{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "f3058bcbb026a692", "cert_id": 5561, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "Ad Noctem Connect 2.3", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-10-21", "validation_type": "Initial", "lab": "Teron Labs"}], "vendor_url": "http://www.northropgrumman.com", "vendor": "Northrop Grumman Corporation", "certificate_pdf_url": null, "module_type": "Software", "standard": "FIPS 140-3", "status": "active", "level": 1, "caveat": "When operated in approved mode. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy.", "exceptions": ["Physical security: N/A", "Non-invasive security: N/A", "Mitigation of other attacks: N/A"], "embodiment": "MultiChipStand", "description": "The module is a VPN Client application. It provides secure communication over untrusted networks. To provide this security, the module implements IKEv2/IPsec. It can be configured over a local, web-based interface.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-10-20", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {}, "fips_security_level": {"Level": {"Level 1": 1}}, "fips_certlike": {"Certlike": {"SHA2-256": 18, "SHA2-384": 5, "SHA2- 512": 3, "SHA2-512": 6, "SHA-1": 3, "SHA2- 384": 1, "SHA1": 3, "SHA-224": 1, "SHA-3": 2, "SHA- 224": 1, "RSA 3072": 1, "RSA 2048": 1, "RSA 4096": 1, "AES-256": 1, "AES- GCM IV IV 96": 1, "AES-GCM IV IV 96": 1, "AES256": 1, "DRBG 256": 1}}, "vendor": {"Infineon": {"Infineon": 2}}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-256": 1, "AES": 6, "AES-": 4, "AES256": 1}, "CAST": {"CAST-128": 3, "CAST": 54}}, "DES": {"DES": {"DES": 3}}, "miscellaneous": {"Blowfish": {"Blowfish": 3}, "Camellia": {"Camellia": 6}}, "constructions": {"MAC": {"CMAC": 3}}}, "asymmetric_crypto": {"RSA": {"RSA 3072": 1, "RSA 2048": 1, "RSA 4096": 1}, "ECC": {"ECDH": {"ECDH": 25}, "ECDSA": {"ECDSA": 42}, "EdDSA": {"EdDSA": 2}, "ECC": {"ECC": 2}}, "FF": {"DH": {"Diffie-Hellman": 3, "DH": 26}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 3, "SHA1": 3}, "SHA2": {"SHA-224": 1}, "SHA3": {"SHA-3": 2}}, "MD": {"MD5": {"MD5": 2}}}, "crypto_scheme": {"MAC": {"MAC": 9}, "KA": {"Key agreement": 2}, "AEAD": {"AEAD": 3}}, "crypto_protocol": {"IKE": {"IKE": 12, "IKEv2": 147}, "IPsec": {"IPsec": 33}, "VPN": {"VPN": 9}}, "randomness": {"PRNG": {"DRBG": 37}, "RNG": {"RBG": 2}}, "cipher_mode": {"GCM": {"GCM": 4}, "CCM": {"CCM": 3}}, "ecc_curve": {"NIST": {"P-224": 12, "P-256": 14, "P-384": 12, "P-521": 12, "secp256k1": 2}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {"OpenSSL": {"OpenSSL": 2}}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 10}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 45, "FIPS186-5": 20, "FIPS 186-5": 6, "FIPS 198-1": 3, "FIPS 180-4": 1}, "NIST": {"SP 800-38A": 3, "SP 800-38C": 1, "SP 800-38D": 2, "SP 800-90A": 1, "SP 800-56A": 3, "SP 800-135": 1, "SP 800-90B": 1, "SP 800-133": 1}, "RFC": {"RFC 5282": 1, "RFC4106": 1, "RFC 7296": 2, "RFC 4303": 1}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 1117877, "pdf_is_encrypted": false, "pdf_number_of_pages": 43, "/Producer": "Microsoft\u00ae Word for Microsoft 365", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/CreationDate": "D:20261015083012-04'00'", "/ModDate": "D:20261015083012-04'00'", "pdf_hyperlinks": {"_type": "Set", "elements": ["http://www.teronlabs.com/", "https://docs.strongswan.org/docs/5.9/index.html"]}}, "module_algorithms": {"_type": "Set", "elements": ["ECDSA KeyGen (FIPS186-5)A7623", "ECDSA SigVer (FIPS186-5)A7623", "SHA2-256A7624", "SHA-1A7624", "KAS-FFC-SSC Sp800-56Ar3A7623", "HMAC-SHA2-512A7624", "AES-CCMA7624", "RSA SigGen (FIPS186-5)A7623", "Counter DRBGA7623", "Safe Primes Key VerificationA7623", "AES-GCMA7624", "ECDSA SigGen (FIPS186-5)A7623", "HMAC-SHA2-384A7624", "AES-CTRA7623", "KDF IKEv2A7623", "AES-CBCA7624", "HMAC-SHA2-256A7624", "KAS-ECC-SSC Sp800-56Ar3A7623", "ECDSA KeyVer (FIPS186-5)A7623", "Safe Primes Key GenerationA7623", "AES-ECBA7623", "SHA2-384A7624", "RSA SigVer (FIPS186-5)A7623", "SHA2-512A7624"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A7623", "#A7624"]}, "is_br1_format": true, "br1_deviations": 1, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "1"}, {"section": "2", "title": "Cryptographic module specification", "level": "1"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "1"}, {"section": "4", "title": "Roles, services, and authentication", "level": "1"}, {"section": "5", "title": "Software/Firmware security", "level": "1"}, {"section": "6", "title": "Operational environment", "level": "1"}, {"section": "7", "title": "Physical security", "level": "N/A"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "1"}, {"section": "10", "title": "Self-tests", "level": "1"}, {"section": "11", "title": "Life-cycle assurance", "level": "1"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "1"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"packageFileName": "/etc/adnoctem-release /usr/lib/adnoctem-fipscheck.service.sh /usr/lib/adnoctem/crypto-boundary.txt", "swFwVersion": "StrongSwan 5.9.11 Kernel 5.14.21 OpenSSL 1.1.1l", "features": "N/A", "integrityTest": "HMAC- SHA2-256"}, {"packageFileName": "StrongSwan: /usr/sbin/ipsec /usr/lib/ipsec/_updown /usr/lib/ipsec/charon /usr/lib/ipsec/pool /usr/lib/ipsec/starter /usr/lib/ipsec/stroke /usr/lib/ipsec/_fipscheck /usr/lib64/ipsec/libstrongswan.so.0.0.0 /usr/lib64/ipsec/libcharon.so.0.0.0 /usr/sbin/swanctl", "swFwVersion": "", "features": "", "integrityTest": ""}, {"packageFileName": "OpenSSL: /usr/lib64/ipsec/plugins/libstrongswan-openssl.so /usr/lib64/libcrypto.so.1.1", "swFwVersion": "", "features": "", "integrityTest": ""}, {"packageFileName": "Linux Kernel: /boot/vmlinux-5.14.21-150400.24.173-default *.ko files in /lib/modules/5.14.21-150400.24.173- default/kernel/arch/arm64/crypto/ *.ko files in /lib/modules/5.14.21-150400.24.173- default/kernel/crypto/", "swFwVersion": "", "features": "", "integrityTest": ""}]}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": false, "entries": []}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A7623, A7624", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CCM", "cavpCertName": "A7624", "properties": "Key Length - 128, 256 Tag Length - 128, 64, 96 IV Length - IV Length: 64, 96, 104 Payload Length - Payload Length: 256 AAD Length - AAD Length: 64, 96", "reference": "SP 800-38C"}, {"algorithm": "AES-CTR", "cavpCertName": "A7623", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No", "reference": "SP 800-38A"}, {"algorithm": "", "cavpCertName": "", "properties": "Incremental Counter - Yes Counter Tests Performed - Yes", "reference": ""}, {"algorithm": "AES-ECB", "cavpCertName": "A7623", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-GCM", "cavpCertName": "A7623", "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1, 8.2.2 Key Length - 128, 192, 256 Tag Length - 128, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 120, 128, 248, 256, Payload Length: 160-65536 Increment 8 AAD Length - AAD Length: 64, 96", "reference": "SP 800-38D"}, {"algorithm": "AES-GCM", "cavpCertName": "A7624", "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 160-65536 Increment 8 AAD Length - AAD Length: 64, 96", "reference": "SP 800-38D"}, {"algorithm": "Counter DRBG", "cavpCertName": "A7623", "properties": "Prediction Resistance - No Supports Reseed - No Mode - AES-256 Derivation Function Enabled - No Additional Input - Additional Input: 0 Entropy Input - Entropy Input: 384 Nonce - Nonce: 0 Personalization String Length - Personalization String Length: 0 Returned Bits - 256", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A7623", "properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA KeyVer (FIPS186-5)", "cavpCertName": "A7623", "properties": "Curve - P-224, P-256, P-384, P-521", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A7623", "properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A7623", "properties": "Component - No Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512", "reference": "FIPS 186-5"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A7623, A7624", "properties": "MAC - MAC: 256 Key Length - Key Length: 256-512 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-384", "cavpCertName": "A7623, A7624", "properties": "MAC - MAC: 256-384 Increment 8 Key Length - Key Length: 256-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-512", "cavpCertName": "A7623, A7624", "properties": "MAC - MAC: 256-512 Increment 8 Key Length - Key Length: 256-1024 Increment 8", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A7623", "properties": "Domain Parameter Generation Methods - P-224, P-256, P-384, P-521 Hash Function Z - SHA2-512 Scheme - onePassDh - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC-SSC Sp800-56Ar3", "cavpCertName": "A7623", "properties": "Domain Parameter Generation Methods - MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A7623", "properties": "Initiator Nonce Length - Initiator Nonce Length: 128-2048 Increment 8 Responder Nonce Length - Responder Nonce Length: 128-2048 Increment 8 Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 224-8192 Increment 8 Derived Keying Material Length - Derived Keying Material Length: 256-16384 Increment 8 Derived Keying Material Child Length - Derived Keying Material Child Length: 160-16384 Increment 8 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A7623", "properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A7623", "properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5 Fixed Public Exponent - 010001 Public Exponent Mode - fixed", "reference": "FIPS 186-5"}, {"algorithm": "Safe Primes Key Generation, Safe Primes Key Verification", "cavpCertName": "A7623", "properties": "Safe Prime Groups - MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "SHA-1, SHA2-256, SHA2- 384, SHA2-512", "cavpCertName": "A7624, A7623", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "Triple DES", "use": "Encryption Algorithms"}, {"name": "CAST-128", "use": "Encryption Algorithms"}, {"name": "Blowfish", "use": "Encryption Algorithms"}, {"name": "Camellia", "use": "Encryption Algorithms"}, {"name": "AES-GMAC with null encryption", "use": "Authenticated Encryption (AEAD) Algorithms"}, {"name": "Camellia with CCM", "use": "Authenticated Encryption (AEAD) Algorithms"}, {"name": "chacha20poly1305", "use": "Authenticated Encryption (AEAD) Algorithms"}, {"name": "HMAC-MD5, SHA1", "use": "Integrity Algorithms"}, {"name": "AES XCBC", "use": "Integrity Algorithms"}, {"name": "AES CMAC", "use": "Integrity Algorithms"}, {"name": "AES-GMAC for authentication", "use": "Integrity Algorithms"}, {"name": "Diffie Hellman with modp768, modp1024, modp1536", "use": "Diffie Hellman"}, {"name": "Diffie Hellman with ecp224, ecp224bp, ecp256bp, ecp384bp, ecp512bp, curve25519, x25519, curve448, x448", "use": "EC"}, {"name": "RSA Signatures with MD5, SHA-1, SHA-224, SHA-3", "use": "Signature Algorithms"}, {"name": "ECDSA Signatures with non-NIST curves", "use": "Signature Algorithms"}, {"name": "EdDSA", "use": "Signature Algorithms"}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": false, "entries": []}, "authentication_methods": {"section": 4, "subsection": 1, "found": false, "entries": []}, "roles": {"section": 4, "subsection": 2, "found": false, "entries": []}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Start IKEv2 daemon", "description": "Execution of the IKEv2 daemon.", "indicator": "N/A", "inputs": "N/A", "outputs": "Success/Failure", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer"}, {"name": "Connect IKEv2", "description": "Load the VPN configuration and initiate the IKEv2 connection.", "indicator": "LIST- SAS-IKE", "inputs": "Pre-shared keys or asymmetric key pairs Configuration data", "outputs": "Success/failure", "secFunImpl": "IKEv2 KAS- ECC IKEv2 KAS- FFC Block Cipher IKEv2 IKEv2 KDF Generate random KAS Key Pair Generation Message Authentication ECDSA Signature Generation ECDSA Signature Verification RSA Signature Generation RSA Signature", "rolesSspAccess": "Crypto Officer - DRBG Seed: R - DRBG Entropy Input: R - DRBG V Value: R,W - DRBG Key Value: R,W - ECDH KAS Private Key: G,W,R - ECDH KAS Public Key: G,W,R - ECDH KAS Peer Key: R - DH KAS Private Key: G,W,R - DH KAS Public Key: G,W,R - DH KAS Peer"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "Verification IKEv2 KTS", "rolesSspAccess": "Key: R - SKEYSEED: G,W,R - IKEv2 Derivation Key: G,W,R - IKEv2 Encryption keys: G,W,R - IKEv2 Authentication key: G,W,R - RSA Public Key: R - RSA Private Key: R - RSA Peer Public Key: R - ECDSA Public Key: R - ECDSA Private Key: R - ECDSA Peer Public Key: R - PSK: R"}, {"name": "IPsec Tunnelling", "description": "Encryption and decryption of user data over the IPsec tunnel", "indicator": "LIST- SAS-ESP", "inputs": "Tunnel encryption keys, Plaintext traffic, Encrypted traffic", "outputs": "Encrypted traffic, decrypted traffic", "secFunImpl": "Block Cipher IPsec", "rolesSspAccess": "- IKEv2 AES- GCM IV: G,W,R Crypto Officer - IPsec Encryption Key: G,E - IPsec Authentication Key: G - IPsec AES- GCM IV: G,W,R"}, {"name": "Teardown connection", "description": "Teardown of Security Associations used for communication.", "indicator": "N/A", "inputs": "Connection identifier", "outputs": "Success/Failure", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - ECDH KAS Private Key: Z - ECDH KAS Public Key: Z - ECDH KAS Peer Key: Z - DH KAS Private Key: Z - DH KAS Public Key: Z - DH KAS Peer Key: Z - SKEYSEED: Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- IKEv2 Derivation Key: Z - IKEv2 Encryption keys: Z - IKEv2 Authentication key: Z"}, {"name": "Terminate IKEv2 daemon", "description": "Termination of IKEv2 daemon resulting in the clearing of all CSPs.", "indicator": "N/A", "inputs": "None", "outputs": "Success/Failure", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - DRBG Seed: Z - DRBG Entropy Input: Z - DRBG V Value: Z - DRBG Key Value: Z - ECDH KAS Private Key: Z - ECDH KAS Public Key: Z - ECDH KAS Peer Key: Z - DH KAS Private Key: Z - DH KAS Public Key: Z - DH KAS Peer Key: Z - SKEYSEED: Z - IKEv2 Derivation Key: Z - IKEv2 Encryption keys: Z - IKEv2 Authentication key: Z - RSA Public Key: Z - RSA Private Key: Z - RSA Peer Public Key: Z - ECDSA Public Key: Z - ECDSA Private Key: Z - ECDSA Peer"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Public Key: Z - PSK: Z"}, {"name": "Perform Self-tests", "description": "On-demand execution of self-tests by power cycling", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer"}, {"name": "Zeroization", "description": "Zeroization of SSPs via power cycling", "indicator": "N/A", "inputs": "", "outputs": "", "secFunImpl": "None", "rolesSspAccess": "Crypto Officer - DRBG Seed: Z - DRBG Entropy Input: Z - DRBG V Value: Z - DRBG Key Value: Z - ECDH KAS Private Key: Z - ECDH KAS Public Key: Z - ECDH KAS Peer Key: Z - DH KAS Private Key: Z - DH KAS Public Key: Z - DH KAS Peer Key: Z - SKEYSEED: Z - IKEv2 Derivation Key: Z - IKEv2 Encryption keys: Z - IKEv2 Authentication key: Z - RSA Public Key: Z - RSA Private Key: Z - RSA Peer Public Key: Z - ECDSA Public Key: Z - ECDSA Private Key: Z - ECDSA Peer Public Key: Z - PSK: Z"}, {"name": "Show Status", "description": "Query the status of the current connections.", "indicator": "N/A", "inputs": "swanctl --list- sas", "outputs": "", "secFunImpl": "None", "rolesSspAccess": "Unauthenticated"}, {"name": "Show Version", "description": "Output the module name and version", "indicator": "N/A", "inputs": "cat /etc/adnoctem- release", "outputs": "", "secFunImpl": "None", "rolesSspAccess": "Unauthenticated"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "Connect IKEv2 (non-approved)", "description": "Load the VPN configuration and initiate the IKEv2 connection (using non-approved algorithms)", "alg_accessed": "Diffie Hellman with modp768, modp1024, modp1536 Diffie Hellman with ecp224, ecp224bp, ecp256bp, ecp384bp, ecp512bp, curve25519, x25519, curve448, x448 RSA Signatures with MD5, SHA-1, SHA- 224, SHA-3 ECDSA Signatures with non-NIST curves EdDSA Triple DES CAST-128 Blowfish Camellia AES-GMAC with null encryption Camellia with CCM chacha20poly1305 HMAC-MD5, SHA1 AES XCBC AES CMAC AES-GMAC for authentication", "role": "Crypto Officer"}, {"name": "IPsec Tunnelling (non-approved)", "description": "Encryption and decryption of user data over the IPsec tunnel (using non-approved algorihm)", "alg_accessed": "Triple DES CAST-128 Blowfish Camellia AES-GMAC with null encryption Camellia with CCM chacha20poly1305 HMAC-MD5, SHA1 AES XCBC AES CMAC AES-GMAC for authentication", "role": "Crypto Officer"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": false, "entries": []}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "RAM", "description": "SSPs are stored temporarily for use by the module services while operational.", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Input: Configuration", "source": "File storage within TOEPP", "dest": "RAM", "format": "Plaintext", "distribution": "Manual", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Input: IKEv2 protocol", "source": "Network interface", "dest": "RAM", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Output: IKEv2 protocol", "source": "RAM", "dest": "Network interface", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Input: IKEv2 encrypted protocol", "source": "Network interface", "dest": "RAM", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "Block Cipher IKEv2"}, {"name": "Output: IKEv2 encrypted protocol", "source": "RAM", "dest": "Network interface", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "Block Cipher IKEv2"}, {"name": "Input: IPsec encrypted protocol", "source": "Network interface", "dest": "RAM", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "Block Cipher IPsec"}, {"name": "Output: IPsec encrypted protocol", "source": "RAM", "dest": "Network interface", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "Block Cipher IPsec"}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Remove power from the module", "description": "The module is powered down.", "rationale": "All SSPs are stored in memory only, and are cleared when power is removed.", "operatorId": "Operator removes power from the module."}, {"method": "Close IKEv2 connection", "description": "IKEv2 connection is closed", "rationale": "SSPs in memory are overwritten with zeroes, making them irretrievable.", "operatorId": "IKEv2 connection is closed."}, {"method": "Terminate IKEv2 daemon", "description": "The IKEv2 daemon is terminated.", "rationale": "SSPs in memory are overwritten with zeroes, making them irretrievable.", "operatorId": "IKEv2 Daemon is terminated."}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "HMAC- SHA2-256", "testProps": "HMAC- SHA2-256", "testMethod": "KAT", "type": "SW/FW Integrity", "indicator": "Module becomes operational", "details": "HMAC-SHA2-256 performed on all files within the crypto boundary and compared to known digests."}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "SHA2-256 (A7623)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Hash", "condition": "Module load"}, {"algorithmOrTest": "SHA2-512 (A7623)", "testProps": "-", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Hash", "condition": "Module load"}, {"algorithmOrTest": "IKEv2 KDF (A7623)", "testProps": "SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Derive", "condition": "Module load"}, {"algorithmOrTest": "HMAC-SHA2-256 (A7623)", "testProps": "160-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute MAC", "condition": "Module load"}, {"algorithmOrTest": "AES-ECB (A7623) Encrypt", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Encrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-ECB (A7623) Decrypt", "testProps": "128-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Decrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-GCM (A7623) Encrypt", "testProps": "256-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Encrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-GCM (A7623) Decrypt", "testProps": "256-bit key", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Decrypt", "condition": "Module load"}, {"algorithmOrTest": "Counter DRBG (A7623)", "testProps": "AES256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Instantiate, Reseed, Generate", "condition": "Module load"}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7623)", "testProps": "SHA2-256, secp256k1", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Sign", "condition": "Module load"}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7623)", "testProps": "SHA2-256, secp256k1", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Verify", "condition": "Module load"}, {"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7623)", "testProps": "SHA2-256, 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Sign", "condition": "Module load"}, {"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7623)", "testProps": "SHA2-256, 2048", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Verify", "condition": "Module load"}, {"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A7623)", "testProps": "P-256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute Shared Secret", "condition": "Module load"}, {"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A7623)", "testProps": "2048-bit", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute Shared secret", "condition": "Module load"}, {"algorithmOrTest": "ECDH PCT", "testProps": "", "testMethod": "PCT", "type": "PCT", "indicator": "Connection successful", "details": "Sign/Verify", "condition": "Key pair generated"}, {"algorithmOrTest": "DH PCT", "testProps": "", "testMethod": "PCT", "type": "PCT", "indicator": "Connection successful", "details": "Compute public key", "condition": "Key pair generated"}, {"algorithmOrTest": "AES-CBC (A7624) Encrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Encrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-CBC (A7624) Decrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Decrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-GCM (A7624) Encrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Encrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-GCM (A7624) Decrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Decrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-CCM (A7624) Encrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Encrypt", "condition": "Module load"}, {"algorithmOrTest": "AES-CCM (A7624) Decrypt", "testProps": "128,192, 256", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Decrypt", "condition": "Module load"}, {"algorithmOrTest": "HMAC-SHA2-256 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute MAC", "condition": "Module load"}, {"algorithmOrTest": "HMAC-SHA2-384 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute MAC", "condition": "Module load"}, {"algorithmOrTest": "HMAC-SHA2-512 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Compute MAC", "condition": "Module load"}, {"algorithmOrTest": "SHA2-256 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Hash", "condition": "Module load"}, {"algorithmOrTest": "SHA2-384 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Hash", "condition": "Module load"}, {"algorithmOrTest": "SHA2-512 (A7624)", "testProps": "", "testMethod": "KAT", "type": "CAST", "indicator": "Module started", "details": "Hash", "condition": "Module load"}, {"algorithmOrTest": "Algorithm or Test", "testProps": "Test Method Test Type Period", "testMethod": "Test Method Test Type Period", "type": "Periodic Method", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "SHA2-256 (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "SHA2-512 (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "IKEv2 KDF (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "HMAC-SHA2-256 (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-ECB (A7623) Encrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-ECB (A7623) Decrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-GCM (A7623) Encrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-GCM (A7623) Decrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "Counter DRBG (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "RSA SigGen (FIPS186-5) (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "RSA SigVer (FIPS186-5) (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "KAS-ECC-SSC Sp800-56Ar3 (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "KAS-FFC-SSC Sp800-56Ar3 (A7623)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "ECDH PCT", "testProps": "PCT", "testMethod": "PCT", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "DH PCT", "testProps": "PCT", "testMethod": "PCT", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-CBC (A7624) Encrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-CBC (A7624) Decrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-GCM (A7624) Encrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-GCM (A7624) Decrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-CCM (A7624) Encrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "AES-CCM (A7624) Decrypt", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "HMAC-SHA2-256 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "HMAC-SHA2-384 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "HMAC-SHA2-512 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "SHA2-256 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "SHA2-384 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "SHA2-512 (A7624)", "testProps": "KAT", "testMethod": "CAST", "type": "On demand Manual", "indicator": "", "details": "", "condition": ""}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Hard Error", "description": "Module is in an inoperable state. No services are available in this state.", "conditions": "Any pre-operational or conditional self-test failure.", "recoveryMethod": "Power cycle module.", "indicator": "The charon daemon is not running"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["ECDSA KeyGen (FIPS186-5)A7623", "ECDSA SigVer (FIPS186-5)A7623", "SHA2-256A7624", "SHA-1A7624", "KAS-FFC-SSC Sp800-56Ar3A7623", "HMAC-SHA2-512A7624", "AES-CCMA7624", "RSA SigGen (FIPS186-5)A7623", "Counter DRBGA7623", "Safe Primes Key VerificationA7623", "AES-GCMA7624", "ECDSA SigGen (FIPS186-5)A7623", "HMAC-SHA2-384A7624", "AES-CTRA7623", "KDF IKEv2A7623", "AES-CBCA7624", "HMAC-SHA2-256A7624", "KAS-ECC-SSC Sp800-56Ar3A7623", "ECDSA KeyVer (FIPS186-5)A7623", "Safe Primes Key GenerationA7623", "AES-ECBA7623", "#A7623", "SHA2-384A7624", "#A7624", "RSA SigVer (FIPS186-5)A7623", "SHA2-512A7624"]}, "extracted_versions": {"_type": "Set", "elements": ["2.3"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "75100acbffd4d4b2bb3a902f6726d6c2ad4399ed747d44e2045a3ba9a89594f7", "txt_hash": "1c29930b31cc049e363a7416a5cdf359c99d3c0e2ba9029b544f6e7fb40bc3e3", "json_hash": "4d7d8211c80587e38956159684e31c28f098f3cb297bb3724b607f1ea8581009"}}}