Palo Alto Networks, Inc. www.paloaltonetworks.com © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies. Revision Date: June 18, 2026 Document Version: 1.1 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200, ION 1200-S, ION 3200, ION 5200, and ION 9200 FIPS 140-3 Non-Proprietary Security Policy Page 2 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Table of Contents 1 General................................................................................................................................... 6 1.1 Overview .......................................................................................................................... 6 1.2 Security Levels ................................................................................................................. 6 2 Cryptographic Module Specification........................................................................................ 6 2.1 Description ....................................................................................................................... 6 2.2 Tested and Vendor Affirmed Module Version and Identification........................................ 9 2.3 Excluded Components.....................................................................................................10 2.4 Modes of Operation.........................................................................................................10 2.5 Algorithms .......................................................................................................................10 2.6 Security Function Implementations..................................................................................14 2.7 Algorithm Specific Information .........................................................................................19 2.8 RBG and Entropy ............................................................................................................19 2.9 Key Generation................................................................................................................20 2.10 Key Establishment.........................................................................................................20 2.11 Industry Protocols..........................................................................................................21 3 Cryptographic Module Interfaces............................................................................................21 3.1 Ports and Interfaces ........................................................................................................21 4 Roles, Services, and Authentication.......................................................................................21 4.1 Authentication Methods ...................................................................................................21 4.2 Roles...............................................................................................................................23 4.3 Approved Services ..........................................................................................................23 4.4 Non-Approved Services...................................................................................................30 4.5 External Software/Firmware Loaded................................................................................30 4.6 Cryptographic Output Actions and Status ........................................................................30 4.7 Additional Information......................................................................................................30 5 Software/Firmware Security ...................................................................................................30 5.1 Integrity Techniques ........................................................................................................30 5.2 Initiate on Demand ..........................................................................................................30 6 Operational Environment........................................................................................................31 6.1 Operational Environment Type and Requirements ..........................................................31 7 Physical Security....................................................................................................................31 7.1 Mechanisms and Actions Required..................................................................................31 7.2 User Placed Tamper Seals..............................................................................................31 8 Non-Invasive Security ............................................................................................................37 9 Sensitive Security Parameters Management..........................................................................37 Page 3 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. 9.1 Storage Areas .................................................................................................................37 9.2 SSP Input-Output Methods..............................................................................................38 9.3 SSP Zeroization Methods................................................................................................38 9.4 SSPs ...............................................................................................................................38 9.5 Transitions.......................................................................................................................45 10 Self-Tests.............................................................................................................................45 10.1 Pre-Operational Self-Tests ............................................................................................45 10.2 Conditional Self-Tests....................................................................................................46 10.3 Periodic Self-Test Information........................................................................................50 10.4 Error States ...................................................................................................................52 11 Life-Cycle Assurance ...........................................................................................................53 11.1 Installation, Initialization, and Startup Procedures..........................................................53 11.2 Administrator Guidance .................................................................................................54 11.3 Non-Administrator Guidance..........................................................................................54 11.4 End of Life .....................................................................................................................54 12 Mitigation of Other Attacks ...................................................................................................54 Page 4 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. List of Tables Table 1: Security Levels............................................................................................................. 6 Table 2: Tested Module Identification – Hardware ..................................................................... 9 Table 3: Modes List and Description .........................................................................................10 Table 4: Approved Algorithms - Crypto Library - I......................................................................12 Table 5: Approved Algorithms - Crypto Library - II.....................................................................13 Table 6: Approved Algorithms - Crypto Library - IV ...................................................................13 Table 7: Approved Algorithms -.................................................................................................13 Table 8: Approved Algorithms - Crypto Library - V ....................................................................14 Table 9: Vendor-Affirmed Algorithms ........................................................................................14 Table 10: Security Function Implementations............................................................................19 Table 11: Entropy Certificates...................................................................................................19 Table 12: Entropy Sources........................................................................................................20 Table 13: Ports and Interfaces ..................................................................................................21 Table 14: Authentication Methods.............................................................................................22 Table 15: Roles.........................................................................................................................23 Table 16: Approved Services ....................................................................................................29 Table 17: Mechanisms and Actions Required ...........................................................................31 Table 18: Storage Areas ...........................................................................................................37 Table 19: SSP Input-Output Methods........................................................................................38 Table 20: SSP Zeroization Methods..........................................................................................38 Table 21: SSP Table 1..............................................................................................................43 Table 22: SSP Table 2..............................................................................................................45 Table 23: Pre-Operational Self-Tests........................................................................................45 Table 24: Conditional Self-Tests ...............................................................................................49 Table 25: Pre-Operational Periodic Information.........................................................................50 Table 26: Conditional Periodic Information................................................................................52 Table 27: Error States...............................................................................................................53 List of Figures Figure 1: ION 1200 .................................................................................................................... 7 Figure 2: ION 1200 (Top), ION 1200-C-NA/ION 1200-C-ROW (Middle), and ION 1200-C-5G- WW (Bottom) front interfaces..................................................................................................... 7 Figure 3: ION 1200-S (Top), ION 1200-S-C-NA/ION 1200-S-C-ROW (Middle), and ION 1200-S- C-5G-WW (Bottom) front interfaces ........................................................................................... 7 Figure 4: ION 1200 (Top), ION 1200-C-NA/ION 1200-C-ROW (Middle), and ION 1200-C-5G- WW (Bottom) Rear Interfaces .................................................................................................... 8 Figure 5: ION 1200-S (Top), ION 1200-S-C-NA/ION 1200-S-C-ROW (Middle), and ION 1200-S- C-5G-WW (Bottom) Rear Interfaces........................................................................................... 8 Figure 6: ION 3200 Front Interfaces........................................................................................... 8 Figure 7: ION 3200 Rear Interfaces ........................................................................................... 8 Figure 8: ION 5200 Front Interfaces........................................................................................... 8 Figure 9: ION 5200 Rear Interfaces ........................................................................................... 8 Figure 10: ION 9200 Front Interfaces......................................................................................... 8 Figure 11: ION 9200 Rear Interfaces ......................................................................................... 9 Figure 12: ION 1200 Front View................................................................................................32 Figure 13: ION 1200-C-5G-WW Front View ..............................................................................32 Page 5 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 14: ION 1200-C-NA and ION 1200-C-ROW Front View .................................................32 Figure 15: ION 1200 Left View (same for all models) ................................................................33 Figure 16: ION 1200 Right View (same for all models)..............................................................33 Figure 17: ION 1200 Top View..................................................................................................33 Figure 18: ION 1200-C-5G-WW/ION 1200-C-NA/ION 1200-C-ROW Top View.........................34 Figure 19: ION 1200 Rear View ................................................................................................34 Figure 20: ION 1200 Bottom View.............................................................................................34 Figure 21: ION 1200-C-5G-WW/ION 1200-C-NA/ION 1200-C-ROW Bottom View....................35 Figure 22: ION 1200-S Rear View.............................................................................................35 Figure 23: ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW Rear View...........35 Figure 24: ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW Bottom View..............................................................................................................................36 Figure 25: ION 3200 Rear View ................................................................................................36 Figure 26: ION 3200 Bottom View.............................................................................................36 Figure 27: ION 3200 Left Side View..........................................................................................37 Figure 28: ION 3200 Right Side View........................................................................................37 Figure 29: ION 5200/9200 FIPS Kit Installation.........................................................................37 Page 6 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. 1 General 1.1 Overview The table below provides the security levels of the various sections of FIPS 140-3 in relation to the Palo Alto Networks SD-WAN Instant-On Network (ION) Devices ION 1200, ION 1200-S, ION 3200, ION 5200, and ION 9200 (hereinafter referred to as the Module or ION module). 1.2 Security Levels Section Title Security Level 1 General 2 2 Cryptographic module specification 2 3 Cryptographic module interfaces 2 4 Roles, services, and authentication 2 5 Software/Firmware security 2 6 Operational environment N/A 7 Physical security 2 8 Non-invasive security N/A 9 Sensitive security parameter management 2 10 Self-tests 2 11 Life-cycle assurance 2 12 Mitigation of other attacks N/A Overall Level 2 Table 1: Security Levels 2 Cryptographic Module Specification 2.1 Description Purpose and Use: The Palo Alto Networks SD-WAN Instant-On Network (ION) Devices enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of a WAN. Built with the intent to reduce remote infrastructure, Palo Alto Networks SD-WAN ION devices enable the cloud-delivered branch. Module Type: Hardware Module Embodiment: Multi-Chip Standalone Cryptographic Boundary: Module’s cryptographic boundary is defined as the entire chassis unit’s physical perimeter encompassing the "top," "front," "left," "right," “rear” and "bottom" surfaces of the case as shown in the figures below and in the Physical Security section. This section illustrates the module hardware with the help of photographs. Page 7 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 1: ION 1200 Figure 2: ION 1200 (Top), ION 1200-C-NA/ION 1200-C-ROW (Middle), and ION 1200-C-5G-WW (Bottom) front interfaces Figure 3: ION 1200-S (Top), ION 1200-S-C-NA/ION 1200-S-C-ROW (Middle), and ION 1200-S-C-5G-WW (Bottom) front interfaces Page 8 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 4: ION 1200 (Top), ION 1200-C-NA/ION 1200-C-ROW (Middle), and ION 1200-C-5G-WW (Bottom) Rear Interfaces Figure 5: ION 1200-S (Top), ION 1200-S-C-NA/ION 1200-S-C-ROW (Middle), and ION 1200-S-C-5G-WW (Bottom) Rear Interfaces Figure 6: ION 3200 Front Interfaces Figure 7: ION 3200 Rear Interfaces Figure 8: ION 5200 Front Interfaces Figure 9: ION 5200 Rear Interfaces Figure 10: ION 9200 Front Interfaces Page 9 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 11: ION 9200 Rear Interfaces 2.2 Tested and Vendor Affirmed Module Version and Identification Tested Module Identification – Hardware: Model and/or Part Number Hardware Version Firmware Version Processors Features ION 1200 ION 1200 6.1.2 Intel Atom C3436L LEDs, Console, Ethernet, Uplink, Power ION 1200-C- NA ION 1200-C- NA 6.1.2 Intel Atom C3436L LEDs, Console, Ethernet, Uplink Connector, Power ION 1200-C- ROW ION 1200-C- ROW 6.1.2 Intel Atom C3436L LEDs, Console, Ethernet, Uplink Connector, Power ION 1200-C- 5G-WW ION 1200-C- 5G-WW 6.1.2 Intel Atom C3436L LEDs, Console, Ethernet, Uplink Connector, Power ION 1200-S ION 1200-S 6.1.2 Intel Atom C3436L Console, Micro USB, SFP/RJ-45 Combo, ByPass Pair, Ethernet Ports, LEDs, Power ION 1200-S- C-NA ION 1200-S- C-NA 6.1.2 Intel Atom C3436L Console, Micro USB, SFP/RJ-45 Combo, ByPass Pair, Ethernet Ports, LEDs, Power, Uplink Connector ION 1200-S- C-ROW ION 1200-S- C-ROW 6.1.2 Intel Atom C3436L Console, Micro USB, SFP/RJ-45 Combo, ByPass Pair, Ethernet Ports, LEDs, Power, Uplink Connector ION 1200-S- C5G-WW ION 1200-S- C5G-WW 6.1.2 Intel Atom C3436L Console, Micro USB, SFP/RJ-45 Combo, ByPass Pair, Ethernet Ports, LEDs, Power, Uplink Connector ION 3200 ION 3200 6.1.2 Intel Atom C3558R Console, Micro USB, SFP / RJ-45 Combo Port, ByPass Pair, Ethernet or PoE, LEDs, Power ION 5200 ION 5200 6.1.2 Intel Atom C5325 ByPass Pair, PoE, SFP+, Ethernet, Console, Micro USB, LEDs, Power ION 9200 ION 9200 6.1.2 Intel Atom P5362 ByPass Pair, PoE, SFP+, Ethernet, Console, Micro USB, LEDs, Power Table 2: Tested Module Identification – Hardware Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets): N/A for this module. Tested Module Identification – Hybrid Disjoint Hardware: Page 10 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: N/A for this module. Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. 2.3 Excluded Components N/A for this module. 2.4 Modes of Operation Modes List and Description: Mode Name Description Type Status Indicator Approved Mode The module has one approved mode of operation and is always in approved mode after initialization Approved Device Mode: "fips" output after following initialization steps in section 11.1 Table 3: Modes List and Description The module has one approved mode of operation and is always in the approved mode of operation after initial operations are performed (See Section 11). The module does not claim implementation of a degraded mode of operation. Section 4 provides details on the service indicator implemented by the module. 2.5 Algorithms Approved Algorithms: Crypto Library - I Algorithm CAVP Cert Properties Reference AES-CBC A3563 Direction - Decrypt, Encrypt Key Length - 128, 192, 256 SP 800-38A AES-CFB128 A3563 Direction - Decrypt, Encrypt Key Length - 128, 192, 256 SP 800-38A AES-CTR A3563 Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Supports Counter larger than maximum value - No SP 800-38A Page 11 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm CAVP Cert Properties Reference Incremental Counter - Yes Counter Tests Performed - Yes AES-ECB A3563 Direction - Decrypt, Encrypt Key Length - 128, 192, 256 SP 800-38A AES-GCM A3563 Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 104, 112, 120, 128, 32, 64, 96 IV Length - IV Length: 96, 1024 Payload Length - Payload Length: 504-1024 Increment 8 AAD Length - AAD Length: 0-1024 Increment 8 SP 800-38D Counter DRBG A3563 Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 128, Additional Input: 256, Additional Input: 320, Additional Input: 384 Entropy Input - Entropy Input: 128, Entropy Input: 192, Entropy Input: 256, Entropy Input: 320, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128, Nonce: 64 Personalization String Length - Personalization String Length: 128, Personalization String Length: 256, Personalization String Length: 320, Personalization String Length: 384 Returned Bits - 1152, 448, 768, 832, 896, 960 SP 800-90A Rev. 1 ECDSA KeyGen (FIPS186-4) A3563 Curve - P-256, P-384, P-521 Secret Generation Mode - Extra Bits, Testing Candidates FIPS 186-4 ECDSA SigGen (FIPS186-4) A3563 Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 FIPS 186-4 ECDSA SigVer (FIPS186-4) A3563 Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512 FIPS 186-4 HMAC-SHA-1 A3563 MAC - MAC: 80-160 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2- 256 A3563 MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2- 384 A3563 MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2- 512 A3563 MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 KAS-ECC- SSC Sp800- 56Ar3 A3563 Domain Parameter Generation Methods - P-256, P-384, P- 521 Scheme - ephemeralUnified - KAS Role - initiator, responder SP 800-56A Rev. 3 KDF IKEv2 (CVL) A3563 Initiator Nonce Length - Initiator Nonce Length: 512 Responder Nonce Length - Responder Nonce Length: 512 Diffie-Hellman Shared Secret Length - Diffie-Hellman SP 800-135 Rev. 1 Page 12 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm CAVP Cert Properties Reference Shared Secret Length: 2048 Derived Keying Material Length - Derived Keying Material Length: 1056-3072 Increment 8 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512 KDF SNMP (CVL) A3563 Password Length - Password Length: 64, 2048 Engine ID - 00100020003000400050, 12345678901234567890 SP 800-135 Rev. 1 KDF SSH (CVL) A3563 Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512 SP 800-135 Rev. 1 KDF TLS (CVL) A3563 TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 SP 800-135 Rev. 1 RSA KeyGen (FIPS186-4) A3563 Key Generation Mode - B.3.3 Modulo - 2048, 3072 Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Random Private Key Format - Standard FIPS 186-4 RSA SigGen (FIPS186-4) A3563 Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072 FIPS 186-4 RSA SigVer (FIPS186-4) A3563 Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072 FIPS 186-4 SHA-1 A3563 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-256 A3563 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-384 A3563 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-512 A3563 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 Table 4: Approved Algorithms - Crypto Library - I Crypto Library - II Algorithm CAVP Cert Properties Reference AES-CBC A3564 Direction - Decrypt, Encrypt Key Length - 128, 256 SP 800-38A AES-GCM A3564 Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96, 1024 Payload Length - Payload Length: 64-256 Increment 8 AAD Length - AAD Length: 0, 256 SP 800-38D HMAC DRBG A3564 Prediction Resistance - Yes Supports Reseed - No Mode - SHA2-512 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 256 Additional Input - Additional Input: 256 Returned Bits - 896 SP 800-90A Rev. 1 Page 13 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm CAVP Cert Properties Reference HMAC-SHA2-256 A3564 MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2-384 A3564 MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 KAS-ECC-SSC Sp800-56Ar3 A3564 Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder SP 800-56A Rev. 3 KDF TLS (CVL) A3564 TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384 SP 800-135 Rev. 1 RSA SigVer (FIPS186-4) A3564 Signature Type - PKCS 1.5 Modulo - 2048 FIPS 186-4 SHA2-256 A3564 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-384 A3564 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 Table 5: Approved Algorithms - Crypto Library - II Crypto Library - IV Algorithm CAVP Cert Properties Reference AES-CBC A3565 Direction - Decrypt, Encrypt Key Length - 128, 256 SP 800-38A HMAC-SHA2- 256 A3565 MAC - MAC: 128-256 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2- 384 A3565 MAC - MAC: 192-384 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 HMAC-SHA2- 512 A3565 MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 SHA2-256 A3565 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-384 A3565 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 SHA2-512 A3565 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 Table 6: Approved Algorithms - Crypto Library - IV Algorithm CAVP Cert Properties Reference HMAC-SHA2- 512 A3564 MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1120 Increment 8 FIPS 198-1 SHA2-512 A3564 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4 Table 7: Approved Algorithms - Page 14 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Crypto Library - V Algorithm CAVP Cert Properties Reference RSA SigVer (FIPS186-4) C170 Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048 Hash Pair - Hash Algorithm - SHA-1 Public Exponent Mode - Fixed Fixed Public Exponent - 10001 FIPS 186-4 SHA-1 C170 Message Length - Message Length: 0-51200 Increment 8 Supports Bit-Oriented Messages - No Supports Empty Message - Yes FIPS 180-4 SHA2-256 C170 Message Length - Message Length: 0-51200 Increment 8 Supports Bit-Oriented Messages - No Supports Empty Message - Yes FIPS 180-4 Table 8: Approved Algorithms - Crypto Library - V Vendor-Affirmed Algorithms: Name Properties Implementation Reference CKG from CTR DRBG Key Type:Asymmetric N/A SP 800-133r2 Section 4, example 1 CKG from HMAC DRBG Key Type:Asymmetric N/A SP 800-133r2 Section 4, example 1 Table 9: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: N/A for this module. 2.6 Security Function Implementations Name Type Description Properties Algorithms KAS-ECC- KeyGen (SSHv2) CKG KAS-KeyGen KAS-ECC KeyGen used in SSHv2 service Bit-strength Caveat:Provides between 128 and 256 bits of CKG from CTR DRBG: () Counter DRBG: (A3563) Page 15 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Description Properties Algorithms encryption strength KAS-ECC- KeyGen (TLSv1.2) CKG KAS-KeyGen KAS-ECC KeyGen used in TLSv1.2 service Bit-strength Caveat:Provides between 128 and 256 bits of encryption strength CKG from CTR DRBG: () CKG from HMAC DRBG: () Counter DRBG: (A3563) HMAC DRBG: (A3564) KAS-ECC- KeyGen (IPSec/IKEv2) CKG KAS-KeyGen KAS-ECC KeyGen used in IPSec/IKEv2 service Bit-strength Caveat:Provides between 128 and 192 bits of encryption strength CKG from CTR DRBG: () Counter DRBG: (A3563) KAS-ECC (SSHv2) KAS-Full KAS-ECC for SSHv2 service IG:IG D.F Scenario 2, path(2), split Key confirmation:no Key derivation:IG 2.4.B SP 800- 135rev1 CVL Caveat:Key establishment methodology provides between 128 and 256 bits of security strength KAS-ECC-SSC Sp800-56Ar3: (A3563) KDF SSH: (A3563) KAS-ECC (TLSv1.2) KAS-Full KAS-ECC for TLSv1.2 service IG:IG D.F Scenario 2, path (2), split Key confirmation:no Key derivation:IG 2.4.B SP 800- 135rev1 CVL Caveat:Key establishment methodology provides between 128 and 256 bits of security strength KAS-ECC-SSC Sp800-56Ar3: (A3563, A3564) KDF TLS: (A3563, A3564) KAS-ECC (IPSec/IKEv2) KAS-Full KAS-ECC for IPSec/IKEv2 service IG:IG D.F Scenario 2, path (2), split Key confirmation:no Key derivation:IG 2.4.B SP 800- 135rev1 CVL KAS-ECC-SSC Sp800-56Ar3: (A3563) Domain Parameter Generation Methods: P-256, P-384 Page 16 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Description Properties Algorithms Caveat:Key establishment methodology provides between 128 and 192 bits of encryption strength KDF IKEv2: (A3563) KTS (TLSv1.2 with AES and HMAC) KTS-Unwrap KTS via TLSv1.2 service by using AES and HMAC Standard:SP 800- 38F IG D.G:"Combination" method - approved symmetric encryption method together with an approved authentication method Caveat:Key establishment methodology provides between 128 and 256 bits of security strength AES-CBC: (A3563) Key Length: 128, 256 AES-CBC: (A3564) HMAC-SHA2-256: (A3563, A3564) HMAC-SHA2-384: (A3563, A3564) SHA2-256: (A3563, A3564) SHA2-384: (A3563, A3564) KTS (TLSv1.2 with AES-GCM) KTS-Unwrap KTS via TLSv1.2 service by using AES-GCM Standard:SP 800- 38F IG D.G:approved authenticated symmetric encryption mode Caveat:Key establishment methodology provides between 128 and 256 bits of security strength AES-GCM: (A3563, A3564) ECDSA KeyGen AsymKeyPair- KeyGen CKG ECDSA KeyGen for SSHv2 service ECDSA KeyGen (FIPS186-4): (A3563) Counter DRBG: (A3563) CKG from CTR DRBG: () ECDSA SigGen DigSig-SigGen ECDSA SigGen for SSHv2 service ECDSA SigGen (FIPS186-4): (A3563) ECDSA SigVer DigSig-SigVer ECDSA SigVer for SSHv2 service ECDSA SigVer (FIPS186-4): (A3563) Page 17 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Description Properties Algorithms RSA KeyGen AsymKeyPair- KeyGen CKG RSA KeyGen for TLSv1.2 and IPSec/IKEv2 services RSA KeyGen (FIPS186-4): (A3563) Counter DRBG: (A3563) CKG from CTR DRBG: () RSA SigGen DigSig-SigGen RSA SigGen for TLSv1.2 and IPSec/IKEv2 services RSA SigGen (FIPS186-4): (A3563) RSA SigVer (TLSv1.2) DigSig-SigVer RSA SigVer for TLSv1.2 service RSA SigVer (FIPS186-4): (A3563, A3564) RSA SigVer (IPSec/IKEv2) DigSig-SigVer RSA SigVer for IPSec/IKEv2 service RSA SigVer (FIPS186-4): (A3563) Block Cipher (SSHv2) BC-UnAuth Block Cipher for SSHv2 Service AES-CTR: (A3563) Block Cipher (TLSv1.2) BC-Auth BC-UnAuth Block Cipher for TLSv1.2 Service AES-CBC: (A3563) Key Length: 128, 256 AES-GCM: (A3563, A3564) AES-ECB: (A3563) AES-CBC: (A3564) Block Cipher (IPSec/IKEv2) BC-UnAuth Block Cipher for IPSec/IKEv2 Service AES-CBC: (A3563, A3565) Block Cipher (SNMPv3) BC-UnAuth Block Cipher for SNMPv3 Service AES-CFB128: (A3563) MAC (SSHv2) MAC MAC for SSHv2 Service HMAC-SHA-1: (A3563) HMAC-SHA2-256: (A3563) HMAC-SHA2-512: (A3563) SHA-1: (A3563) SHA2-256: (A3563) SHA2-512: (A3563) MAC (TLSv1.2) MAC MAC for TLSv1.2 Service HMAC-SHA2-256: (A3563, A3564) HMAC-SHA2-384: (A3563, A3564) SHA2-256: (A3563, A3564) SHA2-384: (A3563, A3564) Page 18 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Description Properties Algorithms MAC (IPSec/IKEv2) MAC MAC for IPSec/IKEv2 Service HMAC-SHA-1: (A3563) HMAC-SHA2-256: (A3563, A3565) HMAC-SHA2-384: (A3563, A3565) HMAC-SHA2-512: (A3563, A3565) SHA-1: (A3563) SHA2-256: (A3563, A3565) SHA2-384: (A3563, A3565) SHA2-512: (A3563, A3565) MAC (SNMPv3) MAC MAC for SNMPv3 Service HMAC-SHA-1: (A3563) SHA-1: (A3563) SSHv2 Keying Materials Development KAS-135KDF SSHv2 session keying materials, used to derive SSHv2 session keys KDF SSH: (A3563) TLSv1.2 Keying Materials Development KAS-135KDF TLSv1.2 session keying materials, used to derive TLSv1.2 session keys KDF TLS: (A3563, A3564) IPSec/IKEv2 Keying Materials Development KAS-135KDF IPSec/IKEv2 session keying materials, used to derive IPSec/IKEv2 session keys KDF IKEv2: (A3563) SNMPv3 Keying Materials Development KAS-135KDF SNMPv3 session keying materials, used to derive SNMPv3 session keys KDF SNMP: (A3563) DRBG Function DRBG Used for DRBG generation Counter DRBG: (A3563) HMAC DRBG: (A3564) HMAC-SHA2-512: (A3564) SHA2-512: (A3564) Firmware Load Test DigSig-SigVer Signature Verification for firmware load test RSA SigVer (FIPS186-4): (A3563) SHA2-256: (A3563) Page 19 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Description Properties Algorithms CO RSA Authentication DigSig-SigVer SHA RSA Signature Verification using embedded RSA Public Key RSA SigVer (FIPS186-4): (C170) SHA-1: (C170) SHA2-256: (C170) Table 10: Security Function Implementations 2.7 Algorithm Specific Information As the module can only be operated in the Approved mode of operation, any algorithms not listed above will be rejected by the module while in the approved mode. AES-GCM • The module’s AES-GCM implementation conforms to FIPS 140-3 IG C.H scenario #1 following RFC 5288 for TLS. The module is compatible with TLSv1.2 and provides support for the acceptable GCM cipher suites from SP800-52 Rev1, Section 3.3.1. The operations of one of the two parties involved in the TLS key establishment scheme were performed entirely within the cryptographic boundary of the module being validated. The counter portion of the IV is set by the module within its cryptographic boundary. When the IV exhausts the maximum number of possible values for a given session key, the first party, client or server, to encounter this condition will trigger a handshake to establish a new encryption key. The keys for the client and server negotiated in the TLSv1.2 handshake process (client_write_key and server_write_key) are compared and the module aborts the session if the key values are identical. In case the module’s power is lost and then restored, a new key for use with the AES GCM encryption/decryption shall be established. FIPS 186-4/186-5 • The module was algorithm tested based on the FIPS 186-4 standard for Digital Signatures prior to Feb 5, 2024. According to IG C.K, this module is 186-5 compliant as all 186-4 CAVP tests performed are mathematically identical to the 186-5 CAVP tests. The Module does not support 186-4 DSA or RSA X9.31 for Signature Generation or Signature Verification. 2.8 RBG and Entropy Cert Number Vendor Name E68 Palo Alto Networks, Inc. E71 Palo Alto Networks, Inc. Table 11: Entropy Certificates Name Type Operational Environment Sample Size Entropy per Sample Conditioning Component Palo Alto Networks DRNG Entropy Source - Physical Intel Corporation Intel(R) Atom(R) Denverton-16 128 bits Full Entropy A2153 (AES- CBC-MAC) Page 20 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Type Operational Environment Sample Size Entropy per Sample Conditioning Component Denverton 16 Core Die with FCBGA1310 Package FCBGA1310 Intel(R) Atom(R) C3958 Processor Palo Alto Networks DRNG Entropy Source - Snow Ridge 24-Core Die with FCBGA2106 Package Physical Intel Corporation Intel(R) Atom(R) Snow Ridge-24 FCBGA2106 Intel(R) Atom(R) P5322 Processor 128 bits Full Entropy A2541 (AES- CBC-MAC) Table 12: Entropy Sources The operational environment is detailed in the Public Use Document for Entropy Certificate E68 and E71. The module implements two approved DRBGs based on SP800-90Arev1, including CTR_DRBG with Algo Cert. #A3563, and HMAC_DRBG with Algo Cert. #A3564. Those two DRBGs are used internally by the module (e.g. to generate symmetric keys, seeds for asymmetric key pairs, and random numbers for security functions). Each DRBG is seeded by the entropy source described in the table above. The module implements CTR_DRBG (AES-128/192/256) both with and without Derivation Function capability. Given that the module’s entropy source provides full entropy, CTR_DRBG without a derivation function is compliant with IG D.L. The module also implements HMAC_DRBG (SHA2- 512) with Prediction Resistance. Each DRBG is instantiated with a 384-bits long entropy input (corresponding to 384 bits of entropy) and provides at least 256 bits security strength for the cryptographic key generation while in the approved mode. Note: • ESV Cert. #E68 is for ION-1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G- WW, ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW and ION 3200 • ESV Cert. #E71 is for ION 5200 and ION 9200 2.9 Key Generation The module generates RSA, ECDSA, and ECDH asymmetric key pairs compliant with FIPS 186-4, using a NIST SP 800-90Ar1 CTR DRBG or HMAC DRBG for random number generation. In accordance with FIPS 140-3 IG D.H, the cryptographic module performs CKG for asymmetric keys as per section 5.1 of NIST SP 800-133rev2 (vendor affirmed) by obtaining a random bit string directly from an approved DRBG. The random bit string supports the required security strength requested by the calling application (without any V, as described in Additional Comments 2 of IG D.H.). 2.10 Key Establishment The module provides the following key/SSP establishment services in the approved mode of operation: Page 21 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. • KAS-ECC Shared Secret Computation: o The module provides SP800-56Arev3 compliant key establishment according to FIPS 140-3 IG D.F scenario 2 path (2) with KAS-ECC shared secret computation. The shared secret computation provides between 128 and 256 bits of encryption strength. 2.11 Industry Protocols The module supports SSHv2, TLS v1.2, SNMPv3 and IPsec/IKEv2 industrial protocols. Please refer to the Security Function Implementations Table for more information. No parts of the SSH, TLS, SNMP and IPSec/IKE protocols, other than the KDFs, have been tested by the CAVP and CMVP. 3 Cryptographic Module Interfaces 3.1 Ports and Interfaces Physical Port Logical Interface(s) Data That Passes Ethernet, PoE, ByPass Pair, SFP+ Data Input Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, IPsec/IKEv2 and SNMPv3 service data. Status of the module via LEDs. Ethernet, PoE, ByPass Pair, SFP+ Data Output Data output from the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, IPsec/IKEv2 and SNMPv3 service data. Status of the module via LEDs. Ethernet, PoE, SFP+ Control Input Control Data input into the module for all the services defined in Approved Services Table, including TLSv1.2, SSHv2, IPsec/IKEv2 and SNMPv3 service data. N/A Control Output N/A Console, ByPass Pair, Ethernet, PoE, SFP+ and LEDs Status Output Status Information output from the module. Power Power Provide the power supply to the module Table 13: Ports and Interfaces The module’s physical perimeter encompasses the case of the tested platform mentioned in Table 2. The module provides physical ports which are mapped to logical interfaces provided by the module (data input, data output, control input, control output and status output) as above. 4 Roles, Services, and Authentication 4.1 Authentication Methods Page 22 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Method Name Description Security Mechanism Strength Each Attempt Strength per Minute RSA-Based Certificate The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits RSA SigVer (FIPS186-4) (A3563) With a minimum modulus size of 2048, the probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. The probability of successfully authenticating to the module within a one minute period is 1,020,000/(2^112), which is less than 1/100,000. The module at its highest can support at most 17,000 new sessions per second to authenticate in a one-minute period. ECDSA-Based Certificate The modules support ECDSA public-key based authentication mechanism using a minimum ECDSA curve of P-256 ECDSA SigVer (FIPS186-4) (A3563) With a minimum curve of P-256, the probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. The probability of successfully authenticating to the module within a one minute period is 1,020,000/(2^128), which is less than 1/100,000. The module at its highest can support at most 17,000 new sessions per second to authenticate in a one-minute period. Password/Pre- shared Secret The minimum length is eight (8) characters (94 possible characters). The configuration supports at most three failed attempts to authenticate in a one-minute period. Password Based The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000. This calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 Integer digits, 52 alphabetic characters, and 32 special characters providing 94 characters to choose from in total. The probability of successfully authenticating to the module within one minute is 3/(94^8), which is less than 1/100,000. The configuration supports at most 3 failed attempts to authenticate in a one-minute period. Table 14: Authentication Methods The modules all support role-based authentication, and provide the Crypto Officer role and the User role. The Crypto Officer role has the ability to perform all tasks and administrative actions while the User is read-only. Additionally, the module supports concurrent operators. Page 23 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. 4.2 Roles Name Type Operator Type Authentication Methods Crypto Officer Role CO RSA-Based Certificate ECDSA-Based Certificate Password/Pre-shared Secret User Role User RSA-Based Certificate ECDSA-Based Certificate Password/Pre-shared Secret Table 15: Roles 4.3 Approved Services Name Description Indicator Inputs Outputs Security Functions SSP Access Self-Test Initiate and run the pre- operational self-tests None Command to trigger self-test Status of the self-test results None Crypto Officer Unauthenticat ed Crypto Officer role Authenticati on Crypto Officer Role Authenticati on CO Role successful login status Crypto Officer role authenticati on request Status of Crypto Officer role authenticati on CO RSA Authenticati on Crypto Officer - Crypto Officer Authentication RSA Public Key: E User Role Authenticati on User Role Authenticati on None User Role authenticati on request Status of User role authenticati on None User - User Password: E Zeroization Zeroize all unprotected SSPs stored in the module None Command to initiate the SSPs zeroization Status of the SSPs zeroization None Crypto Officer - CTR DRBG Entropy Input: Z - CTR DRBG Seed: Z - CTR DRBG Internal State (V, Key): Z - HMAC DRBG Entropy Input: Z - HMAC DRBG Seed: Z - HMAC DRBG Internal State (V, Key): Z - User Password: Z - Crypto Page 24 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access Officer Authentication RSA Public Key: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS ECDHE Private Key: Z - TLS ECDHE Public Key: Z - Peer TLS ECDHE Public Key: Z - TLS ECDHE Shared Secret: Z - TLS Master Secret: Z - TLS Session Encryption Key: Z - TLS Session Authentication Key: Z - IPSec/IKEv2 Pre-Shared Secret: Z - IPSec/IKEv2 RSA Private Key: Z - IPSec/IKEv2 RSA Public Key: Z - IPSec/IKEv2 ECDHE Private Key: Z - IPSec/IKEv2 ECDHE Public Key: Z - Peer IPSec/IKEv2 ECDHE Public Key: Z - IPSec/IKEv2 ECDHE Shared Secret: Z - SKEYSEED: Z - IPSec/IKEv2 Session Page 25 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access Encryption Key: Z - IPSec/IKEv2 Session Authentication Key: Z - SNMPv3 Authentication Secret: Z - SNMPv3 Session Encryption Key: Z - SNMPv3 Session Authentication Key: Z - SSH ECDHE Private Key: Z - SSH ECDHE Public Key: Z - Peer SSH ECDHE Public Key: Z - SSH ECDHE Shared Secret: Z - SSH ECDSA Private Key: Z - SSH ECDSA Public Key: Z - SSH Session Encryption Key: Z - SSH Session Authentication Key: Z Firmware Update The module's Firmware is updated to a new version Firmware update completion message Command to upload a new validated firmware Status of the updated Firmware installation Firmware Load Test Crypto Officer - Firmware Load Test Key: E Show Version Provides the module's name/ID and versions None Command to show version Module's name/ID and versions None Crypto Officer Page 26 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access Show Status Provides the module's current status and information None Command to show status Module's status information None Crypto Officer Configure Network Perform the module's network configuratio n Global indicator and configurati on logs Commands to configure the module Status of the completion of network related configuratio n None Crypto Officer Configure SSHv2 Function Create a secure SSHv2 channel Global indicator and SSH connection log message Commands to configure SSHv2 Status of the completion of SSHv2 configuratio n ECDSA KeyGen DRBG Function Crypto Officer - SSH ECDSA Private Key: G,W - SSH ECDSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E Run SSHv2 Function Negotiation and encrypted data transport via SSH Global indicator and SSH connection log message Initiate SSHv2 tunnel establishme nt request Status of SSHv2 tunnel establishme nt KAS-ECC- KeyGen (SSHv2) KAS-ECC (SSHv2) ECDSA SigGen ECDSA SigVer Block Cipher (SSHv2) MAC (SSHv2) DRBG Function SSHv2 Keying Materials Developme nt Crypto Officer - SSH ECDHE Private Key: G,W,E - SSH ECDHE Public Key: G,R,W - Peer SSH ECDHE Public Key: W,E - SSH ECDHE Shared Secret: G,W,E - SSH ECDSA Private Key: E - SSH ECDSA Public Key: R - SSH Session Encryption Key: G,W,E - SSH Page 27 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access Session Authentication Key: G,W,E - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E Configure TLSv1.2 Function Create a secure TLSv1.2 channel Global Indicator and TLS success log message Commands to configure TLSv1.2 Status of the completion of TLSv1.2 configuratio n RSA KeyGen DRBG Function Crypto Officer - TLS RSA Private Key: G,W - TLS RSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E Run TLSv1.2 Function Negotiation and encrypted data transport via TLS Global indicator and TLS success log message Initiate TLSv1.2 tunnel establishme nt request Status of TLSv1.2 tunnel establishme nt KAS-ECC- KeyGen (TLSv1.2) KAS-ECC (TLSv1.2) KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) RSA SigGen RSA SigVer (TLSv1.2) Block Cipher (TLSv1.2) MAC (TLSv1.2) DRBG Function TLSv1.2 Keying Materials Crypto Officer - TLS RSA Private Key: E - TLS RSA Public Key: R - TLS ECDHE Private Key: G,W,E - TLS ECDHE Public Key: G,R,W - Peer TLS ECDHE Public Key: W,E - TLS ECDHE Shared Secret: G,W,E - TLS Master Secret: G,W,E - TLS Session Encryption Key: G,W,E - TLS Session Authentication Key: G,W,E - CTR DRBG Page 28 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access Developme nt Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E - HMAC DRBG Entropy Input: E - HMAC DRBG Seed: E - HMAC DRBG Internal State (V, Key): E Configure SNMPv3 Function Create a secure SNMPv3 channel Global indicator and SNMPv3 success log message Commands to configure SNMPv3 Status of the completion of SNMPv3 configuratio n KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) Crypto Officer - SNMPv3 Authentication Secret: W Run SNMPv3 Function Negotiation and encrypted data transport via SNMPv3 Global indicator and SNMPv3 success log message Initiate SNMPv3 tunnel establishme nt request Status of SNMPv3 tunnel establishme nt Block Cipher (SNMPv3) MAC (SNMPv3) SNMPv3 Keying Materials Developme nt Crypto Officer - SNMPv3 Authentication Secret: E - SNMPv3 Session Encryption Key: G,W,E - SNMPv3 Session Authentication Key: G,W,E Configure IPSec/IKEv 2 Function Create IPSec/IKEv 2 tunnel Global indicator and IPSec/IKE v2 success log message Commands to configure IPSec/IKEv 2 Status of the completion of IPSec/IKEv 2 configuratio n KTS (TLSv1.2 with AES and HMAC) KTS (TLSv1.2 with AES- GCM) RSA KeyGen DRBG Function Crypto Officer - IPSec/IKEv2 Pre-Shared Secret: W - IPSec/IKEv2 RSA Private Key: G,W - IPSec/IKEv2 RSA Public Key: G,W - CTR DRBG Entropy Input: E - CTR DRBG Seed: E Page 29 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Indicator Inputs Outputs Security Functions SSP Access - CTR DRBG Internal State (V, Key): E Run IPSec/IKEv 2 Function Negotiation and encrypted data transport via IPSec/IKEv 2 Global indicator and IPSec/IKE v2 success log message Initiate IPSec/IKEv 2 tunnel establishme nt request Status of IPSec/IKEv 2 tunnel establishme nt KAS-ECC- KeyGen (IPSec/IKEv 2) KAS-ECC (IPSec/IKEv 2) RSA SigGen RSA SigVer (IPSec/IKEv 2) Block Cipher (IPSec/IKEv 2) MAC (IPSec/IKEv 2) DRBG Function IPSec/IKEv 2 Keying Materials Developme nt Crypto Officer - IPSec/IKEv2 Pre-Shared Secret: E - IPSec/IKEv2 RSA Private Key: E - IPSec/IKEv2 RSA Public Key: R - IPSec/IKEv2 ECDHE Private Key: G,W,E - IPSec/IKEv2 ECDHE Public Key: G,R,W - Peer IPSec/IKEv2 ECDHE Public Key: W,E - IPSec/IKEv2 ECDHE Shared Secret: G,W,E - SKEYSEED: G,W,E - IPSec/IKEv2 Session Encryption Key: G,W,E - IPSec/IKEv2 Session Authentication Key: G,W,E - CTR DRBG Entropy Input: E - CTR DRBG Seed: E - CTR DRBG Internal State (V, Key): E Table 16: Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). Page 30 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. 4.4 Non-Approved Services N/A for this module. 4.5 External Software/Firmware Loaded The module supports the firmware load test by using RSA 2048 bits with SHA2-256 (RSA Cert. # A3563) for the new validated firmware to be uploaded into the module. A Firmware Load Test Key was preloaded to the module’s binary at the factory and used for firmware load test. In order to load new firmware, the Crypto Officer must authenticate into the module before loading any firmware. This ensures that unauthorized access and use of the module is not performed. The module will load the new update upon reboot. The update attempt will be rejected if the verification fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation. 4.6 Cryptographic Output Actions and Status The module implements Self-initiated cryptographic output capability without external operator request. The Crypto Officer shall configure self-initiated cryptographic output capability. Prior to executing the self-initiated cryptographic output capability, the module conducts two independent internal actions to activate the capability to prevent the inadvertent output due to a single error. 4.7 Additional Information The module supports Unauthenticated service, where the unauthenticated users can run the self-test service by power-cycling the module. 5 Software/Firmware Security 5.1 Integrity Techniques The module performs the Firmware Integrity test by using HMAC-SHA2-256 (HMAC Cert. #A3563) during the Pre-Operational Self-Test. A Firmware Integrity Test Key (non-SSP) was preloaded to the module’s binary at the factory and used for firmware integrity test only at the pre-operational self-test. At Module’s initialization, the integrity of the runtime executable is verified using an HMAC-SHA2-256 digest which is compared to a value computed at build time. If at the load time the MAC does not match the stored, known MAC value, the module would enter an Error state with all crypto functionality inhibited. 5.2 Initiate on Demand Page 31 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Integrity test is performed as part of the Pre-Operational Self-Tests. It is automatically executed at power-on. The operator can power-cycle or reboot the module to initiate the firmware integrity test on-demand. This automatically performs the integrity test of all firmware components included within the boundary of the module. 6 Operational Environment 6.1 Operational Environment Type and Requirements Type of Operational Environment: Limited 7 Physical Security 7.1 Mechanisms and Actions Required Mechanism Inspection Frequency Inspection Guidance Tamper Evidence Labels 30 Days Verify integrity of tamper-evident seals in the locations identified in the FIPS Kit Installation Guide. Label integrity to be verified within the module's operating temperature range. TEL Quantity Required on each Module: Qty. 3 - ION 1200; Qty 4 - ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW; Qty. 3 - ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW; Qty. 3 - ION 3200; Qty. 12 - ION 5200/9200 Opacity Shield 30 Days Verify integrity of the front opacity shield such that it has not been tampered, scratched, or warped Table 17: Mechanisms and Actions Required The module utilizes a production-grade enclosure and removable cover along with tamper evidence labels as the physical security mechanisms. 7.2 User Placed Tamper Seals Kit Part Numbers The module requires the following for physical security requirements: • [ION 1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW]: Kit P/N 920- 000363 • [ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW]: Kit P/N 920-000363 • ION 3200: Kit P/N 920-000363 • ION 5200, ION 9200: Kit P/N 920-000333 If additional labels are needed, the CO will need to contact Palo Alto Networks. ION 1200 The following section demonstrates how to apply the tamper evident labels (TELs) to the ION 1200 modules. The enclosure of the modules is the same. Page 32 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. The tamper evident labels shall be installed on the security devices containing the module prior to operating in Approved mode. TELs shall be applied as depicted in the figures below. Any unused TELs must be securely stored, accounted for, and maintained by the Crypto Officer (CO) in a protected location. Should the CO have to remove, change or replace TELs for any reason, the CO must examine the location from which the TEL was removed and ensure that no residual debris is still remaining on the chassis or card. If residual debris remains, the CO must remove the debris using a damp cloth. Any deviation of the TELs placement by unauthorized operators such as tearing, misconfiguration, removal, change, replacement or any other change in the TELs from its original configuration as depicted below shall mean the module is no longer in Approved mode of operation. Returning the system back to Approved mode of operation requires the replacement of the TELs as depicted below and any additional requirement per the site security policy which are out of scope of this Security Policy. The ION 1200 requires 3 tamper evident labels while the ION 1200-C-NA/ION 1200-C- ROW/ION 1200-C-5G-WW require 4 tamper evident labels. The figures below detail the location of the labels. Figure 12: ION 1200 Front View Figure 13: ION 1200-C-5G-WW Front View Figure 14: ION 1200-C-NA and ION 1200-C-ROW Front View Page 33 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 15: ION 1200 Left View (same for all models) Figure 16: ION 1200 Right View (same for all models) Figure 17: ION 1200 Top View Page 34 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 18: ION 1200-C-5G-WW/ION 1200-C-NA/ION 1200-C-ROW Top View Figure 19: ION 1200 Rear View Figure 20: ION 1200 Bottom View Page 35 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 21: ION 1200-C-5G-WW/ION 1200-C-NA/ION 1200-C-ROW Bottom View Figure 22: ION 1200-S Rear View Figure 23: ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW Rear View Page 36 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 24: ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW Bottom View ION 3200 The ION 3200 requires 3 tamper labels, which are placed at the following locations. Figure 25: ION 3200 Rear View Figure 26: ION 3200 Bottom View Page 37 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Figure 27: ION 3200 Left Side View Figure 28: ION 3200 Right Side View ION 5200 / 9200 The ION 5200 and ION 9200 use the same FIPS kit and have the same installation. The figure below demonstrates the tamper label placement along with the front opacity shield. Figure 29: ION 5200/9200 FIPS Kit Installation 8 Non-Invasive Security N/A for this module. 9 Sensitive Security Parameters Management 9.1 Storage Areas Storage Area Name Description Persistence Type DRAM Volatile Memory Dynamic HDD Non-Volatile Memory Static Table 18: Storage Areas Page 38 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. 9.2 SSP Input-Output Methods Name From To Format Type Distribution Type Entry Type SFI or Algorithm Peer Public Key Input External (Outside of the module's boundary) HDD Plaintext Automated Electronic Module Public Key Output HDD External (Outside of the module's boundary) Plaintext Automated Electronic Password/Secret Input via TLSv1.2 decrypted by AES and HMAC External (Outside of the module's boundary) HDD Encrypted Automated Electronic KTS (TLSv1.2 with AES and HMAC) Password/Secret Input via TLSv1.2 decrypted by AES- GCM External (Outside of the module's boundary) HDD Encrypted Automated Electronic KTS (TLSv1.2 with AES- GCM) Table 19: SSP Input-Output Methods 9.3 SSP Zeroization Methods Zeroization Method Description Rationale Operator Initiation Zeroization Command CO issues zeroization service The zeroization command will erase all SSPs stored in the RAM or in the HDD of the module. "Disable System" command Table 20: SSP Zeroization Methods Notes: 1. To initiate zeroization, see Section End of Life / Sanitization in this document for more details. 2. The zeroization operations shall be performed under the control of the CO role. 3. The zeroized SSPs cannot be retrieved or reused. Once the command is initiated, the SSPs are overwritten with 0s. 4. The Firmware Load Test Key is only used for Firmware Load Test Authentication and not subject to the zeroization requirement. 9.4 SSPs Page 39 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Size - Strength Type - Category Generated By Established By Used By CTR DRBG Entropy Input Used to seed the CTR DRBG 256 - 256 bits Entropy Input - CSP DRBG Function CTR DRBG Seed Used in CTR DRBG Generation 256 - 256 bits DRBG Seed - CSP DRBG Function CTR DRBG Internal State (V, Key) Used in CTR DRBG Generation 256 - 256 bits DRBG Internal State - CSP DRBG Function HMAC DRBG Entropy Input Used to seed the HMAC DRBG 256 - 256 bits Entropy Input - CSP DRBG Function HMAC DRBG Seed Used in HMAC DRBG Generation 256 - 256 bits DRBG Seed - CSP DRBG Function HMAC DRBG Internal State (V, Key) Used in HMAC DRBG Generation 256 - 256 bits DRBG Internal State - CSP DRBG Function Crypto Officer Authenticatio n RSA Public Key Used for CO role authenticatio n 2048 bits - 112 bits Public Key - PSP User Password Used for User role authenticatio n 8 character s minimum - 8 character s minimum Password - CSP Firmware Load Test Key Used for Firmware Load Test 2048 bits - 112 bits Public Key - PSP Firmware Load Test TLS RSA Private Key Used for TLS peer authenticatio n 2048, 3072 bits - 112, 128 bits Private Key - CSP RSA KeyGen RSA SigGen TLS RSA Public Key Used for TLS peer authenticatio n 2048, 3072 bits - 112, 128 bits Public Key - PSP RSA KeyGen TLS ECDHE Private Key Used to derive TLS ECDHE Shared Secret P-256, P- 384, P- 521 - 128, 192, 256 bits Private Key - CSP KAS-ECC- KeyGen (TLSv1.2) KAS-ECC (TLSv1.2) Page 40 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Size - Strength Type - Category Generated By Established By Used By TLS ECDHE Public Key Used to derive TLS ECDHE Shared Secret P-256, P- 384, P- 521 - 128, 192, 256 bits Public Key - PSP KAS-ECC- KeyGen (TLSv1.2) Peer TLS ECDHE Public Key Used to derive TLS ECDHE shared secret P-256, P- 384, P- 521 - 128, 192, 256 bits Public Key - PSP KAS-ECC (TLSv1.2) TLS ECDHE Shared Secret Used to derive TLS Master Secret P-256, P- 384, P- 521 - 128, 192, 256 bits Shared Secret - CSP KAS-ECC (TLSv1.2) TLSv1.2 Keying Materials Developmen t TLS Master Secret Used to derive TLS Encryption Keys, TLS Authenticatio n Keys 384 - 384 bits Master Secret - CSP TLSv1.2 Keying Materials Developmen t TLSv1.2 Keying Materials Developmen t TLS Session Encryption Key Used to secure TLS session confidentialit y 128 or 256 bits - 128 or 256 bits Session Key - CSP TLSv1.2 Keying Materials Developmen t Block Cipher (TLSv1.2) TLS Session Authenticatio n Key Used to secure TLS session integrity at least 112 bits - at least 112 bits Session Key - CSP TLSv1.2 Keying Materials Developmen t MAC (TLSv1.2) IPSec/IKEv2 Pre-Shared Secret Used for IPSec/IKEv2 peer authenticatio n 2048 bits character s - 2048 bits character s Shared Secret - CSP IPSec/IKEv2 RSA Private Key Used for IPSec/IKEv2 peer authenticatio n 2048, 3072 bits - 112, 128 bits Private Key - CSP RSA KeyGen RSA SigGen IPSec/IKEv2 RSA Public Key Used for IPSec/IKEv2 peer authenticatio n 2048, 3072 bits - 112, 128 bits Public Key - PSP RSA KeyGen IPSec/IKEv2 ECDHE Private Key Used to derive IPSec/IKEv2 ECDHE P-256, P- 384 - 128, 192 bits Private Key - CSP KAS-ECC- KeyGen (IPSec/IKEv 2) KAS-ECC (IPSec/IKEv 2) Page 41 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Size - Strength Type - Category Generated By Established By Used By Shared Secret IPSec/IKEv2 ECDHE Public Key Used to derive IPSec/IKEv2 ECDHE Shared Secret P-256, P- 384 - 128, 192 bits Public Key - PSP KAS-ECC- KeyGen (IPSec/IKEv 2) Peer IPSec/IKEv2 ECDHE Public Key Used to derive IPSec/IKEv2 ECDHE Shared Secrets P-256, P- 384 - 128, 192 bits Public Key - PSP KAS-ECC (IPSec/IKEv 2) IPSec/IKEv2 ECDHE Shared Secret Used to derive IPSec/IKEv2 Session Encryption Keys, IPSec/IKEv2 Authenticatio n Keys P-256, P- 384 - 128, 192 bits Shared Secret - CSP KAS-ECC (IPSec/IKEv 2) IPSec/IKEv2 Keying Materials Developmen t SKEYSEED Keying material used to derive the IPSec/IKEv2 Session Encryption Key and IPSec/IKEv2 Authenticatio n Key 384 - 384 bits Keying Material - CSP IPSec/IKEv2 Keying Materials Developmen t IPSec/IKEv2 Keying Materials Developmen t IPSec/IKEv2 Session Encryption Key Used to secure IPSec/IKEv2 session confidentialit y 128, 192 bits - 128, 192 bits Session Key - CSP IPSec/IKEv2 Keying Materials Developmen t Block Cipher (IPSec/IKEv 2) IPSec/IKEv2 Session Authenticatio n Key Used to secure IPSec/IKEv2 session integrity at least 112 bits - at least 112 bits Session Key - CSP IPSec/IKEv2 Keying Materials Developmen t MAC (IPSec/IKEv 2) SNMPv3 Authenticatio n Secret Used for SNMPv3 User authenticatio n 8 character s minimum - 8 character Authenticatio n Secret - CSP Page 42 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Size - Strength Type - Category Generated By Established By Used By s minimum SNMPv3 Session Encryption Key Used to secure SNMPv3 session confidentialit y 128 bits - 128 bits Session Key - CSP SNMPv3 Keying Materials Developmen t Block Cipher (SNMPv3) SNMPv3 Session Authenticatio n Key Used to secure SNMPv3 session integrity 160 bits - at least 112 bits Session Key - CSP SNMPv3 Keying Materials Developmen t MAC (SNMPv3) SSH ECDHE Private Key Used to derive the SSH ECDHE Shared Secret P-256, P- 384, P- 521 - 128, 192, 256 bits Private Key - CSP KAS-ECC- KeyGen (SSHv2) KAS-ECC (SSHv2) SSH ECDHE Public Key Used to derive the SSH ECDHE Shared Secret P-256, P- 384, P- 521 - 128, 192, 256 bits Public Key - PSP KAS-ECC- KeyGen (SSHv2) Peer SSH ECDHE Public Key Used to derive SSH ECDHE Shared Secret P-256, P- 384, P- 521 - N/A Public Key - PSP KAS-ECC (SSHv2) SSH ECDHE Shared Secret Used to derive SSH Session Encryption Keys, SSH Session Authenticatio n Keys P-256, P- 384, P- 521 - 128, 192, 256 bits Shared Secret - CSP KAS-ECC (SSHv2) SSHv2 Keying Materials Developmen t SSH ECDSA Private Key Used for SSH session authenticatio n P-256, P- 384, P- 521 - 128, 192, 256 bits Private Key - CSP ECDSA KeyGen ECDSA SigGen SSH ECDSA Public Key Used for SSH Session authenticatio n P-256, P- 384, P- 521 - 128, 192, 256 Public Key - PSP ECDSA KeyGen SSH Session Encryption Key Used for SSH session confidentialit y protection 128, 192, 256 bits - 128, 192, 256 bits Session Key - CSP SSHv2 Keying Materials Developmen t Block Cipher (SSHv2) Page 43 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Size - Strength Type - Category Generated By Established By Used By SSH Session Authenticatio n Key Used for SSH session integrity protection at least 160 bits - at least 160 bits Session Key - CSP SSHv2 Keying Materials Developmen t MAC (SSHv2) Table 21: SSP Table 1 Name Input - Output Storage Storage Duration Zeroization Related SSPs CTR DRBG Entropy Input DRAM:Plaintext Zeroization Command CTR DRBG Seed DRAM:Plaintext Zeroization Command CTR DRBG Internal State (V, Key) DRAM:Plaintext Zeroization Command HMAC DRBG Entropy Input DRAM:Plaintext Zeroization Command HMAC DRBG Seed DRAM:Plaintext Zeroization Command HMAC DRBG Internal State (V, Key) DRAM:Plaintext Zeroization Command Crypto Officer Authentication RSA Public Key HDD:Plaintext Zeroization Command User Password Password/Secret Input via TLSv1.2 decrypted by AES and HMAC Password/Secret Input via TLSv1.2 decrypted by AES- GCM HDD:Plaintext Zeroization Command Firmware Load Test Key HDD:Plaintext N/A TLS RSA Private Key HDD:Plaintext Zeroization Command TLS RSA Public Key Module Public Key Output HDD:Plaintext Zeroization Command TLS ECDHE Private Key DRAM:Plaintext While TLS tunnel is on Zeroization Command TLS ECDHE Public Key Module Public Key Output DRAM:Plaintext While TLS tunnel is on Zeroization Command Peer TLS ECDHE Public Key Peer Public Key Input DRAM:Plaintext While TLS tunnel is on Zeroization Command TLS ECDHE Shared Secret DRAM:Plaintext While TLS tunnel is on Zeroization Command Page 44 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Input - Output Storage Storage Duration Zeroization Related SSPs TLS Master Secret DRAM:Plaintext While TLS tunnel is on Zeroization Command TLS Session Encryption Key DRAM:Plaintext While TLS tunnel is on Zeroization Command TLS Session Authentication Key DRAM:Plaintext While TLS tunnel is on Zeroization Command IPSec/IKEv2 Pre-Shared Secret Password/Secret Input via TLSv1.2 decrypted by AES and HMAC Password/Secret Input via TLSv1.2 decrypted by AES- GCM HDD:Plaintext Zeroization Command IPSec/IKEv2 RSA Private Key HDD:Plaintext Zeroization Command IPSec/IKEv2 RSA Public Key Module Public Key Output HDD:Plaintext Zeroization Command IPSec/IKEv2 ECDHE Private Key DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command IPSec/IKEv2 ECDHE Public Key Module Public Key Output DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command Peer IPSec/IKEv2 ECDHE Public Key Peer Public Key Input DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command IPSec/IKEv2 ECDHE Shared Secret DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command SKEYSEED DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command IPSec/IKEv2 Session Encryption Key DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command IPSec/IKEv2 Session Authentication Key DRAM:Plaintext While IPSec/IKEv2 tunnel is on Zeroization Command SNMPv3 Authentication Secret Password/Secret Input via TLSv1.2 decrypted by AES and HMAC Password/Secret Input via TLSv1.2 decrypted by AES- GCM HDD:Plaintext Zeroization Command Page 45 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Input - Output Storage Storage Duration Zeroization Related SSPs SNMPv3 Session Encryption Key DRAM:Plaintext While SNMPv3 tunnel is on Zeroization Command SNMPv3 Session Authentication Key DRAM:Plaintext While SNMPv3 tunnel is on Zeroization Command SSH ECDHE Private Key DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command SSH ECDHE Public Key Module Public Key Output DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command Peer SSH ECDHE Public Key Peer Public Key Input DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command SSH ECDHE Shared Secret DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command SSH ECDSA Private Key HDD:Plaintext Zeroization Command SSH ECDSA Public Key Module Public Key Output HDD:Plaintext Zeroization Command SSH Session Encryption Key DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command SSH Session Authentication Key DRAM:Plaintext While SSHv2 tunnel is on Zeroization Command Table 22: SSP Table 2 9.5 Transitions FIPS 186-4/186-5 • As of February 5, 2024, the CMVP does not accept module submissions that implement DSA or RSA X9.31 in the approved mode, other than for signature verification which is approved for legacy use. This module does not implement DSA or RSA X9.31 for signature generation and therefore is unaffected by the current transition from 186-4 to 186-5. As detailed in section 2.7, the CAVP testing performed on the 186-4 algorithms is mathematically similar to the testing performed on the 186-5 algorithms and therefore this module claims compliance with 186-5. 10 Self-Tests 10.1 Pre-Operational Self-Tests Algorithm or Test Test Properties Test Method Test Type Indicator Details Firmware Integrity Test HMAC-SHA2- 256 KAT SW/FW Integrity Module is in normal state Hash Comparison Table 23: Pre-Operational Self-Tests Page 46 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Prior to the module providing any data output via the data output interface, the module performs and passes the pre-operational self-test listed above. The module performs the cryptographic algorithm self-tests (CASTs) for HMAC-SHA2-256 and SHA2-256 before performing the firmware integrity test. 10.2 Conditional Self-Tests Algorithm or Test Test Properties Test Method Test Type Indicator Details Conditions AES-CBC Encrypt KAT (A3563) 256 bits KAT CAST Module is in normal state Encrypt Power Up AES-CBC Decrypt KAT (A3563) 256 bits KAT CAST Module is in normal state Decrypt Power Up AES-GCM Encrypt KAT (A3563) 256 bits KAT CAST Module is in normal state Encrypt Power Up AES-GCM Decrypt KAT (A3563) 256 bits KAT CAST Module is in normal state Decrypt Power Up AES-CBC Encrypt KAT (A3564) 256 bits KAT CAST Module is in normal state Encrypt Power Up AES-CBC Decrypt KAT (A3564) 256 bits KAT CAST Module is in normal state Decrypt Power Up AES-GCM Encrypt KAT (A3564) 256 bits KAT CAST Module is in normal state Encrypt Power Up AES-GCM Decrypt KAT (A3564) 256 bits KAT CAST Module is in normal state Decrypt Power Up Counter DRBG Instantiate KAT (A3563) AES-256 KAT CAST Module is in normal state Instantiate Power Up Counter DRBG Generate KAT (A3563) AES-256 KAT CAST Module is in normal state Generate Power Up Counter DRBG Reseed KAT (A3563) AES-256 KAT CAST Module is in normal state Reseed Power Up ECDSA SigGen KAT (A3563) P-224 with SHA2-256 KAT CAST Module is in normal state Sign Power Up ECDSA SigVer KAT (A3563) P-224 with SHA2-256 KAT CAST Module is in normal state Verify Power Up Page 47 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm or Test Test Properties Test Method Test Type Indicator Details Conditions HMAC DRBG Instantiate KAT (A3564) HMAC- SHA2-512 KAT CAST Module is in normal state Instantiate KAT Power Up HMAC DRBG Reseed KAT (A3564) HMAC- SHA2-512 KAT CAST Module is in normal state Reseed KAT Power Up HMAC DRBG Generate KAT (A3564) HMAC- SHA2-512 KAT CAST Module is in normal state Generate KAT Power Up HMAC-SHA- 1 KAT (A3563) HMAC- SHA1 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-256 KAT (A3563) HMAC- SHA2-256 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-384 KAT (A3563) HMAC- SHA2-384 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-512 KAT (A3563) HMAC- SHA2-512 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-256 KAT (A3564) HMAC- SHA2-256 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-384 KAT (A3564) HMAC- SHA2-384 KAT CAST Module is in normal state N/A Power Up KAS-ECC- SSC Sp800- 56Ar3 KAT (A3563) Curve P- 256 KAT CAST Module is in normal state Primitive Z KAT Power Up KAS-ECC- SSC Sp800- 56Ar3 KAT (A3564) Curve P- 256 KAT CAST Module is in normal state Primitive Z KAT Power Up KDF IKEv2 KAT (A3563) N/A KAT CAST Module is in normal state N/A Power Up KDF SSH KAT (A3563) N/A KAT CAST Module is in normal state N/A Power Up KDF TLS KAT (A3563) N/A KAT CAST Module is in normal state N/A Power Up KDF SNMP KAT (A3563) N/A KAT CAST Module is in normal state N/A Power Up KDF TLS KAT (A3564) N/A KAT CAST Module is in normal state N/A Power Up Page 48 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm or Test Test Properties Test Method Test Type Indicator Details Conditions RSA SigGen KAT (A3563) 2048 bit modulus with SHA2- 256 KAT CAST Module is in normal state Sign Power Up RSA SigVer KAT (A3563) 2048 bit modulus with SHA2- 256 KAT CAST Module is in normal state Verify Power Up RSA SigVer KAT (A3564) 2048 bit modulus with SHA2- 256 KAT CAST Module is in normal state Verify Power Up SHA-1 KAT (A3563) SHA-1 KAT CAST Module is in normal state N/A Power Up ECDSA KeyGen PCT (A3563) Curve P- 256 with SHA2-256 PCT PCT Module is in normal state N/A Performs on newly generated keypairs before first operational use RSA KeyGen PCT (A3563) 2048 bit modulus with SHA2- 256 PCT PCT Module is in normal state N/A Performs on newly generated keypairs before first operational use KAS-ECC KeyGen PCT (A3563) Curve P- 256 with SHA2-256 PCT PCT Module is in normal state N/A Performs on newly generated key pairs before first operational use KAS-ECC KeyGen PCT (A3564) Curve P- 256 with SHA2-256 PCT PCT Module is in normal state N/A Performs on newly generated keypairs before first operational use AES-CBC Encrypt KAT (A3565) 128 bits KAT CAST Module is in normal state Encrypt KAT Power Up AES-CBC Decrypt KAT (A3565) 128 bits KAT CAST Module is in normal state Decrypt KAT Power Up HMAC- SHA2-256 KAT (A3565) HMAC- SHA2-256 KAT CAST Module is in normal state N/A Power Up Page 49 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm or Test Test Properties Test Method Test Type Indicator Details Conditions HMAC- SHA2-384 KAT (A3565) HMAC- SHA2-384 KAT CAST Module is in normal state N/A Power Up HMAC- SHA2-512 KAT (A3565) HMAC- SHA2-512 KAT CAST Module is in normal state N/A Power Up RSA SigVer KAT (C170) 2048 bit key with SHA2- 256 KAT CAST Module is in normal state Verify Power Up SHA2-256 KAT (C170) SHA2-256 KAT CAST Module is in normal state N/A Power Up Firmware Load Test RSA 2048 SigVer with SHA2-256 KAT SW/FW Load Module is in normal state N/A When firmware has been uploaded to the module Entropy 90B Start-up Repetition Count Test (RCT) Repetition Count Test RCT CAST Module is in normal state Designed to quickly detect catastrophic failures that cause the noise source to become "stuck" on a single output value for a long period of time Power Up Entropy 90B Start-up Adaptive Proportion Test (APT) Adaptive Proportion Test APT CAST Module is in normal state Designed to detect a large loss of entropy that might occur as a result of some physical failure or environmental change affecting the noise source Power Up Entropy 90B Continuous Repetition Count Test (RPT) Repetition Count Test RCT CAST Module is in normal state Designed to quickly detect catastrophic failures that cause the noise source to become "stuck" on a single output value for a long period of time Entropy data is generatd from the Entropy Source - Continuous Entropy 90B Continuous Adaptive Proportions Test (APT) Adaptive Proportions Test APT CAST Module is in normal state Designed to detect a large loss of entropy that might occur as a result of some physical failure or environmental change affecting the noise source Entropy data is generated from the Entropy Source - Continuous Table 24: Conditional Self-Tests Page 50 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. The Cryptographic Algorithm Self-Tests (CASTs) can be initiated by rebooting the module. All self-tests run without operator intervention. 10.3 Periodic Self-Test Information Algorithm or Test Test Method Test Type Period Periodic Method Firmware Integrity Test KAT SW/FW Integrity 60 Days Reboot Table 25: Pre-Operational Periodic Information Algorithm or Test Test Method Test Type Period Periodic Method AES-CBC Encrypt KAT (A3563) KAT CAST 60 days Reboot AES-CBC Decrypt KAT (A3563) KAT CAST 60 Days Reboot AES-GCM Encrypt KAT (A3563) KAT CAST 60 Days Reboot AES-GCM Decrypt KAT (A3563) KAT CAST 60 Days Reboot AES-CBC Encrypt KAT (A3564) KAT CAST 60 Days Reboot AES-CBC Decrypt KAT (A3564) KAT CAST 60 Days Reboot AES-GCM Encrypt KAT (A3564) KAT CAST 60 Days Reboot AES-GCM Decrypt KAT (A3564) KAT CAST 60 Days Reboot Counter DRBG Instantiate KAT (A3563) KAT CAST 60 Days Reboot Counter DRBG Generate KAT (A3563) KAT CAST 60 Days Reboot Counter DRBG Reseed KAT (A3563) KAT CAST 60 Days Reboot ECDSA SigGen KAT (A3563) KAT CAST 60 Days Reboot ECDSA SigVer KAT (A3563) KAT CAST 60 Days Reboot HMAC DRBG Instantiate KAT (A3564) KAT CAST 60 Days Reboot Page 51 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm or Test Test Method Test Type Period Periodic Method HMAC DRBG Reseed KAT (A3564) KAT CAST 60 Days Reboot HMAC DRBG Generate KAT (A3564) KAT CAST 60 Days Reboot HMAC-SHA-1 KAT (A3563) KAT CAST 60 Days Reboot HMAC-SHA2-256 KAT (A3563) KAT CAST 60 Days Reboot HMAC-SHA2-384 KAT (A3563) KAT CAST 60 Days Reboot HMAC-SHA2-512 KAT (A3563) KAT CAST 60 Days Reboot HMAC-SHA2-256 KAT (A3564) KAT CAST 60 Days Reboot HMAC-SHA2-384 KAT (A3564) KAT CAST 60 Days Reboot KAS-ECC-SSC Sp800-56Ar3 KAT (A3563) KAT CAST 60 Days Reboot KAS-ECC-SSC Sp800-56Ar3 KAT (A3564) KAT CAST 60 Days Reboot KDF IKEv2 KAT (A3563) KAT CAST 60 Days Reboot KDF SSH KAT (A3563) KAT CAST 60 Days Reboot KDF TLS KAT (A3563) KAT CAST 60 Days Reboot KDF SNMP KAT (A3563) KAT CAST 60 Days Reboot KDF TLS KAT (A3564) KAT CAST 60 Days Reboot RSA SigGen KAT (A3563) KAT CAST 60 Days Reboot RSA SigVer KAT (A3563) KAT CAST 60 Days Reboot RSA SigVer KAT (A3564) KAT CAST 60 Days Reboot SHA-1 KAT (A3563) KAT CAST 60 Days Reboot ECDSA KeyGen PCT (A3563) PCT PCT 60 Days Generate new keypair RSA KeyGen PCT (A3563) PCT PCT 60 Days Generate new keypair KAS-ECC KeyGen PCT (A3563) PCT PCT 60 Days Generate new keypair Page 52 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Algorithm or Test Test Method Test Type Period Periodic Method KAS-ECC KeyGen PCT (A3564) PCT PCT 60 Days Generate new keypair AES-CBC Encrypt KAT (A3565) KAT CAST 60 Days Reboot AES-CBC Decrypt KAT (A3565) KAT CAST 60 Days Reboot HMAC-SHA2-256 KAT (A3565) KAT CAST 60 Days Reboot HMAC-SHA2-384 KAT (A3565) KAT CAST 60 Days Reboot HMAC-SHA2-512 KAT (A3565) KAT CAST 60 Days Reboot RSA SigVer KAT (C170) KAT CAST 60 Days Reboot SHA2-256 KAT (C170) KAT CAST 60 Days Reboot Firmware Load Test KAT SW/FW Load N/A Upload new firmware to module Entropy 90B Start- up Repetition Count Test (RCT) RCT CAST N/A N/A Entropy 90B Start- up Adaptive Proportion Test (APT) APT CAST N/A N/A Entropy 90B Continuous Repetition Count Test (RPT) RCT CAST N/A N/A Entropy 90B Continuous Adaptive Proportions Test (APT) APT CAST N/A N/A Table 26: Conditional Periodic Information The module performs on-demand self-tests initiated by the operator, by power cycling the module. The full suite of self-tests is then executed. The same procedure may be employed by the operator to perform periodic self-tests. It is recommended that the Crypto Officer perform periodic testing of the module’s on-demand self-tests every 60 days to ensure all components are functioning correctly. 10.4 Error States Page 53 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. Name Description Conditions Recovery Method Indicator Error State In the Error State, no cryptographic services are provided and the data output is prohibited Failed Pre-Operational Firmware Integrity Test Failed Conditional CAST Failed Conditional PCT Failed Firmware Load Test Failed SP 800-90B Entropy Source Start-up/Continuous health tests Reboot the module System Halt Table 27: Error States If any of the above-mentioned self-tests fail, the module reports the cause of the error and enters an error state (there is only one error state). In the Error State, no cryptographic services are provided and data output is prohibited. The only method to recover from the error state is to reboot the module and perform the self-tests, including the pre-operational firmware integrity test and the conditional CASTs. The module will only enter into the operational state after successfully passing the pre-operational firmware integrity test and the conditional CASTs. 11 Life-Cycle Assurance 11.1 Installation, Initialization, and Startup Procedures The module is designed to handle the various stages of a module’s life-cycle. The sections below highlight the details for each stage. Secure Delivery Procedures The security of the module is maintained during the transfer of these products from production sites to the customer through the following mechanisms: • Email from Palo Alto Networks, Inc. confirming the order and includes tracking number(s). When the package arrives at the customer site, the customer checks the tracking number on the package with the tracking number supplied by Palo Alto Networks, Inc. • The customer also checks the integrity of the package by inspecting the integrity of the security tape and the seals of the package for tampering. Any damages to the security tape and the seals of the package would require the customer to contact Palo Alto. • The hardware and applicable documentation are delivered in the same package. Secure Operation The module meets all the Level 2 requirements for FIPS 140-3. Follow the secure operations provided below to place the module in approved mode. Operating this module without maintaining the following settings will remove the module from the approved mode of operation. The module runs firmware version 6.1.2. This is the only allowable firmware image for this current approved mode of operation. The module is initiated into the Approved mode of operation via the following procedure: 1. The Crypto Officer must apply tamper evidence labels as described in Section “Physical Security” of this document Page 54 of 54 This document can be reproduced and distributed only whole and intact, including this copyright notice. 2. Power on the ION Module 3. Using the Controller, navigate to the device that is to be initiated a. Note: The module authenticates the Crypto Officer using default authentication (Root CA), and then replaces the default information with a specific one from the Controller (CO role) 4. Click the three bullets next to the device 5. Select “FIPS” a. Click “proceed” to begin initialization procedure 6. The module will begin initialization that includes the following: a. Zeroization of any sensitive information or data b. Power cycle of the device followed by running all self-tests 7. Once initialization is complete, the module provides the following status output: a. Device Mode: “fips” b. Self-tests: “Power-up self test successful” Once the module has completed initialization into the Approved mode of operation, the module automatically enforces a login certificate change for the Crypto Officer. Any non-Approved configurations/algorithms are rejected automatically by the module and an error message is output. 11.2 Administrator Guidance Prisma SD-WAN Administrator's Guide from https://docs.paloaltonetworks.com/ 11.3 Non-Administrator Guidance Not Applicable. 11.4 End of Life End of life dates for the module are announced publicly via Palo Alto Networks’ services website. Crypto Officers should follow the procedure below for the secure destruction of their module: Note: This process will cause the module to no longer function after it has wiped all configurations and keys. 1) Access the module via SSH as Crypto Officer 2) Execute command: “disable system” 3) Confirm command 4) Module will begin zeroization process and wipe all security parameters and configurations 12 Mitigation of Other Attacks This module is not designed to mitigate against any other attacks outside of the FIPS 140-3 scope.