-force attacks.
• A portion of the salt shall be generated randomly using the SP 800-90Ar1 DRBG
provided by the module. The module restricts minimum length to 128 bits.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 25 of 82
• The iteration count shall be selected as large as possible, as long as the time required to generate the
key using the entered password is acceptable for the users. The module only allows minimum iteration
count to be 1000.
2.7.3 SP 800-56Ar3 Assurances
To comply with the assurances found in Section 5.6.2 of SP 800-56Ar3, the operator must use the module
together with an application that implements the TLS protocol. Additionally, the module’s approved Key Pair
Generation service (see Section 4.3) must be used to generate ephemeral FFC or ECC key pairs, or the key pairs
must be obtained from another FIPS-validated module. As part of this service, the module will internally
perform the full public key validation of the generated public key.
The module’s shared secret computation service will internally perform the full public key validation of the
peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 800-56Ar3.
2.7.4 RSA Approved Modulus Size
As allowed by FIPS 140-3 IG C.F, the module implements approved RSA signature verification with 1024, 1280,
1536 and 1792-bit moduli. The 1024-bit modulus has been CAVP tested for RSA signature verification in
compliance with FIPS 186-4, while the 1536-bit modulus has been CAVP tested for RSA signature verification
in compliance with FIPS 186-2. The 1280 and 1792-bit modulus are approved for FIPS 186-2 signature
verification, but are untested as no CAVP testing is available for these moduli.
For all other approved moduli (namely 2048, 3072, and 4096 bit keys) supported by the
module, RSA key pair generation, signature generation, and signature verification are approved and CAVP
tested in compliance with FIPS 186-5.
2.7.5 Legacy Use
Digital signature using RSA with 1024, 1280, 1536, 1792-bit moduli is allowed for legacy use only.
These legacy algorithms can only be used on data that was generated prior to the Legacy Date specified in FIPS
140-3 IG C.M.
2.8 RBG and Entropy
Cert
Number
Vendor
Name
E210 Ctrl IQ, Inc.
Table 9: Entropy Certificates
Name Type Operational Environment Sample
Size
Entropy
per
Sample
Conditioning
Component
Rocky Linux Userspace
CPU Time Jitter RNG
Entropy Source
Non-
Physical
Rocky Linux 8 on Intel Xeon E3-
1270 v6; Rocky Linux 9 on Intel
Xeon E3-1270 v6
256
bits
256 bits SHA3-256
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 26 of 82
Table 10: Entropy Sources
The module employs a Deterministic Random Bit Generator (DRBG) implementation based on SP 800-90Ar1.
This DRBG is used internally by the module (e.g. to generate symmetric keys, seeds for asymmetric key pairs,
and random numbers for security functions). It can also be accessed using the specified API functions.
The DRBG implemented is a SHA-256 Hash_DRBG, seeded by the entropy source described in the table above.
It does not employ prediction resistance.
The module complies with the Public Use Document for ESV certificate E210 by reading entropy data from the
get_random() function with the GRND_RANDOM flag set, which corresponds to the GetEntropy() conceptual
interface. This function outputs 256 bits of full entropy.
The DRBG is instantiated with a 384-bit entropy input and reseeded with a 256-bits long entropy input.
Outputs of multiple GetEntropy() calls are concatenated to receive the entropy input length greater than 256
bits. The output is truncated to get the entropy input string which is not a multiple of 256.
The operational environment on the ESV certificate is identical to the operating system described in this
document, which implements the entropy source (outside the module’s cryptographic boundary). Thus, the
module is compliant with scenario 1 (b) of IG 9.3.A. There are no maintenance requirements for the entropy
source.
2.9 Key Generation
The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800-133r2.
When random values are required, they are obtained from the SP 800-90Ar1 approved DRBG, compliant with
Section 4 of SP 800-133r2. The following methods are implemented:
• Direct generation of symmetric keys: compliant with SP 800-133r2, Section 6.1.
• Safe primes key pair generation: compliant with SP 800-133r2, Section 5.2, which maps to SP 800-
56Ar3. The method described in Section 5.6.1.1.4 of SP 800-56Ar3 (“Testing Candidates”) is used.
• RSA key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-5. The
method described in Appendix A.1.3 of FIPS 186-5 (“Probable Primes”) is used.
• ECC key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-5. The
method described in Appendix A.2.2 of FIPS 186-5 (“Rejection Sampling”) is used. Note that this
generation method is used to generate ECDSA and KAS-ECC-SSC key pairs.
Additionally, the module implements the following key derivation methods:
• KBKDF: compliant with SP 800-108r1. This implementation can be used to generate secret keys from a
pre-existing key-derivation-key.
• HKDF: compliant with SP 800-56Cr2. This implementation shall only be used to generate secret keys
in the context of an SP 800-56Ar3 key agreement scheme.
• TLS 1.2 KDF, IKEv2 PRF: compliant with SP 800-135r1. These implementations shall only be used to
generate secret keys in the context of the TLS 1.2 and IKEv2 protocols, respectively.
• PBKDF2: compliant with option 1a of SP 800-132. This implementation shall only be used to derive
keys for use in storage applications.
Intermediate key generation values are not output from the module and are explicitly zeroized after processing
the service.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 27 of 82
2.10 Key Establishment
The module provides FFC and ECC shared secret computation (KAS-FFC-SSC and KAS-ECC-SSC) compliant
with SP800-56Ar3, in accordance with scenario 2 (1) of FIPS 140-3 IG D.F.
For KAS-FFC-SSC, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919
(TLS). Note that the module only key pair generation and verification, and shared secret computation. No
other part of the IKE or TLS protocols is implemented (with the exception of the TLS 1.2 KDF and IKEv2 PRF):
IKE (RFC 3526):
• MODP-2048 (ID = 14)
• MODP-3072 (ID = 15)
• MODP-4096 (ID = 16)
• MODP-6144 (ID = 17)
• MODP-8192 (ID = 18)
TLS (RFC 7919):
• ffdhe2048 (ID = 256)
• ffdhe3072 (ID = 257)
• ffdhe4096 (ID = 258)
• ffdhe6144 (ID = 259)
• ffdhe8192 (ID = 260)
The module also provides the following key transport mechanisms:
• Key wrapping using AES-KW and AES-KWP.
• Key wrapping using AES-GCM.
2.11 Industry Protocols
For KAS-FFC-SSC, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919
(TLS) as listed in Section 2.10. Note that the module only implements key pair generation and verification, and
shared secret computation. No other part of the IKE or TLS protocols is implemented (with the exception of the
TLS 1.2 KDF (RFC 7627) and IKEv2 KDF).
TLS 1.2 KDF (RFC 7627) and IKEv2 implementations shall only be used to generate secret keys in the context
of the TLS 1.2 and IKE protocols respectively.
AES-GCM with internal IV generation is offered in the approved mode compliant with TLS 1.2 (RFC 5288) and
TLS 1.3 (RFC 8446). This functionality shall only be used in conjunction with the TLS protocol.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 28 of 82
3 Cryptographic Module Interfaces
3.1 Ports and Interfaces
Physical
Port
Logical
Interface(s)
Data That Passes
N/A Data Input API input parameters
N/A Data Output API output parameters
N/A Control Input API function calls, API input parameters for control input
N/A Status Output API return codes
Table 11: Ports and Interfaces
The logical interfaces are the APIs through which the applications request services. These logical interfaces are
logically separated from each other by the API design. The module does not implement a control output
interface.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 29 of 82
4 Roles, Services, and Authentication
4.1 Authentication Methods
N/A for this module.
The module does not support authentication for roles.
4.2 Roles
Name Type Operator Type Authentication Methods
Crypto Officer Role CO None
Table 12: Roles
No support is provided for multiple concurrent operators or a maintenance role.
4.3 Approved Services
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Encryption Encrypt a
plaintext
CKS_NSS_FIPS_O
K (1)
AES key,
IV,
plaintext
Ciphertext Encryption
with AES
Crypto
Officer
- AES Key:
W,E
Decryption Decrypt a
ciphertext
CKS_NSS_FIPS_O
K (1)
AES key,
IV,
ciphertex
t
Plaintext Decryption
with AES
Crypto
Officer
- AES Key:
W,E
Authenticated
Encryption
Encrypt a
plaintext
CKS_NSS_
FIPS_OK (1)
AES key,
IV,
plaintext
Ciphertext,
MAC tag
Authenticated
Encryption
with AES
Crypto
Officer
- AES Key:
W,E
Authenticated
Decryption
Decrypt a
ciphertext
CKS_NSS_
FIPS_OK (1)
AES key,
IV, MAC
tag,
ciphertex
t
Plaintext
or fail
Authenticated
Decryption
with AES
Crypto
Officer
- AES Key:
W,E
Key
Derivation
from a KDK
Derive a
key from a
key-
CKS_NSS_FIPS_O
K (1)
Key-
derivatio
n key,
Derived
key
Key
Derivation
with KBKDF
Crypto
Officer
- Key-
Derivation
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 30 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
derivation
key
output
length
Key: W,E
- KBKDF
Derived
Key: G
Key
Derivation
from a shared
secret
Derive a
key from a
shared
secret
CKS_NSS_FIPS_O
K (1)
Shared
secret,
output
length
Derived
key
Key
Derivation
with HKDF
Key
Derivation
with TLS 1.2
KDF
Key
Derivation
with IKEv2
KDF
Crypto
Officer
- Shared
Secret: W,E
- HKDF
Derived
Key: G
- TLS
Derived
Key: G
- IKE
Derived
Key: G
Password-
Based Key
Derivation
Derive a
key from a
password
CKS_NSS_FIPS_O
K (1)
Password
, salt,
iteration
count,
output
length
Derived
key
Key
Derivation
with PBKDF2
Crypto
Officer
- Password:
W,E
- PBKDF2
Derived
Key: G
Key
Wrapping
Wrap a
CSP
CKS_NSS_FIPS_O
K (1)
AES key,
any CSP
Wrapped
CSP
Key
Wrapping
with AES
Crypto
Officer
- AES Key:
W,E
Key
Unwrapping
Unwrap a
CSP
CKS_NSS_FIPS_O
K (1)
AES key,
Wrapped
CSP
Any CSP Key
Unwrapping
with AES
Crypto
Officer
- AES Key:
W,E
Message
Authenticatio
n with HMAC
Compute a
MAC tag
CKS_NSS_FIPS_O
K (1)
HMAC
key
MAC tag Message
Authenticatio
n with HMAC
Crypto
Officer
- HMAC
Key: W,E
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 31 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Message
Authenticatio
n with CMAC
Compute a
MAC tag
CKS_NSS_FIPS_O
K (1)
AES key MAC tag Message
Authenticatio
n with CMAC
Crypto
Officer
- AES Key:
W,E
Message
Digest
Compute a
message
digest
CKS_NSS_FIPS_O
K (1)
Message Digest
value
Message
Digest with
SHA
Crypto
Officer
Random
Number
Generation
Generate
random
bytes
CKR_OK Output
length
Random
bytes
Random
Number
Generation
with
Hash_DRBG
Crypto
Officer
- Entropy
Input:
W,E,Z
- DRBG
Seed: G,E,Z
- Internal
State (V, C):
G,W,E
KAS-FFC-SSC
Shared Secret
Computation
Compute a
shared
secret
CKS_NSS_FIPS_O
K (1)
FFC
private
key
(owner),
FFC
public
key
(peer)
Shared
secret
Shared Secret
Computation
with KAS-
FFC-SSC
Crypto
Officer
- FFC
Private Key:
W,E
- FFC
Public Key:
W,E
- Shared
Secret: G
KAS-ECC-SSC
Shared Secret
Computation
Compute a
shared
secret
CKS_NSS_FIPS_O
K (1)
EC
private
key
(owner),
EC public
key
(peer)
Shared
secret
Shared Secret
Computation
with KAS-
ECC-SSC
Crypto
Officer
- EC Private
Key: W,E
- EC Public
Key: W,E
- Shared
Secret: G
Signature
Generation
with RSA
Generate a
signature
CKS_NSS_FIPS_O
K (1)
RSA
private
key,
message
Signature Signature
Generation
with RSA
Crypto
Officer
- RSA
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 32 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Private Key:
W,E
Signature
Generation
with ECDSA
Generate a
signature
CKS_NSS_FIPS_O
K (1)
EC
private
key,
message
Signature Signature
Generation
with ECDSA
Crypto
Officer
- EC Private
Key: W,E
Signature
Verification
with RSA
Verify a
signature
CKS_NSS_FIPS_O
K (1)
RSA
public
key,
message,
signature
Pass/fail Signature
Verification
with RSA
Crypto
Officer
- RSA
Public Key:
W,E
Signature
Verification
with ECDSA
Verify a
signature
CKS_NSS_FIPS_O
K (1)
EC public
key,
message,
signature
Pass/fail Signature
Verification
with ECDSA
Crypto
Officer
- EC Public
Key: W,E
Key Pair
Generation
with Safe
Primes
Generate a
key pair
CKS_NSS_FIPS_O
K (1)
Group FFC public
key, FFC
private key
Key Pair
Generation
with Safe
Primes
Crypto
Officer
- FFC
Private Key:
G
- FFC
Public Key:
G
-
Intermediat
e key
generation
value: G,E,Z
Key Pair
Generation
with RSA
Generate a
key pair
CKS_NSS_FIPS_O
K (1)
Modulus
size
RSA public
key, RSA
private key
Key Pair
Generation
with RSA
Crypto
Officer
- RSA
Private Key:
G
- RSA
Public Key:
G
-
Intermediat
e key
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 33 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
generation
value: G,E,Z
Key Pair
Generation
with ECDSA
Generate a
key pair
CKS_NSS_FIPS_O
K (1)
Curve EC public
key, EC
private key
Key Pair
Generation
with ECDSA
Crypto
Officer
- EC Private
Key: G
- EC Public
Key: G
-
Intermediat
e key
generation
value: G,E,Z
Symmetric
Key
Generation
Generate a
secret key
CKS_NSS_FIPS_O
K (1)
Key size AES key,
HMAC key
or key-
derivation
key
Symmetric
Key
Generation
with
Hash_DRBG
Crypto
Officer
- AES Key:
G
- HMAC
Key: G
- Key-
Derivation
Key: G
Show Version Return the
module
name and
version
informatio
n
None N/A Module
name and
version
informatio
n
None Crypto
Officer
Show Status Return the
module
status
None N/A Module
status
None Crypto
Officer
Self-Test Perform
the CASTs
and
integrity
tests
None N/A Pass/fail Message
Digest with
SHA
Message
Authenticatio
n with HMAC
Encryption
with AES
Crypto
Officer
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 34 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Decryption
with AES
Authenticated
Encryption
with AES
Authenticated
Decryption
with AES
Message
Authenticatio
n with CMAC
Key
Derivation
with KBKDF
Key
Derivation
with HKDF
Key
Derivation
with TLS 1.2
KDF
Key
Derivation
with IKEv2
KDF
Key
Derivation
with PBKDF2
Shared Secret
Computation
with KAS-
FFC-SSC
Shared Secret
Computation
with KAS-
ECC-SSC
Signature
Generation
with RSA
Signature
Verification
with RSA
Signature
Generation
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 35 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
with ECDSA
Signature
Verification
with ECDSA
Zeroization Zeroize all
SSPs
N/A Any SSP None None Crypto
Officer
- AES Key:
Z
- HMAC
Key: Z
- Key-
Derivation
Key: Z
- Shared
Secret: Z
- Password:
Z
- KBKDF
Derived
Key: Z
- PBKDF2
Derived
Key: Z
- HKDF
Derived
Key: Z
- TLS
Derived
Key: Z
- IKE
Derived
Key: Z
- Entropy
Input: Z
- DRBG
Seed: Z
- Internal
State (V, C):
Z
- FFC
Private Key:
Z
- FFC
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 36 of 82
Name Descriptio
n
Indicator Inputs Outputs Security
Functions
SSP Access
Public Key:
Z
- EC Private
Key: Z
- EC Public
Key: Z
- RSA
Private Key:
Z
- RSA
Public Key:
Z
-
Intermediat
e key
generation
value: Z
Table 13: Approved Services
The module provides services to operators that assume the available role. All services are described in detail in
the API documentation (manual pages). For the above table, the convention below applies when specifying the
access permissions (types) that the service has for each SSP.
• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP.
• N/A: The module does not access any SSP or key during its operation.
To interact with the module, a calling application must use the FIPS token APIs provided by libsoftokn3.so. The
FIPS token API layer can be used to retrieve the approved service indicator for the module. This indicator
consists of three independent service indicators:
1. The session indicator, which must be used for all cryptographic services except the key (pair)
generation and key derivation services. It can be accessed by invoking the NSC_NSSGetFIPSStatus
function with the CKT_NSS_SESSION_LAST_CHECK parameter. If the output parameter is set to
CKS_NSS_FIPS_OK (1), the service was approved.
2. The object indicator, which must be used for the key (pair) generation and key derivation services. It
can be accessed by invoking the NSC_NSSGetFIPSStatus function with the
CKT_NSS_OBJECT_CHECK parameter and the output derived key. If the output parameter is set to
CKS_NSS_FIPS_OK (1), the service was approved.
3. The DRBG service indicator, which must be used for the DRBG service. It can be accessed by invoking
the C_SeedRandom or C_GenerateRandom functions. If any of these functions returns CKR_OK, the
service was approved.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 37 of 82
The above-described behavior maps to example scenario 3 of FIPS 140-3 IG 2.4.C.
4.4 Non-Approved Services
Name Description Algorithms Role
Message Digest Compute a message
digest
MD2, MD5, SHA-1 CO
Encryption Encrypt a plaintext RC2, RC4, DES, Triple-DES, CDMF, Camellia, SEED,
ChaCha20(-Poly1305)
AES GCM (external IV)
CO
Decryption Decrypt a ciphertext RC2, RC4, DES, Triple-DES, CDMF, Camellia, SEED,
ChaCha20(-Poly1305)
CO
Message
Authentication
Compute a MAC tag CBC-MAC, AES XCBC-MAC, AES XCBC-MAC-96
HMAC (MD2, MD5, SHA-1; < 112-bit keys)
HMAC/SSLv3 MAC (constant-time implementation)
CO
Key Derivation Derive a key from a
key-derivation key
or a shared secret
MD2, MD5, SHA-1, SHA-224, SHA-256, SHA-384,
SHA-512, DES, Triple-DES, AES, Camellia, SEED, ANS
X9.63 KDF, SSL 3 PRF, IKEv1 PRF, TLS 1.0/1.1 KDF,
TLS KDF without extended master secret
KBKDF, HKDF, TLS 1.2 KDF, IKEv2 PRF (< 112-bit
keys)
KBKDF (MD2, MD5)
IKEv2 PRF (MD2, MD5)
CO
Password-Based
Key Derivation
Derive a key from a
password
PKCS#5 PBE, PKCS#12 PBE
PBKDF2 (short password; short salt; insufficient
iterations; < 112-bit keys)
CO
Shared Secret
Computation
Compute a shared
secret
J-PAKE
KAS-FFC-SSC (FIPS 186-type groups)
X25519
CO
Signature
Generation
Generate a signature DSA
RSA (primitive; PKCS#1 v1.5 or PSS with MD2, MD5,
SHA-1)
RSA (< 2048-bit keys)
ECDSA (component)
CO
Signature
Verification
Verify a signature DSA
RSA (< 1024-bit keys)
ECDSA (component)
CO
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 38 of 82
Name Description Algorithms Role
Asymmetric
Encryption
Encrypt a plaintext RSA (data encryption / decryption) CO
Asymmetric
Decryption
Decrypt a plaintext RSA (data encryption / decryption) CO
Parameter
Generation
Generate domain
parameters
DSA CO
Parameter
Verification
Verify domain
parameters
DSA CO
Key Pair
Generation
Generate a key pair DSA
Diffie-Hellman (FIPS 186-type groups)
RSA (< 2048 bits; > 4096 bits)
Ed25519, X25519
CO
Secret Key
Generation
Generate a secret key Symmetric key generation (< 112 bits) CO
Table 14: Non-Approved Services
The table above lists the non-approved services in this module, the algorithms involved, the roles that can
request the service, and the respective service indicator. In this table, CO specifies the Crypto Officer role.
4.5 External Software/Firmware Loaded
The module does not load external software or firmware.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 39 of 82
5 Software/Firmware Security
5.1 Integrity Techniques
Each software component of the module has an associated HMAC-SHA2-256 integrity check value. The module
makes use of an HMAC key hard-coded within the module to perform the integrity test. The integrity of the
module is verified by comparing the HMAC-SHA2-256 values calculated at run time with the integrity values
embedded in the check (.chk) files that were computed at build time. If the integrity test fails, the module
enters the Power-On Error state.
5.2 Initiate on Demand
Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is
initialized. The integrity tests may be invoked on-demand by unloading and subsequently re-initializing the
module, which will perform (among others) the software integrity tests.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 40 of 82
6 Operational Environment
6.1 Operational Environment Type and Requirements
Type of Operational Environment: Modifiable
How Requirements are Satisfied:
If properly installed, the operating system provides process isolation and memory protection mechanisms that
ensure appropriate separation for memory access among the processes on the system. Each process has control
over its own data and uncontrolled access to the data of other processes is prevented.
6.2 Configuration Settings and Restrictions
The module shall be installed as stated in Section 11.1.
Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other
tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the
operational environment. The use of any of these tools implies that the cryptographic module is running in a
non-validated operational environment.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 41 of 82
7 Physical Security
The module is comprised of software only and therefore this Section is not applicable.
7.1 Mechanisms and Actions Required
N/A for this module.
7.2 EFP/EFT Information
Temp/Voltage
Type
Temperature
or Voltage
EFP
or
EFT
Result
LowTemperature
HighTemperature
LowVoltage
HighVoltage
Table 15: EFP/EFT Information
7.3 Hardness Testing Temperature Ranges
Temperature
Type
Temperature
LowTemperature
HighTemperature
Table 16: Hardness Testing Temperatures
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 42 of 82
8 Non-Invasive Security
This module does not implement any non-invasive security mechanism and therefore this Section is not
applicable.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 43 of 82
9 Sensitive Security Parameters Management
9.1 Storage Areas
Storage
Area
Name
Description Persistence
Type
RAM Temporary storage for SSPs used by the module as part of service execution. The
module does not perform persistent storage of SSPs
Dynamic
Table 17: Storage Areas
SSPs imported, generated, derived, or otherwise established by the module are stored in RAM while the module
is operational. The operator application can use these SSPs to perform cryptographic operations, or export them
as described in Section 9.2.
The module maintains internal separation of the SSPs (including CSPs) in approved and non-approved modes of
operation using an internal isFIPS flag for each SSP. This flag indicates whether the SSP can be used in
approved or non-approved services.
The module does not perform persistent storage of SSPs.
9.2 SSP Input-Output Methods
Name From To Format
Type
Distribution
Type
Entry
Type
SFI or
Algorithm
API input
parameters
(plaintext)
Calling
application
within TOEPP
Cryptographic
module
Plaintext Manual Electronic
API input
parameters
(encrypted)
Calling
application
within TOEPP
Cryptographic
module
Encrypted Manual Electronic Key
Unwrapping
with AES
API output
parameters
(plaintext)
Cryptographic
module
Calling
application
within TOEPP
Plaintext Manual Electronic
API output
parameters
(encrypted)
Cryptographic
module
Calling
application
within TOEPP
Encrypted Manual Electronic Key
Wrapping
with AES
Table 18: SSP Input-Output Methods
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 44 of 82
CSPs (with the exception of passwords) can only be imported to and exported from the module when they are
wrapped using an approved security function (e.g. AES KW or KWP). PSPs can be imported and exported in
plaintext. Import and export is performed using API input and output parameters.
9.3 SSP Zeroization Methods
Zeroization
Method
Description Rationale Operator Initiation
Destroy Object Destroys the SSP
represented by the
object
Memory occupied by SSPs is overwritten
with zeroes, which renders the SSP values
irretrievable. The completion of the
zeroization routine indicates that the
zeroization procedure succeeded.
By calling the
C_DestroyObject
function.
Automatic Automatically
zeroized by the
module when no
longer needed
Memory occupied by SSPs is overwritten
with zeroes, which renders the SSP values
irretrievable.
N/A
Remove power
from the
module
De-allocates the
volatile memory used
to store SSPs
Volatile memory used by the module is
overwritten within nanoseconds when
power is removed. Module power off
indicates that the zeroization procedure
succeeded.
By removing power
Table 19: SSP Zeroization Methods
All data output is inhibited during zeroization.
9.4 SSPs
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
AES Key AES key used
for
encryption,
decryption,
and for
message
authentication
128, 192,
256 bits -
128, 192,
256 bits
Symmetric
key - CSP
Symmetric
Key
Generation
with
Hash_DRBG
Encryption
with AES
Decryption
with AES
Authenticated
Encryption
with AES
Authenticated
Decryption
with AES
Key Wrapping
with AES
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 45 of 82
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
Key
Unwrapping
with AES
Message
Authentication
with CMAC
HMAC Key HMAC key
used for
message
authentication
112-256
bits - 112-
256 bits
Symmetric
key - CSP
Symmetric
Key
Generation
with
Hash_DRBG
Message
Authentication
with HMAC
Key-
Derivation
Key
Symmetric
key used to
derive
symmetric
keys
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Symmetric
Key
Generation
with
Hash_DRBG
Key Derivation
with KBKDF
Shared
Secret
Shared secret
generated by
KAS-ECC-SSC
or KAS-FFC-
SSC
256-8192
bits - 112-
256 bits
Shared
secret - CSP
Shared
Secret
Computation
with KAS-
ECC-SSC
Shared
Secret
Computation
with KAS-
FFC-SSC
Key Derivation
with HKDF
Key Derivation
with TLS 1.2
KDF
Key Derivation
with IKEv2
KDF
Password Password used
to derive
symmetric
keys
8-128
characters
- N/A
Password -
CSP
Key Derivation
with PBKDF2
KBKDF
Derived Key
Symmetric
key derived
from a key-
derivation key
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Key
Derivation
with KBKDF
PBKDF2
Derived Key
Symmetric
key derived
from a
password
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Key
Derivation
with
PBKDF2
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 46 of 82
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
HKDF
Derived Key
Symmetric
key derived
from a shared
secret using
HKDF
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Key
Derivation
with HKDF
TLS Derived
Key
Symmetric
key derived
from a shared
secret using
TLS 1.2 KDF
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Key
Derivation
with TLS 1.2
KDF
IKE Derived
Key
Symmetric
key derived
from a shared
secret using
IKEv2 KDF
112-4096
bits - 112-
256 bits
Symmetric
key - CSP
Key
Derivation
with IKEv2
KDF
Entropy
Input
Entropy input
used to seed
the DRBG
128-384
bits - 128-
384 bits
Entropy
input - CSP
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
Hash_DRBG
DRBG Seed DRBG seed
derived from
entropy input
440 bits -
256 bits
Seed - CSP Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
Hash_DRBG
Internal
State (V, C)
Internal state
of the
Hash_DRBG
880 bits -
256 bits
Internal
state - CSP
Random
Number
Generation
with
Hash_DRBG
Random
Number
Generation
with
Hash_DRBG
FFC Private
Key
Private key
used for KAS-
FFC-SSC
2048-8192
bits - 112-
200 bits
Private key -
CSP
Key Pair
Generation
with Safe
Primes
Shared Secret
Computation
with KAS-
FFC-SSC
FFC Public
Key
Public key
used for KAS-
FFC-SSC
2048-8192
bits - 112-
200 bits
Public key -
PSP
Key Pair
Generation
Shared Secret
Computation
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 47 of 82
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
with Safe
Primes
with KAS-
FFC-SSC
EC Private
Key
Private key
used for KAS-
ECC-SSC and
ECDSA
P-256, P-
384, P-521
- 128, 192,
256 bits
Private key -
CSP
Key Pair
Generation
with ECDSA
Shared Secret
Computation
with KAS-
ECC-SSC
Signature
Generation
with ECDSA
EC Public
Key
Public key
used for KAS-
ECC-SSC and
ECDSA
P-256, P-
384, P-521
- 128, 192,
256 bits
Public key -
PSP
Key Pair
Generation
with ECDSA
Shared Secret
Computation
with KAS-
ECC-SSC
Signature
Verification
with ECDSA
RSA Private
Key
Private key
used for RSA
signature
generation
2048,
3072, 4096
bits - 112-
150 bits
Private key -
CSP
Key Pair
Generation
with RSA
Signature
Generation
with RSA
RSA Public
Key
Public key
used for RSA
signature
verification
KeyGen:
2048,
3072, 4096
bits;
SigVer:
1024,
1280,
1536,
1792,
2048,
3072, 4096
bits -
KeyGen:
112-150
bits;
SigVer:
80-150
bits
Public key -
PSP
Key Pair
Generation
with RSA
Signature
Verification
with RSA
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 48 of 82
Name Description Size -
Strength
Type -
Category
Generated
By
Established
By
Used By
Intermediate
key
generation
value
Temporary
value
generated
during key
generation
services
256-8192
bits - 112-
256 bits
Intermediate
value - CSP
Key Pair
Generation
with RSA
Key Pair
Generation
with ECDSA
Key Pair
Generation
with Safe
Primes
Key Pair
Generation
with RSA
Key Pair
Generation
with ECDSA
Key Pair
Generation
with Safe
Primes
Table 20: SSP Table 1
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
AES Key API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
HMAC Key API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Key-
Derivation Key
API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
KBKDF Derived
Key:Derivation Of
Shared Secret API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
FFC Private
Key:Derived From
FFC Public
Key:Derived From
EC Private
Key:Derived From
EC Public
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 49 of 82
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
Key:Derived From
HKDF Derived
Key:Derivation Of
TLS Derived
Key:Derivation Of
IKE Derived
Key:Derivation Of
Password API input
parameters
(plaintext)
RAM:Plaintext For the
duration of the
service
Destroy
Object
Remove
power from
the module
PBKDF2 Derived
Key:Derivation Of
KBKDF
Derived Key
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Key-Derivation
Key:Derived From
PBKDF2
Derived Key
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Password:Derived
From
HKDF Derived
Key
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Shared
Secret:Derived From
TLS Derived
Key
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Shared
Secret:Derived From
IKE Derived
Key
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
Shared
Secret:Derived From
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 50 of 82
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
Entropy Input RAM:Plaintext From
generation
until DRBG
Seed is created
Automatic
Remove
power from
the module
DRBG
Seed:Derivation Of
DRBG Seed RAM:Plaintext While the
DRBG is
instantiated
Automatic
Remove
power from
the module
Entropy
Input:Derived From
Internal State (V,
C):Generation Of
Internal State
(V, C)
RAM:Plaintext While the
module is
operational
Remove
power from
the module
DRBG
Seed:Generated From
FFC Private
Key
API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
FFC Public
Key:Paired With
Intermediate key
generation
value:Generated
From
FFC Public
Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
FFC Private
Key:Paired With
Intermediate key
generation
value:Generated
From
EC Private Key API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
EC Public Key:Paired
With
Intermediate key
generation
value:Generated
From
EC Public Key API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
EC Private
Key:Paired With
Intermediate key
generation
value:Generated
From
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 51 of 82
Name Input -
Output
Storage Storage
Duration
Zeroization Related SSPs
RSA Private
Key
API input
parameters
(encrypted)
API output
parameters
(encrypted)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
RSA Public
Key:Paired With
Intermediate key
generation
value:Generated
From
RSA Public
Key
API input
parameters
(plaintext)
API output
parameters
(plaintext)
RAM:Plaintext Until explicitly
zeroized by
operator
Destroy
Object
Remove
power from
the module
RSA Private
Key:Paired With
Intermediate key
generation
value:Generated
From
Intermediate
key generation
value
RAM:Plaintext For the
duration of the
service
Automatic FFC Private
Key:Generation Of
FFC Public
Key:Generation Of
EC Private
Key:Generation Of
EC Public
Key:Generation Of
RSA Private
Key:Generation Of
RSA Public
Key:Generation Of
Table 21: SSP Table 2
9.5 Transitions
The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1,
2031.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 52 of 82
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 53 of 82
10 Self-Tests
Upon initialization, the module immediately performs all libfreeblpriv3.so cryptographic algorithm self-tests
(CASTs) as specified in the Conditional Self-Tests table. When all those self-tests pass successfully, the module
automatically performs the pre-operational integrity test on the libfreeblpriv3.so file using its associated check
value. Consequently, the HMAC-SHA2-256 algorithm goes through a CAST before the software integrity tests
are performed.
Then, the module performs the RSA CAST in the libsoftokn3.so library, followed by the pre-operational
integrity test on the libsoftokn3.so file using its associated check value. The CAST for the algorithm used in the
pre-operational self-test (i.e., HMAC-SHA2-256) was already performed by the libfreeblpriv3.so library, before
the libsoftokn3.so library integrity test. Finally, all remaining CASTs for the algorithms implemented in
libsoftokn3.so are executed (see the Conditional Self-Tests table).
Only if all CASTs and pre-operational integrity tests passed successfully, the module transitions to the
operational state. No operator intervention is required to reach this point.
While the module is executing the self-tests, services are not available, and data output (via the data output
interface) is inhibited until the tests are successfully completed. If any of the self-tests fails, an error message is
returned, and the module transitions to an error state.
10.1 Pre-Operational Self-Tests
Algorithm or
Test
Test
Properties
Test Method Test Type Indicator Details
HMAC-
SHA2-256
(A5915)
256-bit
key
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are available
for use
Integrity test for
libsoftokn3.so and
libfreeblpriv3.so
HMAC-
SHA2-256
(A5919)
256-bit
key
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are available
for use
Integrity test for
libsoftokn3.so and
libfreeblpriv3.so
HMAC-
SHA2-256
(A5921)
256-bit
key
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are available
for use
Integrity test for
libsoftokn3.so and
libfreeblpriv3.so
HMAC-
SHA2-256
(A5925)
256-bit
key
Message
authentication
SW/FW
Integrity
Module becomes
operational and
services are available
for use
Integrity test for
libsoftokn3.so and
libfreeblpriv3.so
Table 22: Pre-Operational Self-Tests
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 54 of 82
10.2 Conditional Self-Tests
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-224
(A5915)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-256
(A5915)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-384
(A5915)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-512
(A5915)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-224
(A5919)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-256
(A5919)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 55 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-384
(A5919)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-512
(A5919)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-224
(A5921)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-256
(A5921)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-384
(A5921)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-512
(A5921)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-224
(A5925)
512-bit
message
KAT CAST Module
becomes
Message Digest Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 56 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
operational
and services
are available
for use
SHA2-256
(A5925)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-384
(A5925)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
SHA2-512
(A5925)
512-bit
message
KAT CAST Module
becomes
operational
and services
are available
for use
Message Digest Module
initialization
HMAC-SHA2-
224 (A5915)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
256 (A5915)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
384 (A5915)
288-bit key KAT CAST Module
becomes
operational
and services
Message
Authentication
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 57 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use
HMAC-SHA2-
512 (A5915)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
224 (A5919)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
256 (A5919)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
384 (A5919)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
512 (A5919)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
224 (A5921)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 58 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-SHA2-
256 (A5921)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
384 (A5921)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
512 (A5921)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
224 (A5925)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
256 (A5925)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
384 (A5925)
288-bit key KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
HMAC-SHA2-
512 (A5925)
288-bit key KAT CAST Module
becomes
Message
Authentication
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 59 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
operational
and services
are available
for use
AES-ECB
(A5915)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-ECB
(A5917)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-ECB
(A5921)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-ECB
(A5923)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-CBC
(A5915)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-CBC
(A5917)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
Encryption and
decryption
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 60 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
are available
for use
AES-CBC
(A5921)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-CBC
(A5923)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-GCM
(A5915)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-GCM
(A5917)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-GCM
(A5918)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-GCM
(A5921)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 61 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM
(A5923)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-GCM
(A5924)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Encryption and
decryption
Module
initialization
AES-CMAC
(A5915)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
AES-CMAC
(A5917)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
AES-CMAC
(A5921)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
AES-CMAC
(A5923)
128, 192, 256-
bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Message
Authentication
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 62 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
KDF SP800-108
(A5915)
HMAC-
SHA2-256 in
counter mode
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
KDF SP800-108
(A5921)
HMAC-
SHA2-256 in
counter mode
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
KDA HKDF
SP800-56Cr2
(A5914)
SHA2-256 KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
KDA HKDF
SP800-56Cr2
(A5920)
SHA2-256 KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
TLS v1.2 KDF
RFC7627
(A5915)
SHA2-256 KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
TLS v1.2 KDF
RFC7627
(A5921)
SHA2-256 KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initalization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 63 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
KDF IKEv2
(A5916)
SHA-1, SHA-
256, SHA-384,
SHA-512
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
KDF IKEv2
(A5922)
SHA-1, SHA-
256, SHA-384,
SHA-512
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
PBKDF (A5915) SHA2-256
with 5
iterations,
128-bit salt
and 14
characters
password
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
PBKDF (A5921) SHA2-256
with 5
iterations,
128-bit salt
and 14
characters
password
KAT CAST Module
becomes
operational
and services
are available
for use
Key Derivation Module
initialization
Hash DRBG
(A5915)
SHA-256
without
prediction
resistance
KAT CAST Module
becomes
operational
and services
are available
for use
Instantiate
Generate; Reseed
Generate
(compliant to SP
800- 90Ar1 Section
11.3)
Module
initialization
Hash DRBG
(A5921)
SHA-256
without
prediction
resistance
KAT CAST Module
becomes
operational
and services
are available
for use
Instantiate
Generate; Reseed
Generate
(compliant to SP
800- 90Ar1 Section
11.3)
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 64 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
KAS-FFC-SSC
Sp800-56Ar3
(A5915)
ffdhe2048 KAT CAST Module
becomes
operational
and services
are available
for use
Shared Secret
Computation
Module
initialization
KAS-FFC-SSC
Sp800-56Ar3
(A5921)
ffdhe2048 KAT CAST Module
becomes
operational
and services
are available
for use
Shared Secret
Computation
Module
initialization
KAS-ECC-SSC
Sp800-56Ar3
(A5915)
P-256 KAT CAST Module
becomes
operational
and services
are available
for use
Shared Secret
Computation
Module
initialization
KAS-ECC-SSC
Sp800-56Ar3
(A5921)
P-256 KAT CAST Module
becomes
operational
and services
are available
for use
Shared Secret
Computation
Module
initialization
RSA SigGen
(FIPS186-5)
(A5915)
PKCS#1 v1.5
with SHA2-
256, SHA2-
384, SHA2-
512, and
2048-bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Generation
Module
initialization
RSA SigGen
(FIPS186-5)
(A5921)
PKCS#1 v1.5
with SHA2-
256, SHA2-
384, SHA2-
512, and
2048-bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Generation
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 65 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
RSA SigVer
(FIPS186-5)
(A5915)
PKCS#1 v1.5
with SHA2-
256, SHA2-
384, SHA2-
512, and
2048-bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Verification
Module
initialization
RSA SigVer
(FIPS186-5)
(A5921)
PKCS#1 v1.5
with SHA2-
256, SHA2-
384, SHA2-
512, and
2048-bit key
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Verification
Module
initialization
ECDSA SigGen
(FIPS186-5)
(A5915)
SHA2-256
and P-256
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Generation
Module
initialization
ECDSA SigGen
(FIPS186-5)
(A5921)
SHA2-256
and P-256
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Generation
Module
initialization
ECDSA SigVer
(FIPS186-5)
(A5915)
SHA2-256
and P-256
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Verification
Module
initialization
ECDSA SigVer
(FIPS186-5)
(A5921)
SHA2-256
and P-256
KAT CAST Module
becomes
operational
and services
are available
for use
Signature
Verification
Module
initialization
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 66 of 82
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
RSA KeyGen
(FIPS186-5)
(A5915)
PKCS#1 v1.5
with SHA-256
PCT PCT Successful key
pair
generation
Signature
Generation and
Signature
Verification
Key Pair
Generation
RSA KeyGen
(FIPS186-5)
(A5921)
PKCS#1 v1.5
with SHA-256
PCT PCT Successful key
pair
generation
Signature
Generation and
Signature
Verification
Key Pair
Generation
ECDSA KeyGen
(FIPS186-5)
(A5915) Public
Key
Recalculation
N/A PCT PCT Successful key
pair
generation
PCT according to
section 5.6.2.1.4 of
[SP800-56Ar3]
Key Pair
Generation
ECDSA KeyGen
(FIPS186-5)
(A5921) Public
Key
Recalculation
N/A PCT PCT Successful key
pair
generation
PCT according to
section 5.6.2.1.4 of
[SP800-56Ar3]
Key Pair
Generation
ECDSA KeyGen
(FIPS186-5)
(A5915) SigGen
SigVer
SHA-256 PCT PCT Successful key
pair
generation
Signature
Generation and
Signature
Verification
Key Pair
Generation
ECDSA KeyGen
(FIPS186-5)
(A5921) SigGen
SigVer
SHA-256 PCT PCT Successful key
pair
generation
Signature
Generation and
Signature
Verification
Key Pair
Generation
Safe Primes Key
Generation
(A5915)
N/A PCT PCT Successful key
pair
generation
PCT according to
section 5.6.2.1.4 of
[SP800-56Ar3]
Key Pair
Generation
Safe Primes Key
Generation
(A5921)
N/A PCT PCT Successful key
pair
generation
PCT according to
section 5.6.2.1.4 of
[SP800-56Ar3]
Key Pair
Generation
Table 23: Conditional Self-Tests
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 67 of 82
10.3 Periodic Self-Test Information
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-256
(A5915)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A5919)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A5921)
Message
authentication
SW/FW Integrity On demand Manually
HMAC-SHA2-256
(A5925)
Message
authentication
SW/FW Integrity On demand Manually
Table 24: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
SHA2-224 (A5915) KAT CAST On demand Manually
SHA2-256 (A5915) KAT CAST On demand Manually
SHA2-384 (A5915) KAT CAST On demand Manually
SHA2-512 (A5915) KAT CAST On demand Manually
SHA2-224 (A5919) KAT CAST On demand Manually
SHA2-256 (A5919) KAT CAST On demand Manually
SHA2-384 (A5919) KAT CAST On demand Manually
SHA2-512 (A5919) KAT CAST On demand Manually
SHA2-224 (A5921) KAT CAST On demand Manually
SHA2-256 (A5921) KAT CAST On demand Manually
SHA2-384 (A5921) KAT CAST On demand Manually
SHA2-512 (A5921) KAT CAST On demand Manually
SHA2-224 (A5925) KAT CAST On demand Manually
SHA2-256 (A5925) KAT CAST On demand Manually
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 68 of 82
Algorithm or Test Test Method Test Type Period Periodic Method
SHA2-384 (A5925) KAT CAST On demand Manually
SHA2-512 (A5925) KAT CAST On demand Manually
HMAC-SHA2-224
(A5915)
KAT CAST On demand Manually
HMAC-SHA2-256
(A5915)
KAT CAST On demand Manually
HMAC-SHA2-384
(A5915)
KAT CAST On demand Manually
HMAC-SHA2-512
(A5915)
KAT CAST On demand Manually
HMAC-SHA2-224
(A5919)
KAT CAST On demand Manually
HMAC-SHA2-256
(A5919)
KAT CAST On demand Manually
HMAC-SHA2-384
(A5919)
KAT CAST On demand Manually
HMAC-SHA2-512
(A5919)
KAT CAST On demand Manually
HMAC-SHA2-224
(A5921)
KAT CAST On demand Manually
HMAC-SHA2-256
(A5921)
KAT CAST On demand Manually
HMAC-SHA2-384
(A5921)
KAT CAST On demand Manually
HMAC-SHA2-512
(A5921)
KAT CAST On demand Manually
HMAC-SHA2-224
(A5925)
KAT CAST On demand Manually
HMAC-SHA2-256
(A5925)
KAT CAST On demand Manually
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 69 of 82
Algorithm or Test Test Method Test Type Period Periodic Method
HMAC-SHA2-384
(A5925)
KAT CAST On demand Manually
HMAC-SHA2-512
(A5925)
KAT CAST On demand Manually
AES-ECB (A5915) KAT CAST On demand Manually
AES-ECB (A5917) KAT CAST On demand Manually
AES-ECB (A5921) KAT CAST On demand Manually
AES-ECB (A5923) KAT CAST On demand Manually
AES-CBC (A5915) KAT CAST On demand Manually
AES-CBC (A5917) KAT CAST On demand Manually
AES-CBC (A5921) KAT CAST On demand Manually
AES-CBC (A5923) KAT CAST On demand Manually
AES-GCM (A5915) KAT CAST On demand Manually
AES-GCM (A5917) KAT CAST On demand Manually
AES-GCM (A5918) KAT CAST On demand Manually
AES-GCM (A5921) KAT CAST On demand Manually
AES-GCM (A5923) KAT CAST On demand Manually
AES-GCM (A5924) KAT CAST On demand Manually
AES-CMAC
(A5915)
KAT CAST On demand Manually
AES-CMAC
(A5917)
KAT CAST On demand Manually
AES-CMAC
(A5921)
KAT CAST On demand Manually
AES-CMAC
(A5923)
KAT CAST On demand Manually
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 70 of 82
Algorithm or Test Test Method Test Type Period Periodic Method
KDF SP800-108
(A5915)
KAT CAST On demand Manually
KDF SP800-108
(A5921)
KAT CAST On demand Manually
KDA HKDF SP800-
56Cr2 (A5914)
KAT CAST On demand Manually
KDA HKDF SP800-
56Cr2 (A5920)
KAT CAST On demand Manually
TLS v1.2 KDF
RFC7627 (A5915)
KAT CAST On demand Manually
TLS v1.2 KDF
RFC7627 (A5921)
KAT CAST On demand Manually
KDF IKEv2
(A5916)
KAT CAST On demand Manually
KDF IKEv2
(A5922)
KAT CAST On demand Manually
PBKDF (A5915) KAT CAST On demand Manually
PBKDF (A5921) KAT CAST On demand Manually
Hash DRBG
(A5915)
KAT CAST On demand Manually
Hash DRBG
(A5921)
KAT CAST On demand Manually
KAS-FFC-SSC
Sp800-56Ar3
(A5915)
KAT CAST On demand Manually
KAS-FFC-SSC
Sp800-56Ar3
(A5921)
KAT CAST On demand Manually
KAS-ECC-SSC
Sp800-56Ar3
(A5915)
KAT CAST On demand Manually
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 71 of 82
Algorithm or Test Test Method Test Type Period Periodic Method
KAS-ECC-SSC
Sp800-56Ar3
(A5921)
KAT CAST On demand Manually
RSA SigGen
(FIPS186-5)
(A5915)
KAT CAST On demand Manually
RSA SigGen
(FIPS186-5)
(A5921)
KAT CAST On demand Manually
RSA SigVer
(FIPS186-5)
(A5915)
KAT CAST On demand Manually
RSA SigVer
(FIPS186-5)
(A5921)
KAT CAST On demand Manually
ECDSA SigGen
(FIPS186-5)
(A5915)
KAT CAST On demand Manually
ECDSA SigGen
(FIPS186-5)
(A5921)
KAT CAST On demand Manually
ECDSA SigVer
(FIPS186-5)
(A5915)
KAT CAST On demand Manually
ECDSA SigVer
(FIPS186-5)
(A5921)
KAT CAST On demand Manually
RSA KeyGen
(FIPS186-5)
(A5915)
PCT PCT On demand Manually
RSA KeyGen
(FIPS186-5)
(A5921)
PCT PCT On demand Manually
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 72 of 82
Algorithm or Test Test Method Test Type Period Periodic Method
ECDSA KeyGen
(FIPS186-5)
(A5915) Public Key
Recalculation
PCT PCT On demand Manually
ECDSA KeyGen
(FIPS186-5)
(A5921) Public Key
Recalculation
PCT PCT On demand Manually
ECDSA KeyGen
(FIPS186-5)
(A5915) SigGen
SigVer
PCT PCT On demand Manually
ECDSA KeyGen
(FIPS186-5)
(A5921) SigGen
SigVer
PCT PCT On demand Manually
Safe Primes Key
Generation
(A5915)
PCT PCT On demand Manually
Safe Primes Key
Generation
(A5921)
PCT PCT On demand Manually
Table 25: Conditional Periodic Information
10.4 Error States
Name Description Conditions Recovery
Method
Indicator
Power-
On Error
An error occurred during
the self-tests executed on
power-on
Software
integrity test
failure
or CAST failure
Restart of the
module
Module will not load
PCT Error An error occurred during a
PCT
PCT failure Restart of the
module
Module stops functioning
(sftk_fatalError is set to
TRUE)
Table 26: Error States
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 73 of 82
In any error state, the output interface is inhibited, and the module accepts no more inputs or requests.
10.5 Operator Initiation of Self-Tests
The software integrity tests and CASTs can be invoked on demand by unloading and subsequently re-
initializing the module. The PCTs can be invoked on demand by requesting the Key Pair Generation service.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 74 of 82
11 Life-Cycle Assurance
11.1 Installation, Initialization, and Startup Procedures
The module is delivered as part of the following RPM packages:
• Rocky Linux 8 system:
o nss-softokn-3.90.0-7.el8_6.ciqfips.0.3.x86_64
o nss-softokn-freebl-3.90.0-7.el8_6.ciqfips.0.3.x86_64
• Rocky Linux 9 system:
o nss-softokn-3.90.0-7.el9_2.ciqfips.0.2.x86_64
o nss-softokn-freebl-3.90.0-7.el9_2.ciqfips.0.2.x86_64
Before these packages are installed, the Rocky Linux 8 or Rocky Linux 9 system respectively must operate in
the FIPS validated configuration. This can be achieved by:
• Adding the fips=1 option to the kernel command line during the system installation. During the
software selection stage, do not install any third-party software.
• Switching the system into the FIPS validated configuration after the installation. Execute the fips-
mode-setup --enable command. Restart the system.
In both cases, once the system has rebooted, the Crypto Officer must verify the system operates in the FIPS
validated configuration by executing the fips-mode-setup --check command, which should output “FIPS mode
is enabled.”
After the completion of the above-mentioned installation steps, the respective RPM packages can be installed
on the Rocky Linux 8 or Rocky Linux 9 system using “dnf install” command.
After the RPM packages are installed, the Crypto Officer must execute the “Show module name and version”
service by accessing the CKA_NSS_VALIDATION_MODULE_ID attribute of the CKO_NSS_VALIDATION
object in the default slot. The object attribute must contain the value:
Rocky Linux 8 NSS Cryptographic Module rocky8.20240909 3.90.0-a7491da2812208d5 (for Rocky Linux 8)
Rocky Linux 9 NSS Cryptographic Module %rocky9.20240909 3.90.0-1631d89a69603589 (for Rocky Linux 9)
Alternatively, the /usr/lib64/nss/unsupported-tools/validation tool is provided as a convenience by either the
nss-tools-3.90.0-7.el8_6.ciqfips.0.3.x86_64 package or the nss-tools-3.90.0-7.el9_2.ciqfips.0.2.x86_64 package.
This tool performs the same steps, and also outputs the FIPS module identifier as above.
11.2 Administrator Guidance
The version of the RPMs containing the FIPS validated Module is stated in Section 11.1. The RPM packages
forming the Module can be installed by standard tools recommended for the installation of RPM packages on a
Rocky Linux system (for example, dnf and rpm). All RPM packages are signed with the CIQ build key, which is
an RSA 4096-bit key using SHA-256 signatures. The signature is automatically verified upon installation of the
RPM package. If the signature cannot be validated, the RPM tool rejects the installation of the package. In such
a case, the Crypto Officer is requested to obtain a new copy of the module's RPMs from CIQ.
11.3 Non-Administrator Guidance
There is no non-administrator guidance.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 75 of 82
11.4 End of Life
As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the
module. This will zeroize all SSPs in volatile memory. Then, if desired, either both the nss-softokn-3.90.0-
7.el8_6.ciqfips.0.3.x86_64 and nss-softokn-freebl-3.90.0-7.el8_6.ciqfips.0.3.x86_64 RPM packages can be
uninstalled from the Rocky Linux 8 systems or both the nss-softokn-3.90.0-7.el9_2.ciqfips.0.2.x86_64 and nss-
softokn-freebl-3.90.0-7.el9_2.ciqfips.0.2.x86_64 RPM packages can be uninstalled from the Rocky Linux 9
systems.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 76 of 82
12 Mitigation of Other Attacks
12.1 Attack List
Timing attacks on RSA
• RSA blinding: timing attack on RSA was first demonstrated by Paul Kocher in 1996, who contributed
the mitigation code to our module. Most recently Boneh and Brumley showed that RSA blinding is an
effective defense against timing attacks on RSA.
o Specific Limit: None.
Cache-timing attacks on the modular exponentiation operation used in RSA
• Cache invariant module exponentiation: this is a variant of a modular exponentiation implementation
that Colin Percival showed to defend against cache-timing attacks
o Specific Limit: this mechanism requires intimate knowledge of the cache line sizes of the
processor. The mechanism may be ineffective when the module is running on a processor whose
cache line sizes are unknown.
Arithmetic errors in RSA signatures
• Double-checking RSA signatures: arithmetic errors in RSA signatures might leak the private key.
Ferguson and Schneier recommend that every RSA signature generation should verify the signature
just generated.
o Specific Limit: None.
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 77 of 82
Appendix A Glossary and Abbreviations
AES Advanced Encryption Standard
API Application Programming Interface
CAST Cryptographic Algorithm Self-Test
CAVP Cryptographic Algorithm Validation Program
CBC Cipher Block Chaining
CKG Cryptographic Key Generation
CMAC Cipher-based Message Authentication Code
CMVP Cryptographic Module Validation Program
CSP Critical Security Parameter
CTR Counter
CTS Ciphertext Stealing
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECC Elliptic Curve Cryptography
ECDSA Elliptic Curve Digital Signature Algorithm
FFC Finite Field Cryptography
FIPS Federal Information Processing Standards
GCM Galois Counter Mode
HKDF HMAC-based Key Derivation Function
HMAC Keyed-Hash Message Authentication Code
IKE Internet Key Exchange
KAS Key Agreement Scheme
KAT Known Answer Test
KBKDF Key-based Key Derivation Function
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 78 of 82
KTS Key Transport Scheme
KW Key Wrap
KWP Key Wrap with Padding
MAC Message Authentication Code
NIST National Institute of Science and Technology
PAA Processor Algorithm Acceleration
PAI Processor Algorithm Implementation
PCT Pair-wise Consistency Test
PBKDF2 Password-based Key Derivation Function v2
PKCS Public-Key Cryptography Standards
PSS Probabilistic Signature Scheme
RSA Rivest, Shamir, Addleman
SHA Secure Hash Algorithm
SSC Shared Secret Computation
SSP Sensitive Security Parameter
TLS Transport Layer Security
XOF Extendable Output Function
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 79 of 82
Appendix B References
FIPS 140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules
March 2019
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf
FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation
Program
23 October 2024
https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-
announcements
FIPS 180-4 Secure Hash Standard (SHS)
August 2015
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
FIPS 186-2 Digital Signature Standard (DSS)
July 2013
https://csrc.nist.gov/files/pubs/fips/186-2/final/docs/fips186-2.pdf
FIPS 186-4 Digital Signature Standard (DSS)
July 2013
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
FIPS 186-5 Digital Signature Standard (DSS)
February 2023
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf
FIPS 197 Advanced Encryption Standard
May 2023
https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC)
July 2008
https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions
August 2015
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 80 of 82
PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version
2.2
November 2016
https://www.rfc-editor.org/rfc/rfc8017.txt
RFC 3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange
(IKE)
May 2003
https://www.ietf.org/rfc/rfc3526.txt
RFC 5288 AES Galois Counter Mode (GCM) Cipher Suites for TLS
August 2008
https://www.ietf.org/rfc/rfc5288.txt
RFC 7919 Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security
(TLS)
August 2016
https://www.ietf.org/rfc/rfc7919.txt
RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3
August 2018
https://www.ietf.org/rfc/rfc8446.txt
SP 800-38A Recommendation for Block Cipher Modes of Operation Methods and Techniques
December 2001
https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
SP 800-38A
Addendum
Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext
Stealing for CBC Mode
October 2010
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-add.pdf
SP 800-38B Recommendation for Block Cipher Modes of Operation: The CMAC Mode for
Authentication
May 2005
https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
SP 800-38D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and
GMAC
November 2007
https://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 81 of 82
SP 800-38F Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping
December 2012
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
SP 800-52r2 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS)
Implementations
August 2019
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
SP 800-56Ar3 Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm
Cryptography
April 2018
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf
SP 800-56Cr2 Recommendation for Key-Derivation Methods in Key-Establishment Schemes
August 2020
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
SP 800-90Ar1 Recommendation for Random Number Generation Using Deterministic Random Bit
Generators
June 2015
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation
January 2018
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
SP 800-108r1 NIST Special Publication 800-108 - Recommendation for Key Derivation Using
Pseudorandom Functions
August 2022
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1-upd1.pdf
SP 800-131Ar2 Transitioning the Use of Cryptographic Algorithms and Key Lengths
March 2019
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
SP 800-132 Recommendation for Password-Based Key Derivation - Part 1: Storage Applications
December 2010
https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf
SP 800-133r2 Recommendation for Cryptographic Key Generation
June 2020
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf
Rocky Linux 8 and 9 NSS Cryptographic Module FIPS 140-3 Non-Proprietary Security Policy
© 2026 Ctrl IQ, Inc., atsec information security.
This document can be reproduced and distributed only whole and intact, including this copyright notice.
Page 82 of 82
SP 800-135r1 Recommendation for Existing Application-Specific Key Derivation Functions
December 2011
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf