{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "eacc30a21d89f388", "cert_id": 5515, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "Arista WiFi Access Points", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-09-08", "validation_type": "Initial", "lab": "Lightship Security, Inc."}], "vendor_url": "http://www.arista.com", "vendor": "Arista Networks, Inc.", "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/September 2026_071026_0710.pdf", "module_type": "Hardware", "standard": "FIPS 140-3", "status": "active", "level": 2, "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and security devices installed as indicated in the security policy. Installation of the referenced components required for the module to operate in an approved mode of operation. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.", "exceptions": ["Operational environment: N/A", "Non-invasive security: N/A", "Mitigation of other attacks: N/A"], "embodiment": "MultiChipStand", "description": "This crypto module provides network connectivity to Wireless clients. It transmits and receives wireless signals from wireless clients. It acts as a bridge between wireless clients and the wired network, extending network connectivity to wireless clients. It controls access to the network by enforcing security policies to regulate which devices can connect to it. The modules accepts commands and sends status information to an authenticated management server allowing itself to be managed by that wireless management server.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-09-07", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {"Cert": {"#5": 1}}, "fips_security_level": {"Level": {"Level 2": 4}}, "fips_certlike": {"Certlike": {"HMAC-SHA-1": 2, "HMAC- SHA-256": 2, "SHA2-224": 9, "SHA2-256": 20, "SHA2-384": 15, "SHA2-512": 17, "SHA3-224": 3, "SHA3-256": 11, "SHA3-384": 3, "SHA3-512": 3, "SHA-1": 8, "SHA2- 384": 1, "SHA-256": 3, "SHA1": 1, "PKCS 1": 2, "AES-128": 2, "AES-192": 2, "AES-256": 3, "DRBG 384": 1, "DRBG 128": 1, "DRBG 256": 1}}, "vendor": {"Qualcomm": {"Qualcomm": 4}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-128": 2, "AES-192": 2, "AES-256": 3, "AES": 4}, "CAST": {"CAST": 58}}, "constructions": {"MAC": {"HMAC": 8, "CMAC": 2}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 9}, "ECDSA": {"ECDSA": 61}, "ECC": {"ECC": 46}}, "FF": {"DH": {"Diffie-Hellman": 2, "DHE": 1, "DH": 41}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 8, "SHA1": 1}, "SHA2": {"SHA-256": 3}, "SHA3": {"SHA3-224": 3, "SHA3-256": 11, "SHA3-384": 3, "SHA3-512": 3}}, "PBKDF": {"PBKDF": 4, "PBKDF2": 1}}, "crypto_scheme": {"MAC": {"MAC": 14}, "KEX": {"Key Exchange": 4}, "KA": {"Key agreement": 4, "Key Agreement": 2}}, "crypto_protocol": {"SSH": {"SSH": 83, "SSHv2": 1}, "TLS": {"TLS": {"TLS v1.2": 8, "TLS v1.3": 9, "TLS": 90, "TLS 1.2": 1, "TLS 1.3": 1, "TLSv1.2": 1, "TLSv1.3": 1}}, "IKE": {"IKEv1": 2, "IKEv2": 4, "IKE": 60}, "IPsec": {"IPsec": 50}, "VPN": {"VPN": 1}}, "randomness": {"PRNG": {"DRBG": 37}, "RNG": {"RBG": 2}}, "cipher_mode": {"CBC": {"CBC": 14}, "GCM": {"GCM": 6}}, "ecc_curve": {"NIST": {"P-256": 44, "P-384": 28, "P-521": 30}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 18}, "IBM": {"SSC": 4}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 71, "FIPS186-5": 34, "FIPS 186-5": 7, "FIPS186-4": 16, "FIPS 186-4": 2, "FIPS 198-1": 11, "FIPS 180-4": 11, "FIPS 202": 1, "FIPS140-3": 1}, "NIST": {"SP 800-38A": 3, "SP 800-38C": 2, "SP 800-38B": 1, "SP 800-38D": 5, "SP 800-38F": 1, "SP 800-90A": 1, "SP 800-56A": 3, "SP 800-135": 5, "SP 800-108": 1, "SP 800-132": 1, "SP 800-52": 1, "SP 800-186": 1, "SP 800-131A": 1}, "PKCS": {"PKCS 1": 1}, "RFC": {"RFC7627": 3, "RFC 8446": 1, "RFC 5647": 1, "RFC 4106": 1, "RFC 5282": 1, "RFC 7296": 1, "RFC762": 1}, "ISO": {"ISO/IEC 19790:2021": 1}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 1437657, "pdf_is_encrypted": false, "pdf_number_of_pages": 62, "/Author": "Scott Ehrlich", "/ClassificationContentMarkingHeaderFontProps": "#008000,10,Aptos", "/ClassificationContentMarkingHeaderShapeIds": "cf7f2c3,4da5b43b,333a3bfd", "/ClassificationContentMarkingHeaderText": "UNCLASSIFIED / NON CLASSIFI\u00c9//TLP:AMBER+STRICT", "/Comments": "", "/Company": "", "/ContentTypeId": "0x01010044788752DEE24048B316A411A5F1F9B2", "/CreationDate": "D:20260903162829-04'00'", "/Creator": "Acrobat PDFMaker 26 for Word", "/Keywords": "", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ActionId": "66ab5853-1091-4428-a83a-3c28928485b2", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_ContentBits": "1", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Enabled": "true", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Method": "Privileged", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Name": "TLP-Amber_Strict", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SetDate": "2026-09-03T20:18:08Z", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a", "/MSIP_Label_74f313cf-d20a-406f-9af7-e4526ef74d9f_Tag": "10, 0, 1, 1", "/MediaServiceImageTags": "", "/ModDate": "D:20260903163057-04'00'", "/Producer": "Adobe PDF Library 26.1.29", "/SourceModified": "", "/Subject": "", "/Title": "", "/_dlc_DocIdItemGuid": "b19cca51-4de5-45d1-96a7-cae66c6603d7", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_C460_Access_Point.pdf", "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_C460E_Access_Point.pdf", "http://www.lightshipsec.com/", "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_O435_Access_Point.pdf", "https://www.arista.com/assets/data/pdf/qsg/qsg-books/QS_O435E_Access_Point.pdf"]}}, "module_algorithms": {"_type": "Set", "elements": ["HMAC-SHA2-512A7104", "ECDSA KeyGen (FIPS186-5)A5259", "AES-GCMA7104", "ECDSA SigVer (FIPS186-4)A5259", "KAS-FFC-SSC Sp800-56Ar3A5259", "RSA SigGen (FIPS186-5)A5259", "HMAC-SHA-1A5259", "ECDSA SigGen (FIPS186-5)A5259", "KDF IKEv2A5259", "KDF SSHA5259", "AES-CBCA7104", "HMAC-SHA2-224A5259", "AES-KWA5259", "HMAC-SHA2-256A7104", "PBKDFA5259", "TLS v1.2 KDF RFC7627A5259", "KAS-ECC-SSC Sp800-56Ar3A5259", "Safe Primes Key GenerationA5259", "SHA2-256A7104", "AES-CCMA5259", "KDF IKEv1A5259", "SHA2-384A7104", "RSA SigVer (FIPS186-5)A5259", "SHA-1A5259", "AES-CMACA5259", "RSA SigVer (FIPS186-4)A5259", "AES-GMACA3239", "SHA2-224A5259", "KDF SP800-108A5259", "TLS v1.3 KDFA5259", "SHA2-512A7104", "Counter DRBGA5259", "HMAC-SHA2-384A7104", "ECDSA SigVer (FIPS186-5)A5259", "SHA3-256A6926", "RSA KeyGen (FIPS186-5)A5259"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A3239", "#A7103", "#A7104", "#A5259", "#A6926"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "2"}, {"section": "2", "title": "Cryptographic module specification", "level": "2"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "2"}, {"section": "4", "title": "Roles, services, and authentication", "level": "2"}, {"section": "5", "title": "Software/Firmware security", "level": "2"}, {"section": "6", "title": "Operational environment", "level": "N/A"}, {"section": "7", "title": "Physical security", "level": "2"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "2"}, {"section": "10", "title": "Self-tests", "level": "2"}, {"section": "11", "title": "Life-cycle assurance", "level": "2"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "2"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": true, "entries": [{"modelPartNum": "C-460", "hwVersion": "C-460", "fwVersion": "21.0.0- 25.3", "processors": "Qualcomm IPQ (64-bit ARM Cortex-A73)", "features": ""}, {"modelPartNum": "C-460E", "hwVersion": "C-460E", "fwVersion": "21.0.0- 25.3", "processors": "Qualcomm IPQ (64-bit ARM Cortex-A73)", "features": "The AP has three (3) antenna ports on both the left and right side of the AP."}, {"modelPartNum": "O-435", "hwVersion": "O-435", "fwVersion": "21.0.0- 25.3", "processors": "Qualcomm IPQ (64-bit ARM Cortex-A53)", "features": ""}, {"modelPartNum": "O-435E", "hwVersion": "O-435E", "fwVersion": "21.0.0- 25.3", "processors": "Qualcomm IPQ (64-bit ARM Cortex-A53)", "features": "The AP has three (3) antenna ports on both the left and right side of the AP."}]}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": true, "entries": [{"name": "Approved Mode", "description": "Approved mode can only be enabled via the Wireless Manager server. The approved mode only consists of FIPS 140-3 compliant cryptography.", "type": "Approved", "statusIndicator": "FIPS mode: enable"}]}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A5259", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CBC", "cavpCertName": "A7103", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CBC", "cavpCertName": "A7104", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CCM", "cavpCertName": "A3239", "properties": "Key Length - 128, 256 Tag Length - 128, 64 IV Length - IV Length: 104 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-524280 Increment 8", "reference": "SP 800-38C"}, {"algorithm": "AES-CCM", "cavpCertName": "A5259", "properties": "Key Length - 128, 192, 256 Tag Length - 112, 128, 32, 48, 64, 80, 96 IV Length - IV Length: 56 Payload Length - Payload Length: 0-256 Increment 8 AAD Length - AAD Length: 0-524288 Increment 8", "reference": "SP 800-38C"}, {"algorithm": "AES-CMAC", "cavpCertName": "A5259", "properties": "Direction - Generation, Verification Key Length - 128, 192, 256 MAC Length - MAC Length: 16-128 Increment 8 Message Length - Message Length: 16-65536 Increment 8", "reference": "SP 800-38B"}, {"algorithm": "AES-GCM", "cavpCertName": "A3239", "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96", "reference": "SP 800-38D"}, {"algorithm": "", "cavpCertName": "", "properties": "Payload Length - Payload Length: 0-65536 Increment 8 AAD Length - AAD Length: 0-65536 Increment 8", "reference": ""}, {"algorithm": "AES-GCM", "cavpCertName": "A5259", "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392", "reference": "SP 800-38D"}, {"algorithm": "AES-GCM", "cavpCertName": "A7103", "properties": "AAD Length - AAD Length: 0, 256, 384, 136, 392 Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392 AAD Length - AAD Length: 0, 256, 384, 136, 392", "reference": "SP 800-38D"}, {"algorithm": "AES-GCM", "cavpCertName": "A7104", "properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 256, 384, 136, 392", "reference": "SP 800-38D"}, {"algorithm": "AES-GMAC", "cavpCertName": "A3239", "properties": "AAD Length - AAD Length: 0, 256, 384, 136, 392 Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 AAD Length - AAD Length: 0-65536 Increment 8", "reference": "SP 800-38D"}, {"algorithm": "AES-KW", "cavpCertName": "A5259", "properties": "Direction - Decrypt, Encrypt Cipher - Cipher, Inverse Key Length - 128, 192, 256 Payload Length - Payload Length: 128-4096 Increment 64", "reference": "SP 800-38F"}, {"algorithm": "Counter DRBG", "cavpCertName": "A5259", "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 0, 128, Additional Input: 0, 256, Additional Input: 0, 320, Additional Input: 0, 384 Entropy Input - Entropy Input: 128, Entropy Input:", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "", "cavpCertName": "", "properties": "192, Entropy Input: 256, Entropy Input: 320, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128, Nonce: 64 Personalization String Length - Personalization String Length: 0, 128, Personalization String Length: 0, 256, Personalization String Length: 0, 320, Personalization String Length: 0, 384 Returned Bits - 512", "reference": ""}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A5259", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A5259", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-4)", "cavpCertName": "A5259", "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-4"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A5259", "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512", "reference": "FIPS 186-5"}, {"algorithm": "HMAC-SHA-1", "cavpCertName": "A5259", "properties": "MAC - MAC: 80-160 Increment 8 Key Length - Key Length: 112-2048 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 224", "cavpCertName": "A5259", "properties": "MAC - MAC: 112-224 Increment 16 Key Length - Key Length: 112-2048 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 256", "cavpCertName": "A5259", "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-2048 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 256", "cavpCertName": "A7103", "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 256", "cavpCertName": "A7104", "properties": "MAC - MAC: 128-256 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 384", "cavpCertName": "A5259", "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-2048 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 384", "cavpCertName": "A7103", "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 384", "cavpCertName": "A7104", "properties": "MAC - MAC: 192-384 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 512", "cavpCertName": "A5259", "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-2048 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 512", "cavpCertName": "A7103", "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2- 512", "cavpCertName": "A7104", "properties": "MAC - MAC: 256-512 Increment 64 Key Length - Key Length: 112-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC- SSC Sp800- 56Ar3", "cavpCertName": "A5259", "properties": "Domain Parameter Generation Methods - P-256, P- 384, P-521 Hash Function Z - SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC- SSC Sp800- 56Ar3", "cavpCertName": "A5259", "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Hash Function Z - SHA2-384 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF IKEv1 (CVL)", "cavpCertName": "A5259", "properties": "Authentication Method - Pre-shared Key Initiator Nonce Length - Initiator Nonce Length: 256- 2048 Increment 128 Responder Nonce Length - Responder Nonce Length: 256-2048 Increment 128 Preshared Key Length - Preshared Key Length: 8- 8192 Increment 8 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 1024-8192 Increment 1024 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A5259", "properties": "Initiator Nonce Length - Initiator Nonce Length: 256- 2048 Increment 128 Responder Nonce Length - Responder Nonce Length: 256-2048 Increment 128 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 1024-8192 Increment 1024 Derived Keying Material Length - Derived Keying Material Length: 256-2048 Increment 128 Hash Algorithm - SHA-1, SHA2-256, SHA2-384,", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF SP800- 108", "cavpCertName": "A5259", "properties": "SHA2-512 KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC-AES256 Supported Lengths - Supported Lengths: 128 Fixed Data Order - Before Fixed Data Counter Length - 8 Supports Empty IV - No Custom Key In Length - 0", "reference": "SP 800-108 Rev. 1"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A5259", "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "PBKDF", "cavpCertName": "A5259", "properties": "Iteration Count - Iteration Count: 1-10000 Increment 1 HMAC Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3-512 Password Length - Password Length: 8-64 Increment 1 Salt Length - Salt Length: 128-512 Increment 8 Key Data Length - Key Data Length: 112-4096 Increment 8", "reference": "SP 800-132"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A5259", "properties": "Key Generation Mode - probable, probableWithProbableAux Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A5259", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-4)", "cavpCertName": "A5259", "properties": "Signature Type - ANSI X9.31, PKCS 1.5, PKCSPSS Modulo - 1024, 2048, 3072, 4096 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Random", "reference": "FIPS 186-4"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A5259", "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Mask Function - mgf1 Public Exponent Mode - random", "reference": "FIPS 186-5"}, {"algorithm": "Safe Primes Key Generation", "cavpCertName": "A5259", "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP- 8192", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "SHA-1", "cavpCertName": "A5259", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-224", "cavpCertName": "A5259", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A5259", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A7103", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A7104", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-384", "cavpCertName": "A5259", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-384", "cavpCertName": "A7103", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-384", "cavpCertName": "A7104", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A5259", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1, 4", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A7103", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A7104", "properties": "Message Length - Message Length: 8-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA3-256", "cavpCertName": "A6926", "properties": "Message Length - Message Length: 0-65536 Increment 8 Large Message Sizes - 1", "reference": "FIPS 202"}, {"algorithm": "TLS v1.2 KDF RFC7627 (CVL)", "cavpCertName": "A5259", "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "TLS v1.3 KDF (CVL)", "cavpCertName": "A5259", "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE", "reference": "SP 800-135 Rev. 1"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG", "algoPropList": "Name:Symmetric Key Generation", "implName": "", "reference": "Section 4 NIST SP800-133r2"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": false, "entries": []}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "Wireless Interface", "logicalInterface": "Data Input Data Output", "data": "The packets that use the networking functionality of the module"}, {"physicalPort": "Serial Interface", "logicalInterface": "Control Input", "data": "All the data that is entered into the access point while using the management interface"}, {"physicalPort": "Serial Interface", "logicalInterface": "Status Output", "data": "LED Status Indicator, API Return Value, Status information"}, {"physicalPort": "Power interface", "logicalInterface": "Power", "data": "N/A"}, {"physicalPort": "Ethernet interface", "logicalInterface": "Data Input Data Output Control Input Status Output Power", "data": "The packets that use the networking functionality of the module"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "Authentication over Console", "description": "Obfuscated password entry", "mechanism": "Memorized Secret", "strength": "Not subjected to failed attempts, but the number of attempts per minute is limited by baud rate of serial port, which is a maximum of 115,200 bps which is 6,912,000 bits per minute", "perMinute": "1/(87^9/108,000) which is less than 1/100,000."}, {"name": "Authentication over SSH", "description": "Authentication over SSH", "mechanism": "Memorized Secret", "strength": "Subject to a limit of 5 failed auth attempts with lockout time of 5 minutes", "perMinute": "5/(5*87^9), which is less than 1/100000."}, {"name": "Authentication over Wi-Fi", "description": "Obfuscated password entry", "mechanism": "Memorized Secret or certificates", "strength": "-", "perMinute": "-"}, {"name": "Authentication of Wireless Manager server over TLS", "description": "Authentication over TLS using certificates", "mechanism": "Certificates", "strength": "-", "perMinute": "-"}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Crypto Officer 1", "type": "Identity", "operatorType": "CO", "authMethodList": "Authentication of Wireless Manager server over TLS"}, {"name": "Crypto Officer 2", "type": "Identity", "operatorType": "CO", "authMethodList": "Authentication over Console Authentication over SSH"}, {"name": "Network User", "type": "Role", "operatorType": "Network User", "authMethodList": "Authentication over Wi-Fi"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Authenticate to module", "description": "Crypto Officer authenticate s to the module over CLI", "indicator": "System logs", "inputs": "Passwor d", "outputs": "Status", "secFunImpl": "Password hash", "rolesSspAccess": "Crypto Officer 2 - Entered CO Password: W,E,Z - Configured user password: E"}, {"name": "Connect to module remotely using SSH (DH)", "description": "The module offers authenticatio n over SSH", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish SSH (FFC) Entropy Random number", "rolesSspAccess": "Crypto Officer 2 - SSH shared secret: G,E,Z - SSH Session Authentication Key: G - SSH Session Encryption Key: G"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- DRBG Output: E - DH Private Key: G,E,Z - DH Public key : G,R,Z - DH Peer Public key: W,E,Z - SSH Server public key: E - SSH Server private key: E"}, {"name": "Connect to module remotely using SSH (ECDH)", "description": "The module offers authenticatio n over SSH", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish SSH (ECC) Entropy Random number", "rolesSspAccess": "Crypto Officer 2 - SSH shared secret: G,E,Z - SSH Session Authentication Key: G - SSH Session Encryption Key: G - DRBG Output: E - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - SSH Server public key: E - SSH Server private key: E"}, {"name": "Connect to HTTP servers (DH)", "description": "The module works as an HTTP client over TLS", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish TLS (FFC) Entropy Random number", "rolesSspAccess": "Network User - TLS server public key: W,E,Z - TLS client public key: R - DH Private Key: G,E,Z - DH Public"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "key : G,R,Z - DH Peer Public key: W,E,Z - TLS pre- master secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session Authentication Key: G - TLS Session Encryption Key: G - TLS client private key: E"}, {"name": "Connect to HTTP servers (ECDH)", "description": "The module works as an HTTP client over TLS", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish TLS (ECC) Entropy Random number", "rolesSspAccess": "Network User - TLS server public key: W,E,Z - TLS client public key: R - TLS pre- master secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session Authentication Key: G - TLS Session Encryption Key: G - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - TLS client private key: E"}, {"name": "Establish IPsec connection (DH)", "description": "Establish IPsec connection as a client", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish IPsec (FFC) Entropy", "rolesSspAccess": "Network User - IKE Authentication Key: G"}, {"name": "Name", "description": "Description", "indicator": "Indicato r", "inputs": "Inputs", "outputs": "Output", "secFunImpl": "Security Functions", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "s", "secFunImpl": "Random number", "rolesSspAccess": "- IKE Pre- Shared Key: E - IKE Session Encryption Key: G - IKE RSA private Key: E - IKE RSA public key: R - IKE RSA peer public key: W,E,Z - IKE ECDSA private Key: E - IKE ECDSA public key: R - IKE ECDSA peer public key: W,E,Z - DH Private Key: G,E,Z - DH Public key : G,R,Z - DH Peer Public key: W,E,Z - IPsec Session Authentication Key: G - IPsec Session Encryption Key: G - IKE key generation key: G,E,Z - IKE/IPSec shared secret: G,E,Z"}, {"name": "Establish IPsec connection (ECDH)", "description": "Establish IPsec connection as a client", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Establish IPsec (ECC) Entropy Random number", "rolesSspAccess": "Network User - IKE Authentication Key: G - IKE Pre- Shared Key: E - IKE Session"}, {"name": "Name", "description": "Description", "indicator": "Indicato r", "inputs": "Inputs", "outputs": "Output s", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Functions", "rolesSspAccess": "Encryption Key: G - IKE RSA private Key: E - IKE RSA public key: R - IKE RSA peer public key: W,E,Z - IKE ECDSA private Key: E - IKE ECDSA public key: R - IKE ECDSA peer public key: W,E,Z - EC DH Private Key: G,E,Z - EC DH Public Key: G,R,Z - ECDH Peer Public key: W,E,Z - IPsec Session Authentication Key: G - IPsec Session Encryption Key: G - IKE key generation key: G,E,Z - IKE/IPSec shared secret:"}, {"name": "Secure 802.11 Wireless Connection", "description": "Provide wireless connection to wireless client", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Transfer data with CBC Transfer wireless managemen t frames Transfer data with GCM/CCM", "rolesSspAccess": "G,E,Z Network User - WPA2/WPA3 Pre-shared Key: W,E,Z - WPA2/WPA3 Pair-Wise Master Key (PMK): G,E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "WPA Handshake", "rolesSspAccess": "- WPA2/WPA3 Pairwise Transient Key (PTK): G,E - WPA2/WPA3 Group Master Key (GMK): G,E,Z - WPA2/WPA3 Group Transient Key (GTK): G,E"}, {"name": "Self-tests", "description": "Execute self tests by rebooting device", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Firmware integrity", "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1"}, {"name": "Config user password", "description": "Change password for config user", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Password hash", "rolesSspAccess": "Crypto Officer 1 - Configured user password: W,E,Z"}, {"name": "Synchronize client information to neighbor APs", "description": "Synchronize client information to neighbor APs", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Transfer data with CBC Key derivation - CMAC", "rolesSspAccess": "Network User - Client information synchronizatio n key: E,Z"}, {"name": "Execute firmware update", "description": "Execute firmware update", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "Firmware authenticatio n", "rolesSspAccess": "Crypto Officer 1 - Firmware upgrade key: E,Z Crypto Officer 2 - Firmware upgrade key: E,Z"}, {"name": "Provision custom certificate", "description": "Generate certificate signing request and verify certificate", "indicator": "System logs", "inputs": "Comman d and certificat e", "outputs": "Status", "secFunImpl": "Generate CSR Verify certificate Random number", "rolesSspAccess": "Crypto Officer 1 - DRBG Output: G,E,Z - RSA Public Keys : G,W,E - RSA Private"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Keys: G,E - ECDSA Public Keys: G,E - ECDSA Private Keys: G,W,E - Entropy input: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - DRBG Key: G,E,Z"}, {"name": "Show approved mode enabled", "description": "Display the module's mode", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1"}, {"name": "Show system status", "description": "Show system status", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer 2"}, {"name": "Show version", "description": "Display the version of the module", "indicator": "System logs", "inputs": "Comman d", "outputs": "Status", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer 2 Crypto Officer 1"}, {"name": "Traffic over HTTP", "description": "Traffic over HTTP", "indicator": "System logs", "inputs": "HTTP request", "outputs": "HTTP data", "secFunImpl": "Transfer data with CBC Transfer data with GCM/CCM", "rolesSspAccess": "Crypto Officer 2 - TLS Session Authentication Key: E,Z - TLS Session Encryption Key: E,Z"}, {"name": "Traffic over SSH", "description": "Traffic over SSH", "indicator": "System logs", "inputs": "SSH comman d", "outputs": "Status", "secFunImpl": "Transfer data with CBC Transfer data with GCM/CCM", "rolesSspAccess": "Crypto Officer 2 - SSH Session Authentication Key: E,Z - SSH Session Encryption Key: E,Z"}, {"name": "Traffic over IPsec", "description": "Traffic over IPsec", "indicator": "System logs", "inputs": "Traffic data", "outputs": "Traffic data", "secFunImpl": "Transfer data with CBC Transfer", "rolesSspAccess": "Network User - IKE Authentication Key: E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "data with GCM/CCM", "rolesSspAccess": "- IKE Session Encryption Key: E,Z - IPsec Session Authentication Key: E,Z - IPsec Session Encryption Key: E,Z"}, {"name": "Factory reset", "description": "Zeroise the module", "indicator": "System reboot", "inputs": "Comman d or reset pinhole", "outputs": "-", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer 2 - Entered CO Password: Z - Client information synchronizatio n key: Z - Entropy input: Z - DRBG Seed: Z - DRBG V: Z - DRBG Key: Z - DRBG Output: Z - TLS server public key: Z - TLS client public key: Z - TLS client private key: Z - TLS pre- master secret: Z - TLS Master Secret: Z - TLS Session Authentication Key: Z - TLS Session Encryption Key: Z - SSH Server public key: Z - SSH Server private key: Z"}, {"name": "Name", "description": "Description", "indicator": "Indicato", "inputs": "Inputs", "outputs": "Output", "secFunImpl": "Security", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "r", "inputs": "", "outputs": "s", "secFunImpl": "Functions", "rolesSspAccess": "- SSH shared secret: Z - SSH Session Authentication Key: Z - SSH Session Encryption Key: Z - IKE Authentication Key: Z - IKE Pre- Shared Key: Z - IKE Session Encryption Key: Z - IKE RSA private Key: Z - IKE RSA public key: Z - IKE RSA peer public key: Z - IKE ECDSA private Key: Z - IKE ECDSA public key: Z - IKE ECDSA peer public key: Z - DH Private Key: Z - DH Public key : Z - EC DH Private Key: Z - EC DH Public Key: Z - AP public key: Z - AP private key: Z"}, {"name": "Authenticatio n to wired network", "description": "Authenticate s the AP to wired network", "indicator": "System logs", "inputs": "Comman d and certificat e", "outputs": "Status", "secFunImpl": "Uplink port authenticatio n", "rolesSspAccess": "Network User - AP public key: R,E - AP private key: E"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": false, "entries": []}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": true, "entries": [{"mechanism": "Tamper- evident seals", "inspectFreq": "CO's discretion", "inspectGuidance": "Tamper seals are not applied at the factory prior to shipping. CO must develop an inspection schedule to verify that the enclosure of module and tamper seals have not been damaged. If found compromised, CO must zeroize the module using the steps in section 9.3 of the SP"}]}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "RAM", "description": "SDRAM", "persistance": "Dynamic"}, {"name": "Flash", "description": "Flash Memory", "persistance": "Static"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Password entered", "source": "External Network Device", "dest": "RAM", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": "Password hash"}, {"name": "Symmetric key import", "source": "External Network Device", "dest": "Flash", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Public Key import", "source": "External Network Device", "dest": "Flash", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Public Key export", "source": "Flash", "dest": "External Network Device", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Password configured", "source": "External Network Device", "dest": "Flash", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "Password hash"}, {"name": "Preloaded", "source": "Manufacturer", "dest": "Flash", "format": "Encrypted", "distribution": "N/A", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Power cycle", "description": "Power-cycle the host device", "rationale": "All RAM is zeroised by a power-cycle.", "operatorId": "Unplugging and plugging the device"}, {"method": "Auto", "description": "Automatic zeroisation of SSPs that are no longer needed.", "rationale": "Memory is overwritten with 0's", "operatorId": "N/A"}, {"method": "Service", "description": "Invoking the service to zeroise all SSPs in persistent storage. Causes an automatic reboot of the host device that zeroises all SSPs in volatile memory.", "rationale": "The CLI command overwrites the storage location keys with 0's, making them irretrievable", "operatorId": "Issue the CLI command : factory reset"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "Firmware integrity test", "testProps": "SHA-256", "testMethod": "KAT", "type": "SW/FW Integrity", "indicator": "Pass Indicator / Error Indicator", "details": "Firmware Integrity"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "AES-CBC (A5259)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot Up"}, {"algorithmOrTest": "AES-GCM (A5259)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot Up"}, {"algorithmOrTest": "Counter DRBG (A5259)", "testProps": "AES-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Health tests- Instantiate, Generate, and Reseed", "condition": "Boot Up"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186- 5) (A5259)", "testProps": "P-256 Curve", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Sign", "condition": "Boot Up"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186- 5) (A5259)", "testProps": "P-256 Curve", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Verify", "condition": "Boot Up"}, {"algorithmOrTest": "HMAC (A5259)", "testProps": "SHA1, SHA2-224, SHA2-256, SHA2-384, SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Message Authentication", "condition": "Boot Up"}, {"algorithmOrTest": "KAS-ECC- SSC Sp800-", "testProps": "P-256 Curve", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator /", "details": "Key Agreement", "condition": "Boot Up"}, {"algorithmOrTest": "56Ar3 (A5259)", "testProps": "", "testMethod": "", "type": "", "indicator": "Error Indicator", "details": "", "condition": ""}, {"algorithmOrTest": "KAS-FFC- SSC Sp800- 56Ar3 (A5259)", "testProps": "MODP- 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Key Agreement", "condition": "Boot Up"}, {"algorithmOrTest": "RSA SigGen", "testProps": "Modulus Size- 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Sign", "condition": "Boot Up"}, {"algorithmOrTest": "RSA SigVer", "testProps": "Modulus Size- 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Verify", "condition": "Boot Up"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS186- 5) (A5259)", "testProps": "Modulus Size - 2048", "testMethod": "PCT", "type": "PCT", "indicator": "Pass Indicator / Error Indicator", "details": "ECDSA key pair generation", "condition": "On key pair generation"}, {"algorithmOrTest": "SHA3-256 (A4291)", "testProps": "SHA3-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Message Digest", "condition": "Boot Up"}, {"algorithmOrTest": "RSA KeyGen (FIPS186- 5) (A5259)", "testProps": "Modulus Size- 2048", "testMethod": "PCT", "type": "PCT", "indicator": "Pass Indicator / Error Indicator", "details": "RSA key pair generation", "condition": "On key pair generation"}, {"algorithmOrTest": "Safe Primes Key Generation (A5259)", "testProps": "MODP 2048", "testMethod": "PCT", "type": "PCT", "indicator": "Pass Indicator / Error Indicator", "details": "Safe prime key pair generation", "condition": "On key pair generation"}, {"algorithmOrTest": "PBKDF (A5259)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Key derivation from password", "condition": "Boot Up"}, {"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A5259)", "testProps": "HMAC- SHA-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "KDF used in TLSv1.2", "condition": "Boot Up"}, {"algorithmOrTest": "TLS v1.3 KDF (A5259)", "testProps": "HMAC- SHA-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "KDF used in TLSv1.3", "condition": "Boot Up"}, {"algorithmOrTest": "KDF SSH (A5259)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "KDF used in SSH", "condition": "Boot Up"}, {"algorithmOrTest": "SHA-1 (A5259)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Hash", "condition": "Boot Up"}, {"algorithmOrTest": "SHA2-256 (A5259)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Hash", "condition": "Boot Up"}, {"algorithmOrTest": "SHA2-512 (A5259)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Hash", "condition": "Boot Up"}, {"algorithmOrTest": "KBKDF", "testProps": "AES-CMAC", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Hash", "condition": "Boot Up"}, {"algorithmOrTest": "AES-CBC (A7104)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot Up"}, {"algorithmOrTest": "AES-CBC (A7103)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot Up"}, {"algorithmOrTest": "HMAC (A7104)", "testProps": "SHA2-256, SHA2-384, SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Message authentication", "condition": "Boot up"}, {"algorithmOrTest": "HMAC (A7103)", "testProps": "SHA2-256, SHA2-384, SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Message authentication", "condition": "Boot up"}, {"algorithmOrTest": "AES-GCM (A3239)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot up"}, {"algorithmOrTest": "Firmware load test", "testProps": "ECDSA, P- 256", "testMethod": "-", "type": "SW/FW Load", "indicator": "Pass Indicator / Error Indicator", "details": "Check firmware authenticity and integrity", "condition": "On loading external firmware"}, {"algorithmOrTest": "AES-GCM (A7103)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot up"}, {"algorithmOrTest": "AES-GCM (A7104)", "testProps": "Key Size - 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Encrypt/Decrypt", "condition": "Boot up"}, {"algorithmOrTest": "SHA3-256 (A6926)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "Hash", "condition": "Boot up"}, {"algorithmOrTest": "APT", "testProps": "-", "testMethod": "FD", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "SP800-90B Section 4", "condition": "Boot up and continuously"}, {"algorithmOrTest": "RCT", "testProps": "-", "testMethod": "FD", "type": "CAST", "indicator": "Pass Indicator / Error Indicator", "details": "SP800-90B Section 4", "condition": "Boot up and continuously"}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Error Mode", "description": "All data output and cryptographic services are inhibited in the error state.", "conditions": "Any self-test fails", "recoveryMethod": "Reboot", "indicator": "Rebooting device ...... [rebootSource]:tgrmgr [rebootReason]:FIPS error when FIPS mode enabled"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["HMAC-SHA2-512A7104", "ECDSA KeyGen (FIPS186-5)A5259", "AES-GCMA7104", "ECDSA SigVer (FIPS186-4)A5259", "KAS-FFC-SSC Sp800-56Ar3A5259", "#A7103", "#A7104", "RSA SigGen (FIPS186-5)A5259", "HMAC-SHA-1A5259", "#A5259", "ECDSA SigGen (FIPS186-5)A5259", "KDF IKEv2A5259", "#A6926", "KDF SSHA5259", "AES-CBCA7104", "HMAC-SHA2-224A5259", "AES-KWA5259", "HMAC-SHA2-256A7104", "PBKDFA5259", "TLS v1.2 KDF RFC7627A5259", "KAS-ECC-SSC Sp800-56Ar3A5259", "Safe Primes Key GenerationA5259", "SHA2-256A7104", "AES-CCMA5259", "KDF IKEv1A5259", "SHA2-384A7104", "RSA SigVer (FIPS186-5)A5259", "SHA-1A5259", "#A3239", "AES-CMACA5259", "RSA SigVer (FIPS186-4)A5259", "AES-GMACA3239", "SHA2-224A5259", "KDF SP800-108A5259", "TLS v1.3 KDFA5259", "SHA2-512A7104", "Counter DRBGA5259", "HMAC-SHA2-384A7104", "ECDSA SigVer (FIPS186-5)A5259", "SHA3-256A6926", "RSA KeyGen (FIPS186-5)A5259"]}, "extracted_versions": {"_type": "Set", "elements": ["-"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "6bcf5f3db307b95a56e267edc23e5c4187d10c5d7a5b94e9a91ee991e187e8ad", "txt_hash": "da387bf50a5309ae38fa5b08f64d34785a5147a5af3393d0bb4baae0ac03a7f3", "json_hash": "e117e914d6b024c2f486d402b8f9f0e44490955c9e783b37042feed3caa4cb77"}}}