This page was not yet optimized for use on mobile devices.
ASI-HSM AHX5 kNET Cryptographic Module
Certificate details
| Certificate ID | #5282 |
|---|---|
| Status | active |
| Validation dates | 20.05.2026 |
| Sunset date | 19-05-2031 |
| Standard | FIPS 140-3 |
| Security level | 3 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section 11 of the Security Policy. When operated in approved mode. |
| Exceptions |
|
| Description | The ASI-HSM AHX5 kNET Cryptographic Module is a Hardware Security Module that provides cryptographic services with native implementation of the Key Management Interoperability Protocol to applications. The hardware is optimized for cryptographic operations along with proprietary firmware and software developed exclusively for the module. Its operators communicate with it via a standard Ethernet interface using IP protocols. The module is usually sold embedded within a stand-alone network appliance, which is typically used in large-scale cloud infrastructures, where ease of remote configuration and operation is required. |
| Vendor | Kryptus http://www.kryptus.com |
| Lab | EWA - Canada |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-, AES, CAST, DES, TDES, HMAC, CBC-MACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, EdDSA, DSAPost-quantum Algorithms
ML-DSA, ML-KEMHash functions
SHA-1, SHA-256, SHA-384, SHA3-224, SHA3-256, SHA3-384, SHA3-512, MD5Schemes
MAC, KEM, Key AgreementProtocols
SSL, TLS, TLS 1.2, TLS v1.2Randomness
TRNG, DRBG, RNG, RBGElliptic Curves
P-224, P-256, P-384, P-521, P-192, P-160, P-320, P-512, NIST P-521, Ed25519Block cipher modes
ECB, CBC, CTR, GCMTrusted Execution Environments
PSP, SSC, Secure Execution, SEVendor
STMicroelectronicsSecurity level
Level 3, level 3Side-channel analysis
malfunction, Fault InductionStandards
FIPS 140-3, FIPS 140-2, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 204, FIPS 203, FIPS 180-4, FIPS 202, SP 800-38A, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-90B, SP 800-90A, SP 800-56A, SP 800-135, SP 800-67, PKCS#1, RFC 5288, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5282,
"dgst": "f58210f7b0278ba1",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"ML-DSA KeyGenA6066",
"HMAC-SHA2-224A6066",
"AES-GCMA6066",
"ECDSA SigGen (FIPS186-5)A6066",
"SHA2-256A6066",
"RSA SigGen (FIPS186-5)A6066",
"ML-KEM EncapDecapA6066",
"ECDSA KeyGen (FIPS186-5)A6066",
"HMAC-SHA2-256A6066",
"SHA2-512A6066",
"EDDSA SigVerA6066",
"SHA2-512/224A6066",
"HMAC-SHA2-512/256A6066",
"ML-KEM KeyGenA6066",
"SHA3-512A6066",
"SHA2-224A6066",
"SHA2-512/256A6066",
"HMAC-SHA3-384A6066",
"HMAC-SHA2-512A6066",
"AES-CMACA6066",
"RSA KeyGen (FIPS186-5)A6066",
"TDES-CBCA6066",
"SHA3-384A6066",
"HMAC-SHA2-512/224A6066",
"ECDSA SigVer (FIPS186-5)A6066",
"SHAKE-256A6066",
"SHA3-224A6066",
"ML-DSA SigGenA6066",
"ML-DSA SigVerA6066",
"EDDSA KeyGenA6066",
"AES-CBCA6066",
"#A6066",
"HMAC-SHA3-256A6066",
"AES-CTRA6066",
"SHA2-384A6066",
"KDF TLSA6066",
"AES-ECBA6066",
"KAS-ECC-SSC Sp800-56Ar3A6066",
"SHA3-256A6066",
"HMAC-SHA3-224A6066",
"HMAC-SHA3-512A6066",
"EDDSA SigGenA6066",
"HMAC-SHA-1A6066",
"Conditioning Component AES-CBC-MAC SP800-90BA6066",
"HMAC-SHA2-384A6066",
"TDES-ECBA6066",
"RSA SigVer (FIPS186-5)A6066",
"AES-KWA6066",
"Hash DRBGA6066"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A6066",
"properties": "Direction - Generation, Verification Key Length - 128, 192, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt, Encrypt IV Generation - External, Internal IV Generation Mode - 8.2.2 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38F"
},
{
"algorithm": "Conditioning Component AES- CBC-MAC SP800- 90B",
"cavpCertName": "A6066",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-90B"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Curve - P-224, P-256, P-384, P-521 Secret Generation Mode - extra bits",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE-256 Component - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Curve - P-224, P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA2-512/224, SHA2-512/256, SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE-256",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA KeyGen",
"cavpCertName": "A6066",
"properties": "Curve - ED-25519, ED-448",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA SigGen",
"cavpCertName": "A6066",
"properties": "Curve - ED-25519, ED-448 PreHash - Yes Pure - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "EDDSA SigVer",
"cavpCertName": "A6066",
"properties": "Curve - ED-25519, ED-448 PreHash - Yes Pure - Yes",
"reference": "FIPS 186-5"
},
{
"algorithm": "Hash DRBG",
"cavpCertName": "A6066",
"properties": "Prediction Resistance - No, Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-224",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-384",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/224",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512/256",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-224",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-256",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-384",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA3-512",
"cavpCertName": "A6066",
"properties": "Key Length - Key Length: 8-65536 Increment 8",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A6066",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF TLS (CVL)",
"cavpCertName": "A6066",
"properties": "TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "ML-DSA KeyGen",
"cavpCertName": "A6066",
"properties": "Parameter Sets - ML-DSA-44, ML-DSA-65, ML-DSA-87",
"reference": "FIPS 204"
},
{
"algorithm": "ML-DSA SigGen",
"cavpCertName": "A6066",
"properties": "Deterministic - No",
"reference": "FIPS 204"
},
{
"algorithm": "ML-DSA SigVer",
"cavpCertName": "A6066",
"properties": "-",
"reference": "FIPS 204"
},
{
"algorithm": "ML-KEM EncapDecap",
"cavpCertName": "A6066",
"properties": "Parameter Sets - ML-KEM-1024, ML-KEM- 512, ML-KEM-768 Functions - Decapsulation, Encapsulation",
"reference": "FIPS 203"
},
{
"algorithm": "ML-KEM KeyGen",
"cavpCertName": "A6066",
"properties": "Parameter Sets - ML-KEM-1024, ML-KEM- 512, ML-KEM-768",
"reference": "FIPS 203"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6066",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA2-224",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/224",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512/256",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA3-224",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-256",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-384",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHA3-512",
"cavpCertName": "A6066",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 202"
},
{
"algorithm": "SHAKE-256",
"cavpCertName": "A6066",
"properties": "Output Length - Output Length: 512",
"reference": "FIPS 202"
},
{
"algorithm": "TDES-CBC",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt",
"reference": "SP 800-67 Rev. 2"
},
{
"algorithm": "TDES-ECB",
"cavpCertName": "A6066",
"properties": "Direction - Decrypt",
"reference": "SP 800-67 Rev. 2"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Initialize the HSM; create first PCO with provisory password (PIN)",
"indicator": "IND-1",
"inputs": "Temporary PIN and arguments",
"name": "Initialize HSM",
"outputs": "Initialization status",
"rolesSspAccess": "Physical HSM Crypto Officer - Job Descriptor Key Encryption Key: G - PCO Initializatio n Password: W,E,Z - PCOs\u0027 Passwords : W,E,Z - PHSM Server CA Key: G - Master Key: E - PHSM Server",
"secFunImpl": "Digital Signature Generatio n Input- Output"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G - PHSM Server CA Certificate: G - PHSM Client CA Key: G - PHSM Client CA Certificate: G Virtual HSM Crypto Officer - Job Descriptor Key Encryption Key: G - VCO Initializatio n Password: W,E,Z - VCOs\u0027 Passwords : W,E,Z - VCOs\u0027 Hashed Passwords : G,Z - VHSM Server CA Certificate: G - VHSM Client CA Certificate s: G",
"secFunImpl": "Functions"
},
{
"description": "Configure network settings (IP, netmask, gateway (optional), DNS (optional))",
"indicator": "IND-1",
"inputs": "Network arguments",
"name": "Configure Network",
"outputs": "Configured network settings",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Get network setting",
"indicator": "IND-1",
"inputs": "-",
"name": "Get Network Configuratio n",
"outputs": "Network Configuratio n",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Reset HSM to factory state",
"indicator": "IND-1",
"inputs": "-",
"name": "Reset HSM",
"outputs": "HSM in Factory State",
"rolesSspAccess": "Physical HSM Crypto Officer - Job Descriptor Key Encryption Key: Z - PHSM Server CA Key: Z - PHSM Server CA Certificate: Z - PCO Initializatio n Password: Z - PCOs\u0027 Temporary Password: Z - PCOs\u0027 Hashed Passwords : Z - PCOs\u0027 Certificate Fingerprint s: Z - PCO\u0027s OTP Key: Z - PCO\u0027s OTP: Z - VHSM Server CA Key: Z - VHSM Server CA Certificate: Z",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- VHSM Server Keys: Z - VHSM Server Certificate s: Z - VHSM Client CA Keys: Z - VHSM Client CA Certificate s: Z - VCO Initializatio n Password: Z - VCOs\u0027 Passwords : Z - VCOs\u0027 Hashed Passwords : Z - VCOs\u0027 Certificate Fingerprint s: Z - VCO\u0027s OTP Key: Z - VCO\u0027s OTP: Z - Users\u0027 Temporary Password (Pin): Z - Users\u0027 Passwords : Z - Users\u0027 Hashed Passwords : Z - Users\u0027 Certificate Fingerprint",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access s: Z - User\u0027s OTP Key: Z - User\u0027s OTP: Z - Users\u0027 RSA Private Key: Z - Users\u0027 RSA Public Key: Z - Users\u0027 ECDSA Private Key: Z - Users\u0027 ECDSA Public Key: Z - Users\u0027 EDDSA Private Key: Z - Users\u0027 EDDSA Public Key: Z - Users\u0027 ML-DSA Private Key: Z - Users\u0027 ML-DSA Public Key: Z - Users\u0027 ML-KEM Private Key: Z - Users\u0027 ML-KEM Public Key: Z - Users\u0027 AES Key: Z",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Users\u0027 HMAC Key: Z - Users\u0027 Certificate: Z - ECDH Private Componen t (ephemera l): Z - ECDH Public Componen t (ephemera l): Z - TLS Peer Public Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Session Key: Z - TLS Authentica tion Key: Z - DRBG C and V values: Z - Disk Encryption Key: Z - Cluster TLS CA Private Key: Z - Cluster TLS CA Certificate: Z - Cluster TLS",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Server Private Key: Z - Cluster TLS Server Certificate: Z - Cluster TLS Client Private Key: Z - Cluster TLS Client Certificate: Z - Cluster Secret: Z - Authentica tion Certificate: Z - Authentica tion Certificate Challenge: Z - Authentica tion Certificate Response: Z - Session Token: Z - Fastlane ID: Z - Fastlane Secret: Z - Quorum Secret: Z - Quorum Secret Share: Z - DRBG Entropy Input: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Seed: Z - PHSM Server Key: Z - PHSM Server Certificate: Z - PHSM Client CA Key: Z - PHSM Client CA Certificate: Z",
"secFunImpl": ""
},
{
"description": "Set the current date and time",
"indicator": "IND-1",
"inputs": "Date, time and arguments",
"name": "Set Date Time",
"outputs": "Set Date Time",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Get the current date and time",
"indicator": "IND-1",
"inputs": "Get Date Time arguments",
"name": "Get Date Time",
"outputs": "Current Date Time",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Get CPU, RAM and disk usage",
"indicator": "IND-1",
"inputs": "Get HSM Usage arguments",
"name": "Get HSM Usage",
"outputs": "Current HSM Usage",
"rolesSspAccess": "Physical HSM Crypto",
"secFunImpl": "None"
},
{
"description": "Create a PCO, VCO or User",
"indicator": "IND-1",
"inputs": "New user information and arguments",
"name": "Create User",
"outputs": "New User Temporary Password",
"rolesSspAccess": "Officer Physical HSM Crypto Officer - PCOs\u0027 Temporary Password: G - Users\u0027 Temporary Password (Pin): G Virtual HSM Crypto Officer - VCOs\u0027 Temporary Password: G",
"secFunImpl": "Determinis tic Random Number Generator Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Users\u0027 Temporary Password (Pin): G",
"secFunImpl": ""
},
{
"description": "Destroy a PCO, VCO or User",
"indicator": "IND-1",
"inputs": "User Unique Identifier and arguments",
"name": "Delete User",
"outputs": "Deleted User",
"rolesSspAccess": "Physical HSM Crypto Officer - PCOs\u0027 Hashed Passwords : Z - PCOs\u0027 Certificate Fingerprint s: Z - PCO\u0027s OTP: Z - Users\u0027 Hashed Passwords : Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s OTP Key: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z Virtual HSM Crypto Officer - VCOs\u0027 Hashed Passwords : Z - VCOs\u0027 Certificate Fingerprint s: Z",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- VCO\u0027s OTP: Z - Users\u0027 Hashed Passwords : Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s OTP Key: Z - Users\u0027 RSA Private Key: Z - Users\u0027 RSA Public Key: Z - Users\u0027 ECDSA Private Key: Z - Users\u0027 ECDSA Public Key: Z - Users\u0027 EDDSA Private Key: Z - Users\u0027 EDDSA Public Key: Z - Users\u0027 ML-DSA Private Key: Z - Users\u0027 ML-DSA Public Key: Z - Users\u0027 ML-KEM Private Key: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Users\u0027 ML-KEM Public Key: Z - Users\u0027 AES Key: Z - Users\u0027 HMAC Key: Z - Users\u0027 Certificate: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z",
"secFunImpl": ""
},
{
"description": "List PCOs, VCOs or Users",
"indicator": "IND-1",
"inputs": "List User Arguments",
"name": "List Users",
"outputs": "List of PCOs, VCOs or Users",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Change a PCO, VCO or User\u0027s password. It\u0027s used to activate the user in its first time performing this operation",
"indicator": "IND-1",
"inputs": "Temporary Password and arguments",
"name": "Change Password",
"outputs": "Status return",
"rolesSspAccess": "Physical HSM Crypto Officer - PCOs\u0027 Temporary Password: W,E,Z - PCOs\u0027 Passwords : W,E,Z - PCOs\u0027 Hashed Passwords : W,E,Z - Users\u0027 Temporary Password (Pin):",
"secFunImpl": "Digital Signature Verificatio n Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : G,E,Z Virtual HSM Crypto Officer - VCOs\u0027 Temporary Password: W,E,Z - VCOs\u0027 Passwords : W,E,Z - VCOs\u0027 Hashed Passwords : G,E,Z - Users\u0027 Temporary Password (Pin): W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : E,Z User - Users\u0027 Temporary Password (Pin): W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : G,E,Z",
"secFunImpl": ""
},
{
"description": "Reset a PCO, VCO or User\u0027s password. When a User\u0027s password is reset, it deactivates the user, until their password is set again",
"indicator": "IND-1",
"inputs": "Reset arguments",
"name": "Reset Password",
"outputs": "Temporary Password",
"rolesSspAccess": "Physical HSM Crypto Officer - PCOs\u0027 Temporary Password: G,R - Users\u0027 Temporary Password (Pin): G,R - PCOs\u0027 Hashed Passwords : G,Z - PCOs\u0027 Certificate Fingerprint s: Z - PCO\u0027s OTP Key: Z - Users\u0027 Hashed Passwords : G,Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s OTP Key: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z Virtual HSM Crypto Officer - VCOs\u0027 Temporary Password:",
"secFunImpl": "Determinis tic Random Number Generator Secure Hash (Message Digest) Input- Output"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access G,R - Users\u0027 Temporary Password (Pin): G,R - VCOs\u0027 Hashed Passwords : G,Z - VCOs\u0027 Certificate Fingerprint s: Z - VCO\u0027s OTP Key: Z - Users\u0027 Hashed Passwords : Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s OTP Key: Z - Users\u0027 RSA Private Key: Z - Users\u0027 RSA Public Key: Z - Users\u0027 ECDSA Private Key: Z - Users\u0027 ECDSA Public Key: Z - Users\u0027 EDDSA Private Key: Z - Users\u0027",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: Z - Users\u0027 ML-DSA Private Key: Z - Users\u0027 ML-DSA Public Key: Z - Users\u0027 ML-KEM Private Key: Z - Users\u0027 ML-KEM Public Key: Z - Users\u0027 AES Key: Z - Users\u0027 HMAC Key: Z - Users\u0027 Certificate: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z User - Users\u0027 Temporary Password (Pin): G,R - Users\u0027 Hashed Passwords : G,Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "OTP Key: Z",
"secFunImpl": ""
},
{
"description": "Sign a CSR and register the certificate for PCO, VCO or User authenticati on",
"indicator": "IND-1",
"inputs": "Certificate and arguments",
"name": "Register Certificate",
"outputs": "Registered Certificate",
"rolesSspAccess": "Physical HSM Crypto Officer - PCOs\u0027 Certificate Fingerprint s: W,Z - Users\u0027 Certificate Fingerprint s: W,Z - PHSM Client CA Key: E - PHSM Client CA Certificate: E Virtual HSM Crypto Officer - VCOs\u0027 Certificate Fingerprint s: W,Z - Users\u0027 Certificate Fingerprint s: W,Z User - Users\u0027 Certificate Fingerprint s: W,Z",
"secFunImpl": "Digital Signature Generatio n"
},
{
"description": "Activates quorum authenticati on for the PHSM, VHSM or a Object",
"indicator": "IND-1",
"inputs": "Activate Quorum Authenticati on arguments",
"name": "Activate Quorum Authenticati on",
"outputs": "Activated Quorum Authenticati on",
"rolesSspAccess": "Physical HSM Crypto Officer - Quorum Secret: G - Quorum Secret Share: G Virtual HSM",
"secFunImpl": "Determinis tic Random Number Generator"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Crypto Officer - Quorum Secret: G - Quorum Secret Share: G User - Quorum Secret: G - Quorum Secret Share: G",
"secFunImpl": ""
},
{
"description": "Deactivates quorum authenticati on for the PHSM",
"indicator": "IND-1",
"inputs": "Deactivate Quorum Authenticati on arguments",
"name": "Deactivate Quorum Authenticati on",
"outputs": "Deactivated Quorum Authenticati on",
"rolesSspAccess": "Physical HSM Crypto Officer - Quorum Secret: Z - Quorum Secret Share: Z Virtual HSM Crypto Officer - Quorum Secret: Z - Quorum Secret Share: Z User - Quorum Secret: Z - Quorum Secret Share: Z",
"secFunImpl": "Data Decryption"
},
{
"description": "Check the quorum authenticati on state of the PHSM (i.e. activated or not, the minimum quorum)",
"indicator": "IND-1",
"inputs": "Get Quorum Authenticati on State arguments",
"name": "Get Quorum Authenticati on State",
"outputs": "Quorum Authenticati on State",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Check the quorum authenticati on status of the PHSM (i.e. number of operations or time left)",
"indicator": "IND-1",
"inputs": "Get Quorum Authenticati on Status arguments",
"name": "Get Quorum Authenticati on Status",
"outputs": "Quorum Authenticati on Status",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Inform the operator\u0027s verdict for quorum authenticati on operations (allow or deny)",
"indicator": "IND-1",
"inputs": "Vote Quorum Authenticati on arguments",
"name": "Vote Quorum Authenticati on",
"outputs": "Voted Quorum Authenticati on",
"rolesSspAccess": "Physical HSM Crypto Officer - PCOs\u0027 Passwords : W,E,Z - Users\u0027 Passwords : W,E,Z - Quorum Secret: W - Quorum Secret Share: G,E Virtual HSM Crypto Officer - VCOs\u0027 Passwords : W,E,Z - Users\u0027 Passwords : W,E,Z - Quorum Secret: W - Quorum Secret Share: G,E User - Users\u0027 Passwords : W,E,Z - Quorum Secret: W - Quorum Secret",
"secFunImpl": "Data Encryption Data Decryption Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Share: G,E",
"secFunImpl": ""
},
{
"description": "Request that operators vote to start quorum authenticati on votes to allow critical operations",
"indicator": "IND-1",
"inputs": "Start Quorum Authenticati on arguments",
"name": "Start Quorum Authenticati on",
"outputs": "Started Quorum Authenticati on",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Stop quorum authenticati on, blocking critical operations when quorum authenticati on is activated (a new start is required)",
"indicator": "IND-1",
"inputs": "Stop Quorum Authenticati on",
"name": "Stop Quorum Authenticati on",
"outputs": "Stopped Quorum Authenticati on",
"rolesSspAccess": "Physical HSM Crypto Officer - Quorum Secret: Z Virtual HSM Crypto Officer - Quorum Secret: Z User - Quorum",
"secFunImpl": "None"
},
{
"description": "Create a Virtual HSM along with its first VCO with provisory password (PIN)",
"indicator": "IND-1",
"inputs": "Virtual HSM information and arguments",
"name": "Create Virtual HSM",
"outputs": "Created Virtual HSM information",
"rolesSspAccess": "Secret: Z Physical HSM Crypto Officer - VCO Initializatio n Password: G,R,Z",
"secFunImpl": "Determinis tic Random Number Generator Input- Output"
},
{
"description": "List all Virtual HSMs",
"indicator": "IND-1",
"inputs": "List Virtual HSMs arguments",
"name": "List Virtual HSMs",
"outputs": "List of Virtual HSMs",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Activate a Virtual HSM",
"indicator": "IND-1",
"inputs": "Activate Virtual HSM arguments",
"name": "Activate Virtual HSM",
"outputs": "Activated Virtual HSM",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Deactivate a Virtual HSM",
"indicator": "IND-1",
"inputs": "Deactivate Virtual HSM arguments",
"name": "Deactivate Virtual HSM",
"outputs": "Deactivated Virtual HSM",
"rolesSspAccess": "Physical HSM Crypto Officer - VCO",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Initializatio n Password: Z - VCOs\u0027 Temporary Password: Z - VCOs\u0027 Passwords : Z - VCO\u0027s OTP: Z - Users\u0027 Temporary Password (Pin): Z - Users\u0027 Passwords : Z - User\u0027s OTP: Z - ECDH Private Componen t (ephemera l): Z - ECDH Public Componen t (ephemera l): Z - TLS Peer Public Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Session Key: Z - TLS Authentica tion Key: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Authentica tion Certificate Challenge: Z - Authentica tion Certificate Response: Z - Session Token: Z - Fastlane ID: Z - Fastlane Secret: Z - Quorum Secret: Z",
"secFunImpl": ""
},
{
"description": "Delete a Virtual HSM and all of its objects",
"indicator": "IND-1",
"inputs": "Delete Virtual HSM arguments",
"name": "Delete Virtual HSM",
"outputs": "Deleted Virtual HSM",
"rolesSspAccess": "Physical HSM Crypto Officer - VHSM Server CA Key: Z - VHSM Server CA Certificate: Z - VHSM Server Keys: Z - VHSM Server Certificate s: Z - VHSM Client CA Keys: Z - VHSM Client CA Certificate s: Z - VCOs\u0027 Hashed Passwords : Z",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access - VCOs\u0027 Certificate Fingerprint s: Z - VCO\u0027s OTP Key: Z - Users\u0027 Hashed Passwords : Z - Users\u0027 Certificate Fingerprint s: Z - User\u0027s OTP Key: Z - Users\u0027 RSA Private Key: Z - Users\u0027 RSA Public Key: Z - Users\u0027 ECDSA Private Key: Z - Users\u0027 ECDSA Public Key: Z - Users\u0027 EDDSA Private Key: Z - Users\u0027 EDDSA Public Key: Z - Users\u0027 ML-DSA Private Key: Z - Users\u0027 ML-DSA Public",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: Z - Users\u0027 ML-KEM Private Key: Z - Users\u0027 ML-KEM Public Key: Z - Users\u0027 AES Key: Z - Users\u0027 HMAC Key: Z - Users\u0027 Certificate: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z",
"secFunImpl": ""
},
{
"description": "Edit a VHSM configuratio n",
"indicator": "IND-1",
"inputs": "Edit Virtual HSM arguments",
"name": "Edit Virtual HSM",
"outputs": "Edited Virtual HSM",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Export an entire Virtual HSM; its users and objects",
"indicator": "IND-1",
"inputs": "Export VHSM arguments",
"name": "Export VHSM",
"outputs": "Exported VHSM encrypted package",
"rolesSspAccess": "Physical HSM Crypto Officer - VHSM Server CA Key: R - VHSM Server CA Certificate: R - VHSM Server Keys: R - VHSM Server Certificate s: R - VHSM",
"secFunImpl": "Data Encryption Determinis tic Random Number Generator Digital Signature Generatio n Input- Output"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Client CA Keys: R - VHSM Client CA Certificate s: R - VCOs\u0027 Hashed Passwords : R - VCOs\u0027 Certificate Fingerprint s: R - VCO\u0027s OTP Key: R - Users\u0027 Hashed Passwords : R - Users\u0027 Certificate Fingerprint s: R - User\u0027s OTP Key: R - Users\u0027 RSA Private Key: R - Users\u0027 RSA Public Key: R - Users\u0027 ECDSA Private Key: R - Users\u0027 ECDSA Public Key: R - Users\u0027 EDDSA Private Key: R - Users\u0027",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "EDDSA Public Key: R - Users\u0027 ML-DSA Private Key: R - Users\u0027 ML-DSA Public Key: R - Users\u0027 ML-KEM Private Key: R - Users\u0027 ML-KEM Public Key: R - Users\u0027 AES Key: R - Users\u0027 HMAC Key: R - Users\u0027 Certificate: R - Authentica tion Certificate: R - Quorum Secret Share: R - Disk Encryption Key: E - Kryptus kNET CA Certificate: E - PHSM Module Key: E - PHSM Module",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Certificate: E",
"secFunImpl": ""
},
{
"description": "Import an entire Virtual HSM",
"indicator": "IND-1",
"inputs": "Import VHSM encrypted package and arguments",
"name": "Import VHSM",
"outputs": "Status return",
"rolesSspAccess": "Physical HSM Crypto Officer - VHSM Server CA Key: W - VHSM Server CA Certificate: W - VHSM Server Keys: W - VHSM Server Certificate s: W - VHSM Client CA Keys: W - VHSM Client CA Certificate s: W - VCOs\u0027 Hashed Passwords : W - VCOs\u0027 Certificate Fingerprint s: W - VCO\u0027s OTP Key: W - Users\u0027 Hashed Passwords : W - Users\u0027 Certificate Fingerprint s: W - User\u0027s OTP Key: W",
"secFunImpl": "Data Decryption Digital Signature Generatio n Input- Output"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access - Users\u0027 RSA Private Key: W - Users\u0027 RSA Public Key: W - Users\u0027 ECDSA Private Key: W - Users\u0027 ECDSA Public Key: W - Users\u0027 EDDSA Private Key: W - Users\u0027 EDDSA Public Key: W - Users\u0027 ML-DSA Private Key: W - Users\u0027 ML-DSA Public Key: W - Users\u0027 ML-KEM Private Key: W - Users\u0027 ML-KEM Public Key: W - Users\u0027 AES Key: W - Users\u0027 HMAC Key: W - Users\u0027 Certificate: W",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Authentica tion Certificate: W - Quorum Secret Share: W - PHSM Module Key: E - PHSM Module Certificate: E - Disk Encryption Key: E - Kryptus kNET CA Certificate: E",
"secFunImpl": ""
},
{
"description": "Export an entire Physical HSM, its users and VHMs",
"indicator": "IND-1",
"inputs": "Export PHSM arguments",
"name": "Export PHSM",
"outputs": "Exported PHSM encrypted package",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Module Key: R,E - PHSM Module Certificate: E - Quorum Secret Share: R - Authentica tion Certificate: R - Cluster TLS CA Certificate: R - Cluster TLS Server Certificate:",
"secFunImpl": "Data Encryption Determinis tic Random Number Generator Digital Signature Generatio n Input- Output"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access R - Cluster TLS Client Certificate: R - Cluster Secret: R - VHSM Client CA Keys: R - VHSM Client CA Certificate s: R - VHSM Server CA Certificate: R - PHSM Server CA Certificate: R - PHSM Server CA Key: R - PCOs\u0027 Hashed Passwords : R - PCOs\u0027 Certificate Fingerprint s: R - PCO\u0027s OTP Key: R - VHSM Server CA Key: R - VHSM Server Keys: R - Users\u0027 Hashed Passwords : R - Users\u0027 Certificate Fingerprint",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access s: R - User\u0027s OTP Key: R - Users\u0027 RSA Private Key: R - Users\u0027 RSA Public Key: R - Users\u0027 ECDSA Private Key: R - Users\u0027 ECDSA Public Key: R - Users\u0027 EDDSA Private Key: R - Users\u0027 EDDSA Public Key: R - Users\u0027 ML-DSA Private Key: R - Users\u0027 ML-DSA Public Key: R - Users\u0027 ML-KEM Private Key: R - Users\u0027 ML-KEM Public Key: R - Users\u0027 AES Key: R - Users\u0027 HMAC",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Key: R - Users\u0027 Certificate: R - Disk Encryption Key: R - Cluster TLS CA Private Key: R - Cluster TLS Server Private Key: R - Cluster TLS Client Private Key: R",
"secFunImpl": ""
},
{
"description": "Import an entire Physical HSM",
"indicator": "IND-1",
"inputs": "Import PHSM encrypted package and arguments",
"name": "Import PHSM",
"outputs": "Status return",
"rolesSspAccess": "Physical HSM Crypto Officer - Kryptus kNET CA Certificate: E - PHSM Module Key: E - PHSM Module Certificate: W,E - PHSM Server CA Key: W - PHSM Server CA Certificate: W - PCOs\u0027 Hashed Passwords : W - PCOs\u0027 Certificate Fingerprint",
"secFunImpl": "Data Decryption Digital Signature Verificatio n Input- Output"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access s: W - PCO\u0027s OTP Key: W - VHSM Server CA Key: W - VHSM Server CA Certificate: W - VHSM Server Keys: W - VHSM Server Certificate s: W - VCOs\u0027 Hashed Passwords : W - VCOs\u0027 Certificate Fingerprint s: W - VCO\u0027s OTP Key: W - Cluster TLS CA Private Key: W - Cluster TLS CA Certificate: W - Cluster TLS Server Private Key: W - Cluster TLS Server Certificate: W - Cluster TLS Client",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Private Key: W - Cluster TLS Client Certificate: W - Cluster Secret: W - Disk Encryption Key: W - Authentica tion Certificate: W - Quorum Secret Share: W - Users\u0027 Hashed Passwords : W - Users\u0027 Certificate Fingerprint s: W - User\u0027s OTP Key: W - Users\u0027 RSA Private Key: W - Users\u0027 RSA Public Key: W - Users\u0027 ECDSA Private Key: W - Users\u0027 ECDSA Public Key: W - Users\u0027 EDDSA Private",
"secFunImpl": ""
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Key: W - Users\u0027 EDDSA Public Key: W - Users\u0027 ML-DSA Private Key: W - Users\u0027 ML-DSA Public Key: W - Users\u0027 ML-KEM Private Key: W - Users\u0027 ML-KEM Public Key: W - Users\u0027 AES Key: W - Users\u0027 HMAC Key: W - Users\u0027 Certificate: W - Master Key: E",
"secFunImpl": ""
},
{
"description": "Get the role of the requester",
"indicator": "IND-1",
"inputs": "Get Requester Type arguments",
"name": "Get Requester Type",
"outputs": "Requester Type",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Update the module firmware. Any firmware loaded into this module that is not",
"indicator": "IND-1",
"inputs": "Update Firmware encrypted package and arguments",
"name": "Update Firmware",
"outputs": "Status return; Updated Firmware",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Module Key: E - PHSM",
"secFunImpl": "Digital Signature Generatio n Secure Hash (Message Digest)"
},
{
"description": "shown on the module certificate, is out of the scope of this validation and requires a separate FIPS 140- 3 validation",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Module Certificate: E",
"secFunImpl": ""
},
{
"description": "Get the current log level",
"indicator": "IND-1",
"inputs": "Get Log Level arguments",
"name": "Get Log Level",
"outputs": "Log Level",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Set the current log level",
"indicator": "IND-1",
"inputs": "Set Log Level arguments",
"name": "Set Log Level",
"outputs": "Log Level set",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieve the PHSM log",
"indicator": "IND-1",
"inputs": "Get System Log arguments",
"name": "Get System Log",
"outputs": "System Log file",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Module Key: E",
"secFunImpl": "Digital Signature Generatio n Secure Hash (Message Digest)"
},
{
"description": "Get the status of the HSM",
"indicator": "IND-1",
"inputs": "Show Status arguments",
"name": "Show Status",
"outputs": "Status",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Shutdown the HSM",
"indicator": "IND-1",
"inputs": "Shutdown arguments",
"name": "Shutdown",
"outputs": "-",
"rolesSspAccess": "Physical HSM Crypto Officer - PCO Initializatio n Password: Z - PCOs\u0027 Temporary Password: Z - PCOs\u0027 Passwords : Z",
"secFunImpl": "None"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PCO\u0027s OTP: Z - VCO Initializatio n Password: Z - VCOs\u0027 Temporary Password: Z - VCOs\u0027 Passwords : Z - VCO\u0027s OTP: Z - Users\u0027 Temporary Password (Pin): Z - Users\u0027 Passwords : Z - User\u0027s OTP: Z - ECDH Private Componen t (ephemera l): Z - ECDH Public Componen t (ephemera l): Z - TLS Peer Public Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Session Key: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Authentica tion Key: Z - Authentica tion Certificate Challenge: Z - Authentica tion Certificate Response: Z - Session Token: Z - Fastlane ID: Z - Fastlane Secret: Z - Quorum Secret: Z",
"secFunImpl": ""
},
{
"description": "Restart the HSM and Perform self-tests on demand",
"indicator": "IND-1",
"inputs": "Restart arguments",
"name": "Restart",
"outputs": "-",
"rolesSspAccess": "Physical HSM Crypto Officer - Job Descriptor Key Encryption Key: G - PCO Initializatio n Password: G - DRBG C and V values: G - Super Root Key Hash: E - PCOs\u0027 Temporary Password: Z - PCOs\u0027 Passwords",
"secFunImpl": "Data Decryption Determinis tic Random Number Generator Digital Signature Verificatio n Key Generatio n"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access : Z - PCO\u0027s OTP: Z - VCO Initializatio n Password: Z - VCOs\u0027 Temporary Password: Z - VCOs\u0027 Passwords : Z - VCO\u0027s OTP: Z - Users\u0027 Temporary Password (Pin): Z - Users\u0027 Passwords : Z - User\u0027s OTP: Z - ECDH Private Componen t (ephemera l): Z - ECDH Public Componen t (ephemera l): Z - TLS Peer Public Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Session",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Key: Z - TLS Authentica tion Key: Z - Authentica tion Certificate Challenge: Z - Authentica tion Certificate Response: Z - Session Token: Z - Fastlane ID: E - Fastlane Secret: E - Quorum Secret: E - DRBG Entropy Input: G - DRBG",
"secFunImpl": ""
},
{
"description": "Boot process before main services are available",
"indicator": "IND-1",
"inputs": "-",
"name": "Boot",
"outputs": "-",
"rolesSspAccess": "Physical HSM Crypto Officer - Job Descriptor Key Encryption Key: G - PCO Initializatio n Password: G - DRBG C and V values: G - Super Root Key Hash: E",
"secFunImpl": "Data Decryption Determinis tic Random Number Generator Digital Signature Verificatio n Key Generatio n"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Entropy Input: G - DRBG Seed: G - Master Key: E",
"secFunImpl": ""
},
{
"description": "Get device version, status, serial number and other information",
"indicator": "IND-1",
"inputs": "Get Device Information arguments",
"name": "Get Device Information",
"outputs": "Device Information",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Get the TLS certificate of the PHSM server and the correspondi ng CA",
"indicator": "IND-1",
"inputs": "Get TLS Certificate arguments",
"name": "Get TLS Certificate",
"outputs": "TLS Certificate",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Server CA Key: R - PHSM Server CA Certificate: R - PHSM Server Certificate: R Virtual HSM Crypto Officer - VHSM Server CA Key: R - VHSM Server CA Certificate: R",
"secFunImpl": "Input- Output"
},
{
"description": "Renew the PHSM server TLS certificate",
"indicator": "IND-1",
"inputs": "Renew Server Certificate arguments",
"name": "Renew Server Certificate",
"outputs": "Renewed Server Certificate",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Server CA Certificate: G,R",
"secFunImpl": "Key Generatio n Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PHSM Server Certificate: G Virtual HSM Crypto Officer - VHSM Server Certificate s: G,R,Z",
"secFunImpl": ""
},
{
"description": "Activate OTP for the PCO, VCO or User",
"indicator": "IND-1",
"inputs": "Activate OTP arguments",
"name": "Activate OTP",
"outputs": "Activated OTP",
"rolesSspAccess": "Physical HSM Crypto Officer - PCO\u0027s OTP Key: G,R - PCO\u0027s OTP: G,W - User\u0027s OTP Key: G,R - User\u0027s OTP: G,W - DRBG C and V values: E - DRBG Entropy Input: E - DRBG Seed: E Virtual HSM Crypto Officer - VCO\u0027s OTP Key: G,R - VCO\u0027s OTP: G,W - User\u0027s OTP Key: G,R - User\u0027s OTP: G,W - DRBG C",
"secFunImpl": "Key Generatio n Message Authentica tion Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "and V values: E - DRBG Entropy Input: E - DRBG Seed: E User - User\u0027s OTP Key: G,R - User\u0027s OTP: G,W - DRBG C and V values: E - DRBG Entropy Input: E - DRBG Seed: E",
"secFunImpl": ""
},
{
"description": "Manually activate OTP for the PCO, VCO or User informing the OTP key",
"indicator": "IND-1",
"inputs": "Manual Activate OTP arguments",
"name": "Manual Activate OTP",
"outputs": "Manually Activated OTP",
"rolesSspAccess": "Physical HSM Crypto Officer - PCO\u0027s OTP Key: W - PCO\u0027s OTP: G,W - User\u0027s OTP Key: W - User\u0027s OTP: G,W Virtual HSM Crypto Officer - VCO\u0027s OTP Key: W - VCO\u0027s OTP: G,W - User\u0027s OTP Key: W - User\u0027s OTP: G,W",
"secFunImpl": "Message Authentica tion"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "User - User\u0027s OTP Key: W - User\u0027s",
"secFunImpl": ""
},
{
"description": "Deactivates OTP for the PCO, VCO or User",
"indicator": "IND-1",
"inputs": "Deactivate OTP arguments",
"name": "Deactivate OTP",
"outputs": "Deactivated OTP",
"rolesSspAccess": "OTP: G,W Physical HSM Crypto Officer - PCO\u0027s OTP Key: Z - User\u0027s OTP Key: Z Virtual HSM Crypto Officer - VCO\u0027s OTP Key: Z - User\u0027s OTP Key: Z User - User\u0027s OTP Key: Z",
"secFunImpl": "None"
},
{
"description": "Register a certificate to be used during PCO, VCO or User authenticati on",
"indicator": "IND-1",
"inputs": "Register Authenticati on Certificate arguments",
"name": "Register Authenticati on Certificate",
"outputs": "Registered Authenticati on Certificate",
"rolesSspAccess": "Physical HSM Crypto Officer - Authentica tion Certificate: W Virtual HSM Crypto Officer - Authentica tion Certificate: W User",
"secFunImpl": "Digital Signature Verificatio n Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Authentica tion Certificate: W",
"secFunImpl": ""
},
{
"description": "Delete a certificate used for authenticati on",
"indicator": "IND-1",
"inputs": "Remove Authenticati on Certificate arguments",
"name": "Remove Authenticati on Certificate",
"outputs": "Removed Authenticati on Certificate",
"rolesSspAccess": "Physical HSM Crypto Officer - Authentica tion Certificate: Z Virtual HSM Crypto Officer - Authentica tion Certificate: Z User - Authentica tion Certificate:",
"secFunImpl": "None"
},
{
"description": "List the registered certificates for the PCO, VCO or User",
"indicator": "IND-1",
"inputs": "List Authenticati on Certificates arguments",
"name": "List Authenticati on Certificates",
"outputs": "List of Authenticati on Certificates",
"rolesSspAccess": "Physical HSM Crypto Officer - Authentica tion Certificate: R Virtual HSM Crypto Officer - Authentica tion Certificate: R User -",
"secFunImpl": "None"
},
{
"description": "Retrieves a session token used for further authenticati ons",
"indicator": "IND-1",
"inputs": "Get Session Credential arguments",
"name": "Get Session Credential",
"outputs": "Session Credential",
"rolesSspAccess": "Physical HSM Crypto Officer - Session Token: R Virtual HSM Crypto Officer - Session Token: R User - Session Token: R",
"secFunImpl": "Input- Output"
},
{
"description": "Uploads a logo image for the kNET frontal board",
"indicator": "IND-1",
"inputs": "Upload Logo Image arguments",
"name": "Upload Logo Image",
"outputs": "Uploaded Logo Image",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves SNMP Data",
"indicator": "IND-1",
"inputs": "Get SNMP Data arguments",
"name": "Get SNMP Data",
"outputs": "SNMP Data",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Sets up the kNET SNMP Agent as well as some information it provides",
"indicator": "IND-1",
"inputs": "Set SNMP Data arguments",
"name": "Set SNMP Data",
"outputs": "Set SNMP Data",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Deletes the user session credential cached on server",
"indicator": "IND-1",
"inputs": "Delete Session Credential arguments",
"name": "Delete Session Credential",
"outputs": "Deleted Session Credential",
"rolesSspAccess": "Physical HSM Crypto Officer - Session Token: Z Virtual HSM Crypto Officer - Session",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Token: Z User - Session",
"secFunImpl": ""
},
{
"description": "Starts a token authenticati on",
"indicator": "IND-1",
"inputs": "Start Token Authenticati on arguments",
"name": "Start Token Authenticati on",
"outputs": "Started Token Authenticati on",
"rolesSspAccess": "Token: Z Physical HSM Crypto Officer - Authentica tion Certificate Challenge: R Virtual HSM Crypto Officer - Authentica tion Certificate Challenge: R User - Authentica tion Certificate Challenge:",
"secFunImpl": "Input- Output"
},
{
"description": "Changes authenticati on restrictions",
"indicator": "IND-1",
"inputs": "Set Password Policy arguments",
"name": "Set Password Policy",
"outputs": "Password Policy set",
"rolesSspAccess": "R Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves the current password policy for a specific user",
"indicator": "IND-1",
"inputs": "Get Password Policy arguments",
"name": "Get Password Policy",
"outputs": "Password Policy information",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Activates the NTP service",
"indicator": "IND-1",
"inputs": "Activate NTP Service arguments",
"name": "Activate NTP Service",
"outputs": "Activated NTP Service",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Deactivates the NTP service",
"indicator": "IND-1",
"inputs": "Deactivate NTP Service arguments",
"name": "Deactivate NTP Service",
"outputs": "Deactivated NTP Service",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves the current status of the NTP Service in the HSM",
"indicator": "IND-1",
"inputs": "Get NTP Service Info arguments",
"name": "Get NTP Service Info",
"outputs": "NTP Service Info",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Activates the Remote System Log",
"indicator": "IND-1",
"inputs": "Activate Remote Syslog arguments",
"name": "Activate Remote Syslog",
"outputs": "Activated Remote Syslog",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Deactivates the Remote System Log",
"indicator": "IND-1",
"inputs": "Deactivate Remote Syslog arguments",
"name": "Deactivate Remote Syslog",
"outputs": "Deactivated Remote Syslog",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves the current status of the Remote System Log in the HSM",
"indicator": "IND-1",
"inputs": "Get Remote Syslog arguments",
"name": "Get Remote Syslog",
"outputs": "Remote Syslog status",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Updates the permission for unauthentic ated execution of the Get System Log operation",
"indicator": "IND-1",
"inputs": "Set Unauthentic ated Get System Log Permission arguments",
"name": "Set Unauthentic ated Get System Log Permission",
"outputs": "Unauthentic ated Get System Log Permission set",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "Data Encryption None"
},
{
"description": "Retrieves the current status of the permission for unauthentic ated execution of",
"indicator": "IND-1",
"inputs": "Get Unauthentic ated Get System Log Permission arguments",
"name": "Get Unauthentic ated Get System Log Permission",
"outputs": "Unauthentic ated Get System Log Permission status",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto",
"secFunImpl": "None"
},
{
"description": "the Get System Log operation",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Officer User",
"secFunImpl": ""
},
{
"description": "Drops and recreates all tables to reclaim disk space remnant from delete operations",
"indicator": "IND-1",
"inputs": "Optimize Database arguments",
"name": "Optimize Database",
"outputs": "Optimized Database",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves information about the HSM",
"indicator": "IND-1",
"inputs": "Query Operation arguments",
"name": "Query Operation",
"outputs": "Queried Operation",
"rolesSspAccess": "Physical HSM Crypto Officer - PHSM Module Certificate: R Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Retrieves the current status of an ongoing firmware update operation",
"indicator": "IND-1",
"inputs": "Get Firmware Update Status arguments",
"name": "Get Firmware Update Status",
"outputs": "Firmware Update Status",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves information about the requester from the system",
"indicator": "IND-1",
"inputs": "Get Requester Info arguments",
"name": "Get Requester Info",
"outputs": "Requester Info",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Sets the authenticati on policy for Users, VCOs and PCOs",
"indicator": "IND-1",
"inputs": "Set Authenticati on Policy arguments",
"name": "Set Authenticati on Policy",
"outputs": "Authenticati on Policy set",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Retrieves the authenticati on policy for Users, VCOs and PCOs",
"indicator": "IND-1",
"inputs": "Get Authenticati on Policy arguments",
"name": "Get Authenticati on Policy",
"outputs": "Authenticati on Policy",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Initializes a database synchroniza tion cluster",
"indicator": "IND-1",
"inputs": "Create Cluster arguments",
"name": "Create Cluster",
"outputs": "Created Cluster",
"rolesSspAccess": "Physical HSM Crypto Officer - Cluster TLS CA Private Key: G - Cluster TLS CA Certificate: G - Cluster TLS Server Private Key: G - Cluster TLS Server Certificate: G - Cluster TLS Client Private Key: G - Cluster TLS Client Certificate: G - Cluster Secret: G",
"secFunImpl": "Digital Signature Generatio n Key Generatio n"
},
{
"description": "Prepares a node to join in the cluster",
"indicator": "IND-1",
"inputs": "Prepare Join Cluster arguments",
"name": "Prepare Join Cluster",
"outputs": "Join Cluster encrypted package",
"rolesSspAccess": "Physical HSM Crypto Officer - Cluster TLS CA Private Key: R",
"secFunImpl": "Data Encryption Digital Signature Generatio n Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Cluster TLS CA Certificate: R - Cluster TLS Server Private Key: R - Cluster TLS Server Certificate: R - Cluster TLS Client Private Key: R - Cluster TLS Client Certificate: R - Cluster Secret: R",
"secFunImpl": ""
},
{
"description": "Allows a HSM to join an existing cluster",
"indicator": "IND-1",
"inputs": "Join encrypted package and arguments",
"name": "Join Cluster",
"outputs": "Joined Cluster",
"rolesSspAccess": "Physical HSM Crypto Officer - Cluster TLS CA Private Key: W - Cluster TLS CA Certificate: W - Cluster TLS Server Private Key: W - Cluster TLS Server Certificate: W - Cluster TLS Client Private",
"secFunImpl": "Data Decryption Digital Signature Verificatio n Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: W - Cluster TLS Client Certificate: W - Cluster Secret: W",
"secFunImpl": ""
},
{
"description": "Retrieves the current session timeout",
"indicator": "IND-1",
"inputs": "Get Session Timeout arguments",
"name": "Get Session Timeout",
"outputs": "Session Timeout",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Sets the session timeout with minutes precision",
"indicator": "IND-1",
"inputs": "Set Session Timeout arguments",
"name": "Set Session Timeout",
"outputs": "Session Timeout set",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Leaves the existing cluster",
"indicator": "IND-1",
"inputs": "Leave Cluster arguments",
"name": "Leave Cluster",
"outputs": "The HSM is no longer part of the cluster",
"rolesSspAccess": "Physical HSM Crypto Officer - Kryptus kNET CA Certificate: Z - PHSM Module Key: Z - PHSM Server CA Certificate: Z - VHSM Server CA Certificate: Z - VHSM Server Certificate s: Z - VHSM",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Client CA Certificate s: Z - Cluster TLS CA Certificate: Z - Cluster TLS Server Certificate: Z - Cluster TLS Client Certificate: Z - Cluster Secret: Z - Authentica tion Certificate: Z - Quorum Secret Share: Z - PCO Initializatio n Password: Z - PCOs\u0027 Temporary Password: Z - PCOs\u0027 Passwords : Z - PCO\u0027s OTP: Z - VCO Initializatio n Password: Z - VCOs\u0027 Temporary Password: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- VCOs\u0027 Passwords : Z - VCO\u0027s OTP: Z - Users\u0027 Temporary Password (Pin): Z - Users\u0027 Passwords : Z - User\u0027s OTP: Z - ECDH Private Componen t (ephemera l): Z - ECDH Public Componen t (ephemera l): Z - TLS Peer Public Key: Z - TLS Pre- Master Secret: Z - TLS Master Secret: Z - TLS Session Key: Z - TLS Authentica tion Key: Z - Authentica tion Certificate Challenge: Z - Authentica",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "tion Certificate Response: Z - Session Token: Z - Fastlane ID: Z - Fastlane Secret: Z - Quorum Secret: Z",
"secFunImpl": ""
},
{
"description": "Retrieves the cluster status",
"indicator": "IND-1",
"inputs": "Get Cluster Status arguments",
"name": "Get Cluster Status",
"outputs": "Cluster Status",
"rolesSspAccess": "Physical HSM Crypto Officer Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Updates the cluster configuratio n",
"indicator": "IND-1",
"inputs": "Configure Cluster arguments",
"name": "Configure Cluster",
"outputs": "Configured Cluster",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Stops the execution of any ongoing Import Physical HSM",
"indicator": "IND-1",
"inputs": "Cancel Backup arguments",
"name": "Cancel Backup",
"outputs": "-",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Updates the state of the HSM",
"indicator": "IND-1",
"inputs": "Change kNET State arguments",
"name": "Change kNET State",
"outputs": "Changed kNET State",
"rolesSspAccess": "Physical HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Get VHSM CPU, RAM and disk usage",
"indicator": "IND-1",
"inputs": "Get Virtual HSM Usage arguments",
"name": "Get Virtual HSM Usage",
"outputs": "Virtual HSM Usage information",
"rolesSspAccess": "Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Activate a User (This is embedded in Change Password Operation)",
"indicator": "IND-1",
"inputs": "Activate User arguments",
"name": "Activate User",
"outputs": "Activated User",
"rolesSspAccess": "Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Deactivate a User (This is embedded in Reset Password Operation)",
"indicator": "IND-1",
"inputs": "Deactivate User arguments",
"name": "Deactivate User",
"outputs": "Deactivated User",
"rolesSspAccess": "Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "This operation changes the permissions of a user",
"indicator": "IND-1",
"inputs": "Change Operator Permission arguments",
"name": "Change Operator Permission",
"outputs": "Changed Operator Permission",
"rolesSspAccess": "Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "This operation approves an imported Virtual HSM to enter the Operational State",
"indicator": "IND-1",
"inputs": "Approve Backup Import arguments",
"name": "Approve Backup Import",
"outputs": "Backup Import approved",
"rolesSspAccess": "Virtual HSM Crypto Officer",
"secFunImpl": "None"
},
{
"description": "Determine a list of supported protocol versions by the server",
"indicator": "IND-1",
"inputs": "Discover Versions arguments",
"name": "Discover Versions",
"outputs": "Discovered Versions",
"rolesSspAccess": "Virtual HSM Crypto Officer User",
"secFunImpl": "None"
},
{
"description": "Create a symmetric key within the VHSM",
"indicator": "IND-1",
"inputs": "Create arguments",
"name": "Create",
"outputs": "Key UID",
"rolesSspAccess": "User - Users\u0027 AES Key: G - Users\u0027 HMAC Key: G",
"secFunImpl": "Symmetric Key Generatio n"
},
{
"description": "Create asymmetric key pair in the VHSM",
"indicator": "IND-1",
"inputs": "Create Key Pair arguments",
"name": "Create Key Pair",
"outputs": "Key Pair UIDs",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: G - Users\u0027 RSA Public Key: G - Users\u0027 ECDSA Private Key: G - Users\u0027 ECDSA",
"secFunImpl": "Key Generatio n"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: G - Users\u0027 EDDSA Private Key: G - Users\u0027 EDDSA Public Key: G - Users\u0027 ML-DSA Private Key: G - Users\u0027 ML-DSA Public Key: G - Users\u0027 ML-KEM Private Key: G - Users\u0027 ML-KEM Public Key: G",
"secFunImpl": ""
},
{
"description": "Add a single attribute to an object",
"indicator": "IND-1",
"inputs": "Add Attribute arguments",
"name": "Add Attribute",
"outputs": "Attribute added",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Retrieve attribute values of an object",
"indicator": "IND-1",
"inputs": "Get Attributes arguments",
"name": "Get Attributes",
"outputs": "List of Attributes values",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Retrieve attributes of an object",
"indicator": "IND-1",
"inputs": "Get Attributes List arguments",
"name": "Get Attributes List",
"outputs": "List of Attributes names",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Modify an attribute value",
"indicator": "IND-1",
"inputs": "Modify Attribute arguments",
"name": "Modify Attribute",
"outputs": "Modified Attribute",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Delete an attribute value of an object",
"indicator": "IND-1",
"inputs": "Delete Attribute arguments",
"name": "Delete Attribute",
"outputs": "Deleted attribute",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Revoke object",
"indicator": "IND-1",
"inputs": "Revoke arguments",
"name": "Revoke",
"outputs": "Revoked object UID",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Activate object",
"indicator": "IND-1",
"inputs": "Activate arguments",
"name": "Activate",
"outputs": "Activated object UID",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Destroy object",
"indicator": "IND-1",
"inputs": "Destroy arguments",
"name": "Destroy",
"outputs": "Destroyed object UID",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: Z - Users\u0027 RSA Public Key: Z - Users\u0027 ECDSA Private Key: Z - Users\u0027 ECDSA Public Key: Z - Users\u0027 EDDSA Private Key: Z - Users\u0027 EDDSA Public Key: Z - Users\u0027 ML-DSA Private Key: Z - Users\u0027 ML-DSA Public Key: Z - Users\u0027 ML-KEM Private Key: Z - Users\u0027 ML-KEM Public Key: Z - Users\u0027 AES Key: Z - Users\u0027 HMAC Key: Z - Users\u0027",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Certificate: Z",
"secFunImpl": ""
},
{
"description": "Locate an object given its attributes",
"indicator": "IND-1",
"inputs": "Locate arguments",
"name": "Locate",
"outputs": "Located object(s) UIDs",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Check usage quota of an object",
"indicator": "IND-1",
"inputs": "Check arguments",
"name": "Check",
"outputs": "Checked object",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Register an object",
"indicator": "IND-1",
"inputs": "Register arguments",
"name": "Register",
"outputs": "Object\u0027s UID",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: W - Users\u0027 RSA Public Key: W - Users\u0027 ECDSA Private Key: W - Users\u0027 ECDSA Public Key: W - Users\u0027 EDDSA Private Key: W - Users\u0027 EDDSA Public Key: W - Users\u0027 ML-DSA Private Key: W - Users\u0027 ML-DSA Public Key: W - Users\u0027 ML-KEM Private Key: W - Users\u0027 ML-KEM Public",
"secFunImpl": "Key Unwrappin g Legacy Key Wrapping Input- Output"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: W - Users\u0027 AES Key: W - Users\u0027 HMAC Key: W - Users\u0027 Certificate: W",
"secFunImpl": ""
},
{
"description": "Get an object",
"indicator": "IND-1",
"inputs": "Get arguments",
"name": "Get",
"outputs": "Wrapped object",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: R - Users\u0027 RSA Public Key: R - Users\u0027 ECDSA Private Key: R - Users\u0027 ECDSA Public Key: R - Users\u0027 EDDSA Private Key: R - Users\u0027 EDDSA Public Key: R - Users\u0027 ML-DSA Private Key: R - Users\u0027 ML-DSA Public Key: R - Users\u0027 ML-KEM Private Key: R - Users\u0027 ML-KEM",
"secFunImpl": "Key Wrapping"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Key: R - Users\u0027 AES Key: R,E - Users\u0027 HMAC Key: R - Users\u0027 Certificate: R",
"secFunImpl": ""
},
{
"description": "Encrypt data",
"indicator": "IND-1",
"inputs": "Encrypt arguments",
"name": "Encrypt",
"outputs": "Encrypted data",
"rolesSspAccess": "User - Users\u0027 RSA Public Key: E - Users\u0027 ECDSA Public Key: E - Users\u0027 EDDSA Public Key: E - Users\u0027 AES Key: E",
"secFunImpl": "Data Encryption"
},
{
"description": "Decrypt data",
"indicator": "IND-1",
"inputs": "Decrypt arguments",
"name": "Decrypt",
"outputs": "Decrypted data",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: E - Users\u0027 ECDSA Private Key: E - Users\u0027 EDDSA Private Key: E - Users\u0027 AES Key: E",
"secFunImpl": "Data Decryption Legacy Data Decryption"
},
{
"description": "Sign data",
"indicator": "IND-1",
"inputs": "Sign arguments",
"name": "Sign",
"outputs": "Signed data",
"rolesSspAccess": "User - Users\u0027 RSA Private",
"secFunImpl": "Digital Signature Generatio n"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Users\u0027 ECDSA Private Key: E - Users\u0027 EDDSA Private Key: E - Users\u0027 ML-DSA Private Key: E",
"secFunImpl": ""
},
{
"description": "Verify signature",
"indicator": "IND-1",
"inputs": "Signature verify arguments",
"name": "Signature verify",
"outputs": "Signature verification result",
"rolesSspAccess": "User - Users\u0027 RSA Public Key: E - Users\u0027 ECDSA Public Key: E - Users\u0027 EDDSA Public Key: E - Users\u0027 ML-DSA Public Key: E",
"secFunImpl": "Digital Signature Verificatio n"
},
{
"description": "Retrieve randomness",
"indicator": "IND-1",
"inputs": "RNG Retrieve arguments",
"name": "RNG Retrieve",
"outputs": "RNG Retrieved",
"rolesSspAccess": "User - DRBG C and V values: E - DRBG Entropy Input: E - DRBG Seed: E",
"secFunImpl": "Determinis tic Random Number Generator"
},
{
"description": "Seed RNG",
"indicator": "IND-1",
"inputs": "RNG Seed arguments",
"name": "RNG Seed",
"outputs": "RNG Seeded",
"rolesSspAccess": "User",
"secFunImpl": "Get Entropy"
},
{
"description": "Compute hash",
"indicator": "IND-1",
"inputs": "Hash arguments",
"name": "Hash",
"outputs": "Computed hash",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Generate MAC of data",
"indicator": "IND-1",
"inputs": "MAC arguments",
"name": "MAC",
"outputs": "Generated MAC",
"rolesSspAccess": "User - DRBG C and V values: E - DRBG Entropy",
"secFunImpl": "Message Authentica tion"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Input: E - DRBG Seed: E",
"secFunImpl": ""
},
{
"description": "Verify a MAC",
"indicator": "IND-1",
"inputs": "MAC Verify arguments",
"name": "MAC Verify",
"outputs": "Verified MAC",
"rolesSspAccess": "User - DRBG C and V values: E - DRBG Entropy Input: E - DRBG Seed: E",
"secFunImpl": "Message Verificatio n"
},
{
"description": "Set object permissions for a specific user",
"indicator": "IND-1",
"inputs": "Set User Object Permission arguments",
"name": "Set User Object Permission",
"outputs": "User Object Permission set",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Get object permissions for a specific user",
"indicator": "IND-1",
"inputs": "Get User Object Permission arguments",
"name": "Get User Object Permission",
"outputs": "User Object Permission",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Load key in cache",
"indicator": "IND-1",
"inputs": "Load Key arguments",
"name": "Load Key",
"outputs": "Loaded Key UID",
"rolesSspAccess": "User - Fastlane ID: G,R - Fastlane Secret: W",
"secFunImpl": "Determinis tic Random Number Generator Input- Output"
},
{
"description": "Validate a digital certificate or certificate chain",
"indicator": "IND-1",
"inputs": "Validate arguments",
"name": "Validate",
"outputs": "Validity Indicator",
"rolesSspAccess": "User - Users\u0027 Certificate: E",
"secFunImpl": "Data Decryption"
},
{
"description": "Sign data according to XMLDSig standard",
"indicator": "IND-1",
"inputs": "Sign XML arguments",
"name": "Sign XML",
"outputs": "Signed XML",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: E - Users\u0027 ECDSA Private Key: E",
"secFunImpl": "Digital Signature Generatio n Secure Hash (Message Digest)"
},
{
"description": "Generate a Signing Certificate Request",
"indicator": "IND-1",
"inputs": "Generate CSR arguments",
"name": "Generate CSR",
"outputs": "Generated CSR",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: E",
"secFunImpl": "Digital Signature Generatio n"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Users\u0027 RSA Public Key: R - Users\u0027 ECDSA Private Key: E - Users\u0027 ECDSA Public Key: R - Users\u0027 EDDSA Private Key: E - Users\u0027 EDDSA Public Key: R",
"secFunImpl": ""
},
{
"description": "Generate a time stamp for the given hash, and signs it",
"indicator": "IND-1",
"inputs": "Generate Timestamp arguments",
"name": "Generate Timestamp",
"outputs": "Generated Timestamp",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: E - Users\u0027 ECDSA Private Key: E",
"secFunImpl": "Digital Signature Generatio n"
},
{
"description": "Derive a new key from a pre- existing key",
"indicator": "IND-1",
"inputs": "Derive Key arguments",
"name": "Derive Key",
"outputs": "Derived Key UID; and/or Derivation Data",
"rolesSspAccess": "User - Users\u0027 ECDSA Private Key: E - Users\u0027 ML-DSA Private Key: E - Users\u0027 AES Key: G,E - Users\u0027 HMAC Key: G - Users\u0027 ML-KEM Private Key: E",
"secFunImpl": "Key Generatio n Symmetric Key Generatio n Key Encapsula tion Key Wrapping"
},
{
"description": "Request the user respective encrypt-ed share for quor-um activation for given Object",
"indicator": "IND-1",
"inputs": "Get Secret Share arguments",
"name": "Get Secret Share",
"outputs": "Secret Share (encrypted)",
"rolesSspAccess": "User - Quorum Secret Share: R",
"secFunImpl": "Data Encryption Digital Signature Generatio n Input- Output"
},
{
"description": "Take a PIN Block and reformats it to the desired format",
"indicator": "IND-1",
"inputs": "Reformat Clear Pin arguments",
"name": "Reformat Clear PIN",
"outputs": "Reformatted Clear Pin",
"rolesSspAccess": "User",
"secFunImpl": "None"
},
{
"description": "Create a key in different parts and save each part as one key in the",
"indicator": "IND-1",
"inputs": "Create Split Key arguments",
"name": "Create Split Key",
"outputs": "Split Key UIDs",
"rolesSspAccess": "User - Users\u0027 AES Key: G,E - Users\u0027 HMAC Key: G,E",
"secFunImpl": "Symmetric Key Generatio n"
},
{
"description": "HSM Join different parts of a split key into only one key in the HSM",
"indicator": "IND-1",
"inputs": "Join Split Key arguments",
"name": "Join Split Key",
"outputs": "Joined Split Key UID",
"rolesSspAccess": "User - Users\u0027 AES Key: G,E - Users\u0027 HMAC Key: G,E",
"secFunImpl": "Symmetric Key Generatio n"
},
{
"description": "Prepare the HSM to perform Fast Red Blob Sign operation",
"indicator": "IND-1",
"inputs": "Prepare Fast Red Blob Sign arguments",
"name": "Prepare Fast Red Blob Sign",
"outputs": "Red Blob UID",
"rolesSspAccess": "User - Fastlane ID: G,R - Fastlane Secret: W",
"secFunImpl": "Determinis tic Random Number Generator"
},
{
"description": "Sign a Token Authenticati on Pack- age generated by the Start Token Authenticati on Operation",
"indicator": "IND-1",
"inputs": "Sign Authenticati on Package arguments",
"name": "Sign Authenticati on Package",
"outputs": "Signed Authenticati on Package",
"rolesSspAccess": "User - PHSM Module Key: E",
"secFunImpl": "Digital Signature Generatio n"
},
{
"description": "Decrypt a Packaged Secret Share retrieved from the Get Secret Share Operation",
"indicator": "IND-1",
"inputs": "Decrypt Secret Share arguments",
"name": "Decrypt Secret Share",
"outputs": "Decrypted Secret Share",
"rolesSspAccess": "User - Users\u0027 RSA Private Key: E - Users\u0027 ECDSA Private Key: E - Users\u0027 EDDSA Private Key: E",
"secFunImpl": "Data Decryption"
},
{
"description": "Generate an EMV (Europay, MasterCard and Visa) Cryptogram",
"indicator": "IND-1",
"inputs": "Generate EMV Cryptogram arguments",
"name": "Generate EMV Cryptogram",
"outputs": "Generated EMV Cryptogram",
"rolesSspAccess": "User - Users\u0027 AES Key: E",
"secFunImpl": "Data Encryption"
},
{
"description": "The operator authenticati on process, using one or more of the authenticati on methods",
"indicator": "IND-1",
"inputs": "Authenticati on",
"name": "Authenticati on",
"outputs": "-",
"rolesSspAccess": "Physical HSM Crypto Officer - PCO Initializatio n Password: W,E,Z - PCOs\u0027 Temporary Password: W,E,Z - PCOs\u0027 Passwords : W,E,Z - PCOs\u0027 Hashed Passwords : E - PCOs\u0027 Certificate Fingerprint s: E - PCO\u0027s OTP: E - Users\u0027 Temporary Password (Pin):",
"secFunImpl": "Digital Signature Verificatio n Secure Hash (Message Digest) Message Authentica tion Input- Output"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : E - Users\u0027 Certificate Fingerprint s: E - User\u0027s OTP Key: E - User\u0027s OTP: W,E,Z - Authentica tion Certificate: E - Authentica tion Certificate Challenge: W,E,Z - Authentica tion Certificate Response: W,E,Z - Fastlane ID: W,E - Fastlane Secret: W,E,Z Virtual HSM Crypto Officer - VCO Initializatio n Password: W,E,Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- VCOs\u0027 Temporary Password: W,E,Z - VCOs\u0027 Passwords : W,E,Z - VCOs\u0027 Hashed Passwords : E - VCOs\u0027 Certificate Fingerprint s: E - VCO\u0027s OTP Key: E - VCO\u0027s OTP: W,E,Z - Users\u0027 Temporary Password (Pin): W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : E - Users\u0027 Certificate Fingerprint s: E - User\u0027s OTP Key: E - User\u0027s OTP: W,E,Z - Authentica tion Certificate: E -",
"secFunImpl": ""
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Authentica tion Certificate Challenge: W,E,Z - Authentica tion Certificate Response: W,E - Fastlane ID: W,E - Fastlane Secret: W,E,Z User - Users\u0027 Temporary Password (Pin): W,E,Z - Users\u0027 Passwords : W,E,Z - Users\u0027 Hashed Passwords : E - Users\u0027 Certificate Fingerprint s: E - User\u0027s OTP Key: E - User\u0027s OTP: W,E,Z - Authentica tion Certificate: E - Authentica tion Certificate Challenge:",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,E,Z - Authentica tion Certificate Response: W,E,Z - Fastlane ID: W,E - Fastlane Secret: W,E,Z",
"secFunImpl": ""
},
{
"description": "The process to establish the TLS connection between the module and the external entity (operator, process, etc.)",
"indicator": "IND-1",
"inputs": "TLS Establishme nt arguments",
"name": "TLS Establishme nt",
"outputs": "TLS Established",
"rolesSspAccess": "Physical HSM Crypto Officer - ECDH Private Componen t (ephemera l): G,R,W,E,Z - ECDH Public Componen t (ephemera l): G,R,W,E,Z - TLS Peer Public Key: W,E - TLS Pre- Master Secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session Key: G,E,Z - TLS Authentica tion Key: G,E,Z - PHSM",
"secFunImpl": "Key Agreement Key Generatio n"
},
{
"description": "Description",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Server CA Key: E - PHSM Server CA Certificate: E - PHSM Server Key: E - PHSM Server Certificate: E - PHSM Client CA Key: E - PHSM Client CA Certificate: E Virtual HSM Crypto Officer - ECDH Private Componen t (ephemera l): G,R,W,E,Z - ECDH Public Componen t (ephemera l): G,R,W,E,Z - TLS Peer Public Key: W,E - TLS Pre- Master Secret: G,E,Z - TLS Master Secret: G,E,Z",
"secFunImpl": "Functions"
},
{
"description": "Description",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- TLS Session Key: G,E,Z - TLS Authentica tion Key: G,E,Z - VHSM Server CA Key: E - VHSM Server CA Certificate: E - VHSM Client CA Keys: E - VHSM Client CA Certificate s: E User - ECDH Private Componen t (ephemera l): G,R,W,E,Z - ECDH Public Componen t (ephemera l): G,R,W,E,Z - TLS Peer Public Key: W,E - TLS Pre- Master Secret: G,E,Z - TLS Master Secret: G,E,Z - TLS Session",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G,E,Z - TLS Authentica tion Key: G,E,Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [],
"found": false,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "Hash DRBG (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Hash-based Deterministic Random Number Generation: Instantiate, Reseed, Generate and Uninstantiate",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB Encrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Encryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Encryption ECB mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-ECB Decrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Decryption ECB mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Encrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Encryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Encryption in CBC mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC Decrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Decryption in CBC mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR Encrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Encryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Encryption in CTR mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR Decrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Decryption in CTR mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Encrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Encryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Encryption in GCM mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM Decrypt (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Decryption in GCM mode. Key size: 128, 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-224 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6066)",
"condition": "Prior to the first operational use of any",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "cryptographi c algorithm",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "SHA2-384 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512/224 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512/256 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-224 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-256 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-384 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA3-512 (A6066)",
"condition": "Prior to the first operational",
"details": "Message Digest",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "use of any cryptographi c algorithm",
"details": "",
"indicator": "the frontal board",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "HMAC-SHA- 1 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA-1",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-224 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA2-224",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-384 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-512 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA3-224 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA3-224",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA3-256 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA3-256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA3-384 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA3-384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA3-512 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "MAC Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "SHA3-512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Generation. SHA-256. Key size: 2048 bit",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Verification",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Verification. Key size: 2048 bit",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Generation. Curve: NIST P-521",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Verification",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Verification. Curve: NIST P-521",
"type": "CAST"
},
{
"algorithmOrTest": "EDDSA SigGen (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Generation. Curve Ed25519",
"type": "CAST"
},
{
"algorithmOrTest": "EDDSA SigVer (A6066)",
"condition": "Prior to the first operational use of any",
"details": "Digital Signature Verification",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Verification. Curve Ed25519",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "cryptographi c algorithm",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "ML-KEM Encapsulatio n (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Key Encapsulatio n",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Encapsulation . Parameters Set: ML-KEM- 512, ML- KEM-768, ML-KEM- 1024",
"type": "CAST"
},
{
"algorithmOrTest": "ML-KEM Decapsulatio n (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Key Decapsulatio n",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Decapsulatio n. Parameters Set: ML-KEM- 512, ML- KEM-768, ML-KEM- 1024",
"type": "CAST"
},
{
"algorithmOrTest": "ML-DSA SigGen (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Generation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Generation. Parameters Set: ML-DSA- 44, ML-DSA- 65, ML-DSA- 87",
"type": "CAST"
},
{
"algorithmOrTest": "ML-DSA SigVer (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Digital Signature Verification",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Digital Signature Verification. Parameters Set: ML-DSA- 44, ML-DSA- 65, ML-DSA- 87",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Shared Secret Computation",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Key Agreement Scheme (Primitive \u0027Z\u0027 computation using ECDH). Curve: P-256, P-384, P-512",
"type": "CAST"
},
{
"algorithmOrTest": "KDF TLS (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Key Derivation Function",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "[SP800-135 Rev 1] TLS 1.2 KDF. SHA-256, SHA-384",
"type": "CAST"
},
{
"algorithmOrTest": "TDES-CBC (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Key Option: 1",
"type": "CAST"
},
{
"algorithmOrTest": "TDES-ECB (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption",
"indicator": "\u0027PASS\u0027 or \u0027FAIL\u0027 on the frontal board",
"testMethod": "KAT",
"testProps": "Key Option: 1",
"type": "CAST"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "Prior to the first operational use of any cryptographi c algorithm",
"details": "Decryption, Digital Signature Verification",
"indicator": "Frontal board frozen in \u0027Initializing \u0027 screen",
"testMethod": "KAT",
"testProps": "Digital Signature Verification and AES Decryption: RSA 2048 bits and SHA- 256",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "Entropy 90 Repetition Count Test (RCT)",
"condition": "Continuous during the entropy source operation",
"details": "Continuous Health Test",
"indicator": "System Log",
"testMethod": "RCT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy 90 Adaptive Proportion Test (APT)",
"condition": "Continuous during the entropy source operation",
"details": "Continuous Health Test",
"indicator": "System Log",
"testMethod": "APT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm and on- demand",
"details": "Key Pair Generation and Verification",
"indicator": "System Log",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm and on- demand",
"details": "Key Pair Generation and Verification",
"indicator": "System Log",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "EDDSA KeyGen (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm and on- demand",
"details": "Key Pair Generation and Verification",
"indicator": "System Log",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "ML-DSA KeyGen (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm and on- demand",
"details": "Key Pair Generation and Verification",
"indicator": "System Log",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
},
{
"algorithmOrTest": "ML-KEM KeyGen (A6066)",
"condition": "Prior to the first operational use of any cryptographi c algorithm and on- demand",
"details": "Key Pair Generation and Verification",
"indicator": "System Log",
"testMethod": "PCT",
"testProps": "N/A",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Failure of any Pre-Operational Self-tests. Failure of any Conditional Self-tests. Failure of any Periodic Self- Test Information",
"description": "Failure of any Self- Test",
"indicator": "Right after test execution, the test will be tagged as \u0027FAIL\u0027 on the frontal display. After the completion of the FIPS tests, the device switches to Error State. This condition is indicated on the frontal display by the message \u0027Auto Test has failed\u0027. Also , it can be checked by getting the log file",
"name": "Error State",
"recoveryMethod": "Click on MENU to restart the module or click on OK to proceed. If the latter option is chosen, the only services available will be: \u0027Get System Log\u0027, \u0027Restart\u0027 and \u0027Shutdown\u0027. Power cycle or re-start the module to recover it from this state"
},
{
"conditions": "Failures at the hardware of the module detected during the boot, preventing its operation",
"description": "Failures at the hardware",
"indicator": "The frontal display shows the message \u0027Failure\u0027 and one of the following conditions: \u00b7 \u0027Cryptographic Module Start Failure\u0027 \u00b7 \u0027CPU start Failure\u0027 After the message has been displayed for 10 seconds, the module is restarted, and if the failure persists, the kNET switches to Power Off State",
"name": "Start Failures",
"recoveryMethod": "Click on MENU to restart the module or click on OK to proceed. If the latter option is chosen, the only services available will be: \u0027Get System Log\u0027, \u0027Restart\u0027 and \u0027Shutdown\u0027. Power cycle or restart the module to recover it from this state"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "Epoxy resin"
},
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "EFP"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The FIPS 140-3 approved mode of operation",
"name": "FIPS 140-3",
"statusIndicator": "Frontal Board Display",
"type": "Approved"
},
{
"description": "Non-approved mode for legacy FIPS 140-2 restrictions",
"name": "Legacy FIPS 140-2",
"statusIndicator": "System Log",
"type": "Non- Approved"
},
{
"description": "Non-approved mode for Common Criteria restrictions",
"name": "Common Criteria",
"statusIndicator": "System Log",
"type": "Non- Approved"
},
{
"description": "Non-approved mode for unrestricted usage",
"name": "Unrestricted",
"statusIndicator": "System Log",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "Triple DES",
"use": "Data Encryption"
},
{
"name": "RSA",
"use": "Data encryption using PKCS#1; Signature Generation using keys less than 2048 bits"
},
{
"name": "MD5",
"use": "Message Digest"
},
{
"name": "DSA",
"use": "Key Pair Generation and Signature Generation"
},
{
"name": "Brainpool P-160 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-192 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-224 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-256 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-320 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-384 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Brainpool P-512 (r1/t1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "Ed521",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
},
{
"name": "SEC P-256 (k1)",
"use": "Key Pair Generation, Digital Signature Generation, Digital Signature Verification"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "Triple DES RSA MD5 DSA Brainpool P- 160 (r1/t1) Brainpool P-",
"description": "The kNET HSM enables the user to execute Python applications with access to cryptographic objects stored on that device. These applications may be uploaded, controlled and monitored on the device via custom KMIP requests. These requests, although use the KMIP protocol, are not commands from the KMIP specification, but were added by Kryptus to its own KMIP server to offer extended",
"name": "Register SEApp",
"role": "User"
},
{
"alg_accessed": "192 (r1/t1) Brainpool P- 224 (r1/t1) Brainpool P- 256 (r1/t1) Brainpool P- 320 (r1/t1) Brainpool P- 384 (r1/t1) Brainpool P- 512 (r1/t1) Ed521 SEC P-256 (k1)",
"description": "functionalities. This document provides a brief explanation on how the kNET HSM Secure Execution feature works. For instructions on commands to manage Secure Execution Applications, please refer to the Command Line Interface manual. Important: The user of the SE App is responsible for its security and enforcing the desired security rules upon its connections",
"name": "",
"role": ""
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Two sets of ports for Ethernet connection are available. These interfaces are the main communication channel for the cryptographic module. Also, encrypted channel with ASI-HSM AHX5 kNET client when using the Trusted Channel (sensitive data is always encrypted when transmitted through these channels)",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet Interfaces"
},
{
"data": "Serial interface used for module configuration (e.g. configure network interface). No sensitive information is transmitted through this channel. Also used to output module status",
"logicalInterface": "Control Input Status Output",
"physicalPort": "RS232 Interface"
},
{
"data": "Interface with the Frontal Board, which is responsible for power control (e.g. turn off the module) and user interface control (buttons, LCD). Information about the module status is send through this interface, such as temperature and battery voltage. No sensitive information is transmitted through this channel",
"logicalInterface": "Control Input Status Output",
"physicalPort": "I2C Interface"
},
{
"data": "Two output signals (FLAG0 and FLAG1) that inform to the frontal board the current condition of the CM board (normal condition, occurrence of some internal error or environmental failure) and the temperature used at the fans speed control subroutine",
"logicalInterface": "Status Output",
"physicalPort": "FLAGx"
},
{
"data": "Receives a control signal that can be connected to a tamper- evidence device (e.g. tamper switch)",
"logicalInterface": "Control Input",
"physicalPort": "Tamper Pin"
},
{
"data": "Currently optionally used for Import/Export Backup Operations. Since backups are encrypted, no sensitive information is transmitted through this channel",
"logicalInterface": "Data Input Data Output",
"physicalPort": "USB Interface"
},
{
"data": "Power input from the ATX power supply unit",
"logicalInterface": "Power",
"physicalPort": "ATX Power input"
},
{
"data": "Power input from the battery unit",
"logicalInterface": "Power",
"physicalPort": "Battery Power input"
},
{
"data": "Indicate the status of the module initialization sequence",
"logicalInterface": "Status Output",
"physicalPort": "Status LEDs"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password with KAS-ECC- SSC Sp800-56Ar3 Password with KDF TLS mTLS Certificate with KAS-ECC-SSC Sp800- 56Ar3 mTLS Certificate with KDF TLS Authentication Certificate Session Token Time-Based OTP HMAC-Based OTP Quorum",
"name": "Physical HSM Crypto Officer",
"operatorType": "Crypto Officer",
"type": "Identity"
},
{
"authMethodList": "Password with KAS-ECC- SSC Sp800-56Ar3 Password with KDF TLS mTLS Certificate with KAS-ECC-SSC Sp800- 56Ar3 mTLS Certificate with KDF TLS Authentication Certificate Session Token Time-Based OTP HMAC-Based OTP Quorum",
"name": "Virtual HSM Crypto Officer",
"operatorType": "Crypto Officer",
"type": "Identity"
},
{
"authMethodList": "Password with KAS-ECC- SSC Sp800-56Ar3 Password with KDF TLS mTLS Certificate with KAS-ECC-SSC Sp800- 56Ar3 mTLS Certificate with KDF TLS Authentication Certificate Session Token Fastlane Token Time-Based OTP",
"name": "User",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "HMAC-Based OTP Quorum",
"name": "",
"operatorType": "",
"type": ""
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "3",
"section": "1",
"title": "General"
},
{
"level": "3",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "3",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "3",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "3",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "3",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "3",
"section": "10",
"title": "Self-tests"
},
{
"level": "3",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "3",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6066)",
"details": "Digital Signature",
"indicator": "Frozen in \u0027Initializing\u0027 screen on the frontal board in case of failure, otherwise, the device will enter the Conditional Self-Tests stage",
"testMethod": "KAT",
"testProps": "Digital Signature Verification with RSA 2048 bits and SHA-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "ACTIVATE OTP 1",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "Encrypte d Volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "ACTIVATE OTP 2",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "AUTHENTICATIO N",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Encrypte d Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "CHANGE PASSWORD",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "CREATE USER",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "CREATE VHSM",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Plaintext",
"name": "ESTABLISH TLS SESSION 1",
"sfiAlgo": "Key Agreemen t",
"source": "Volatile Memory"
},
{
"dest": "Volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Plaintext",
"name": "ESTABLISH TLS SESSION 2",
"sfiAlgo": "Key Agreemen t",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "EXPORT PHSM 1",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "EXPORT PHSM 2",
"sfiAlgo": "Input- Output",
"source": "Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "EXPORT VHSM 1",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "EXPORT VHSM 2",
"sfiAlgo": "Input- Output",
"source": "Non- volatile Memory"
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "FACTORY INPUT 1",
"sfiAlgo": "",
"source": "External"
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "FACTORY INPUT 2",
"sfiAlgo": "",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "GET",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "GET SECRET SHARE",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "GET SESSION CREDENTIAL",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "GET TEMPORARY PIN",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "GET TLS CERTIFICATE",
"sfiAlgo": "Input- Output",
"source": "Non- volatile Memory"
},
{
"dest": "Encrypte d Non-",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "IMPORT PHSM 1",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "volatile Memory",
"distribution": "",
"entry": "",
"format": "",
"name": "",
"sfiAlgo": "",
"source": ""
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "IMPORT PHSM 2",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Encrypte d Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "IMPORT VHSM 1",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "IMPORT VHSM 2",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "INITIALIZE HSM",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Encrypte d Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "JOIN CLUSTER",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "LCD DISPLAY",
"sfiAlgo": "",
"source": "Volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "LOAD KEY",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "PREPARE JOIN CLUSTER",
"sfiAlgo": "Input- Output",
"source": "Encrypte d Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "QUERY",
"sfiAlgo": "Input- Output",
"source": "Non- volatile Memory"
},
{
"dest": "Encrypte d Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "REGISTER",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Encrypte d Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "REGISTER AUTHENTICATIO N CERTIFICATE",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "Non- volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "RENEW SERVER CERTIFICATE",
"sfiAlgo": "Input- Output",
"source": "External"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "RESET PASSWORD",
"sfiAlgo": "Input- Output",
"source": "Non- volatile Memory"
},
{
"dest": "External",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "START TOKEN AUTHENTICATIO N",
"sfiAlgo": "Input- Output",
"source": "Volatile Memory"
},
{
"dest": "Volatile Memory",
"distribution": "Manual",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "VOTE QUORUM AUTHENTICATIO N",
"sfiAlgo": "Input- Output",
"source": "External"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "It is the zeroisation processes executed when a unprotected SSP is the volatile memory is not required anymore",
"method": "AFTER USE ZEROISATION",
"operatorId": "No",
"rationale": "The zeroisation is applied in order to make the SSP irretrievable and not reusable"
},
{
"description": "It is the zeroisation of all PHSM SSPs",
"method": "PHSM ZEROISATION",
"operatorId": "Yes",
"rationale": "Since the PHSM represents all the information of the module, the zeroisation is applied in order to make the PHSM SSPs irretrievable and not reusable when the process is initiated by the Operator"
},
{
"description": "It is the zeroisation of all SSPs of a VHSM",
"method": "VHSM ZEROISATION",
"operatorId": "Yes",
"rationale": "Since the VHSM represents part of the information of the module, the zeroisation is applied in order to make the VHSM SSPs irretrievable and not reusable when the process is initiated by the Operator. When the PHSM ZEROISATION is applied, the VHSM ZEROISATION is applied as a consequence"
},
{
"description": "It is the zeroisation of all SSPs of a USER",
"method": "USER ZEROISATION",
"operatorId": "Yes",
"rationale": "Since the USER\u0027s SSPs reside in the module, the zeroisation is applied in order to make the USER SSPs irretrievable and not reusable when the process is initiated by the Operator. When the PHSM ZEROISATION or VHSM ZEROISATION is applied, the USER ZEROISATION is applied as a consequence"
},
{
"description": "It is the zeroisation of all SSPs of an OBJECT",
"method": "OBJECT ZEROISATION",
"operatorId": "Yes",
"rationale": "Since the OBJECT is a USER\u0027s SSPs, the zeroisation is applied in order to make the OBJECT SSPs irretrievable and not reusable when the process is"
},
{
"description": "",
"method": "",
"operatorId": "",
"rationale": "initiated by the Operator. When the PHSM ZEROISATION, VHSM ZEROISATION or USER ZEROISATION is applied, the OBJECT ZEROISATION is applied as a consequence"
},
{
"description": "It is the zeroisation of all SSPs stored in the Volatile Memory and Encrypted Volatile Memory",
"method": "SHUTDOWN ZEROISATION",
"operatorId": "Yes",
"rationale": "Since the SSPs stored in the volatile memory are not stored in the disk, the SHUTDOWN ZEROISATION guarantees that the SSPs are irretrievable and not reusable. The SHUTDOWN ZEROISATION process can be initiated either by the Operator or Automatically: if the module enters in Intrusion State, the shutdown is applied"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Read-only, non-volatile memory, internal to the CPU encapsulation",
"name": "One-time Programmable Memory",
"persistance": "Static"
},
{
"description": "Non-volatile memory, external to the CPU, but internal to the cryptographic boundary",
"name": "Non-volatile Memory",
"persistance": "Dynamic"
},
{
"description": "Non-volatile Memory where encrypted data is stored",
"name": "Encrypted Non-volatile Memory",
"persistance": "Dynamic"
},
{
"description": "Volatile memory, external to the CPU, but internal to the cryptographic boundary",
"name": "Volatile Memory",
"persistance": "Dynamic"
},
{
"description": "Volatile Memory where encrypted data is stored",
"name": "Encrypted Volatile Memory",
"persistance": "Dynamic"
},
{
"description": "CPU registers, internal to the CPU encapsulation",
"name": "CPU Registers",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "Unique version",
"fwVersion": "1.1.0",
"hwVersion": "1.1.0",
"modelPartNum": "ASI-HSM AHX5 kNET Cryptographic Module",
"processors": "C293 Crypto Coprocessor"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "SP 800-133r2 Section 4 Example #1, Section 5.1, Section 5.2 and Section 6.1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 25
},
"ECDSA": {
"ECDSA": 55
},
"EdDSA": {
"EdDSA": 1
}
},
"FF": {
"DSA": {
"DSA": 6
}
},
"RSA": {
"RSA 2048": 3
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 3
},
"CTR": {
"CTR": 2
},
"ECB": {
"ECB": 2
},
"GCM": {
"GCM": 3
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"TLS": {
"SSL": {
"SSL": 4
},
"TLS": {
"TLS": 195,
"TLS 1.2": 3,
"TLS v1.2": 1
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 10
},
"KEM": {
"KEM": 4
},
"MAC": {
"MAC": 19
}
},
"device_model": {},
"ecc_curve": {
"Edwards": {
"Ed25519": 2
},
"NIST": {
"NIST P-521": 2,
"P-160": 1,
"P-192": 2,
"P-224": 18,
"P-256": 32,
"P-320": 1,
"P-384": 30,
"P-512": 2,
"P-521": 28
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1
}
},
"fips_certlike": {
"Certlike": {
"AES 256": 1,
"DSA-44": 2,
"DSA-65": 2,
"DSA-87": 2,
"HMAC- SHA-1": 2,
"HMAC-SHA- 1": 2,
"HMAC-SHA-1": 4,
"HMAC-SHA1": 2,
"HMACSHA1": 1,
"PKCS#1": 2,
"RSA 2048": 3,
"SHA- 256": 1,
"SHA-1": 3,
"SHA-256": 4,
"SHA-384": 2,
"SHA2-224": 7,
"SHA2-256": 11,
"SHA2-384": 8,
"SHA2-512": 7,
"SHA3-224": 7,
"SHA3-256": 7,
"SHA3-384": 7,
"SHA3-512": 7
}
},
"fips_security_level": {
"Level": {
"Level 3": 1,
"level 3": 1
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 2
}
},
"SHA": {
"SHA1": {
"SHA-1": 3
},
"SHA2": {
"SHA-256": 4,
"SHA-384": 2
},
"SHA3": {
"SHA3-224": 7,
"SHA3-256": 7,
"SHA3-384": 7,
"SHA3-512": 7
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {
"FIPS": {
"ML-DSA": 40,
"ML-KEM": 38
}
},
"randomness": {
"PRNG": {
"DRBG": 51
},
"RNG": {
"RBG": 2,
"RNG": 7
},
"TRNG": {
"TRNG": 3
}
},
"side_channel_analysis": {
"FI": {
"Fault Induction": 2,
"malfunction": 1
}
},
"standard_id": {
"FIPS": {
"FIPS 140-2": 2,
"FIPS 140-3": 8,
"FIPS 180-4": 6,
"FIPS 186-5": 9,
"FIPS 198-1": 11,
"FIPS 202": 5,
"FIPS 203": 4,
"FIPS 204": 4,
"FIPS186-5": 31
},
"NIST": {
"SP 800-135": 1,
"SP 800-38A": 3,
"SP 800-38B": 1,
"SP 800-38D": 3,
"SP 800-38F": 2,
"SP 800-56A": 1,
"SP 800-67": 2,
"SP 800-90A": 1,
"SP 800-90B": 1
},
"PKCS": {
"PKCS#1": 1
},
"RFC": {
"RFC 5288": 1
},
"X509": {
"X.509": 18
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 30,
"AES-": 1
},
"CAST": {
"CAST": 88
}
},
"DES": {
"3DES": {
"TDES": 1
},
"DES": {
"DES": 2
}
},
"constructions": {
"MAC": {
"CBC-MAC": 1,
"HMAC": 21
}
}
},
"tee_name": {
"AMD": {
"PSP": 23
},
"IBM": {
"SE": 1,
"SSC": 6,
"Secure Execution": 2
}
},
"tls_cipher_suite": {},
"vendor": {
"STMicroelectronics": {
"STMicroelectronics": 2
}
},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"ML-DSA KeyGenA6066",
"HMAC-SHA2-224A6066",
"AES-GCMA6066",
"ECDSA SigGen (FIPS186-5)A6066",
"SHA2-256A6066",
"RSA SigGen (FIPS186-5)A6066",
"ML-KEM EncapDecapA6066",
"ECDSA KeyGen (FIPS186-5)A6066",
"HMAC-SHA2-256A6066",
"SHA2-512A6066",
"EDDSA SigVerA6066",
"SHA2-512/224A6066",
"HMAC-SHA2-512/256A6066",
"ML-KEM KeyGenA6066",
"SHA3-512A6066",
"SHA2-224A6066",
"SHA2-512/256A6066",
"HMAC-SHA3-384A6066",
"HMAC-SHA2-512A6066",
"AES-CMACA6066",
"RSA KeyGen (FIPS186-5)A6066",
"TDES-CBCA6066",
"SHA3-384A6066",
"HMAC-SHA2-512/224A6066",
"ECDSA SigVer (FIPS186-5)A6066",
"SHAKE-256A6066",
"SHA3-224A6066",
"ML-DSA SigGenA6066",
"ML-DSA SigVerA6066",
"EDDSA KeyGenA6066",
"AES-CBCA6066",
"HMAC-SHA3-256A6066",
"AES-CTRA6066",
"SHA2-384A6066",
"KDF TLSA6066",
"AES-ECBA6066",
"KAS-ECC-SSC Sp800-56Ar3A6066",
"SHA3-256A6066",
"HMAC-SHA3-224A6066",
"HMAC-SHA3-512A6066",
"EDDSA SigGenA6066",
"HMAC-SHA-1A6066",
"Conditioning Component AES-CBC-MAC SP800-90BA6066",
"HMAC-SHA2-384A6066",
"TDES-ECBA6066",
"RSA SigVer (FIPS186-5)A6066",
"AES-KWA6066",
"Hash DRBGA6066"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6066"
]
},
"policy_metadata": {
"/CreationDate": "D:20260518084711-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260518084711-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1950328,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 168
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "b4556779d11bb818c78a79a2a196a288c40fb9e075fc3a5539bc6f728cdc9180",
"source_hash": "d1053d01d123f688f67b0bb17309cccb09f6f7677071c5bf680c7e245f23336f",
"txt_hash": "f6ebe0db449880348d597f8ba0773c58a5a999440beca01584bfafd1f2e0a0a7"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section 11 of the Security Policy. When operated in approved mode.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/May 2026_030626_0716.pdf",
"date_sunset": "2031-05-19",
"description": "The ASI-HSM AHX5 kNET Cryptographic Module is a Hardware Security Module that provides cryptographic services with native implementation of the Key Management Interoperability Protocol to applications. The hardware is optimized for cryptographic operations along with proprietary firmware and software developed exclusively for the module. Its operators communicate with it via a standard Ethernet interface using IP protocols. The module is usually sold embedded within a stand-alone network appliance, which is typically used in large-scale cloud infrastructures, where ease of remote configuration and operation is required.",
"embodiment": "MultiChipStand",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 3,
"mentioned_certs": {},
"module_name": "ASI-HSM AHX5 kNET Cryptographic Module",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-05-20",
"lab": "EWA - Canada",
"validation_type": "Initial"
}
],
"vendor": "Kryptus",
"vendor_url": "http://www.kryptus.com"
}
}