This page was not yet optimized for use on mobile devices.
Ciena Waveserver Ai WCS-2
Certificate details
| Certificate ID | #5508 |
|---|---|
| Status | active |
| Validation dates | 31.08.2026 |
| Sunset date | 30-08-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipEmbed |
| Caveat | None |
| Exceptions |
|
| Description | The module serves as the central control and storage facility for any SSPs utilized by the Encryption Module. Management functions of the module include device configuration, alarm monitoring, and log collection. |
| Vendor | Ciena Corporation http://www.ciena.com |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES-, AES, CAST, DES, 3DES, TDES, Triple-DES, TDEA, HMACAsymmetric Algorithms
RSA 2048, RSA 4096, ECDH, ECDSA, DHE, DH, Diffie-HellmanHash functions
SHA-1, SHA256, MD5, PBKDFSchemes
MAC, Key AgreementProtocols
SSHv2, SSH, TLS v1.3, TLS v1.2, TLS 1.3, TLS, TLS 1.2Randomness
DRBG, RNG, RBGLibraries
Crypto Library 2Elliptic Curves
P-256, P-384, P-521, P-512Block cipher modes
ECB, CBC, CTR, GCMTLS cipher suites
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Trusted Execution Environments
PSP, SSCSecurity level
Level 2Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS186, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-108, SP 800-135, SP 800-132, SP 800-67, RFC7627, RFC 5288, RFC 5246, RFC 8446, RFC762, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5508,
"dgst": "f04ac0af071c3907",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A5908",
"KAS-FFC-SSC Sp800-56Ar3A5908",
"SHA2-256A5908",
"Safe Primes Key VerificationA5908",
"KDF SSHA5908",
"SHA2-384A5908",
"PBKDFA5908",
"HMAC-SHA2-512A5908",
"#A5908",
"SHA-1A5908",
"TLS v1.2 KDF RFC7627A5908",
"HMAC-SHA2-384A5908",
"KDF SP800-108A5908",
"RSA SigGen (FIPS186-5)A5908",
"Hash DRBGA5908",
"KAS-ECC-SSC Sp800-56Ar3A5908",
"AES-CBCA5908",
"Safe Primes Key GenerationA5908",
"ECDSA SigVer (FIPS186-5)A5908",
"HMAC-SHA-1A5908",
"SHA2-512A5908",
"ECDSA KeyGen (FIPS186-5)A5908",
"TDES-CBCA5908",
"AES-GCMA5908",
"ECDSA SigGen (FIPS186-5)A5908",
"TLS v1.3 KDFA5908",
"AES-CTRA5908",
"RSA SigVer (FIPS186-5)A5908",
"RSA KeyGen (FIPS186-5)A5908",
"ECDSA KeyVer (FIPS186-5)A5908"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"2"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A5908",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A5908",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 128 Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A5908",
"properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 192, 256 Tag Length - 128 IV Length - IV Length: 96",
"reference": "SP 800-38D"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Payload Length - Payload Length: 128, 256 AAD Length - AAD Length: 0, 256",
"reference": ""
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A5908",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - extra bits",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A5908",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5), ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A5908",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A5908",
"properties": "Prediction Resistance - No Supports Reseed - Yes Mode - SHA2-256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0 Additional Input - Additional Input: 0 Returned Bits - 1024",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A5908",
"properties": "MAC - MAC: 80-160 Increment 8 Key Length - Key Length: 112-2048 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A5908",
"properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 256-448 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A5908",
"properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 256-448 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A5908",
"properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 256-448 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800- 56Ar3",
"cavpCertName": "A5908",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800- 56Ar3",
"cavpCertName": "A5908",
"properties": "Domain Parameter Generation Methods - FC, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A5908",
"properties": "KDF Mode - Feedback MAC Mode - HMAC-SHA2-256 Supported Lengths - Supported Lengths: 256 Fixed Data Order - After Fixed Data Counter Length - 8",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Supports Empty IV - Yes Requires Empty IV - Yes Custom Key In Length - 0",
"reference": ""
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A5908",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "PBKDF",
"cavpCertName": "A5908",
"properties": "Iteration Count - Iteration Count: 4096 HMAC Algorithm - SHA2-256 Password Length - Password Length: 14- 128 Increment 1 Salt Length - Salt Length: 128-512 Increment 8 Key Data Length - Key Data Length: 128",
"reference": "SP 800-132"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A5908",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Info Generated By Server - No Private Key Format - standard Public Exponent Mode - random",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A5908",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186- 5)",
"cavpCertName": "A5908",
"properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation, Safe Primes Key Verification",
"cavpCertName": "A5908",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1, SHA2-256, SHA2-384, SHA2-512",
"cavpCertName": "A5908",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TDES-CBC",
"cavpCertName": "A5908",
"properties": "Direction - Decrypt Keying Option - 1",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A5908",
"properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A5908",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK-DHE",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Perform boot-up and initialization of the module, configure the module settings, Import certificates",
"indicator": "Completi on of all these activities results in a global flag indicating system is running",
"inputs": "N/A",
"name": "Initialize and configure the module",
"outputs": "N/A",
"rolesSspAccess": "CO - Ciena signature public key (CPK): E - Base Key Encryption Key (BKEK): E - Master Key",
"secFunImpl": "Integrity Test KTS-1 Key Derivation TDES KTS-2 KAS-1 KAS-2"
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "over SSH or the Console, Via control / data input interface (SGMII,cons ole) Disable root account / diag shell.",
"indicator": "in an approved mode.",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryption Key (MKEK): E - Ciena Device ID certificate (iDevID): E - DRBG Seed (DRBG): W,E - Entropy Input (EI): W,E - TLS Public Key (TLS- PUB): G,R,W,E - TLS Private Key (TLS- Priv): G,R,W,E - TLS Master Secret (TLSMS): G,R,W,E - TLS Pre- Master Secret (TLSPMS): G,R,W,E - TLS Session Key (TLSK): G,R,W,E - TLS Authenticatio n Key (TLSAK): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH Private Key (Priv-ECKP): G,R,W,E - DH Public Key (Pub- DHKP):",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK): G,R,W,E - Customer Enrollment Certificate CUST-CERT: W,E - Password: W,E - X509 Passphrase (X509- PW): W,E - X.509 Key Encryption Key (PKIX- KEK): G - TLS Extended Master Secret (TLSEMS): G,R,W,E - Ciena Device ID private key (iDevID- priv): R - DRBG Secret C: G,E - DRBG Secret V: G,E",
"secFunImpl": ""
},
{
"description": "Install encryption PSK or certificate for datapath encryption",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Pre- Shared Keys (PSK)",
"name": "Configure datapath encryption",
"outputs": "Comman d Respons e",
"rolesSspAccess": "CO - DPE Pre- Shared Keys (PSK): W - DPE Customer Enrollment Certificate (DPE- CERT): W - DPE Customer Enrollment Certificate Private Key (Priv-DPE- CERT): W - DPE Customer Enrollment CA Certificate (DPE-CA): W - Customer Enrollment Certificate CUST-CERT: W - Data Encryption Key (DPE- KEK): G - X.509 Key Encryption Key (PKIX- KEK): G - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK): G,R,W,E",
"secFunImpl": "Module Configurati on Asymmetric Key Generation KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH User Authenticatio n Public Key (SSHPK): G,R,W,E - DH Public Key (Pub- DHKP): G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH Private Key (Priv-ECKP): G,R,W,E",
"secFunImpl": ""
},
{
"description": "Initiate a system wide firmware upgrade using RSA 4096 load test.",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Load Firmware from SSD",
"name": "Perform a Firmware Upgrade",
"outputs": "Comman d respons e; Log generati on",
"rolesSspAccess": "CO - Ciena signature public key (CPK): E - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK): G,R,W,E - SSH User Authenticatio n Public Key (SSHPK): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH",
"secFunImpl": "Firmware Upgrade KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key (Priv-ECKP): G,R,W,E - DH Public Key (Pub- DHKP): G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E",
"secFunImpl": ""
},
{
"description": "1) Select PSK for DPE peer authenticatio n and provision the encryption MOTR. 2) Activate certificate peer authenticatio n and provision the encryption MOTR Over the TLS 1.3 interface.",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "N/A",
"name": "Manage the encryption MOTR module",
"outputs": "DPE Pre- shared Keys (PSK) or Certificat e",
"rolesSspAccess": "CO - DPE Pre- Shared Keys (PSK): R - Data Encryption Key (DPE- KEK): E - X.509 Key Encryption Key (PKIX- KEK): E - DPE Customer Enrollment Certificate Private Key (Priv-DPE- CERT): R,E - DPE Customer Enrollment Certificate (DPE- CERT): R,E - DPE Customer Enrollment CA Certificate (DPE-CA): R,E - TLS Public Key (TLS- PUB): R,W,E - TLS Master Secret (TLSMS):",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "R,W,E - TLS Pre- Master Secret (TLSPMS): R,W,E - TLS Private Key (TLS- Priv): R,W,E - TLS Session Key (TLSK): R,W,E - TLS Authenticatio n Key (TLSAK): R,W,E - TLS Extended Master Secret (TLSEMS): R,W,E - DH Public Key (Pub- DHKP): R,W,E - DH Private Key (Priv- DHKP): R,W,E - ECDH Public Key (Pub-ECKP): R,W,E - ECDH Private Key (Priv-ECKP): R,W,E",
"secFunImpl": "Functions"
},
{
"description": "Clear all SSP\u0027s and disable cryptographic output via control pins (power down of modules) (Zeroise)",
"indicator": "Successf ul power cycle and the module initializes after power cycle",
"inputs": "RTFD Comman d",
"name": "Zeroise -- Secure Erase via RTFD command",
"outputs": "N/A",
"rolesSspAccess": "CO - DRBG Seed (DRBG): Z - Entropy Input (EI): Z - ECDH Public Key (Pub-ECKP): Z",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- ECDH Private Key (Priv-ECKP): Z - Data Encryption Key (DPE- KEK): Z - X509 Passphrase (X509- PW): Z - X.509 Key Encryption Key (PKIX- KEK): Z - TLS Authenticatio n Key (TLSAK): Z - TLS Public Key (TLS- PUB): Z - TLS Private Key (TLS- Priv): Z - SSH Session MAC Key (SSHAK): Z - SSH Encryption Key (SSHK): Z - SSH Server Host Key (SSHHK): Z - SSH User Authenticatio n Public Key (SSHPK): Z - DH Public Key (Pub- DHKP): Z - DH Private Key (Priv- DHKP): Z - Customer Enrollment",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Certificate CUST-CERT: Z - Password: Z - DPE Pre- Shared Keys (PSK): Z - DPE Customer Enrollment Certificate Private Key (Priv-DPE- CERT): Z - DPE Customer Enrollment Certificate (DPE- CERT): Z - TLS Session Key (TLSK): Z - TLS Pre- Master Secret (TLSPMS): Z - TLS Master Secret (TLSMS): Z - TLS Extended Master Secret (TLSEMS): Z - DRBG Secret C: Z - DRBG Secret V: Z Unauthentica ted - DRBG Seed (DRBG): Z - Entropy Input (EI): Z - ECDH Public Key (Pub-ECKP):",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Z - ECDH Private Key (Priv-ECKP): Z - Data Encryption Key (DPE- KEK): Z - X509 Passphrase (X509- PW): Z - X.509 Key Encryption Key (PKIX- KEK): Z - TLS Authenticatio n Key (TLSAK): Z - TLS Public Key (TLS- PUB): Z - TLS Private Key (TLS- Priv): Z - SSH Session MAC Key (SSHAK): Z - SSH Encryption Key (SSHK): Z - SSH Server Host Key (SSHHK): Z - SSH User Authenticatio n Public Key (SSHPK): Z - DH Public Key (Pub- DHKP): Z - DH Private Key (Priv- DHKP): Z - Customer",
"secFunImpl": ""
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Enrollment Certificate CUST-CERT: Z - Password: Z - DPE Pre- Shared Keys (PSK): Z - DPE Customer Enrollment Certificate Private Key (Priv-DPE- CERT): Z - DPE Customer Enrollment Certificate (DPE- CERT): Z - DPE Customer Enrollment CA Certificate (DPE-CA): Z - TLS Session Key (TLSK): Z - TLS Pre- Master Secret (TLSPMS): Z - TLS Master Secret (TLSMS): Z - TLS Extended Master Secret (TLSEMS): Z - DRBG Secret C: Z - DRBG Secret V: Z",
"secFunImpl": "Functions"
},
{
"description": "Authenticate operators",
"indicator": "Global Approve",
"inputs": "SSH Key (RSA) Or",
"name": "Perform operator",
"outputs": "N/A",
"rolesSspAccess": "Unauthentica ted",
"secFunImpl": "Authenticati on"
},
{
"description": "using module local database",
"indicator": "d mode indicator (show status indicator)",
"inputs": "SSH Key (ECDSA) Or SSH Password",
"name": "authenticati on",
"outputs": "",
"rolesSspAccess": "- Password: W,E - TLS Public Key (TLS- PUB): R,W,E - TLS Private Key (TLS- Priv): R,W,E - TLS Master Secret (TLSMS): R,W,E - TLS Pre- Master Secret (TLSPMS): R,W,E - TLS Session Key (TLSK): R,W,E - TLS Authenticatio n Key (TLSAK): R,W,E - ECDH Public Key (Pub-ECKP): R,W,E - ECDH Private Key (Priv-ECKP): R,W,E - DH Public Key (Pub- DHKP): R,W,E - DH Private Key (Priv- DHKP): R,W,E - SSH Session MAC Key (SSHAK): R,W,E - SSH Encryption",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key (SSHK): R,W,E - SSH Server Host Key (SSHHK): R,W,E - SSH User Authenticatio n Public Key (SSHPK): R,W,E - TLS Extended Master Secret (TLSEMS): R,W,E",
"secFunImpl": ""
},
{
"description": "Perform power-up selftests via a module reset.",
"indicator": "Log status output",
"inputs": "N/A",
"name": "Perform on demand self-tests",
"outputs": "Log status output",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "View and monitor active alarms and module status for diagnostic purposes",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Comman d",
"name": "View module status, alarms, and statistics (Show Status)",
"outputs": "Status Output",
"rolesSspAccess": "Unauthentica ted - TLS Public Key (TLS- PUB): R,W,E - TLS Private Key (TLS- Priv): R,W,E - TLS Master Secret (TLSMS): R,W,E - TLS Pre- Master Secret (TLSPMS): R,W,E - TLS Session Key (TLSK): R,W,E - TLS Authenticatio n Key (TLSAK): R,W,E",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DH Public Key (Pub- DHKP): G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH Private Key (Priv-ECKP): G,R,W,E - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK): G,R,W,E - TLS Extended Master Secret (TLSEMS):",
"secFunImpl": "Functions"
},
{
"description": "Report the running Firmware version of the WCS-2 and the encryption MOTR.",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Comman d",
"name": "Display the running Firmware (Show Version)",
"outputs": "Comman d respons e output",
"rolesSspAccess": "R,W,E Unauthentica ted - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK):",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G,R,W,E - SSH User Authenticatio n Public Key (SSHPK): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH Private Key (Priv-ECKP): G,R,W,E - DH Public Key (Pub- DHKP): G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E - TLS Public Key (TLS- PUB): R,W,E - TLS Private Key (TLS- Priv): R,W,E - TLS Master Secret (TLSMS): R,W,E - TLS Pre- Master Secret (TLSPMS): R,W,E - TLS Session Key (TLSK): R,W,E - TLS Extended Master Secret (TLSEMS): R,W,E",
"secFunImpl": ""
},
{
"description": "Transfer configuration file, certificate, PSK or firmware image to the module. Keys are then installed in the module.",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "DPE Pre- shared Key, Certificate or Firmware Key",
"name": "Perform secure file transfer",
"outputs": "N/A",
"rolesSspAccess": "CO - SSH Session MAC Key (SSHAK): R,W,E - SSH Encryption Key (SSHK): R,W,E - SSH Server Host Key (SSHHK): R,W,E - SSH User Authenticatio n Public Key (SSHPK): R,W,E - ECDH Public Key (Pub-ECKP): R,W,E - ECDH Private Key (Priv-ECKP): R,W,E - DH Public Key (Pub- DHKP): R,W,E - DH Private Key (Priv- DHKP): R,W,E - Password:",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "View system status messages, events and provisioning logs locally or via syslog over TLS",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Comman d",
"name": "View system logs",
"outputs": "Status Output",
"rolesSspAccess": "W,E Unauthentica ted - TLS Public Key (TLS- PUB): G,R,W,E - TLS Private Key (TLS- Priv): G,R,W,E - TLS Pre- Master",
"secFunImpl": "KTS-1 KTS-2 KAS-1 KAS-2"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret (TLSPMS): G,R,W,E - TLS Session Key (TLSK): G,R,W,E - TLS Authenticatio n Key (TLSAK): G,R,W,E - ECDH Public Key (Pub-ECKP): G,R,W,E - ECDH Private Key (Priv-ECKP): G,R,W,E - DH Public Key (Pub- DHKP): G,R,W,E - DH Private Key (Priv- DHKP): G,R,W,E - SSH Session MAC Key (SSHAK): G,R,W,E - SSH Encryption Key (SSHK): G,R,W,E - SSH Server Host Key (SSHHK): G,R,W,E - TLS Master Secret (TLSMS): G,R,W,E - SSH User Authenticatio n Public Key",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(SSHPK): G,R,W,E",
"secFunImpl": ""
},
{
"description": "Perform pre- operational and conditional cryptographic algorithm self-tests on demand via module restart",
"indicator": "Global Approve d mode indicator (show status indicator)",
"inputs": "Power- cycle/reb oot",
"name": "Perform on-demand self- tests",
"outputs": "Successf ul module reboot",
"rolesSspAccess": "Unauthentica ted",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The module supports ECDSA P-256, P-384 and P- 521 bit digital certificate authentication for TLS 1.2 and public key- based authentication for SSH.",
"mechanism": "SSH Authentication",
"name": "ECDSA Public Key Certificate",
"perMinute": "At most (1 \u00d710^10 \u00d7 60 = 6 \u00d7 10^11) 600,000,000,000 bits of data can be transmitted in one minute; Therefore, the probability that a random attempt will succeed, or a false acceptance will occur in one minute is: 1: (2^112 possible keys / ((6 \u00d7 10^11 bits per minute) / 112 bits per key)) = 1: (2^112 possible keys / 535,714,2857 keys per minute) = 1: 9.69 \u00d7 10^23 which is less than 1:100,000 within one minute.",
"strength": "The module supports ECDSA P-256, P-384 and P- 521 bit digital certificate authentication for TLS 1.2 and public key-based authentication for SSH"
},
{
"description": "The module supports ECDSA P-256, P-384 and P- 521 bit and RSA 2048, 3072- and 4096-bit digital certificate authentication for TLS 1.2 and public key- based authentication for SSH.",
"mechanism": "SSH Authentication",
"name": "RSA Public Key Certificate",
"perMinute": "At most (1 \u00d710^10 \u00d7 60 = 6 \u00d7 10^11) 600,000,000,000 bits of data can be transmitted in one minute; Therefore, the probability that a random attempt will succeed, or a false acceptance will occur in one minute is: 1: (2^112 possible keys / ((6 \u00d7 10^11 bits per minute) / 112 bits per",
"strength": "Using conservative estimates and equating the use of RSA with 2048 bits with 112 bits of security strength (the lowest strength offered by the module), the probability for a random attempt to succeed is: 1:2^112 or 1: 5.19 x 10^33 which is"
},
{
"description": "",
"mechanism": "",
"name": "",
"perMinute": "key)) = 1: (2^112 possible keys / 535,714,2857 keys per minute) = 1: 9.69 \u00d7 10^23 which is less than 1:100,000 within one minute.",
"strength": "less than 1:1,000,000. The fastest network connection supported by the modules over Management interfaces is 1 Gb/s"
},
{
"description": "For SSH and Console the module enforces 8- character passwords (at minimum) chosen from the 96 human readable ASCII characters.",
"mechanism": "8- character passwords (at minimum) chosen from the 96 human readable ASCII character",
"name": "Password- based",
"perMinute": "A limit of 10 failed attempts is enforced by the module for SSH; Therefore, there can be at most 10:96^8 attempts in a one-minute period, which is less than 1:100,000",
"strength": "The password can be a maximum of 128 characters. Based on the minimum password length, the probability for a random attempt to succeed is: 1:96^8 or 1: 7.21 X 10^15 Which is less than 1:1,000,000"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [],
"found": false,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Failure of Firmware load test",
"description": "Upon failure of the firmware load test, the module enters \"Soft Error\" state. The soft error state is a nonpersistent state wherein the module resolves the error by rejecting the loading of the new firmware. Upon rejection, the error state is cleared, and the module resumes its services using the previously loaded firmware.",
"indicator": "Status Log",
"name": "Soft Error",
"recoveryMethod": "Reboot or Power Cycle"
},
{
"conditions": "Failure of pre- operational or or conditional self-tests",
"description": "If the module encounters an error in any Pre-Operational self-tests or conditional self-tests the module will enter a Critical error state. In this case, the module will be stuck in infinite boot loop until the self-tests pass. If the error condition is not cleared, then the module is considered to be malfunctioning and should be returned to Ciena.",
"indicator": "A permanent error status will be relayed via the status output interface (Module will be stuck in infinite boot loop)",
"name": "Critical Error",
"recoveryMethod": "N/A"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Periodic inspection of tamper-evident seals when moving/replacing the module",
"inspectGuidance": "Three tamper-evident seals are applied to the multi-chip embedded cryptographic module during manufacturing; The physical security of the module is intact if there is no evidence of tampering with the tamper-evident seal(s); If evidence of tamper is found, the Cryptographic Officer is requested to follow their internal IT policies, which may include contacting Ciena for replacing the unit",
"mechanism": "Tamper- evident seals"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [],
"found": false,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "No Security Claimed",
"name": "SNMPv2C (MD5, DES, 3DES, SHA- 1 AES-128, AES- 192, AES-256)",
"use": "SNMPv2C is used for non-security relevant status output such as alerts, alarms etc. Hence no security claimed as per IG 2.4.A Additional Comment 2 and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non -approved use and purpo se (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
},
{
"caveat": "No Security Claimed",
"name": "SNMPv3 (MD5, DES, 3DES, SHA- 1 AES-128, AES- 192, AES-256)",
"use": "SNMPv3 is used for non-security relevant status output such as alerts, alarms etc. Hence no security claimed as per IG 2.4.A Additional Comment 2 and the following requirements per the Additional Comment 2 are satisfied: 1) the algorithm is not used whatsoever to meet any FIPS 140-3 requirements; 2) the algorithm does not access or share CSPs in a way that counters the requirements of the IG; 3) i) the algorithm is not intended to be used as a security function 4) the algorithm\u0027s non -approved use and purpos e (from 3)) is unambiguous to the operator and can\u0027t be easily confused for a security function given as the purpose is not providing any security functionality recognized in FIPS 140-3."
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Console Management",
"logicalInterface": "Control Input Status Output",
"physicalPort": "Console Interface (RJ-45, UART Interface and USB-C connectors on front panel)"
},
{
"data": "SSHv2, TLS 1.2 and TLS 1.3 communications",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (SGMII, Midplane connector, PCIe, \u0026 faceplate connector)"
},
{
"data": "Reset Signal",
"logicalInterface": "Control Input",
"physicalPort": "Reset Button (Module faceplate)"
},
{
"data": "Power control for the encryption MOTR",
"logicalInterface": "Control Output",
"physicalPort": "Control pins (Midplane connector)"
},
{
"data": "LED Active/On",
"logicalInterface": "Status Output",
"physicalPort": "LED (Module faceplate)"
},
{
"data": "Power supply/input from within the Waveserver Ai Encryption Module chassis where the module resides",
"logicalInterface": "Power",
"physicalPort": "Power Supply (Midplane connector)"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "ECDSA Public Key Certificate RSA Public Key Certificate Password-based",
"name": "CO",
"operatorType": "Crypto Officer",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "2",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "EDC",
"details": "Verify integrity of the firmware.",
"indicator": "Log status output",
"testMethod": "EDC",
"testProps": "SHA2-384.",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "eFUSE",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Stored at manufacture",
"sfiAlgo": "",
"source": "Manufacturer"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input_1",
"sfiAlgo": "KTS-1",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output_1",
"sfiAlgo": "KTS-1",
"source": "RAM"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output_2",
"sfiAlgo": "",
"source": "RAM"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input_2",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input_3",
"sfiAlgo": "KTS-2",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "Non- Volatile Memory (NVM)",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Stored at manufacture - 2",
"sfiAlgo": "",
"source": "Manufacturer"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output_3",
"sfiAlgo": "KTS-2",
"source": "RAM"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output_4",
"sfiAlgo": "KTS-1",
"source": "Non-Volatile Memory (NVM)"
},
{
"dest": "External (Outside of the Module\u0027s Boundary)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output_5",
"sfiAlgo": "KTS-2",
"source": "Non-Volatile Memory (NVM)"
},
{
"dest": "Non- Volatile Memory (NVM)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input_4",
"sfiAlgo": "KTS-1",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "Non- Volatile Memory (NVM)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input_5",
"sfiAlgo": "",
"source": "External (Outside of the Module\u0027s Boundary)"
},
{
"dest": "Non- Volatile Memory (NVM)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Input_6",
"sfiAlgo": "KTS-2",
"source": "External (Outside of the Module\u0027s Boundary)"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "SSPs in memory are lost during reboot or power cycle executed using the Push Button",
"method": "Reboot or Power Cycle",
"operatorId": "On Demand",
"rationale": "SSPs in memory are cleared during power cycle."
},
{
"description": "SSPs are zeroized after use automatically",
"method": "Zeroise after use",
"operatorId": "Automatically Zeroise after use",
"rationale": "Ephemeral keys are zeroised by the module after use"
},
{
"description": "Erase via RTFD Command",
"method": "Secure Erase",
"operatorId": "On Demand",
"rationale": "Zeroise on demand via RTFD Command"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Stored in plaintext in RAM",
"name": "RAM",
"persistance": "Dynamic"
},
{
"description": "Read-only eFUSE in plaintext",
"name": "eFUSE",
"persistance": "Static"
},
{
"description": "Non-Volatile Memory (NVM)",
"name": "Non-Volatile Memory (NVM)",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "2.4.50",
"hwVersion": "Hardware 186-1034-411-EB [Revision 002, 003, 004, 005, 006, and 007]",
"modelPartNum": "PCB 186- 1034- 210 Revision 001",
"processors": "ARM Cortex A53"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4",
"reference": "NIST SP800-133r2 Section 4: Using the Output of a Random Bit Generator Option 1 (Symmetric keys and seed for asymmetric keys (Option 1)); Section 5.1: Key Pairs for Digital Signature Schemes; Section 5.2: Key Pairs for Key Establishment; 6.1: The Direct Generation of Symmetric Keys; Section 6.2.1: Symmetric Keys Generated Using Key Agreement Schemes; Section 6.2.3 Symmetric Keys Derived from Passwords"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 31
},
"ECDSA": {
"ECDSA": 48
}
},
"FF": {
"DH": {
"DH": 31,
"DHE": 1,
"Diffie-Hellman": 1
}
},
"RSA": {
"RSA 2048": 6,
"RSA 4096": 2
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 3
},
"CTR": {
"CTR": 2
},
"ECB": {
"ECB": 1
},
"GCM": {
"GCM": 6
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"Generic": {
"Crypto Library 2": 1
}
},
"crypto_protocol": {
"SSH": {
"SSH": 79,
"SSHv2": 2
},
"TLS": {
"TLS": {
"TLS": 97,
"TLS 1.2": 5,
"TLS 1.3": 5,
"TLS v1.2": 9,
"TLS v1.3": 9
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 8
},
"MAC": {
"MAC": 17
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 38,
"P-384": 36,
"P-512": 8,
"P-521": 16
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 3,
"#2": 1,
"#5": 1
}
},
"fips_certlike": {
"Certlike": {
"AES- 192": 2,
"AES- CBC 256, 384": 1,
"AES- CTR 128": 1,
"AES- GCM 128": 1,
"AES-128": 3,
"AES-192": 1,
"AES-256": 3,
"Certificate RSA": 1,
"DRBG 256": 1,
"Diffie-Hellman 7": 1,
"HMAC- SHA- 256": 1,
"HMAC-SHA-1": 4,
"RSA 112": 4,
"RSA 2048": 6,
"RSA 4096": 2,
"SHA- 1": 2,
"SHA- 256": 1,
"SHA-1": 3,
"SHA2- 256": 3,
"SHA2- 512": 1,
"SHA2-224": 2,
"SHA2-256": 9,
"SHA2-384": 9,
"SHA2-512": 5,
"SHA256": 1,
"SHA3- 256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 2
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 2
}
},
"PBKDF": {
"PBKDF": 3
},
"SHA": {
"SHA1": {
"SHA-1": 3
},
"SHA2": {
"SHA256": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 58
},
"RNG": {
"RBG": 2,
"RNG": 4
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 10,
"FIPS 180-4": 1,
"FIPS 186-5": 6,
"FIPS 198-1": 4,
"FIPS186": 4,
"FIPS186-5": 20
},
"NIST": {
"SP 800-108": 1,
"SP 800-132": 1,
"SP 800-135": 3,
"SP 800-38A": 2,
"SP 800-38D": 1,
"SP 800-56A": 3,
"SP 800-67": 1,
"SP 800-90A": 1
},
"RFC": {
"RFC 5246": 1,
"RFC 5288": 1,
"RFC 8446": 2,
"RFC762": 3,
"RFC7627": 2
},
"X509": {
"X.509": 10
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 10,
"AES-": 6,
"AES-128": 3,
"AES-192": 1,
"AES-256": 3
},
"CAST": {
"CAST": 30
}
},
"DES": {
"3DES": {
"3DES": 2,
"TDEA": 1,
"TDES": 2,
"Triple-DES": 1
},
"DES": {
"DES": 2
}
},
"constructions": {
"MAC": {
"HMAC": 4
}
}
},
"tee_name": {
"AMD": {
"PSP": 8
},
"IBM": {
"SSC": 2
}
},
"tls_cipher_suite": {
"TLS": {
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384": 1,
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 1
}
},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"HMAC-SHA2-256A5908",
"KAS-FFC-SSC Sp800-56Ar3A5908",
"SHA2-256A5908",
"Safe Primes Key VerificationA5908",
"KDF SSHA5908",
"PBKDFA5908",
"SHA2-384A5908",
"HMAC-SHA2-512A5908",
"SHA-1A5908",
"TLS v1.2 KDF RFC7627A5908",
"HMAC-SHA2-384A5908",
"KDF SP800-108A5908",
"RSA SigGen (FIPS186-5)A5908",
"Hash DRBGA5908",
"KAS-ECC-SSC Sp800-56Ar3A5908",
"AES-CBCA5908",
"Safe Primes Key GenerationA5908",
"ECDSA SigVer (FIPS186-5)A5908",
"HMAC-SHA-1A5908",
"SHA2-512A5908",
"ECDSA KeyGen (FIPS186-5)A5908",
"TDES-CBCA5908",
"AES-GCMA5908",
"ECDSA SigGen (FIPS186-5)A5908",
"TLS v1.3 KDFA5908",
"AES-CTRA5908",
"RSA SigVer (FIPS186-5)A5908",
"RSA KeyGen (FIPS186-5)A5908",
"ECDSA KeyVer (FIPS186-5)A5908"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A5908"
]
},
"policy_metadata": {
"/CreationDate": "D:20260824093439-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260824093439-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1083845,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E199_PublicUse.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 55
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "d26a55106233c80057340233ef9d13ecbfdb3a13db16dd077836a61c3d18dc82",
"source_hash": "90cbfb9e922d4a93d94eab48f0f3e3657324d8a636c62c215dab5b7e55f6fb76",
"txt_hash": "733f877b2feee850f488c6277a664071f22279f0214b615c21487012db33d68a"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "None",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
"date_sunset": "2031-08-30",
"description": "The module serves as the central control and storage facility for any SSPs utilized by the Encryption Module. Management functions of the module include device configuration, alarm monitoring, and log collection.",
"embodiment": "MultiChipEmbed",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "Ciena Waveserver Ai WCS-2",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-08-31",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "Ciena Corporation",
"vendor_url": "http://www.ciena.com"
}
}