Arista WiFi Access Points

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5515,
  "dgst": "eacc30a21d89f388",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "AES-GCMA7104",
        "HMAC-SHA-1A5259",
        "SHA-1A5259",
        "SHA2-512A7104",
        "SHA2-224A5259",
        "#A6926",
        "AES-CMACA5259",
        "KDF SP800-108A5259",
        "Counter DRBGA5259",
        "AES-CBCA7104",
        "HMAC-SHA2-256A7104",
        "AES-KWA5259",
        "RSA SigGen (FIPS186-5)A5259",
        "KDF IKEv2A5259",
        "#A3239",
        "AES-GMACA3239",
        "KAS-ECC-SSC Sp800-56Ar3A5259",
        "SHA3-256A6926",
        "TLS v1.3 KDFA5259",
        "HMAC-SHA2-384A7104",
        "#A7103",
        "TLS v1.2 KDF RFC7627A5259",
        "Safe Primes Key GenerationA5259",
        "RSA SigVer (FIPS186-5)A5259",
        "SHA2-256A7104",
        "#A7104",
        "ECDSA SigGen (FIPS186-5)A5259",
        "ECDSA KeyGen (FIPS186-5)A5259",
        "AES-CCMA5259",
        "HMAC-SHA2-224A5259",
        "RSA SigVer (FIPS186-4)A5259",
        "SHA2-384A7104",
        "#A5259",
        "HMAC-SHA2-512A7104",
        "KAS-FFC-SSC Sp800-56Ar3A5259",
        "KDF IKEv1A5259",
        "PBKDFA5259",
        "KDF SSHA5259",
        "RSA KeyGen (FIPS186-5)A5259",
        "ECDSA SigVer (FIPS186-4)A5259",
        "ECDSA SigVer (FIPS186-5)A5259"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A5259",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A7103",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A7104",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CCM",
            "cavpCertName": "A3239",
            "properties": "Key Length - 128, 256 Tag Length - 128, 64 IV Length - IV Length: 104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-524280 Increment 8",
            "reference": "SP 800-38C"
          },
          {
            "algorithm": "AES-CCM",
            "cavpCertName": "A5259",
            "properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-524288 Increment 8",
            "reference": "SP 800-38C"
          },
          {
            "algorithm": "AES-CMAC",
            "cavpCertName": "A5259",
            "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 16-128 Increment 8 Message Length - Message Length: 16-65536 Increment 8",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A3239",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Payload Length - Payload Length: 0-65536 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8",
            "reference": ""
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A5259",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7103",
            "properties": "AAD Length - AAD Length: 0, 256, 384, 136, 392 Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392 AAD Length - AAD Length: 0, 256, 384, 136, 392",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A7104",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-GMAC",
            "cavpCertName": "A3239",
            "properties": "AAD Length - AAD Length: 0, 256, 384, 136, 392 Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 AAD Length - AAD Length: 0-65536 Increment 8",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A5259",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher, Inverse Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 64",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A5259",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256, Additional Input: 0, 320, Additional Input: 0, 384 Entropy Input - Entropy Input: 128, Entropy Input:",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "192, Entropy Input: 256, Entropy Input: 320, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128, Nonce: 64 Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256, Personalization String Length: 0, 320, Personalization String Length: 0, 384 Returned Bits - 512",
            "reference": ""
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-4)",
            "cavpCertName": "A5259",
            "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A5259",
            "properties": "MAC - MAC: 80-160 Increment 8 Key Length - Key Length: 112-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 224",
            "cavpCertName": "A5259",
            "properties": "MAC - MAC: 112-224 Increment 16 Key Length - Key Length: 112-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "A5259",
            "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "A7103",
            "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "A7104",
            "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "A5259",
            "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "A7103",
            "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "A7104",
            "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "A5259",
            "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "A7103",
            "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "A7104",
            "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-512 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC- SSC Sp800- 56Ar3",
            "cavpCertName": "A5259",
            "properties": "Domain Parameter Generation Methods - P-256, P- 384, P-521 Hash Function Z - SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-FFC- SSC Sp800- 56Ar3",
            "cavpCertName": "A5259",
            "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Hash Function Z - SHA2-384 Scheme - dhEphem - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF IKEv1 (CVL)",
            "cavpCertName": "A5259",
            "properties": "Authentication Method - Pre-shared Key Initiator Nonce Length - Initiator Nonce Length: 256- 2048 Increment 128 Responder Nonce Length - Responder Nonce Length: 256-2048 Increment 128 Preshared Key Length - Preshared Key Length: 8- 8192 Increment 8 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 1024-8192 Increment 1024 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF IKEv2 (CVL)",
            "cavpCertName": "A5259",
            "properties": "Initiator Nonce Length - Initiator Nonce Length: 256- 2048 Increment 128 Responder Nonce Length - Responder Nonce Length: 256-2048 Increment 128 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 1024-8192 Increment 1024 Derived Keying Material Length - Derived Keying Material Length: 256-2048 Increment 128 Hash Algorithm - SHA-1, SHA2-256, SHA2-384,",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SP800- 108",
            "cavpCertName": "A5259",
            "properties": "SHA2-512 KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES256 Supported Lengths - Supported Lengths: 128 Fixed Data Order - Before Fixed Data Counter Length - 8 Supports Empty IV - No Custom Key In Length - 0",
            "reference": "SP 800-108 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A5259",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "PBKDF",
            "cavpCertName": "A5259",
            "properties": "Iteration Count - Iteration Count: 1-10000 Increment 1 HMAC Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512 Password Length - Password Length: 8-64 Increment 1 Salt Length - Salt Length: 128-512 Increment 8 Key Data Length - Key Data Length: 112-4096 Increment 8",
            "reference": "SP 800-132"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Key Generation Mode - probable, probableWithProbableAux Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - random",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A5259",
            "properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Random",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A5259",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Public Exponent Mode - random",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "Safe Primes Key Generation",
            "cavpCertName": "A5259",
            "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A5259",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-224",
            "cavpCertName": "A5259",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A5259",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7103",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A7104",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A5259",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A7103",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A7104",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A5259",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A7103",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A7104",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA3-256",
            "cavpCertName": "A6926",
            "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
            "cavpCertName": "A5259",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "TLS v1.3 KDF (CVL)",
            "cavpCertName": "A5259",
            "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
            "reference": "SP 800-135 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Crypto Officer authenticate s to the module over CLI",
            "indicator": "System logs",
            "inputs": "Passwor d",
            "name": "Authenticate to module",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 - Entered CO Password: W,E,Z - Configured user password: E",
            "secFunImpl": "Password hash"
          },
          {
            "description": "The module offers authenticatio n over SSH",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Connect to module remotely using SSH (DH)",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 - SSH shared secret: G,E,Z - SSH Session Authentication Key: G - SSH Session Encryption Key: G",
            "secFunImpl": "Establish SSH (FFC) Entropy Random number"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- DRBG Output: E - DH Private Key: G,E,Z - DH Public key : G,R,Z - DH Peer Public key: W,E,Z - SSH Server public key: E - SSH Server private key: E",
            "secFunImpl": ""
          },
          {
            "description": "The module offers authenticatio n over SSH",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Connect to module remotely using SSH (ECDH)",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 - SSH shared secret: G,E,Z - SSH Session Authentication Key: G - SSH Session Encryption Key: G - DRBG Output: E - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - SSH Server public key: E - SSH Server private key: E",
            "secFunImpl": "Establish SSH (ECC) Entropy Random number"
          },
          {
            "description": "The module works as an HTTP client over TLS",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Connect to HTTP servers (DH)",
            "outputs": "Status",
            "rolesSspAccess": "Network User - TLS server public key: W,E,Z - TLS client public key: R - DH Private Key: G,E,Z - DH Public",
            "secFunImpl": "Establish TLS (FFC) Entropy Random number"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "key : G,R,Z - DH Peer Public key: W,E,Z - TLS pre- master secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session Authentication Key: G - TLS Session Encryption Key: G - TLS client private key: E",
            "secFunImpl": ""
          },
          {
            "description": "The module works as an HTTP client over TLS",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Connect to HTTP servers (ECDH)",
            "outputs": "Status",
            "rolesSspAccess": "Network User - TLS server public key: W,E,Z - TLS client public key: R - TLS pre- master secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session Authentication Key: G - TLS Session Encryption Key: G - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - TLS client private key: E",
            "secFunImpl": "Establish TLS (ECC) Entropy Random number"
          },
          {
            "description": "Establish IPsec connection as a client",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Establish IPsec connection (DH)",
            "outputs": "Status",
            "rolesSspAccess": "Network User - IKE Authentication Key: G",
            "secFunImpl": "Establish IPsec (FFC) Entropy"
          },
          {
            "description": "Description",
            "indicator": "Indicato r",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Output",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "s",
            "rolesSspAccess": "- IKE Pre- Shared Key: E - IKE Session Encryption Key: G - IKE RSA private Key: E - IKE RSA public key: R - IKE RSA peer public key: W,E,Z - IKE ECDSA private Key: E - IKE ECDSA public key: R - IKE ECDSA peer public key: W,E,Z - DH Private Key: G,E,Z - DH Public key : G,R,Z - DH Peer Public key: W,E,Z - IPsec Session Authentication Key: G - IPsec Session Encryption Key: G - IKE key generation key: G,E,Z - IKE/IPSec shared secret: G,E,Z",
            "secFunImpl": "Random number"
          },
          {
            "description": "Establish IPsec connection as a client",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Establish IPsec connection (ECDH)",
            "outputs": "Status",
            "rolesSspAccess": "Network User - IKE Authentication Key: G - IKE Pre- Shared Key: E - IKE Session",
            "secFunImpl": "Establish IPsec (ECC) Entropy Random number"
          },
          {
            "description": "Description",
            "indicator": "Indicato r",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Output s",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Encryption Key: G - IKE RSA private Key: E - IKE RSA public key: R - IKE RSA peer public key: W,E,Z - IKE ECDSA private Key: E - IKE ECDSA public key: R - IKE ECDSA peer public key: W,E,Z - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - IPsec Session Authentication Key: G - IPsec Session Encryption Key: G - IKE key generation key: G,E,Z - IKE/IPSec shared secret:",
            "secFunImpl": "Functions"
          },
          {
            "description": "Provide wireless connection to wireless client",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Secure 802.11 Wireless Connection",
            "outputs": "Status",
            "rolesSspAccess": "G,E,Z Network User - WPA2/WPA3 Pre-shared Key: W,E,Z - WPA2/WPA3 Pair-Wise Master Key (PMK): G,E,Z",
            "secFunImpl": "Transfer data with CBC Transfer wireless managemen t frames Transfer data with GCM/CCM"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- WPA2/WPA3 Pairwise Transient Key (PTK): G,E - WPA2/WPA3 Group Master Key (GMK): G,E,Z - WPA2/WPA3 Group Transient Key (GTK): G,E",
            "secFunImpl": "WPA Handshake"
          },
          {
            "description": "Execute self tests by rebooting device",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Self-tests",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1",
            "secFunImpl": "Firmware integrity"
          },
          {
            "description": "Change password for config user",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Config user password",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 1 - Configured user password: W,E,Z",
            "secFunImpl": "Password hash"
          },
          {
            "description": "Synchronize client information to neighbor APs",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Synchronize client information to neighbor APs",
            "outputs": "Status",
            "rolesSspAccess": "Network User - Client information synchronizatio n key: E,Z",
            "secFunImpl": "Transfer data with CBC Key derivation - CMAC"
          },
          {
            "description": "Execute firmware update",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Execute firmware update",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 1 - Firmware upgrade key: E,Z Crypto Officer 2 - Firmware upgrade key: E,Z",
            "secFunImpl": "Firmware authenticatio n"
          },
          {
            "description": "Generate certificate signing request and verify certificate",
            "indicator": "System logs",
            "inputs": "Comman d and certificat e",
            "name": "Provision custom certificate",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 1 - DRBG Output: G,E,Z - RSA Public Keys : G,W,E - RSA Private",
            "secFunImpl": "Generate CSR Verify certificate Random number"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "Keys: G,E - ECDSA Public Keys: G,E - ECDSA Private Keys: G,W,E - Entropy input: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - DRBG Key: G,E,Z",
            "secFunImpl": ""
          },
          {
            "description": "Display the module\u0027s mode",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Show approved mode enabled",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1",
            "secFunImpl": "None"
          },
          {
            "description": "Show system status",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Show system status",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2",
            "secFunImpl": "None"
          },
          {
            "description": "Display the version of the module",
            "indicator": "System logs",
            "inputs": "Comman d",
            "name": "Show version",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1",
            "secFunImpl": "None"
          },
          {
            "description": "Traffic over HTTP",
            "indicator": "System logs",
            "inputs": "HTTP request",
            "name": "Traffic over HTTP",
            "outputs": "HTTP data",
            "rolesSspAccess": "Crypto Officer 2 - TLS Session Authentication Key: E,Z - TLS Session Encryption Key: E,Z",
            "secFunImpl": "Transfer data with CBC Transfer data with GCM/CCM"
          },
          {
            "description": "Traffic over SSH",
            "indicator": "System logs",
            "inputs": "SSH comman d",
            "name": "Traffic over SSH",
            "outputs": "Status",
            "rolesSspAccess": "Crypto Officer 2 - SSH Session Authentication Key: E,Z - SSH Session Encryption Key: E,Z",
            "secFunImpl": "Transfer data with CBC Transfer data with GCM/CCM"
          },
          {
            "description": "Traffic over IPsec",
            "indicator": "System logs",
            "inputs": "Traffic data",
            "name": "Traffic over IPsec",
            "outputs": "Traffic data",
            "rolesSspAccess": "Network User - IKE Authentication Key: E,Z",
            "secFunImpl": "Transfer data with CBC Transfer"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- IKE Session Encryption Key: E,Z - IPsec Session Authentication Key: E,Z - IPsec Session Encryption Key: E,Z",
            "secFunImpl": "data with GCM/CCM"
          },
          {
            "description": "Zeroise the module",
            "indicator": "System reboot",
            "inputs": "Comman d or reset pinhole",
            "name": "Factory reset",
            "outputs": "-",
            "rolesSspAccess": "Crypto Officer 2 - Entered CO Password: Z - Client information synchronizatio n key: Z - Entropy input: Z - DRBG Seed: Z - DRBG V: Z - DRBG Key: Z - DRBG Output: Z - TLS server public key: Z - TLS client public key: Z - TLS client private key: Z - TLS pre- master secret: Z - TLS Master Secret: Z - TLS Session Authentication Key: Z - TLS Session Encryption Key: Z - SSH Server public key: Z - SSH Server private key: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Description",
            "indicator": "Indicato",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Output",
            "rolesSspAccess": "SSP Access",
            "secFunImpl": "Security"
          },
          {
            "description": "",
            "indicator": "r",
            "inputs": "",
            "name": "",
            "outputs": "s",
            "rolesSspAccess": "- SSH shared secret: Z - SSH Session Authentication Key: Z - SSH Session Encryption Key: Z - IKE Authentication Key: Z - IKE Pre- Shared Key: Z - IKE Session Encryption Key: Z - IKE RSA private Key: Z - IKE RSA public key: Z - IKE RSA peer public key: Z - IKE ECDSA private Key: Z - IKE ECDSA public key: Z - IKE ECDSA peer public key: Z - DH Private Key: Z - DH Public key : Z - EC DH Private Key: Z - EC DH Public Key: Z - AP public key: Z - AP private key: Z",
            "secFunImpl": "Functions"
          },
          {
            "description": "Authenticate s the AP to wired network",
            "indicator": "System logs",
            "inputs": "Comman d and certificat e",
            "name": "Authenticatio n to wired network",
            "outputs": "Status",
            "rolesSspAccess": "Network User - AP public key: R,E - AP private key: E",
            "secFunImpl": "Uplink port authenticatio n"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "Obfuscated password entry",
            "mechanism": "Memorized Secret",
            "name": "Authentication over Console",
            "perMinute": "1/(87^9/108,000) which is less than 1/100,000.",
            "strength": "Not subjected to failed attempts, but the number of attempts per minute is limited by baud rate of serial port, which is a maximum of 115,200 bps which is 6,912,000 bits per minute"
          },
          {
            "description": "Authentication over SSH",
            "mechanism": "Memorized Secret",
            "name": "Authentication over SSH",
            "perMinute": "5/(5*87^9), which is less than 1/100000.",
            "strength": "Subject to a limit of 5 failed auth attempts with lockout time of 5 minutes"
          },
          {
            "description": "Obfuscated password entry",
            "mechanism": "Memorized Secret or certificates",
            "name": "Authentication over Wi-Fi",
            "perMinute": "-",
            "strength": "-"
          },
          {
            "description": "Authentication over TLS using certificates",
            "mechanism": "Certificates",
            "name": "Authentication of Wireless Manager server over TLS",
            "perMinute": "-",
            "strength": "-"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-CBC (A5259)",
            "condition": "Boot Up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM (A5259)",
            "condition": "Boot Up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A5259)",
            "condition": "Boot Up",
            "details": "Health tests- Instantiate, Generate, and Reseed",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186- 5) (A5259)",
            "condition": "Boot Up",
            "details": "Sign",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "P-256 Curve",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186- 5) (A5259)",
            "condition": "Boot Up",
            "details": "Verify",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "P-256 Curve",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC (A5259)",
            "condition": "Boot Up",
            "details": "Message Authentication",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS-ECC- SSC Sp800-",
            "condition": "Boot Up",
            "details": "Key Agreement",
            "indicator": "Pass Indicator /",
            "testMethod": "KAT",
            "testProps": "P-256 Curve",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "56Ar3 (A5259)",
            "condition": "",
            "details": "",
            "indicator": "Error Indicator",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 (A5259)",
            "condition": "Boot Up",
            "details": "Key Agreement",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "MODP- 2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigGen",
            "condition": "Boot Up",
            "details": "Sign",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Modulus Size- 2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer",
            "condition": "Boot Up",
            "details": "Verify",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Modulus Size- 2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA KeyGen (FIPS186- 5) (A5259)",
            "condition": "On key pair generation",
            "details": "ECDSA key pair generation",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "PCT",
            "testProps": "Modulus Size - 2048",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "SHA3-256 (A4291)",
            "condition": "Boot Up",
            "details": "Message Digest",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA3-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA KeyGen (FIPS186- 5) (A5259)",
            "condition": "On key pair generation",
            "details": "RSA key pair generation",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "PCT",
            "testProps": "Modulus Size- 2048",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "Safe Primes Key Generation (A5259)",
            "condition": "On key pair generation",
            "details": "Safe prime key pair generation",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "PCT",
            "testProps": "MODP 2048",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "PBKDF (A5259)",
            "condition": "Boot Up",
            "details": "Key derivation from password",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLS v1.2 KDF RFC7627 (A5259)",
            "condition": "Boot Up",
            "details": "KDF used in TLSv1.2",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "HMAC- SHA-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLS v1.3 KDF (A5259)",
            "condition": "Boot Up",
            "details": "KDF used in TLSv1.3",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "HMAC- SHA-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KDF SSH (A5259)",
            "condition": "Boot Up",
            "details": "KDF used in SSH",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA-1 (A5259)",
            "condition": "Boot Up",
            "details": "Hash",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-256 (A5259)",
            "condition": "Boot Up",
            "details": "Hash",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2-512 (A5259)",
            "condition": "Boot Up",
            "details": "Hash",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KBKDF",
            "condition": "Boot Up",
            "details": "Hash",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "AES-CMAC",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC (A7104)",
            "condition": "Boot Up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CBC (A7103)",
            "condition": "Boot Up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC (A7104)",
            "condition": "Boot up",
            "details": "Message authentication",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA2-256, SHA2-384, SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC (A7103)",
            "condition": "Boot up",
            "details": "Message authentication",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA2-256, SHA2-384, SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM (A3239)",
            "condition": "Boot up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Firmware load test",
            "condition": "On loading external firmware",
            "details": "Check firmware authenticity and integrity",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "-",
            "testProps": "ECDSA, P- 256",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "AES-GCM (A7103)",
            "condition": "Boot up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM (A7104)",
            "condition": "Boot up",
            "details": "Encrypt/Decrypt",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "Key Size - 128 bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA3-256 (A6926)",
            "condition": "Boot up",
            "details": "Hash",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "APT",
            "condition": "Boot up and continuously",
            "details": "SP800-90B Section 4",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "FD",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RCT",
            "condition": "Boot up and continuously",
            "details": "SP800-90B Section 4",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "FD",
            "testProps": "-",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Any self-test fails",
            "description": "All data output and cryptographic services are inhibited in the error state.",
            "indicator": "Rebooting device ...... [rebootSource]:tgrmgr [rebootReason]:FIPS error when FIPS mode enabled",
            "name": "Error Mode",
            "recoveryMethod": "Reboot"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "CO\u0027s discretion",
            "inspectGuidance": "Tamper seals are not applied at the factory prior to shipping. CO must develop an inspection schedule to verify that the enclosure of module and tamper seals have not been damaged. If found compromised, CO must zeroize the module using the steps in section 9.3 of the SP",
            "mechanism": "Tamper- evident seals"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Approved mode can only be enabled via the Wireless Manager server. The approved mode only consists of FIPS 140-3 compliant cryptography.",
            "name": "Approved Mode",
            "statusIndicator": "FIPS mode: enable",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "The packets that use the networking functionality of the module",
            "logicalInterface": "Data Input Data Output",
            "physicalPort": "Wireless Interface"
          },
          {
            "data": "All the data that is entered into the access point while using the management interface",
            "logicalInterface": "Control Input",
            "physicalPort": "Serial Interface"
          },
          {
            "data": "LED Status Indicator, API Return Value, Status information",
            "logicalInterface": "Status Output",
            "physicalPort": "Serial Interface"
          },
          {
            "data": "N/A",
            "logicalInterface": "Power",
            "physicalPort": "Power interface"
          },
          {
            "data": "The packets that use the networking functionality of the module",
            "logicalInterface": "Data Input Data Output Control Input Status Output Power",
            "physicalPort": "Ethernet interface"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Authentication of Wireless Manager server over TLS",
            "name": "Crypto Officer 1",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "Authentication over Console Authentication over SSH",
            "name": "Crypto Officer 2",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "Authentication over Wi-Fi",
            "name": "Network User",
            "operatorType": "Network User",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "2",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "2",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Firmware integrity test",
            "details": "Firmware Integrity",
            "indicator": "Pass Indicator / Error Indicator",
            "testMethod": "KAT",
            "testProps": "SHA-256",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "RAM",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Password entered",
            "sfiAlgo": "Password hash",
            "source": "External Network Device"
          },
          {
            "dest": "Flash",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Symmetric key import",
            "sfiAlgo": "",
            "source": "External Network Device"
          },
          {
            "dest": "Flash",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public Key import",
            "sfiAlgo": "",
            "source": "External Network Device"
          },
          {
            "dest": "External Network Device",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public Key export",
            "sfiAlgo": "",
            "source": "Flash"
          },
          {
            "dest": "Flash",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Password configured",
            "sfiAlgo": "Password hash",
            "source": "External Network Device"
          },
          {
            "dest": "Flash",
            "distribution": "N/A",
            "entry": "Electronic",
            "format": "Encrypted",
            "name": "Preloaded",
            "sfiAlgo": "",
            "source": "Manufacturer"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Power-cycle the host device",
            "method": "Power cycle",
            "operatorId": "Unplugging and plugging the device",
            "rationale": "All RAM is zeroised by a power-cycle."
          },
          {
            "description": "Automatic zeroisation of SSPs that are no longer needed.",
            "method": "Auto",
            "operatorId": "N/A",
            "rationale": "Memory is overwritten with 0\u0027s"
          },
          {
            "description": "Invoking the service to zeroise all SSPs in persistent storage. Causes an automatic reboot of the host device that zeroises all SSPs in volatile memory.",
            "method": "Service",
            "operatorId": "Issue the CLI command : factory reset",
            "rationale": "The CLI command overwrites the storage location keys with 0\u0027s, making them irretrievable"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "SDRAM",
            "name": "RAM",
            "persistance": "Dynamic"
          },
          {
            "description": "Flash Memory",
            "name": "Flash",
            "persistance": "Static"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "",
            "fwVersion": "21.0.0- 25.3",
            "hwVersion": "C-460",
            "modelPartNum": "C-460",
            "processors": "Qualcomm IPQ (64-bit ARM Cortex-A73)"
          },
          {
            "features": "The AP has three (3) antenna ports on both the left and right side of the AP.",
            "fwVersion": "21.0.0- 25.3",
            "hwVersion": "C-460E",
            "modelPartNum": "C-460E",
            "processors": "Qualcomm IPQ (64-bit ARM Cortex-A73)"
          },
          {
            "features": "",
            "fwVersion": "21.0.0- 25.3",
            "hwVersion": "O-435",
            "modelPartNum": "O-435",
            "processors": "Qualcomm IPQ (64-bit ARM Cortex-A53)"
          },
          {
            "features": "The AP has three (3) antenna ports on both the left and right side of the AP.",
            "fwVersion": "21.0.0- 25.3",
            "hwVersion": "O-435E",
            "modelPartNum": "O-435E",
            "processors": "Qualcomm IPQ (64-bit ARM Cortex-A53)"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Name:Symmetric Key Generation",
            "implName": "",
            "name": "CKG",
            "reference": "Section 4 NIST SP800-133r2"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 46
          },
          "ECDH": {
            "ECDH": 9
          },
          "ECDSA": {
            "ECDSA": 61
          }
        },
        "FF": {
          "DH": {
            "DH": 41,
            "DHE": 1,
            "Diffie-Hellman": 2
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 14
        },
        "GCM": {
          "GCM": 6
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "IKE": {
          "IKE": 60,
          "IKEv1": 2,
          "IKEv2": 4
        },
        "IPsec": {
          "IPsec": 50
        },
        "SSH": {
          "SSH": 83,
          "SSHv2": 1
        },
        "TLS": {
          "TLS": {
            "TLS": 90,
            "TLS 1.2": 1,
            "TLS 1.3": 1,
            "TLS v1.2": 8,
            "TLS v1.3": 9,
            "TLSv1.2": 1,
            "TLSv1.3": 1
          }
        },
        "VPN": {
          "VPN": 1
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 2,
          "Key agreement": 4
        },
        "KEX": {
          "Key Exchange": 4
        },
        "MAC": {
          "MAC": 14
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 44,
          "P-384": 28,
          "P-521": 30
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#5": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES-128": 2,
          "AES-192": 2,
          "AES-256": 3,
          "DRBG 128": 1,
          "DRBG 256": 1,
          "DRBG 384": 1,
          "HMAC- SHA-256": 2,
          "HMAC-SHA-1": 2,
          "PKCS 1": 2,
          "SHA-1": 8,
          "SHA-256": 3,
          "SHA1": 1,
          "SHA2- 384": 1,
          "SHA2-224": 9,
          "SHA2-256": 20,
          "SHA2-384": 15,
          "SHA2-512": 17,
          "SHA3-224": 3,
          "SHA3-256": 11,
          "SHA3-384": 3,
          "SHA3-512": 3
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 4
        }
      },
      "hash_function": {
        "PBKDF": {
          "PBKDF": 4,
          "PBKDF2": 1
        },
        "SHA": {
          "SHA1": {
            "SHA-1": 8,
            "SHA1": 1
          },
          "SHA2": {
            "SHA-256": 3
          },
          "SHA3": {
            "SHA3-224": 3,
            "SHA3-256": 11,
            "SHA3-384": 3,
            "SHA3-512": 3
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 37
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 71,
          "FIPS 180-4": 11,
          "FIPS 186-4": 2,
          "FIPS 186-5": 7,
          "FIPS 198-1": 11,
          "FIPS 202": 1,
          "FIPS140-3": 1,
          "FIPS186-4": 16,
          "FIPS186-5": 34
        },
        "ISO": {
          "ISO/IEC 19790:2021": 1
        },
        "NIST": {
          "SP 800-108": 1,
          "SP 800-131A": 1,
          "SP 800-132": 1,
          "SP 800-135": 5,
          "SP 800-186": 1,
          "SP 800-38A": 3,
          "SP 800-38B": 1,
          "SP 800-38C": 2,
          "SP 800-38D": 5,
          "SP 800-38F": 1,
          "SP 800-52": 1,
          "SP 800-56A": 3,
          "SP 800-90A": 1
        },
        "PKCS": {
          "PKCS 1": 1
        },
        "RFC": {
          "RFC 4106": 1,
          "RFC 5282": 1,
          "RFC 5647": 1,
          "RFC 7296": 1,
          "RFC 8446": 1,
          "RFC762": 1,
          "RFC7627": 3
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 4,
            "AES-128": 2,
            "AES-192": 2,
            "AES-256": 3
          },
          "CAST": {
            "CAST": 58
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 2,
            "HMAC": 8
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 18
        },
        "IBM": {
          "SSC": 4
        }
      },
      "tls_cipher_suite": {},
      "vendor": {
        "Qualcomm": {
          "Qualcomm": 4
        }
      },
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-GCMA7104",
        "HMAC-SHA-1A5259",
        "SHA-1A5259",
        "SHA2-512A7104",
        "SHA2-224A5259",
        "AES-CMACA5259",
        "KDF SP800-108A5259",
        "Counter DRBGA5259",
        "AES-CBCA7104",
        "HMAC-SHA2-256A7104",
        "AES-KWA5259",
        "RSA SigGen (FIPS186-5)A5259",
        "KDF IKEv2A5259",
        "AES-GMACA3239",
        "KAS-ECC-SSC Sp800-56Ar3A5259",
        "SHA3-256A6926",
        "TLS v1.3 KDFA5259",
        "HMAC-SHA2-384A7104",
        "TLS v1.2 KDF RFC7627A5259",
        "Safe Primes Key GenerationA5259",
        "RSA SigVer (FIPS186-5)A5259",
        "SHA2-256A7104",
        "ECDSA SigGen (FIPS186-5)A5259",
        "ECDSA KeyGen (FIPS186-5)A5259",
        "AES-CCMA5259",
        "HMAC-SHA2-224A5259",
        "RSA SigVer (FIPS186-4)A5259",
        "SHA2-384A7104",
        "HMAC-SHA2-512A7104",
        "KAS-FFC-SSC Sp800-56Ar3A5259",
        "KDF IKEv1A5259",
        "PBKDFA5259",
        "KDF SSHA5259",
        "RSA KeyGen (FIPS186-5)A5259",
        "ECDSA SigVer (FIPS186-4)A5259",
        "ECDSA SigVer (FIPS186-5)A5259"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A5259",
        "#A7103",
        "#A7104",
        "#A6926",
        "#A3239"
      ]
    },
    "policy_metadata": {
      "/Author": "Scott Ehrlich",
      "/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos",
      "/ClassificationContentMarkingHeaderShapeIds": "cf7f2c3,4da5b43b,333a3bfd",
      "/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT",
      "/Comments": "",
      "/Company": "",
      "/ContentTypeId": "0x01010044788752DEE24048B316A411A5F1F9B2",
      "/CreationDate": "D:20260903162829-04\u002700\u0027",
      "/Creator": "Acrobat PDFMaker 26 for Word",
      "/Keywords": "",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "66ab5853-1091-4428-a83a-3c28928485b2",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-09-03T20:18:08Z",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
      "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1",
      "/MediaServiceImageTags": "",
      "/ModDate": "D:20260903163057-04\u002700\u0027",
      "/Producer": "Adobe PDF Library 26.1.29",
      "/SourceModified": "",
      "/Subject": "",
      "/Title": "",
      "/_dlc_DocIdItemGuid": "b19cca51-4de5-45d1-96a7-cae66c6603d7",
      "pdf_file_size_bytes": 1437657,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_C460E_Access_Point.pdf",
          "http://www.lightshipsec.com/",
          "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_C460_Access_Point.pdf",
          "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_O435_Access_Point.pdf",
          "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_O435E_Access_Point.pdf"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 62
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "e117e914d6b024c2f486d402b8f9f0e44490955c9e783b37042feed3caa4cb77",
      "source_hash": "6bcf5f3db307b95a56e267edc23e5c4187d10c5d7a5b94e9a91ee991e187e8ad",
      "txt_hash": "da387bf50a5309ae38fa5b08f64d34785a5147a5af3393d0bb4baae0ac03a7f3"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and security devices installed as indicated in the security policy. Installation of the referenced components required for the module to operate in an approved mode of operation. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
    "certificate_pdf_url": null,
    "date_sunset": "2031-09-07",
    "description": "This crypto module provides network connectivity to Wireless clients. It transmits and receives wireless signals from wireless clients. It acts as a bridge between wireless clients and the wired network, extending network connectivity to wireless clients. It controls access to the network by enforcing security policies to regulate which devices can connect to it. The modules accepts commands and sends status information to an authenticated management server allowing itself to be managed by that wireless management server.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Arista WiFi Access Points",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-09-08",
        "lab": "Lightship Security, Inc.",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Arista Networks, Inc.",
    "vendor_url": "http://www.arista.com"
  }
}