Cloud Software Group
NetScaler MPX
Hardware Models: 8900 FIPS, 9100 FIPS, 9200 FIPS
Firmware Version: 14.1.FIPS
FIPS 140-3 Non-Proprietary Security Policy
FIPS Security Level: 2
Document Version: 0.4
Prepared for: Prepared by:
Cloud Software Group Corsec Security, Inc.
851 Cypress Creek Road 12600 Fair Lakes Circle, Suite 210
Fort Lauderdale, FL 33309 Fairfax, VA 22033
United States of America United States of America
Phone: +1 954 267 3000 Phone: +1 703 267 6050
www.cloud.com www.corsec.com
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 2 of 103
Table of Contents
1. General.................................................................................................................................................... 5
1.1 Overview................................................................................................................................................ 5
1.2 Security Levels........................................................................................................................................ 5
2. Cryptographic Module Specification ........................................................................................................ 7
2.1 Description............................................................................................................................................. 7
2.2 Tested and Vendor Affirmed Module Version and Identification ....................................................... 10
2.3 Excluded Components ......................................................................................................................... 10
2.4 Modes of Operation............................................................................................................................. 11
2.5 Algorithms............................................................................................................................................ 11
2.6 Security Function Implementations..................................................................................................... 18
2.7 Algorithm Specific Information............................................................................................................ 26
2.8 RNG and Entropy ................................................................................................................................. 27
2.9 Key Generation .................................................................................................................................... 28
2.10 Key Establishment................................................................................................................................ 28
2.11 Industry Protocols................................................................................................................................ 29
2.12 Additional Information ........................................................................................................................ 29
3. Cryptographic Module Interfaces........................................................................................................... 30
3.1 Ports and Interfaces............................................................................................................................. 30
4. Roles, Services, and Authentication ....................................................................................................... 34
4.1 Authentication Methods...................................................................................................................... 34
4.2 Roles..................................................................................................................................................... 35
4.3 Approved Services ............................................................................................................................... 36
4.4 Non-Approved Services ....................................................................................................................... 53
4.5 External Software/Firmware Loaded................................................................................................... 53
5. Software/Firmware Security.................................................................................................................. 54
5.1 Integrity Techniques ............................................................................................................................ 54
5.2 Initiate on Demand .............................................................................................................................. 54
6. Operational Environment ...................................................................................................................... 55
6.1 Operational Environment Type and Requirements............................................................................. 55
7. Physical Security .................................................................................................................................... 56
7.1 Mechanisms and Actions Required ..................................................................................................... 56
8. Non-Invasive Security ............................................................................................................................ 60
9. Sensitive Security Parameters Management .......................................................................................... 61
9.1 Storage Areas....................................................................................................................................... 61
9.2 SSP Input-Output Methods.................................................................................................................. 61
9.3 SSP Zeroization Methods ..................................................................................................................... 62
9.4 SSPs ...................................................................................................................................................... 63
9.5 Transitions............................................................................................................................................ 81
10. Self-Tests ............................................................................................................................................... 82
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 3 of 103
10.1 Pre-Operational Self-Tests................................................................................................................... 82
10.2 Conditional Self-Tests .......................................................................................................................... 82
10.3 Periodic Self-Test Information............................................................................................................. 89
10.4 Error States .......................................................................................................................................... 91
10.5 Operator Initiation of Self-Tests .......................................................................................................... 92
11. Life-Cycle Assurance .............................................................................................................................. 93
11.1 Installation, Initialization, and Startup Procedures ............................................................................. 93
11.2 Administrator Guidance....................................................................................................................... 96
11.3 Non-Administrator Guidance............................................................................................................... 97
11.4 Design and Rules.................................................................................................................................. 98
11.5 End of Life ............................................................................................................................................ 98
12. Mitigation of Other Attacks ................................................................................................................... 99
Appendix A. Acronyms and Abbreviations.................................................................................................... 100
List of Tables
Table 1: Security Levels ............................................................................................................................................. 6
Table 2: Tested Module Identification – Hardware................................................................................................. 10
Table 3: Modes List and Description ....................................................................................................................... 11
Table 4: Approved Algorithms - Data Plane ............................................................................................................ 13
Table 5: Approved Algorithms - Hardware.............................................................................................................. 14
Table 6: Approved Algorithms - Control Plane........................................................................................................ 17
Table 7: Approved Algorithms - CPU Jitter Entropy Source .................................................................................... 17
Table 8: Vendor-Affirmed Algorithms ..................................................................................................................... 17
Table 9: Non-Approved, Allowed Algorithms with No Security Claimed ................................................................ 17
Table 10: Security Function Implementations......................................................................................................... 25
Table 11: Entropy Certificates ................................................................................................................................. 27
Table 12: Entropy Sources....................................................................................................................................... 28
Table 13: Ports and Interfaces................................................................................................................................. 32
Table 14: Authentication Methods.......................................................................................................................... 35
Table 15: Roles ........................................................................................................................................................ 36
Table 16: Approved Services ................................................................................................................................... 53
Table 17: Mechanisms and Actions Required ......................................................................................................... 59
Table 18: Storage Areas........................................................................................................................................... 61
Table 19: SSP Input-Output Methods...................................................................................................................... 61
Table 20: SSP Zeroization Methods......................................................................................................................... 62
Table 21: SSP Table 1............................................................................................................................................... 71
Table 22: SSP Table 2............................................................................................................................................... 81
Table 23: Pre-Operational Self-Tests....................................................................................................................... 82
Table 24: Conditional Self-Tests .............................................................................................................................. 89
Table 25: Pre-Operational Periodic Information..................................................................................................... 89
Table 26: Conditional Periodic Information ............................................................................................................ 91
Table 27: Error States .............................................................................................................................................. 92
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 4 of 103
Table 28. Acronyms and Abbreviations................................................................................................................. 100
List of Figures
Figure 1. Typical MPX “Two-Arm” Topology ............................................................................................................. 8
Figure 2. NetScaler MPX 8900 FIPS Appliance .......................................................................................................... 9
Figure 3. NetScaler MPX 9100 FIPS Appliance .......................................................................................................... 9
Figure 4. NetScaler MPX 9200 FIPS Appliance ........................................................................................................ 10
Figure 5. NetScaler MPX 8900 FIPS Front Panel...................................................................................................... 30
Figure 6. NetScaler MPX 8900 FIPS Rear Panel ....................................................................................................... 30
Figure 7. NetScaler MPX 9100 FIPS Front Panel...................................................................................................... 31
Figure 8. NetScaler MPX 9100 FIPS Rear Panel ....................................................................................................... 31
Figure 9. NetScaler MPX 9200 FIPS Front Panel...................................................................................................... 31
Figure 10. NetScaler MPX 9200 FIPS Rear Panel ..................................................................................................... 32
Figure 11. Front Cover of the NetScaler MPX 8900 FIPS......................................................................................... 56
Figure 12. Back Panel of the NetScaler MPX 8900 FIPS .......................................................................................... 56
Figure 13. Left Side of the NetScaler MPX 8900 FIPS.............................................................................................. 56
Figure 14. Right Side of the NetScaler MPX 8900 FIPS............................................................................................ 57
Figure 15. Front Cover of the NetScaler MPX 9100 FIPS......................................................................................... 57
Figure 16. Back Panel of the NetScaler MPX 9100 FIPS .......................................................................................... 57
Figure 17. Left Side of the NetScaler MPX 9100 FIPS.............................................................................................. 57
Figure 18. Right Side of the NetScaler MPX 9100 FIPS............................................................................................ 58
Figure 19. Front Cover of the NetScaler MPX 9200 FIPS......................................................................................... 58
Figure 20. Back Panel of the NetScaler MPX 9200 FIPS .......................................................................................... 58
Figure 21. Left Side of the NetScaler MPX 9200 FIPS.............................................................................................. 58
Figure 22. Right Side of the NetScaler MPX 9200 FIPS............................................................................................ 59
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 5 of 103
1. General
1.1 Overview
This is a non-proprietary Cryptographic Module Security Policy for the NetScaler MPX (version 14.1.FIPS) from
Cloud Software Group (CSG). This Security Policy describes how the NetScaler MPX meets the security
requirements of Federal Information Processing Standards (FIPS) Publication 140-3, which details the U.S. and
Canadian government requirements for cryptographic modules. More information about the FIPS 140-3 standard
and validation program is available on the National Institute of Standards and Technology (NIST) and the Canadian
Centre for Cyber Security (CCCS) Cryptographic Module Validation Program (CMVP) website at
http://csrc.nist.gov/groups/STM/cmvp.
This document also describes how to operate the module in its Approved mode of operation. This policy was
prepared as part of the Level 2 FIPS 140-3 validation of the module. The NetScaler MPX is referred to in this
document as MPX or the module.
1.1.1 References
This document deals only with operations and capabilities of the module in the technical terms of a FIPS 140-3
cryptographic module security policy. More information is available on the module from the following sources:
• The CSG website www.cloud.com contains information on the full line of services and solutions from CSG.
• The search page on the CMVP website (https://csrc.nist.gov/Projects/cryptographic-module-validation-
program/Validated-Modules/Search) can be used to locate and obtain vendor contact information for
technical or sales-related questions about the module.
1.1.2 Document Organization
ISO/IEC 19790 Annex B uses the same section naming convention as ISO/IEC 19790 section 7 - Security
requirements. For example, Annex B section B.2.1 is named “General” and B.2.2 is named “Cryptographic module
specification,” which is the same as ISO/IEC 19790 section 7.1 and section 7.2, respectively. Therefore, the format
of this Security Policy is presented in the same order as indicated in Annex B, starting with “General” and ending
with “Mitigation of other attacks.” If sections are not applicable, they have been marked as such in this document.
1.2 Security Levels
The NetScaler MPX is validated at the FIPS 140-3 section levels shown in the table below.
Section Title Security Level
1 General 2
2 Cryptographic module specification 2
3 Cryptographic module interfaces 2
4 Roles, services, and authentication 3
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 6 of 103
Section Title Security Level
5 Software/Firmware security 2
6 Operational environment N/A
7 Physical security 2
8 Non-invasive security N/A
9 Sensitive security parameter management 2
10 Self-tests 2
11 Life-cycle assurance 2
12 Mitigation of other attacks N/A
Overall Level 2
Table 1: Security Levels
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 7 of 103
2. Cryptographic Module Specification
2.1 Description
2.1.1 Purpose and Use
The NetScaler product line optimizes delivery of applications over the Internet and private networks. It is an
Application Delivery Controller (ADC) that performs application-specific traffic analysis to intelligently distribute,
optimize, and secure L4-L71
network traffic for web-applications. All these capabilities are combined into a single,
integrated appliance for increased productivity, with lower overall total cost of ownership.
The NetScaler MPX is a hardware appliance consisting of a control plane processing function (providing all
configuration and management processing functions) and multiple data planes which provide data packet
processing functions. All configuration and management activities are performed at the workstation via the web-
based GUI2
, REST3
ful Nitro API4
, and CLI5
interfaces. The GUI includes a configuration utility for configuring the
appliance and a statistical utility called Dashboard.
In a typical installation (see Figure 1 for an illustration of a typical “two-arm” topology), the NetScaler MPX is
installed in the data center between the clients and the internal customer network so that client requests and
server responses pass through it. Administrators enable appliance features and apply configured policies to
incoming and outgoing traffic.
1
L4-L7 – Layer 4 – Layer 7
2
GUI – Graphical User Interface
3
REST – Representational State Transfer
4
API – Application Programming Interface
5
CLI – Command Line Interface
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 8 of 103
Figure 1. Typical MPX “Two-Arm” Topology
The internal customer network hosts all load-balancing and authentication services, such as LDAP6
, Kerberos, and
SAML7
.
The feature set can be broadly categorized as consisting of switching features, security and protection features,
and server-farm optimization features:
• Switching features – When deployed in front of application servers, the NetScaler ensures optimal
distribution of traffic by the way in which it directs client requests. Administrators can segment application
traffic according to information in the body of an HTTP8
or TCP9
request, and on the basis of L4–L7 header
information such as URL10
, application data type, or cookie. Numerous load balancing algorithms and
extensive server health checks improve application availability by ensuring that client requests are
directed to the appropriate servers.
• Security and protection features – NetScaler’s security and protection features protect web applications
from Application Layer attacks. NetScaler allows legitimate client requests and can block malicious
requests. It provides built-in defenses against denial-of-service (DoS) attacks and supports features that
protect against legitimate surges in application traffic that would otherwise overwhelm the servers. An
available built-in firewall protects web applications from Application Layer attacks, including buffer
overflow exploits, SQL11
injection attempts, cross-site scripting attacks, and more. In addition, the firewall
provides identity theft protection by securing confidential corporate information and sensitive customer
data.
6
LDAP – Lightweight Directory Access Protocol
7
SAML – Security Assurance Markup Language
8
HTTP – Hypertext Transfer Protocol
9
TCP – Transmission Control Protocol
10
URL – Uniform Resource Locator
11
SQL – Structured Query Language
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 9 of 103
• Optimization features – Optimization features offload resource-intensive operations, such as SSL 12
processing, data compression, client keep-alive, TCP buffering, and the caching of static and dynamic
content from servers. This improves the performance of the servers in the server farm and therefore
speeds up applications. NetScaler supports several transparent TCP optimizations, which mitigate
problems caused by high latency and congested network links, accelerating the delivery of applications
while requiring no configuration changes to clients or servers.
These appliances employ a multi-core processor design and are available in a wide range of appliance
configurations, from sub gigabit throughput to 50 Gbps13
. Each leverages a fully hardened and secure operating
system.
2.1.2 Module Type
The module is a Hardware module.
2.1.3 Module Embodiment
The module has a Multi-Chip Standalone embodiment.
2.1.4 Cryptographic Boundary
The module’s cryptographic boundary is defined by its hard enclosure (shown in Figure 2, Figure 3, and Figure 4
below). This includes all ports, physical interfaces, and removable covers.
Figure 2. NetScaler MPX 8900 FIPS Appliance
Figure 3. NetScaler MPX 9100 FIPS Appliance
12
SSL – Secure Sockets Layer
13
Gbps – Gigabits per second
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 10 of 103
Figure 4. NetScaler MPX 9200 FIPS Appliance
2.2 Tested and Vendor Affirmed Module Version and
Identification
2.2.1 Tested Module Identification – Hardware
The module was tested and found to be compliant with FIPS 140-3 requirements using the hardware versions
listed in the table below.
Model and/or Part
Number
Hardware
Version
Firmware
Version
Processors Features
NetScaler MPX 8900 8900-FIPS 14.1.FIPS Intel® Xeon® E5-2620 v4 (Broadwell) N/A
NetScaler MPX 9100 9100-FIPS 14.1.FIPS Intel® Xeon® Silver 4310T (Ice Lake) N/A
NetScaler MPX 9200 9200-FIPS 14.1.FIPS Intel® Xeon® Silver 4516Y+ (Emerald Rapids) N/A
Table 2: Tested Module Identification – Hardware
2.2.2 Tested Module Identification – Software, Firmware, Hybrid
(Executable Code Sets)
Not applicable. The module is a hardware module.
2.2.3 Tested Module Identification – Hybrid Disjoint Hardware
Not applicable. The module is a hardware module.
2.2.4 Tested Module Identification – Software, Firmware, Hybrid
Not applicable. The module is a hardware module.
2.2.5 Vendor-Affirmed Operational Environments - Software,
Firmware, Hybrid
Not applicable. The module is a hardware module.
2.3 Excluded Components
The module does not exclude any components from the requirements.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 11 of 103
2.4 Modes of Operation
2.4.1 Modes List and Description
The module supports the modes of operation listed in the table below.
Mode
Name
Description Type
Status
Indicator
Approved When installed, initialized, and operated according to Section 11.1 of the Security Policy, the
Approved mode is the only supported mode of operation of the module.
Approved Global
Indicator
Table 3: Modes List and Description
2.5 Algorithms
2.5.1 Approved Algorithms
The module includes the following cryptographic libraries that provide basic cryptographic functionalities and
support secure networking protocols:
• NetScaler Control Plane Cryptographic Library version 2.0 (Cert. A7126)
• NetScaler Data Plane Cryptographic Library version 1.0 (Cert. A3943)
• NetScaler CPU Jitter Entropy Source version 3.4.0 (Cert. A3513)
• Intel Hardware Cryptographic Accelerator version 1.0 (Cert. A3944)
The module implements the Approved algorithms listed in the table below.
Data Plane
Algorithm CAVP Cert Properties Reference
AES-CBC A3943 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A3943 Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 256
Tag Length - 104, 112, 120, 128, 32, 64, 96
IV Length - IV Length: 96, 128
Payload Length - Payload Length: 504, 512, 1016, 1024
AAD Length - AAD Length: 0, 504, 512, 1016, 1024
SP 800-38D
ECDSA KeyGen
(FIPS186-4)
A3943 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen
(FIPS186-5)
A3943 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyVer (FIPS186-
4)
A3943 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer (FIPS186-
5)
A3943 Curve - P-224, P-256, P-384, P-521 FIPS 186-5
ECDSA SigGen (FIPS186-
4)
A3943 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-4
ECDSA SigGen (FIPS186-
5)
A3943 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 12 of 103
Algorithm CAVP Cert Properties Reference
ECDSA SigVer (FIPS186-
4)
A3943 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-4
ECDSA SigVer (FIPS186-
5)
A3943 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
Hash DRBG A3943 Prediction Resistance - No, Yes
Supports Reseed - Yes
Mode - SHA2-256
Entropy Input - Entropy Input: 256
Nonce - Nonce: 128
Personalization String Length - Personalization String Length: 0-256
Increment 8
Additional Input - Additional Input: 0-256 Increment 8
Returned Bits - 1024
SP 800-90A Rev.
1
HMAC-SHA-1 A3943 MAC - MAC: 160, MAC: 80, 96, 128, 160
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-224 A3943 MAC - MAC: 112, 128, 160, 192, 224, MAC: 224
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-256 A3943 MAC - MAC: 128, 192, 256, MAC: 256
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-384 A3943 MAC - MAC: 192, 256, 320, 384, MAC: 384
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-512 A3943 MAC - MAC: 256, 320, 384, 448, 512, MAC: 512
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
KAS-ECC-SSC Sp800-
56Ar3
A3943 Domain Parameter Generation Methods - P-224, P-256, P-384, P-521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A Rev.
3
KDF TLS (CVL) A3943 TLS Version - v1.0/1.1, v1.2
Hash Algorithm - SHA2-256, SHA2-384
SP 800-135 Rev.
1
KTS-IFC A3943 Function - keyPairGen, partialVal
IUT ID - CAFECAFE
Modulo - 2048, 4096
Key Generation Methods - rsakpg1-basic
Fixed Public Exponent - 010001
Scheme -
KTS-OAEP-basic -
KAS Role - initiator, responder
Key Transport Method -
Hash Algorithms - SHA-1
Supports Null Associated Data - Yes
Associated Data Pattern -
Associated Data Encoding - concatenation
Key Length - 384
SP 800-56B Rev.
2
RSA SigGen (FIPS186-4) A3943 Signature Type - PKCS 1.5
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigGen (FIPS186-5) A3943 Hash Pair -
Hash Algorithm - SHA2-224
Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
FIPS 186-5
RSA SigVer (FIPS186-2) A3943 Public Exponent Mode - Random
Signature Type - PKCS 1.5
Modulo - 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 13 of 103
Algorithm CAVP Cert Properties Reference
RSA SigVer (FIPS186-4) A3943 Signature Type - PKCS 1.5
Modulo - 1024, 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer (FIPS186-5) A3943 Hash Pair -
Hash Algorithm - SHA2-224
Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
Fixed Public Exponent - 010001
Public Exponent Mode - fixed
FIPS 186-5
SHA-1 A3943 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-224 A3943 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-256 A3943 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-384 A3943 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
SHA2-512 A3943 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
TLS v1.2 KDF RFC7627
(CVL)
A3943 Hash Algorithm - SHA2-256, SHA2-384
Key Block Length - Key Block Length: 1024
SP 800-135 Rev.
1
TLS v1.3 KDF (CVL) A3943 HMAC Algorithm - SHA2-256, SHA2-384
KDF Running Modes - DHE, PSK, PSK-DHE
SP 800-135 Rev.
1
Table 4: Approved Algorithms - Data Plane
Hardware
Algorithm CAVP Cert Properties Reference
AES-CBC A3944 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-GCM A3944 Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 256
Tag Length - 104, 112, 120, 128, 32, 64, 96
IV Length - IV Length: 96
Payload Length - Payload Length: 504, 512, 1016, 1024
AAD Length - AAD Length: 504, 512, 1016, 1024
SP 800-38D
ECDSA KeyGen (FIPS186-
4)
A3944 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - Testing Candidates
FIPS 186-4
ECDSA KeyGen (FIPS186-
5)
A3944 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyVer (FIPS186-4) A3944 Curve - P-224, P-256, P-384, P-521 FIPS 186-4
ECDSA KeyVer (FIPS186-5) A3944 Curve - P-224, P-256, P-384, P-521 FIPS 186-5
ECDSA SigGen (FIPS186-4) A3944 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-4
ECDSA SigGen (FIPS186-5) A3944 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
ECDSA SigVer (FIPS186-4) A3944 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-
512
FIPS 186-4
ECDSA SigVer (FIPS186-5) A3944 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-224, SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
HMAC-SHA-1 A3944 MAC - MAC: 160, MAC: 80, 96, 128, 160
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-224 A3944 MAC - MAC: 112, 128, 160, 192, 224, MAC: 224
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-256 A3944 MAC - MAC: 128, 192, 256, MAC: 256
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 14 of 103
Algorithm CAVP Cert Properties Reference
HMAC-SHA2-384 A3944 MAC - MAC: 192, 256, 320, 384, MAC: 384
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-512 A3944 MAC - MAC: 256, 320, 384, 448, 512, MAC: 512
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
KAS-ECC-SSC Sp800-56Ar3 A3944 Domain Parameter Generation Methods - P-224, P-256, P-384, P-
521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A Rev.
3
KDF TLS (CVL) A3944 TLS Version - v1.0/1.1, v1.2
Hash Algorithm - SHA2-256, SHA2-384
SP 800-135 Rev.
1
RSA SigGen (FIPS186-4) A3944 Signature Type - PKCS 1.5
Modulo - 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
FIPS 186-4
RSA SigGen (FIPS186-5) A3944 Hash Pair -
Hash Algorithm - SHA2-224
Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
FIPS 186-5
RSA SigVer (FIPS186-4) A3944 Signature Type - PKCS 1.5
Modulo - 1024, 2048, 3072, 4096
Hash Pair -
Hash Algorithm - SHA2-224
Public Exponent Mode - Fixed
Fixed Public Exponent - 010001
FIPS 186-4
RSA SigVer (FIPS186-5) A3944 Hash Pair -
Hash Algorithm - SHA2-224
Modulo - 2048, 3072, 4096
Signature Type - pkcs1v1.5
Fixed Public Exponent - 010001
Public Exponent Mode - fixed
FIPS 186-5
SHA-1 A3944 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-224 A3944 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-256 A3944 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-384 A3944 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
SHA2-512 A3944 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
TLS v1.2 KDF RFC7627
(CVL)
A3944 Hash Algorithm - SHA2-256, SHA2-384
Key Block Length - Key Block Length: 1024
SP 800-135 Rev.
1
Table 5: Approved Algorithms - Hardware
Control Plane
Algorithm
CAVP
Cert
Properties Reference
AES-CBC A7126 Direction - Decrypt, Encrypt
Key Length - 128, 192, 256
SP 800-38A
AES-CFB128 A7126 Direction - Decrypt, Encrypt
Key Length - 128
SP 800-38A
AES-CTR A7126 Direction - Encrypt
Key Length - 128, 192, 256
Payload Length - Payload Length: 128
Supports Counter larger than maximum value - Yes
Incremental Counter - Yes
Counter Tests Performed - Yes
SP 800-38A
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 15 of 103
Algorithm
CAVP
Cert
Properties Reference
AES-GCM A7126 Direction - Decrypt, Encrypt
IV Generation - Internal
IV Generation Mode - 8.2.1
Key Length - 128, 256
Tag Length - 104, 112, 120, 128, 32, 64, 96
IV Length - IV Length: 96, 128
Payload Length - Payload Length: 504, 512, 1016, 1024
AAD Length - AAD Length: 0, 504, 512, 1016, 1024
SP 800-38D
Counter DRBG A7126 Prediction Resistance - No, Yes
Supports Reseed - Yes
Mode - AES-256
Derivation Function Enabled - No, Yes
Additional Input - Additional Input: 0-256 Increment 8, Additional Input: 0-384 Increment
8
Entropy Input - Entropy Input: 256, Entropy Input: 384
Nonce - Nonce: 0, Nonce: 128
Personalization String Length - Personalization String Length: 0-256 Increment 8,
Personalization String Length: 0-384 Increment 8
Returned Bits - 512
SP 800-90A
Rev. 1
ECDSA
KeyGen
(FIPS186-5)
A7126 Curve - P-224, P-256, P-384, P-521
Secret Generation Mode - testing candidates
FIPS 186-5
ECDSA KeyVer
(FIPS186-5)
A7126 Curve - P-224, P-256, P-384, P-521 FIPS 186-5
ECDSA SigGen
(FIPS186-5)
A7126 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
ECDSA SigVer
(FIPS186-4)
A7126 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA-1
FIPS 186-4
ECDSA SigVer
(FIPS186-5)
A7126 Curve - P-224, P-256, P-384, P-521
Hash Algorithm - SHA2-256, SHA2-384, SHA2-512
FIPS 186-5
HMAC-SHA-1 A7126 MAC - MAC: 160
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-
256
A7126 MAC - MAC: 256
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-
384
A7126 MAC - MAC: 384
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
HMAC-SHA2-
512
A7126 MAC - MAC: 512
Key Length - Key Length: 8-512 Increment 8
FIPS 198-1
KAS-ECC-SSC
Sp800-56Ar3
A7126 Domain Parameter Generation Methods - P-224, P-256, P-384, P-521
Scheme -
ephemeralUnified -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KAS-FFC-SSC
Sp800-56Ar3
A7126 Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144,
MODP-2048, MODP-3072, MODP-4096, MODP-6144
Scheme -
dhEphem -
KAS Role - initiator, responder
SP 800-56A
Rev. 3
KDF IKEv1
(CVL)
A7126 Authentication Method - Pre-shared Key
Initiator Nonce Length - Initiator Nonce Length: 128
Responder Nonce Length - Responder Nonce Length: 128
Preshared Key Length - Preshared Key Length: 64-504 Increment 8
Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048
Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512
SP 800-135
Rev. 1
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 16 of 103
Algorithm
CAVP
Cert
Properties Reference
KDF IKEv2
(CVL)
A7126 Initiator Nonce Length - Initiator Nonce Length: 256
Responder Nonce Length - Responder Nonce Length: 256
Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 2048
Derived Keying Material Length - Derived Keying Material Length: 1056-3072 Increment 8
Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512
SP 800-135
Rev. 1
KDF SNMP
(CVL)
A7126 Password Length - Password Length: 64-248 Increment 8
Engine ID - 800002b805123456789abcdef0123456789abcdef0123456789abcdef0123456,
80000b3f0300106b02fe55
SP 800-135
Rev. 1
KDF SSH (CVL) A7126 Cipher - AES-128, AES-192, AES-256
Hash Algorithm - SHA2-256, SHA2-512
SP 800-135
Rev. 1
KTS-IFC A7126 Function - keyPairGen, partialVal
IUT ID - CAFECAFE
Modulo - 2048
Key Generation Methods - rsakpg1-basic
Fixed Public Exponent - 010001
Scheme -
KTS-OAEP-basic -
KAS Role - initiator, responder
Key Transport Method -
Hash Algorithms - SHA-1
Supports Null Associated Data - Yes
Associated Data Pattern -
Associated Data Encoding - concatenation
Key Length - 384
SP 800-56B
Rev. 2
PBKDF A7126 Iteration Count - Iteration Count: 10-10000 Increment 1
HMAC Algorithm - SHA-1
Password Length - Password Length: 8-128 Increment 1
Salt Length - Salt Length: 128-4096 Increment 8
Key Data Length - Key Data Length: 112-4096 Increment 8
SP 800-132
RSA KeyGen
(FIPS186-5)
A7126 Key Generation Mode - probableWithProbableAux
Modulo - 2048, 3072, 4096
p mod 8 - 0
Primality Tests - 2powSecStr
q mod 8 - 0
Info Generated By Server - Yes
Private Key Format - standard
Public Exponent Mode - random
FIPS 186-5
RSA SigGen
(FIPS186-5)
A7126 Hash Pair -
Hash Algorithm - SHA2-256
Modulo - 2048, 3072
Signature Type - pkcs1v1.5
FIPS 186-5
RSA SigVer
(FIPS186-4)
A7126 Signature Type - PKCS 1.5
Modulo - 2048, 3072
Hash Pair -
Hash Algorithm - SHA-1
Public Exponent Mode - Random
FIPS 186-4
RSA SigVer
(FIPS186-5)
A7126 Hash Pair -
Hash Algorithm - SHA2-256
Modulo - 2048, 3072
Signature Type - pkcs1v1.5
Public Exponent Mode - random
FIPS 186-5
Safe Primes
Key
Generation
A7126 Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, MODP-2048, MODP-
3072, MODP-4096, MODP-6144
SP 800-56A
Rev. 3
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 17 of 103
Algorithm
CAVP
Cert
Properties Reference
Safe Primes
Key
Verification
A7126 Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, MODP-2048, MODP-
3072, MODP-4096, MODP-6144
SP 800-56A
Rev. 3
SHA-1 A7126 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-256 A7126 Message Length - Message Length: 8-51200 Increment 8 FIPS 180-4
SHA2-384 A7126 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
SHA2-512 A7126 Message Length - Message Length: 8-65536 Increment 8 FIPS 180-4
TLS v1.2 KDF
RFC7627 (CVL)
A7126 Hash Algorithm - SHA2-256, SHA2-384
Key Block Length - Key Block Length: 1024
SP 800-135
Rev. 1
Table 6: Approved Algorithms - Control Plane
CPU Jitter Entropy Source
Algorithm CAVP Cert Properties Reference
SHA3-256 A3513 Message Length - Message Length: 0-65528 Increment 8 FIPS 202
Table 7: Approved Algorithms - CPU Jitter Entropy Source
2.5.2 Vendor Affirmed Algorithms
The table below lists the vendor-affirmed security methods.
Name Properties Implementation Reference
CKG (Control Plane -
VA)
CKG:Symmetric NetScaler Control Plane Cryptographic
Library
SP 800-133 Rev. 2, sections 4
and 6.3
CKG (Data Plane -
VA)
CKG:Symmetric NetScaler Data Plane Cryptographic
Library
SP 800-133 Rev. 2, section 4
CKG (KEK) CKG:Combining keys and other
data
NetScaler Control Plane Cryptographic
Library
NIST SP 800-133rev2, Section
6.3
Table 8: Vendor-Affirmed Algorithms
2.5.3 Non-Approved, Allowed Algorithms
The module does not implement any non-Approved algorithms allowed in the Approved mode of operation.
N/A for this module.
2.5.4 Non-Approved, Allowed Algorithms with No Security Claimed
The table below lists the non-Approved algorithms implemented by the module that are allowed for use in the
Approved mode of operation with no security claimed.
Name Caveat Use and Function
MD5 (NetScaler Control Plane Cryptographic Library) N/A Message digest in TLS 1.0/1.1 handshake on the control plane
MD5 (NetScaler Data Plane Cryptographic Library) N/A Message digest in TLS 1.0/1.1 handshake on the data plane
Table 9: Non-Approved, Allowed Algorithms with No Security Claimed
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 18 of 103
2.5.5 Non-Approved, Not Allowed Algorithms
The module does not include any non-Approved algorithms that are not allowed in the Approved mode of
operation.
N/A for this module.
2.6 Security Function Implementations
The table below lists the security function implementations for this module.
Name Type Description Properties Algorithms
AES for Disk Encryption BC-Auth Used for
encrypting/decrypting
passwords and
passphrases using KEK
Publication:SP 800-38A AES-GCM: (A7126)
Key Length: 256
AES for Data Encryption BC-UnAuth Used for general
encryption/decryption
using the AES Key
Publication :SP 800-38A AES-CBC: (A3943)
CKG (KEK) CKG Used for generation of
the KEK by combining
multiple keys/other
data
Publication:NIST SP 800-
90B, SP 800-133 Rev. 2,
Section 6.3
Counter DRBG: (A7126)
SHA3-256: (A3513)
Key Generation for TLS
Ticket Keys (DP)
KAS-135KDF Used for generation of
the TLS Ticket
Encryption Key and TLS
Ticket Authentication
Key
Publication:SP 800-135
Rev. 1
Hash DRBG: (A3943)
AES for TLS Tickets BC-UnAuth Used for encryption and
decryption of TLS
session resumption
tickets using the TLS
Ticket Encryption Key
Publication:SP 800-38A AES-CBC: (A3943)
Key Length: 128
Hash DRBG: (A3943)
HMAC for TLS Tickets MAC Used for authentication
of TLS session
resumption tickets for
using the TLS Ticket
Authentication Key
Publication:FIPS 198-1 HMAC-SHA2-256:
(A3943)
SHA2-256: (A3943)
Key Generation for SSH
Authentication (CP)
AsymKeyPair-KeyGen Used for generation of
SSH Public Key and SSH
Private Key for
authenticating SSH
sessions
Publication :FIPS 186-5 ECDSA KeyGen
(FIPS186-5): (A7126)
RSA KeyGen (FIPS186-
5): (A7126)
Counter DRBG: (A7126)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 19 of 103
Name Type Description Properties Algorithms
DH Key Agreement for
SSH (CP)
KAS-Full Used for derivation of
the SSH Session Key and
SSH Authentication Key
(includes shared secret
computation and key
derivation)
Publication:SP 800-56
Rev. 3
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 256
bits of encryption
strength
Caveat:No part of the
SSH protocol, other
than the KDF, has been
tested by the CAVP and
CMVP.
KDF SSH: (A7126)
KAS-FFC-SSC Sp800-
56Ar3: (A7126)
Safe Primes Key
Generation: (A7126)
Safe Primes Key
Verification: (A7126)
ECDH Key Agreement
for SSH (CP)
KAS-Full Used for derivation of
the SSH Session Key and
SSH Authentication Key
(includes shared secret
computation and key
derivation)
Publication:FIPS 186-5,
SP 800-56 Rev. 3
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:: IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 256
bits of encryption
strength
Caveat:No part of the
SSH protocol, other
than the KDF, has been
tested by the CAVP and
CMVP.
KDF SSH: (A7126)
KAS-ECC-SSC Sp800-
56Ar3: (A7126)
Curve: P-256, P-384, P-
521
ECDSA KeyGen
(FIPS186-5): (A7126)
Curve : P-256, P-384, P-
521
ECDSA KeyVer (FIPS186-
5): (A7126)
Curve : P-256, P-384, P-
521
Counter DRBG: (A7126)
SHA2-256: (A7126)
SHA2-384: (A7126)
SHA2-512: (A7126)
AES for SSH (CP) BC-Auth Used for encryption and
decryption of SSH
session packets using
the SSH Session Key
Publication:SP 800-38A AES-CTR: (A7126)
Key Length: 128, 256
AES-GCM: (A7126)
Key Length: 128, 256
Counter DRBG: (A7126)
HMAC for SSH (CP) MAC Used for authentication
of SSH session packets
using the SSH
Authentication Key
Publication:FIPS 198-1,
SP 800-107 Rev. 1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA2-256:
(A7126)
HMAC-SHA2-512:
(A7126)
SHA2-256: (A7126)
SHA2-512: (A7126)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 20 of 103
Name Type Description Properties Algorithms
DH Key Agreement for
IKE (CP)
KAS-Full Used for derivation of
the IKEv1/IKEv2 Session
Keys and IKEv1/IKEv2
Authentication Keys
(includes key pair
generation, DH shared
secret computation, and
protocol key derivation)
Publication:SP 800-56
Rev. 3
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 176
bits of encryption
strength.
Caveat:No part of the
IKEv1 and IKEv2
protocols, other than
the KDFs, have been
tested by the CAVP and
CMVP.
KDF IKEv1: (A7126)
KDF IKEv2: (A7126)
KAS-FFC-SSC Sp800-
56Ar3: (A7126)
Domain Parameter
Generation Methods:
MODP-2048, MODP-
3072, MODP-6144
Counter DRBG: (A7126)
Safe Primes Key
Generation: (A7126)
Safe Prime Groups:
MODP-2048, MODP-
3072, MODP-6144
Safe Primes Key
Verification: (A7126)
Safe Prime Groups:
MODP-2048, MODP-
3072, MODP-6144
SHA-1: (A7126)
SHA2-256: (A7126)
SHA2-384: (A7126)
SHA2-512: (A7126)
AES for IKE/IPsec (CP) BC-UnAuth Used for encryption and
decryption of IKE/IPsec
session packets using
the IKEv1/IKEv2/IPsec
Session Keys
Publication:SP 800-38A AES-CBC: (A7126)
Counter DRBG: (A7126)
HMAC for IKE/IPsec (CP) MAC Used for authentication
of IKE/IPsec session
packets using the
IKEv1/IKEv2/IPsec
Authentication Keys
Publication :FIPS 198-1
Caveat:: The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A7126,
A3943)
HMAC-SHA2-256:
(A7126)
HMAC-SHA2-384:
(A7126)
HMAC-SHA2-512:
(A7126)
SHA-1: (A7126)
SHA2-256: (A7126)
SHA2-384: (A7126)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 21 of 103
Name Type Description Properties Algorithms
HMAC for Message
Authentication
MAC Used for message
authentication using
HMAC key
Publication:FIPS PUB
198-1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A3943,
A3944)
HMAC-SHA2-224:
(A3943, A3944)
HMAC-SHA2-256:
(A3943, A3944)
HMAC-SHA2-384:
(A3943, A3944)
HMAC-SHA2-512:
(A3943, A3944)
SHA-1: (A3943, A3944)
SHA2-224: (A3943,
A3944)
SHA2-256: (A3943,
A3944)
SHA2-384: (A3943,
A3944)
SHA2-512: (A3943,
A3944)
SigGen for TLS
Authentication (CP)
DigSig-SigGen Used to generate
ECDSA/RSA signatures
during the TLS
handshake on the
control plane
Publication:FIPS 186-5 ECDSA SigGen (FIPS186-
5): (A7126)
RSA SigGen (FIPS186-5):
(A7126)
SigVer for TLS
Authentication (CP)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the
control plane
Publication:FIPS 186-5 ECDSA SigVer (FIPS186-
5): (A7126)
RSA SigVer (FIPS186-5):
(A7126)
SigVer for TLS
Authentication (CP)
(legacy)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the
control plane
Publication:FIPS 186-4 ECDSA SigVer (FIPS186-
4): (A7126)
RSA SigVer (FIPS186-4):
(A7126)
SigGen for TLS
Authentication (DP-FW)
DigSig-SigGen Used to generate
ECDSA/RSA signatures
during the TLS
handshake on the data
plane
Publication:FIPS 186-4,
FIPS 186-5
ECDSA SigGen (FIPS186-
4): (A3943)
ECDSA SigGen (FIPS186-
5): (A3943)
RSA SigGen (FIPS186-4):
(A3943)
RSA SigGen (FIPS186-5):
(A3943)
SigVer for TLS
Authentication (DP-FW)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the data
plane
Publication:FIPS 186-5 ECDSA SigVer (FIPS186-
5): (A3943)
RSA SigVer (FIPS186-5):
(A3943)
SigVer for TLS
Authentication (DP-FW)
(legacy)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the data
plane.
Publication:FIPS 186-4 ECDSA SigVer (FIPS186-
4): (A3943)
Curve: P-224, P-256, P-
384, P-521
Hash Algorithm: SHA-1
RSA SigVer (FIPS186-4):
(A3943)
Modulo: 1024
Hash Pair:
Hash Algorithm: SHA-1
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 22 of 103
Name Type Description Properties Algorithms
DH Key Agreement for
TLS (CP)
KAS-Full Used to derive the TLS
Session Key and TLS
Authentication Key
(includes key pair
generation, DH shared
secret computation, and
protocol key derivation
ion)
Publication:RFC 7627
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 176
bits of encryption
strength.
Caveat:No part of the
TLS protocols, other
than the KDF, has been
tested by the CAVP and
CMVP.
TLS v1.2 KDF RFC7627:
(A7126)
KAS-FFC-SSC Sp800-
56Ar3: (A7126)
Domain Parameter
Generation Methods:
ffdhe2048, ffdhe3072,
ffdhe4096, ffdhe6144
Counter DRBG: (A7126)
Safe Primes Key
Generation: (A7126)
Safe Primes Key
Verification: (A7126)
Safe Prime Groups:
ffdhe2048, ffdhe3072,
ffdhe4096, ffdhe6144
SHA2-256: (A7126)
Safe Prime Groups:
ffdhe2048, ffdhe3072,
ffdhe4096, ffdhe6144
SHA2-384: (A7126)
ECDH Key Agreement
for TLS (CP)
KAS-Full Used to derive the TLS
Session Key and TLS
Authentication Key
(includes key pair
generation, ECDH
shared secret
computation, and
protocol key derivation)
Publication:FIPS 186-5,
RFC 7627
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 256
bits of encryption
strength
Caveat:No part of the
TLS protocols, other
than the KDFs, have
been tested by the
CAVP and CMVP.
TLS v1.2 KDF RFC7627:
(A7126)
KAS-ECC-SSC Sp800-
56Ar3: (A7126)
Counter DRBG: (A7126)
ECDSA KeyGen
(FIPS186-5): (A7126)
ECDSA KeyVer (FIPS186-
5): (A7126)
SHA2-256: (A7126)
SHA2-384: (A7126)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 23 of 103
Name Type Description Properties Algorithms
ECDH Key Agreement
for TLS (DP-FW)
KAS-Full Used to derive the TLS
Session Key and TLS
Authentication Key
(includes key pair
generation, ECDH
shared secret
computation, and
protocol key derivation)
Publication:FIPS 186-4,
FIPS 186-5, RFC 7627,
RFC 8446
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 256
bits of encryption
strength
Caveat:No part of the
TLS protocols, other
than the KDFs, have
been tested by the
CAVP and CMVP.
KDF TLS: (A3943)
TLS v1.2 KDF RFC7627:
(A3943)
TLS v1.3 KDF: (A3943)
KAS-ECC-SSC Sp800-
56Ar3: (A3943)
Hash DRBG: (A3943)
ECDSA KeyGen
(FIPS186-4): (A3943)
ECDSA KeyGen
(FIPS186-5): (A3943)
ECDSA KeyVer (FIPS186-
4): (A3943)
ECDSA KeyVer (FIPS186-
5): (A3943)
SHA2-256: (A3943)
SHA2-384: (A3943)
ECDH Key Agreement
for TLS (DP-HW)
KAS-Full Used to derive the TLS
Session Key and TLS
Authentication Key
(includes key pair
generation, ECDH
shared secret
computation, and
protocol key derivation)
Publication:FIPS 186-4,
FIPS 186-5, RFC 7627
IG:IG D.F Scenario 2
path (2), split
Key confirmation:no
Key derivation:IG 2.4.B
SP 800-135rev1 CVL
Key Strength:Key
establishment
methodology provides
between 112 and 256
bits of encryption
strength
Caveat:No part of the
TLS protocols, other
than the KDFs, have
been tested by the
CAVP and CMVP.
TLS v1.2 KDF RFC7627:
(A3944)
KAS-ECC-SSC Sp800-
56Ar3: (A3944)
Hash DRBG: (A3943)
ECDSA KeyGen
(FIPS186-4): (A3944)
ECDSA KeyGen
(FIPS186-5): (A3944)
ECDSA KeyVer (FIPS186-
5): (A3944)
ECDSA KeyVer (FIPS186-
4): (A3944)
SHA2-256: (A3944)
SHA2-384: (A3944)
KDF TLS: (A3944)
RSA Key Transport for
TLS (CP)
KTS-Encap Used for transporting a
TLS Session Key and TLS
Authentication Key
(includes key pair
generation and key
encapsulation)
Publication:FIPS 186-5,
SP 800-56B Rev. 2
Key Strength:Key
establishment
methodology provides
112 bits of encryption
strength
KTS-IFC: (A7126)
Modulo: 2048
Counter DRBG: (A7126)
RSA KeyGen (FIPS186-
5): (A7126)
RSA Key Transport for
TLS (DP-FW)
KTS-Encap Used for transporting a
TLS Session Key and TLS
Authentication Key
(includes key pair
generation and key
encapsulation)
Publication:FIPS 186-5,
SP 800-56B Rev. 2
Key Strength:Key
establishment
methodology provides
112 bits of encryption
strength
KTS-IFC: (A3943)
Hash DRBG: (A3943)
RSA KeyGen (FIPS186-
5): (A7126)
Modulo: 2048
AES for TLS (CP) BC-Auth
BC-UnAuth
Used for encryption and
decryption of TLS
session packets using
the TLS Session Key
Publication:FIPS 800-
38A, SP 800-38D
AES-CBC: (A7126)
Key Length: 128, 256
AES-GCM: (A7126)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 24 of 103
Name Type Description Properties Algorithms
AES for TLS (DP-FW) BC-Auth
BC-UnAuth
Used for encryption and
decryption of TLS
session packets using
the TLS Session Key
Publication:FIPS 800-
38A, SP 800-38D
AES-CBC: (A3943)
Key Length: 128, 256
AES-GCM: (A3943)
Key Length: 128, 256
AES for TLS (DP-HW) BC-Auth
BC-UnAuth
Used for encryption and
decryption of TLS
session packets using
the TLS Session Key
Publication:FIPS 800-
38A, SP 800-38D
AES-CBC: (A3944)
AES-GCM: (A3944)
HMAC for TLS (CP) MAC Used for authentication
of TLS session packets
using the TLS
Authentication Key
Publication:FIPS 198-1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A7126)
HMAC-SHA2-256:
(A7126)
HMAC-SHA2-384:
(A7126)
SHA-1: (A7126)
SHA2-256: (A7126)
SHA2-384: (A7126,
A3944)
HMAC for TLS (DP-FW) MAC Used for authentication
of TLS session packets
using the TLS
Authentication Key
Publication:FIPS 198-1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A3943)
HMAC-SHA2-256:
(A3943)
HMAC-SHA2-384:
(A3943)
SHA-1: (A3943)
SHA2-224: (A3943)
SHA2-256: (A3943)
SHA2-384: (A3943)
HMAC for TLS (DP-HW) MAC Used for authentication
of TLS session packets
using the TLS
Authentication Key
Publication:FIPS 198-1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A3944)
HMAC-SHA2-256:
(A3944)
HMAC-SHA2-384:
(A3944)
SHA-1: (A3944)
SHA2-224: (A3944)
SHA2-256: (A3944)
RSA SigGen for DNSSec DigSig-SigGen Used for generation of
an RSA digital signature
for DNSSec
Publication:FIPS 186-5 RSA SigGen (FIPS186-5):
(A3943)
HMAC-SHA2-256:
(A3943)
SHA2-256: (A3943)
RSA SigVer for DNSSec DigSig-SigVer Used to verify an RSA
digital signature for
DNSSec
Publication:FIPS 186-5 RSA SigVer (FIPS186-5):
(A3943)
HMAC-SHA2-256:
(A3943)
SHA2-256: (A3943)
RSA SigVer for DNSSec
(legacy)
DigSig-SigVer Used to verify an RSA
digital signature for
DNSSec (using a 1024-
bit modulus and/or
SHA-1)
Publication:FIPS 186-2,
FIPS 186-4
RSA SigVer (FIPS186-2):
(A3943)
RSA SigVer (FIPS186-4):
(A3943)
HMAC-SHA2-256:
(A3943)
SHA2-256: (A3943)
PBKDF for PEM Key PBKDF Used for derivation of
the PEM Key from the
PEM Passphrase
Publication:SP 800-132 PBKDF: (A7126)
AES for Encrypting TLS
Private Key
BC-UnAuth Used for encryption of
the TLS Private Key
using the PEM Key
Publication:SP 800-38A AES-CBC: (A7126)
Key Length: 256
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 25 of 103
Name Type Description Properties Algorithms
AES for SNMPv3 BC-UnAuth Used for encryption and
decryption of SNMPv3
packets using the
SNMPv3 Privacy Key
Publication:SP 800-38A AES-CFB128: (A7126)
Key Length: 128
KDF SNMP: (A7126)
Counter DRBG: (A7126)
HMAC for SNMPv3 MAC Used for authentication
of SNMPv3 packets
using the SNMPv3
Authentication Key
Publication:FIPS 198-1,
SP 800-107 Rev.1
Caveat:The module
supports the truncation
of HMAC SHA-1 to 96
bits according to NIST
SP 800-107 Rev.1
HMAC-SHA-1: (A7126)
KDF SNMP: (A7126)
SHA-1: (A7126)
RSA SigVer for Firmware
Load Integrity
DigSig-SigVer Used to verification of a
new firmware image
prior to load
Publication:FIPS 186-5 RSA SigVer (FIPS186-5):
(A7126)
Capabilities:
Signature Type:
pkcs1v1.5
Properties:
Modulo: 2048
Hash Pair: SHA2-512
SHA2-512: (A3943)
RSA SigVer for Web GUI DigSig-SigVer Used for certificate-
based authentication
via the Web GUI
Publication:FIPS 186-4,
FIPS 186-5
RSA SigVer (FIPS186-4):
(A3943)
Modulo:
1024/2048/3072/4096
Hash Pair:
Hash Algorithm: SHA-1
RSA SigVer (FIPS186-5):
(A3943)
SHA2-256: (A3943)
SHA2-384: (A3943)
SHA2-512: (A3943)
SigGen for TLS
Authentication (DP-HW)
DigSig-SigGen Used to generate
ECDSA/RSA signatures
during the TLS
handshake on the data
plane
Publication:FIPS 186-4,
FIPS 186-5
ECDSA SigGen (FIPS186-
4): (A3944)
ECDSA SigGen (FIPS186-
5): (A3944)
RSA SigGen (FIPS186-5):
(A3944)
RSA SigGen (FIPS186-4):
(A3944)
SigVer for TLS
Authentication (DP-HW)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the data
plane
Publication:FIPS 186-5 ECDSA SigVer (FIPS186-
5): (A3944)
RSA SigVer (FIPS186-5):
(A3944)
SigVer for TLS
Authentication (DP-HW)
(legacy)
DigSig-SigVer Used to verify
ECDSA/RSA signatures
during the TLS
handshake on the data
plane
Publication:FIPS 186-4 ECDSA SigVer (FIPS186-
4): (A3944)
Curve: P-224, P-256, P-
384, P-521
Hash Algorithm: SHA-1
RSA SigVer (FIPS186-4):
(A3944)
Modulo: 1024
Hash Pair:
Hash Algorithm: SHA-1
Table 10: Security Function Implementations
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 26 of 103
2.7 Algorithm Specific Information
2.7.1 AES-GCM
The module supports internal IV generation using the module’s Approved DRBG. Per section 8.2.2 of NIST SP 800-
38D, the IV is at least 96 bits in length. The Approved DRBG generates outputs such that the (key/IV) pair collision
probability is less than 2^-32. The mechanism for IV generation falls into scenario 2 in FIPS 140-3 IG C.H.
AES-GCM is also used in the following protocols:
• For SSH, the module meets the (key/IV14
) pair uniqueness requirements from NIST SP 800-38D. The
protocol’s implementation is contained within the boundary of the module, and the generated IV is only
used in the context of the AES-GCM encryption executing the provisions of the SSH protocol. The
mechanism for IV generation falls into scenario 1 in FIPS 140-3 IG C.H and is compliant with RFC 4252, RFC
4253, and RFC 5647.
A new IV parameter is generated by the module for each AES-GCM encryption. The IV consists of a 32-bit
fixed field and a 64-bit invocation counter. The fixed field of this IV remains the same for the duration of
the session. The invocation counter is treated as a 64-bit integer and is incremented by one when
performing an AES-GCM encryption.
If the invocation counter reaches its maximum value 2^64 - 1, the next AES-GCM encryption is performed
with the invocation counter set to either 0 or 1. No more than 2^64 - 1 AES-GCM encryptions are
performed in the same session. When a session is terminated for any reason, it is the responsibility of the
module operator to derive a new key and a new initial IV.
• For TLS v1.2, the module supports acceptable AES-GCM cipher suites from section 3.3.1.1 of NIST SP 800-
52rev2 and meets the (key/IV) pair uniqueness requirements from NIST SP 800-38D. The protocol’s
implementation is contained within the boundary of the module, and the generated IV is only used in the
context of the AES-GCM encryption executing the provisions of the TLS 1.2 protocol.
The mechanism for IV generation falls into scenario 1 in FIPS 140-3 IG C.H and is compliant with RFC 5288.
The IV is a random 96-bit value generated with entropy provided by the module’s Approved entropy
source. The 64-bit counter portion of the IV is strictly increasing. The counter portion of the IV does not
exhaust the maximum number of possible values for a given session key. This condition is implicitly
ensured by the design of the TLS protocol, in which the counter is denied exhaustion by the control
exerted by the protocol’s (and hence also the module’s) management logic (wherein the counter is
incremented per each TLS record). This management logic also implies that the probability of an
exhaustion of all 2^64 - 1 values of the counter for the same TLS session in a realistic time frame is not
significant.
• For TLS v1.3, the module supports acceptable AES-GCM cipher suites from section 3.3.1.2 of NIST SP 800-
52rev2 and meets the (key/IV) pair uniqueness requirements from NIST SP 800-38D. The protocol’s
implementation is contained within the boundary of the module, and the generated IV is only used in the
context of the AES-GCM encryption executing the provisions of the TLS 1.3 protocol.
14
IV – Initialization Vector
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 27 of 103
The mechanism for IV generation falls into scenario 5 in FIPS 140-3 IG C.H and is compliant with RFC 8446.
Each session employs a “per-record nonce”, a 64-bit sequence number (or IV) maintained separately for
reading and writing records. Each sequence number is set to 0 at the beginning of a connection and
whenever the key is changed (the first record transmitted under a particular traffic key uses sequence
number 0), and the appropriate sequence number is incremented by one after reading or writing each
record. Because the size of sequence numbers is 64 bits, the IV should not exhaust the maximum number
of possible values for a given session key. If the IV exhaustion condition is observed, this will trigger a
session termination or a re-key due to session re-establishment.
If the module’s power is lost and then restored, the CO shall establish a new key for AES-GCM encryption.
2.7.2 ECDSA
The module implements ECDSA signature functions that were CAVP-tested against FIPS PUB 186-4. These tests
are mathematically identical to the FIPS PUB 186-5 tests. Thus, as allowed per Additional Comment #3 under FIPS
140-3 IG C.K, compliance with the FIPS PUB 186-5 tests is claimed.
2.7.3 PBKDF2
The module uses PBKDF2 option 1a from section 5.4 of NIST SP 800-132 for key establishment.
The PBKDF implementation takes an input salt that is a minimum of 128 bits in length, with a password/passphrase
containing at least 8 characters and an iteration count of 10,000, producing a random value of 256 bits for AES
keys. The underlying pseudorandom function used in this derivation is HMAC SHA2-256.
As specified in NIST SP 800-132, keys derived from passwords/passphrases are used only in storage applications.
2.7.4 RSA
The module implements RSA signature functions that were CAVP-tested against FIPS PUB 186-4. These tests are
mathematically identical to the FIPS PUB 186-5 tests. Thus, as allowed per Additional Comment #3 under FIPS 140-
3 IG C.K, compliance with the FIPS PUB 186-5 tests is claimed.
2.8 RNG and Entropy
The module’s DRBG is seeded via entropy generated internally from CPU jitter. The module requests a minimum
of 256 bits of entropy per call, and it generates symmetric SSPs with up to 256 bits in size and security strength
and asymmetric SSPs with up to 6144 bits in size and 178 bits of security strength.
The table below specifies the module’s entropy certificates.
Cert
Number
Vendor Name
E52 Cloud Software Group
Table 11: Entropy Certificates
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 28 of 103
The table below specifies the module’s entropy sources.
Name Type
Operational
Environment
Sample
Size
Entropy per Sample Conditioning Component
NetScaler CPU
Jitter Entropy
Source
Non-
Physical
FreeBSD
11.4
256
bits
A request for 256 bits of entropy results in
256 bits of entropy per output sample, or
full entropy.
SHA3-256 (NetScaler CPU
Jitter Entropy Source)
Table 12: Entropy Sources
2.9 Key Generation
The module implements the following Approved key generation methods specified in NIST SP 800-140D Rev. 1:
• Counter DRBG + CKG
• Hash DRBG + CKG
• RSA key generation
• ECDSA key generation
• DH key generation
• ECDH key generation
In compliance with NIST SP 800-133, the module uses its Approved DRBGs to generate cryptographic keys and
seeds used for the generation of cryptographic keys. The resulting symmetric key or generated seed is an
unmodified output from the DRBG.
2.10 Key Establishment
2.10.1 Key Agreement Schemes
The module implements the following Approved key agreement methods specified in FIPS 140-3 IG D.F:
• KAS-ECC-SSC + SSH KDF
• KAS-ECC-SSC + TLS 1.0/1.1 KDF
• KAS-ECC-SSC + TLS 1.2 KDF
• KAS-ECC-SSC + TLS 1.3 KDF
• KAS-ECC-SSC + SSH KDF
• KAS-FFC-SSC + TLS 1.0/1.1 KDF
• KAS-FFC-SSC + TLS 1.2 KDF
• KAS-ECC-SSC + TLS 1.3 KDF
The module performs assurances for its key agreement schemes as specified in the following sections of NIST SP
800-56A Rev 3:
• Section 5.5.2 (for assurances of domain parameter validity)
• Section 5.6.2.1 (for assurances required by the key pair owner)
• Section 5.6.2.2.2 (for recipient assurance of ephemeral public key validity)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 29 of 103
Key confirmation is not supported by the module.
2.10.2 Key Transport Methods
The module implements the following Approved/allowed key transport methods specified in FIPS 140-3 IG D.G:
• AES + MAC key wrap/unwrap
• AES-CCM key wrap/unwrap
• AES-GCM key wrap/unwrap
• RSA key encapsulation/decapsulation
2.11 Industry Protocols
The module implements the following industry protocols which use cryptography in the Approved mode of
operation:
• IPsec with IKEv1
• IPsec with IKEv2
• SNMPv3
• SSH
• TLS 1.0/1.1
• TLS 1.2
• TLS 1.3
The KDFs associated with these protocols shall only be used within the context of their respective protocols. No
parts of these protocols, other than the Approved cryptographic algorithms and the KDFs, have been tested by
the CAVP and CMVP.
2.12 Additional Information
Algorithms designated as “Legacy” can only be used on data that was generated prior to the Legacy Date specified
in FIPS 140-3 IG C.M.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 30 of 103
3. Cryptographic Module Interfaces
3.1 Ports and Interfaces
The module supports the following logical interfaces:
• Data Input
• Data Output
• Control Input
• Control Output
• Status Output
The module’s physical boundary includes the physical ports, manual controls, physical indicators, and physical,
logical, and electrical characteristics of the device. Figure 5 and Figure 6 below depict the ports and interfaces on
the front and rear panels of the NetScaler MPX 8900 FIPS.
USB
Ports
RS-232
Serial Port
Ethernet Ports
(10/100/1000 Base-T Copper)
Management Port
LOM
Port Ethernet Ports
(10G SFP+)
LCD
LCD Keypad
Figure 5. NetScaler MPX 8900 FIPS Front Panel
Power Supply 1
Power Switch
Solid-State Drive
NMI Button
(recessed)
Disable Alarm Button Power Supply 2
(optional)
Figure 6. NetScaler MPX 8900 FIPS Rear Panel
Figure 7 and Figure 8 below depict the ports and interfaces on the front and rear panels of the NetScaler MPX
9100 FIPS.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 31 of 103
RS-232
Serial Port
Mgmt
Port
LOM
Port
Ethernet Ports (25G SFP28)
25/5 25/6 25/7 25/8
USB
Ports
Ethernet Ports (25G SFP28)
25/1 25/2 25/3 25/4
Figure 7. NetScaler MPX 9100 FIPS Front Panel
Power Supply 1
Power Switch
Solid-State Drive
NMI Button
(recessed)
Disable Alarm
Button
Power Supply 2
(optional)
Figure 8. NetScaler MPX 9100 FIPS Rear Panel
Figure 9 and Figure 10 below depict the ports and interfaces on the front and rear panels of the NetScaler MPX
9200 FIPS.
USB
Ports
NMI Button
(recessed)
Power
Switch
Ethernet Ports (SFP56)
50/1 50/2 50/3 50/4
USB-C
Port
Solid-State
Drive
Mgmt
Ports
LOM
Port
RS-232
Serial Port
UID
LED
Ethernet Ports (SFP56)
50/5 50/6 50/7 50/8
GPIO
LEDs
Figure 9. NetScaler MPX 9200 FIPS Front Panel
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 32 of 103
Power
Supply 1
Disable Alarm
Button
Power
Supply 2
UID
LED
Power
Switch
Figure 10. NetScaler MPX 9200 FIPS Rear Panel
Each of the module’s physical ports and manual controls maps to one of the logical interfaces defined in FIPS 140-
3. The table below contains a mapping of the physical and logical interfaces of the module.
Physical Port
Logical
Interface(s)
Data That Passes
Ethernet port Data Input Network traffic (ingress)
Ethernet port Data Output Network traffic (egress)
Ethernet port Control Input Management data used to remotely manage the appliance
Ethernet port Control
Output
Control information sent to remote machines supporting LDAP and RADIUS in order
for the module to communicate with these machines
Ethernet port Status
Output
Status information used to remotely monitor the appliance
Management port Control Input Management data used to connect directly to the appliance for CSG ADC
administrative functions
Management port Status
Output
Status information used to remotely monitor the appliance
RS-232 serial port Control Input Initial configuration data from a connected computer
RS-232 serial port Status
Output
Status information sent to a connected computer regarding initial configuration and
troubleshooting
LCD Keypad Control Input (8900) Initial configuration information from a connected computer; status
information
LCD Status
Output
(8900) IP information, system status updates, system information, current selection, or
input information
Disable Alarm button** Control Input Button used to stop the power alarm from sounding (functional only if a second power
supply is installed)
Non-Maskable Interrupt
(NMI) button
Control Input Button used (at the request of Technical Support) to initiate a core dump
Power interface Power Power
UID LED Status
Output
(9100, 9200) Remote identification capability
GPIO LEDs Status
Output
(9200) disabled
Power switch/button Control Input Button used to turn the module on/off
Table 13: Ports and Interfaces
Figure 5, Figure 7, and Figure 9 above also include the following ports and interfaces that are not mapped in the
table above:
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 33 of 103
• GPIO LEDs (disabled by default)
• LOM15
port (disabled by default – the operator shall not enable this port)
• USB ports (reserved for future releases)
15
LOM – Lights-Out Management
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 34 of 103
4. Roles, Services, and Authentication
4.1 Authentication Methods
Module operators are required to authenticate to the module for assumption of an authorized role. The module
supports identity-based authentication. Role assumption is implicit, as module operator roles are assigned to their
account.
Each session remains active (logged in) and secured until the operator logs out or is automatically logged out from
inactivity (inactivity default is 900 seconds). When the module is powered off, results of any previous
authentication will be cleared. Here, module operators are required to re-authenticate to assume a new role.
The strength objectives of the authentication mechanisms are as follows:
• For each attempt to use an authentication mechanism, the probability shall be less than one in 1,000,000
that a random attempt will succeed or a false acceptance will occur.
• For multiple attempts to use an authentication mechanism during a one-minute period, the probability
shall be less than one in 100,000 that a random attempt will succeed or a false acceptance will occur.
To meet the stated strength objectives, the password policies shall be configured by the Crypto Officer after the
initial setup of the module such that all passwords shall require:
• A minimum of 8 characters
• At least 1 lowercase letter
• At least 1 uppercase letter
• At least 1 digit
• At least 1 special character (~, `, !, @, #, $, %, ^, &, *, -, _, =, +, {, }, [, ], |, \, :, <, >, /, ., ,, " ")
The Crypto Officer shall configure the password policies during module initialization. Once set, the module
enforces the password policies on all subsequent attempts to change a password. See section 11.1.3.1 below for
instructions on setting password policies via the Web GUI.
The strength calculations for each of the authentication mechanisms are provided in the table below.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 35 of 103
Method
Name
Description Security Mechanism Strength Each Attempt Strength per Minute
Password The minimum length of the
password is eight characters,
with 90 different case-
sensitive alphanumeric
characters and symbols
possible for usage. The
password must contain: * At
least 8 characters * At least
one lowercase letter * At
least one uppercase letter *
At least one digit * At least
one special character (~, `, !,
@, #, $, %, ^, &, *, -, _, =, +, {,
}, [, ], |, \, :, <, >, /, ., ,, " ")
Username/Password The minimum length of
the password is eight
characters, with 90
different case-sensitive
alphanumeric
characters and symbols
possible for usage. The
probability of a random
attempt falsely
succeeding is: * =1 per
908 possible passwords
* =1 per 4.3x1015
The fastest network connection
supported by the module is 1000
Mbps. At most (1x109 bits/second ×
60 seconds) = 6x1010 =
60,000,000,000 bits of data can be
transmitted in one minute. The
minimum password is 64 bits (8 bits
per character x 8 characters),
meaning 9.375x108 passwords can be
passed to the module (assuming
there is no overhead). This equates to
a 1:4,591,650 chance of a random
attempt will succeed, or a false
acceptance will occur in a one-minute
period.
Certificate The module supports 2048-
bit RSA digital certificate
authentication during Web
GUI/HTTPS (TLS) access. This
equates to a 112-bit
symmetric key.
RSA SigVer for Web
GUI
Using conservative
estimates and equating
a 2048-bit RSA key to a
112-bit symmetric key,
the probability of a
random attempt falsely
succeeding is: * =1 per
2112 * =1 per 5.19 x
1033
The fastest network connection
supported by the module is 1000
Mbps. At most (1x109 bits/second ×
60 seconds) = 6x1010 =
60,000,000,000 bits of data can be
transmitted in one minute. Thus, at
most 60,000,000,000 / 2048 or
2.93x107 certificates can be passed
to the module in a one-minute period
(assuming there is no overhead),
Given that there can be
60,000,000,000 bits of data
transmitted to the module in one
minute and that a certificate contains
a 2048-bit RSA key, then at most
60,000,000,000 / 2048 or 2.93x107
certificates can be passed to the
module in a one-minute period
(assuming there is no overhead),
meaning if one key has a
1:5.19x1033 chance of succeeding
then in a one minute period there is a
2.93x107:5.19x1033, or 1:1.77x1026
chance of a random attempt
succeeding
Table 14: Authentication Methods
For first-time access, the module comes with a factory-set default login ID (“nsroot”) and password (“nsroot”) for
the CLI, RESTful Nitro API, and web GUI. These credentials are used by the CO for initial setup and configuration
of the device. During initial configuration, the CO shall disable local authentication to prevent any further use of
the default root account (see section 11.1.3.5 below for instructions).
4.2 Roles
The module supports the following role(s):
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 36 of 103
• Crypto Officer (CO) – The CO role performs administrative services on the module, such as initialization,
configuration, and monitoring of the module. The CO role includes the privileges listed under the read-
only, operator, network, and sysadmin command policies.
• User – The User role can view the module status and employ module services (including IPsec16
, TLS, SSH,
and SNMPv3 services). The User role includes the privileges listed under the read-only command policy.
The following table lists the supported roles.
Name Type Operator Type Authentication Methods
Crypto Officer Identity CO Password
Certificate
User Identity User Password
Certificate
Table 15: Roles
Operators connect to the module via an SSH connection (using the CLI) or via a TLS connection (using the Web
GUI or RESTful API). The module can support up to 10 operator sessions concurrently from multiple client devices.
Each secure session for simultaneous operators is distinguished and kept separate by unique session information,
which is provided by the session protocol and protected by the OS.
4.3 Approved Services
Descriptions of the services available are provided in the table below.
As allowed per section 2.4.C of FIPS 140-3 Implementation Guidance, the module provides indicators for the use
of Approved services through a combination of an explicit indication (via a global Approved mode indicator) and
an implicit indication (via the successful completion of the service).
The keys and Sensitive Security Parameters (SSPs) listed in the table indicate the type of access required using the
following notation:
• G = Generate: The module generates or derives the SSP.
• R = Read: The SSP is read from the module (e.g., the SSP is output).
• W = Write: The SSP is updated, imported, or written to the module.
• E = Execute: The module uses the SSP in performing a cryptographic operation.
• Z = Zeroize: The module zeroizes the SSP.
16
IPsec – Internet Protocol Security
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 37 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Configure
system
settings
Configure modes and
features, system settings,
and cloud parameters
Command
Line
Interface
Command
and
parameters
Command
response/status
output
AES for Disk
Encryption
AES for Data
Encryption
CKG (KEK)
Crypto Officer
- AES Key: G
- KEK: G,E
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
- Hash DRBG
Entropy: W,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
Configure
network
settings
Configure network
routing protocols
Command
Line
Interface
Command
and
parameters
Command
response / status
output
AES for Disk
Encryption
CKG (KEK)
Crypto Officer
- ZebOS Router
Password: W
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
Configure
clustering
Configure an appliance
to either be the cluster
coordinator or a node in
the cluster
Command
Line
Interface
Command
and
parameters
Command
response / status
output / control
output
None Crypto Officer
- Cluster
Password
(Alphanumeric
string): W
Manage data
policy
encryption
keys
Add, edit, delete
encryption keys
Command
Line
Interface
Command Status output AES for Disk
Encryption
AES for Data
Encryption
CKG (KEK)
Crypto Officer
- AES Key: G
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
- Hash DRBG
Entropy: W,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 38 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Manage data
policy HMAC
keys
Add, edit, delete HMAC
keys
Command
Line
Interface
Command Status output AES for Disk
Encryption
CKG (KEK)
HMAC for
Message
Authentication
Crypto Officer
- HMAC Key: G
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
- Hash DRBG
Entropy: W,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
Exchange
routing
information
Exchange routing update
information using ZebOS,
authenticate source of
packets
Show
Command
O/P and
Traffic
Command Status output AES for Disk
Encryption
Crypto Officer
- ZebOS Router
Password: E
- KEK: E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 39 of 103
Zeroize Reboot/power-cycle the
module
N/A Command Status output None Crypto Officer
- PEM Passphrase:
Z
- PEM Key: Z
- AES-GCM IV : Z
- DH Public Key: Z
- DH Peer Public
Key: Z
- DH Private Key:
Z
- ECDH Public Key
: Z
- ECDH Peer
Public Key : Z
- ECDH Private
Key : Z
- RSA Public Key: Z
- RSA Private Key :
Z
- SSH Shared
Secret: Z
- SSH Session Key:
Z
- SSH
Authentication
Key: Z
- IKEv1 Shared
Secret: Z
- IKEv1 PSK: Z
- IKEv1 SKEYID: Z
- IKEv1 SKEYID_e:
Z
- IKEv1 SKEYID_a:
Z
- IKEv1 SKEYID_d:
Z
- IKEv1 Session
Key: Z
- IKEv1
Authentication
Key: Z
- IKEv2 Shared
Secret: Z
- IKEv2 SKEYSEED:
Z
- IKEv2 Session
Key: Z
- IKEv2
Authentication
Key: Z
- IPsec Session
Key: Z
- IPsec
Authentication
Key: Z
- TLS Pre-Master
Secret: Z
- TLS Master
Secret: Z
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 40 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
- TLS Session Key:
Z
- TLS
Authentication
Key: Z
- TLS Ticket
Encryption Key: Z
- TLS Ticket
Authentication
Key: Z
- Hash DRBG
Entropy: Z
- Hash DRBG
Seed: Z
- Hash DRBG 'V'
Value : Z
- Hash DRBG 'C'
Value: Z
- CTR DRBG
Entropy: Z
- CTR DRBG Seed:
Z
- CTR DRBG 'V'
Value: Z
- CTR DRBG 'Key'
Value: Z
- SNMPv3 Privacy
Key: Z
- SNMPv3
Authentication
Key: Z
Zeroize KEK Zeroize KEK API return
value
Command Status output None Crypto Officer
- KEK: Z
Configure
Gateway
Configure Gateway
global settings, virtual
servers, portal themes,
AAA groups and users,
policies, and resources
Command
Line
Interface
Command
and
parameters
Command
response / status
output
AES for Disk
Encryption
CKG (KEK)
Crypto Officer
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
Configure
IPsec
Configure IPsec profile;
configure CloudBridge
Connector settings,
network bridges, and IP
tunnels; view IP tunnel
details
Command
Line
Interface
Command
and
parameters
Command
response / status
output
AES for Disk
Encryption
CKG (KEK)
Crypto Officer
- IKEv1 PSK: W
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 41 of 103
Establish
IKEv1/IPsec
session
Establish an IPsec session
using IKEv1
Traffic Command Status output AES for Disk
Encryption
CKG (KEK)
DH Key
Agreement for
IKE (CP)
AES for
IKE/IPsec (CP)
HMAC for
IKE/IPsec (CP)
Crypto Officer
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- IKEv1 PSK: W,E
- IKEv1 Shared
Secret: G,E
- IKEv1 SKEYID:
G,E
- IKEv1 SKEYID_e:
G,E
- IKEv1 SKEYID_a:
G,E
- IKEv1 SKEYID_d:
G,E
- IKEv1 Session
Key: G,E
- IKEv1
Authentication
Key: G,E
- IPsec Session
Key: G,E
- IPsec
Authentication
Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
User
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- IKEv1 PSK: W,E
- IKEv1 Shared
Secret: G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 42 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
- IKEv1 SKEYID:
G,E
- IKEv1 SKEYID_e:
G,E
- IKEv1 SKEYID_a:
G,E
- IKEv1 SKEYID_d:
G,E
- IKEv1 Session
Key: G,E
- IKEv1
Authentication
Key: G,E
- IPsec Session
Key: G,E
- IPsec
Authentication
Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 43 of 103
Establish
IKEv2/IPsec
session
Establish an IPsec session
using IKEv2
Traffic Command Status output AES for Disk
Encryption
CKG (KEK)
DH Key
Agreement for
IKE (CP)
AES for
IKE/IPsec (CP)
HMAC for
IKE/IPsec (CP)
Crypto Officer
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- IKEv2 Shared
Secret: G,E
- IKEv2 SKEYSEED:
G,E
- IKEv2 Session
Key: G,E
- IKEv2
Authentication
Key: G,E
- IPsec Session
Key: G,E
- IPsec
Authentication
Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
User
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- IKEv2 Shared
Secret: G,E
- IKEv2 SKEYSEED:
G,E
- IKEv2 Session
Key: G,E
- IKEv2
Authentication
Key: G,E
- IPsec Session
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 44 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Key: G,E
- IPsec
Authentication
Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
Configure SSH Configure SSH
authentication settings;
generate SSH keys
Command
Line
Interface
Command
and
parameters
Command
response / status
output
Key Generation
for SSH
Authentication
(CP)
Crypto Officer
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- SSH Private Key:
G
- SSH Public Key:
G
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 45 of 103
Establish SSH
session
Establish an SSH session
(includes authentication
of the communicating
parties, negotiation of
cryptographic modes and
parameters,
establishment of shared
secrets, and derivation of
session keys)
Traffic Command Status output DH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
SSH (CP)
AES for SSH (CP)
HMAC for SSH
(CP)
Crypto Officer
- SSH Private Key:
E
- SSH Public Key: R
- SSH Peer Public
Key: W,E
- CTR DRBG
Entropy: R,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- ECDH Peer
Public Key : W,E
- SSH Shared
Secret: G,E
- SSH Session Key:
G,E
- SSH
Authentication
Key: G,W,E
User
- SSH Private Key:
E
- SSH Public Key: R
- SSH Peer Public
Key: W,E
- CTR DRBG
Entropy: R,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
G,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- ECDH Peer
Public Key : W,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 46 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
- SSH Shared
Secret: G,E
- SSH Session Key:
G,E
- SSH
Authentication
Key: G,W,E
Zeroize SSH
private keys
Zeroize SSH private keys API return
value
Command Status output None Crypto Officer
- SSH Private Key:
Z
Configure
SNMPv3
Configure SNMP
communities, traps,
managers, views, groups,
users, alarms, and engine
ID ; view SNMP OIDs
Command
Line
Interface
Command
and
parameters
Command
response / status
output
AES for Disk
Encryption
CKG (KEK)
Crypto Officer
- SNMPv3
Authentication
Passphrase: W
- SNMPv3 Privacy
Passphrase : W
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
SNMPv3 traps Provides system
condition information
Log files None Status output /
control output
AES for SNMPv3
HMAC for
SNMPv3
Crypto Officer
- SNMPv3
Authentication
Passphrase: E
- SNMPv3 Privacy
Passphrase : E
- SNMPv3 Privacy
Key: G,E
- SNMPv3
Authentication
Key: G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 47 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Configure TLS Configure TLS sessions
and profiles
Command
Line
Interface
Command
and
parameters
Command
response / status
output
AES for Disk
Encryption
CKG (KEK)
Key Generation
for TLS Ticket
Keys (DP)
AES for TLS
Tickets
HMAC for TLS
Tickets
SigGen for TLS
Authentication
(CP)
SigGen for TLS
Authentication
(DP-FW)
RSA SigGen for
DNSSec
RSA SigVer for
DNSSec
RSA SigVer for
DNSSec (legacy)
PBKDF for PEM
Key
AES for
Encrypting TLS
Private Key
SigGen for TLS
Authentication
(DP-HW)
Crypto Officer
- CA Public Key: W
- TLS Private Key:
G,E
- TLS Public Key:
G,W
- TLS Master
Secret: G,E
- TLS Ticket
Encryption Key: W
- TLS Ticket
Authentication
Key: W
- DNS Private KSK:
W
- DNS Public KSK:
W
- DNS Private ZSK:
W
- DNS Public ZSK:
W
- PEM Passphrase:
G,E
- PEM Key: G
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- Hash DRBG
Entropy: G,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 48 of 103
Establish TLS
session (CP)
Establish a TLS session on
the control plane
(includes server
authentication,
negotiation of
cryptographic modes and
parameters,
establishment of shared
secrets, and generation
of session keys)
Traffic Command Status output CKG (KEK)
SigVer for TLS
Authentication
(CP)
SigVer for TLS
Authentication
(CP) (legacy)
DH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (CP)
RSA Key
Transport for
TLS (CP)
AES for TLS (CP)
HMAC for TLS
(CP)
Crypto Officer
- CA Public Key: E
- TLS Private Key:
E
- TLS Public Key: R
- TLS Peer Public
Key: W,E
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
W,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- RSA Private Key :
G,E
- RSA Public Key:
G,E
- TLS Pre-Master
Secret: G,E
- TLS Master
Secret: G,E
- TLS Session Key:
G,E
- TLS
Authentication
Key: G,E
- AES-GCM IV :
G,E
- PEM Passphrase:
W,E
- PEM Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
User
- CA Public Key: E
- TLS Private Key:
E
- TLS Public Key: R
- TLS Peer Public
Key: W,E
- CTR DRBG
Entropy: W,E
- CTR DRBG Seed:
G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 49 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
- CTR DRBG 'V'
Value: G,E
- CTR DRBG 'Key'
Value: G,E
- DH Private Key:
W,E
- DH Public Key:
G,R
- DH Peer Public
Key: W,E
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- ECDH Peer
Public Key : W,E
- RSA Private Key :
G,E
- RSA Public Key:
G,E
- TLS Pre-Master
Secret: G,E
- TLS Master
Secret: G,E
- TLS Session Key:
G,E
- TLS
Authentication
Key: G,E
- AES-GCM IV :
G,E
- PEM Passphrase:
W,E
- PEM Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 50 of 103
Establish TLS
session (DP)
Establish a TLS session on
the data plane (includes
server authentication,
negotiation of
cryptographic modes and
parameters,
establishment of shared
secrets, and generation
of session keys)
Traffic Command Status output CKG (KEK)
Key Generation
for TLS Ticket
Keys (DP)
AES for TLS
Tickets
HMAC for TLS
Tickets
SigVer for TLS
Authentication
(DP-FW)
SigVer for TLS
Authentication
(DP-FW) (legacy)
ECDH Key
Agreement for
TLS (DP-FW)
ECDH Key
Agreement for
TLS (DP-HW)
RSA Key
Transport for
TLS (DP-FW)
AES for TLS (DP-
FW)
AES for TLS (DP-
HW)
HMAC for TLS
(DP-FW)
HMAC for TLS
(DP-HW)
SigVer for TLS
Authentication
(DP-HW)
SigVer for TLS
Authentication
(DP-HW)
(legacy)
Crypto Officer
- CA Public Key: E
- TLS Private Key:
E
- TLS Public Key: R
- TLS Peer Public
Key: W,E
- Hash DRBG
Entropy: G,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- ECDH Peer
Public Key : W,E
- RSA Private Key :
G,E
- RSA Public Key:
G,E
- TLS Pre-Master
Secret: G,E
- TLS Master
Secret: G,E
- TLS Session Key:
G,E
- TLS
Authentication
Key: G,E
- AES-GCM IV :
G,E
- PEM Passphrase:
W,E
- PEM Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
User
- CA Public Key: E
- TLS Private Key:
E
- TLS Public Key: R
- TLS Peer Public
Key: W,E
- Hash DRBG
Entropy: W,E
- Hash DRBG
Seed: G,E
- Hash DRBG 'V'
Value : G,E
- Hash DRBG 'C'
Value: G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 51 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
- ECDH Private
Key : G,E
- ECDH Public Key
: G,R
- ECDH Peer
Public Key : W,E
- RSA Private Key :
G,E
- RSA Public Key:
G,E
- TLS Pre-Master
Secret: G,E
- TLS Master
Secret: G,E
- TLS Session Key:
G,E
- TLS
Authentication
Key: G,E
- AES-GCM IV :
G,E
- PEM Passphrase:
W,E
- PEM Key: G,E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 52 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Resume TLS
session (DP)
Resume a TLS session on
the data plane (includes
decryption and
authentication of the TLS
ticket and use of TLS
Session Key and TLS
Authentication Key)
Traffic Command Status output AES for TLS
Tickets
HMAC for TLS
Tickets
AES for TLS (DP-
FW)
AES for TLS (DP-
HW)
HMAC for TLS
(DP-FW)
HMAC for TLS
(DP-HW)
Crypto Officer
- TLS Session Key:
W,E
- TLS
Authentication
Key: W,E
- AES-GCM IV :
W,E
- TLS Ticket
Encryption Key:
W,E
- TLS Ticket
Authentication
Key: W,E
User
- TLS Session Key:
W,E
- TLS
Authentication
Key: W,E
- AES-GCM IV :
W,E
- TLS Ticket
Encryption Key:
W,E
- TLS Ticket
Authentication
Key: W,E
Show status Show the system status N/A Command Status output None Crypto Officer
User
Perform self-
tests on-
demand
Perform pre-operational
self-tests
Log File Command Status output None Crypto Officer
Show
versioning
information
Show module name and
version
Console
Output
Command Module name,
version
None Crypto Officer
User
Load
firmware
image
Update the module's
firmware to a new
version
Log files Command Status output RSA SigVer for
Firmware Load
Integrity
Crypto Officer
- Firmware Load
Integrity Key: W
Authenticate
via RADIUS
Used for operator logins
to the module using
RADIUS
Traffic Command Status output None Unauthenticated
- Operator
Password: W
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 53 of 103
Name Description Indicator Inputs Outputs
Security
Functions
SSP Access
Authenticate
via LDAP
Used for operator logins
to the module using
LDAP
Traffic Command Status output CKG (KEK)
RSA SigVer for
Web GUI
Unauthenticated
- Operator
Password: W
- LDAP Admin
Password: R,E
- SSH Public Key: E
- TLS Public Key: E
- AES Key: E
- AES GCM Key: E
- AES-GCM IV : E
- KEK: G,E,Z
- KEK Fragment 1:
G,E
- KEK Fragment 2:
G,E
Table 16: Approved Services
The module offers additional non-security-relevant services for module configuration and administration. These
services do not employ security services, nor do they access SSPs. For more information regarding these services,
refer to the Getting started with NetScaler article found on the online product documentation portal.
4.4 Non-Approved Services
The module does not provide any non-Approved services.
4.5 External Software/Firmware Loaded
The module provides the capability of upgrading its firmware by downloading a complete firmware image from
an external source. To update the module firmware, the following steps must be performed:
• Download a new firmware load integrity key (for use with the next upgrade).
• Download the firmware upgrade package.
• Run the installation script.
When the installation script is finished, it will prompt the CO to reboot the module. Upon reboot, the module will
load the new image into memory for execution and perform its pre-operational integrity test using a 2048-bit RSA
digital signature to verify the image’s firmware components before executing. If the test is passed, the module
will begin execution of the new image. If the test is failed, the bootup process will abort, and the module will be
rendered inoperable. To recover, CSG Customer Support will need to be contacted for assistance.
Prior to execution of the new image, module operators shall zeroize all keys in non-volatile memory using the
methods described in section 9.3. All keys in volatile are zeroized on module reboot.
In order to maintain the module’s validation, only validated images may be loaded. The new image shall include
updated version information to represent the newly loaded image.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 54 of 103
5. Software/Firmware Security
5.1 Integrity Techniques
At module start-up, all firmware components within the cryptographic boundary are verified using an Approved
integrity technique implemented within the cryptographic module itself. The module verifies a single
encompassing 2048-bit RSA digital signature with a SHA2-512 hash to ensure the integrity of all of its firmware
components. Unsuccessful verification of any component will cause the module to enter a critical error state.
5.2 Initiate on Demand
The pre-operational integrity test can be launched on demand by the following methods:
• power-cycling the module
• using the reset button on the platform (if applicable)
• issuing the reboot CLI command
• issuing the reboot API method
• via the Web GUI by navigating to Configuration > System > System Information and clicking the Reboot
button
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 55 of 103
6. Operational Environment
6.1 Operational Environment Type and Requirements
The NetScaler MPX is a hardware cryptographic module with a Modifiable operational environment and is
complaint with level 2 physical security requirements. Therefore, per section 7.5 of the CMVP Management
Manual, the requirements for this section are not applicable.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 56 of 103
7. Physical Security
7.1 Mechanisms and Actions Required
The MPX is a multi-chip standalone hardware cryptographic module that includes an enclosure composed of hard,
production-grade, metal components sufficient for compliance with FIPS 140-3 level 2 physical security
requirements. The module enclosure is opaque within the visible spectrum and completely encloses all internal
components. All integrated circuits are coated with commercial standard passivation.
The enclosure has removable front and back covers which provide only a limited set of ventilation holes, obscuring
visual access to the module’s internal components. Tamper-evident seals are applied to the module at the factory
to protect against unauthorized access to the module. The NetScaler MPX 8900 FIPS will have a total of four (4)
tamper-evident seals installed.
• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 11).
• One seal is placed on the back of the enclosure, connecting the back to the top (Figure 12).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 13).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 14).
1
Figure 11. Front Cover of the NetScaler MPX 8900 FIPS
2
Figure 12. Back Panel of the NetScaler MPX 8900 FIPS
3
Figure 13. Left Side of the NetScaler MPX 8900 FIPS
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 57 of 103
4
Figure 14. Right Side of the NetScaler MPX 8900 FIPS
The NetScaler MPX 9100 FIPS will have a total of four (4) tamper-evident seals installed.
• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 15).
• One seal is placed on the back of the enclosure, connecting the back to the top (Figure 16).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 17).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 18).
Figure 15. Front Cover of the NetScaler MPX 9100 FIPS
2
Figure 16. Back Panel of the NetScaler MPX 9100 FIPS
3
Figure 17. Left Side of the NetScaler MPX 9100 FIPS
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 58 of 103
4
Figure 18. Right Side of the NetScaler MPX 9100 FIPS
The NetScaler MPX 9200 FIPS will have a total of seven (7) tamper-evident seals installed.
• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 19).
• Four seals are placed on the back of the enclosure, connecting the rear fan assemblies to the top (Figure
20).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 21).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 22).
1
Figure 19. Front Cover of the NetScaler MPX 9200 FIPS
2 3 4 5
Figure 20. Back Panel of the NetScaler MPX 9200 FIPS
6
Figure 21. Left Side of the NetScaler MPX 9200 FIPS
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 59 of 103
7
Figure 22. Right Side of the NetScaler MPX 9200 FIPS
The following table describes the physical security mechanisms that are implemented in the module and the
actions required by the operator(s) to ensure that the physical security is maintained.
Mechanism Inspection Frequency Inspection Guidance
Tamper-evident
seals
When first deployed; At least every 6 months
after deployment; Whenever repositioned
Inspect the seals for signs of damage or removal. Ensure that all
seals are present and placed according to the guidance herein.
Table 17: Mechanisms and Actions Required
All tamper-evident seals are required for the module to be considered operating in its Approved mode of
operation. If any seals show signs of tampering, the module shall be considered in a non-compliant state and taken
the module out of operation, and the CO shall immediately contact CSG Customer Support.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 60 of 103
8. Non-Invasive Security
This section is not applicable. There are currently no approved non-invasive mitigation techniques references in
Annex F of ISO/IEC 19790.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 61 of 103
9. Sensitive Security Parameters
Management
9.1 Storage Areas
The table below lists sensitive security parameters (SSPs) storage areas for this module. Section 9.4 below selects
from the storage areas listed here and specifies the associated storage area in the “Storage” column for each SSP.
Storage Area
Name
Description
Persistence
Type
On Disk SSPs are stored on disk Static
In Volatile Memory SSPs are stored in volatile memory Dynamic
Table 18: Storage Areas
9.2 SSP Input-Output Methods
The table below lists SSP input and output methods for this module. Section 9.4 below selects from the methods
listed here and specifies the associated method in the “Inputs/Outputs” column for each SSP.
Name From To
Format
Type
Distribution
Type
Entry
Type
SFI or Algorithm
Imported plaintext form via public key
certificate
External On Disk Plaintext Automated Electronic
Imported encrypted form via SSH External On Disk Encrypted Automated Electronic AES for SSH (CP)
Imported encrypted form via TLS (CP) External On Disk Encrypted Automated Electronic AES for TLS (CP)
Imported encrypted form via TLS (DP-
FW)
External On Disk Encrypted Automated Electronic AES for TLS (DP-FW)
Imported encrypted form via TLS (DP-
HW)
External On Disk Encrypted Automated Electronic AES for TLS (DP-HW)
Imported plaintext via local console External On Disk Plaintext Automated Electronic
Imported plaintext External On Disk Plaintext Automated Electronic
Imported encrypted form via RSA key
transport (CP)
External On Disk Encrypted Automated Electronic RSA Key Transport for TLS
(CP)
Imported encrypted form via RSA key
transport (DP-FW)
External On Disk Encrypted Automated Electronic RSA Key Transport for TLS
(DP-FW)
Exported encrypted form via part of
config backup file
On Disk External Encrypted Automated Electronic AES for Disk Encryption
Exported plaintext form via public key
certificate
On Disk External Plaintext Automated Electronic
Exported encrypted form via RSA key
transport (CP)
On Disk External Encrypted Automated Electronic RSA Key Transport for TLS
(CP)
Exported encrypted form via RSA key
transport (DP-FW)
On Disk External Encrypted Automated Electronic RSA Key Transport for TLS
(DP-FW)
Table 19: SSP Input-Output Methods
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 62 of 103
9.3 SSP Zeroization Methods
The table below lists SSP zeroization methods for this module. The tables in section 9.4 below selects from the
methods listed here and specifies the associated method in the “Zeroization” column for each SSP.
Zeroization
Method
Description Rationale Operator Initiation
Completion of TLS
key derivation
Temporary SSPs used for deriving
TLS keys are zeroized.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
N/A
Reboot/Remove
power
All ephemeral keys are cleared
from memory on module reboot
or power removal.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
The module operator
reboots or removes
power from the module.
Session
termination
Ephemeral session keys are
automatically zeroized when a
secure protocol session is
terminated.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
N/A
Completion of KEK
operation
The KEK resides in volatile
memory and is automatically
zeroized and freed after each
use.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
N/A
CLI command (KEK
fragments)
KEK fragments are zeroized and
KEK fragment files are deleted,
rendering all passphrases and
passwords stored in the non-
volatile memory unrecoverable.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
Crypto Officer issues the
following CLI command:
rm system csps -type KEK
CLI command
(SSH private keys)
SSH private keys stored in non-
volatile memory in plaintext form
are zeroized.
Keys are overwritten with zeroes. Zeroization
is immediate and non-interruptible.
Zeroization occurs in a sufficiently small time
period, preventing the recovery of the
sensitive data between the time zeroization is
initiated and the actual zeroization is
completed.
Crypto Officer issues the
following CLI command:
rm system csps -type
SSH_HOST_KEYS
Table 20: SSP Zeroization Methods
For CLI command-based methods, the success status is indicated by the display of the command line prompt after
completion of the command without any error showing on the console. If the command fails, an error will show
on the console before returning control to the module operator.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 63 of 103
When the pre-operational integrity test is complete, the module zeroizes all temporary values used in the integrity
test.
9.4 SSPs
The module supports the keys and other SSPs listed in the table below.
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
KEK Fragment 1 Key fragment hashed
in combination with
KEK Fragment 2 to
generate KEK
N/A - N/A Keying
Material - PSP
Counter
DRBG
(A7126)
CKG (KEK)
KEK Fragment 2 Key fragment hashed
in combination with
KEK Fragment 1 to
generate KEK
N/A - N/A Keying
Material - PSP
Counter
DRBG
(A7126)
CKG (KEK)
KEK Symmetric key used
for encryption and
decryption of
passwords and
passphrases
256 bits - 256 bits Symmetric Key
- CSP
CKG (KEK) AES for Disk
Encryption
PEM Key Symmetric key used
for encryption and
decryption of
asymmetric private
keys
256 bits - 256 bits Symmetric Key
- CSP
PBKDF for
PEM Key
AES for
Encrypting TLS
Private Key
AES Key Symmetric key used
for encryption and
decryption
Between 128 and
256 bits - Between
128 and 256 bits
Symmetric Key
- CSP
Hash DRBG
(A3943)
AES for Data
Encryption
AES GCM Key Symmetric key used
for encryption and
decryption
256 bits - 256 bits Symmetric Key
- CSP
Hash DRBG
(A3943)
AES for Disk
Encryption
HMAC Key Key used for message
authentication
Between 160 and
512 bits - Between
128 and 256 bits
Authentication
- CSP
Hash DRBG
(A3943)
HMAC for
Message
Authentication
CA Public Key Public key used for TLS
certificate
authentication
[for ECDSA]
Between 224 and
512 bits [for RSA]
Between 2048 and
3072 bits - [for
ECDSA] Between
224 and 512 bits
[for RSA] Between
2048 and 3072 bits
Public/Private -
PSP
SigVer for TLS
Authentication
(CP)
SigVer for TLS
Authentication
(CP) (legacy)
SigVer for TLS
Authentication
(DP-FW)
SigVer for TLS
Authentication
(DP-FW) (legacy)
SigVer for TLS
Authentication
(DP-HW)
SigVer for TLS
Authentication
(DP-HW)
(legacy)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 64 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
DH Private Key Private key used for
generating shared
secrets in IKE, SSH,
and TLS
[for SSH] Between
2048 and 6144 bits
[for TLS] Between
2048 and 4096 bits
[for IKE] 2048 bits -
[for SSH] Between
112 and 176 bits
[for TLS] Between
112 and 150 bits
[for IKE] 112 bits
Public/Private -
CSP
Safe Primes
Key
Generation
(A7126)
DH Key
Agreement for
SSH (CP)
DH Key
Agreement for
IKE (CP)
DH Key
Agreement for
TLS (CP)
DH Public Key Public key used by
peer for generating
shared secrets in IKE,
SSH, and TLS
[for SSH] Between
2048 and 6144 bits
[for TLS] Between
2048 and 4096 bits
[for IKE] 2048 bits -
[for SSH] Between
112 and 176 bits
[for TLS] Between
112 and 150 bits
[for IKE] 112 bits
Public/Private -
PSP
Safe Primes
Key
Generation
(A7126)
DH Peer Public
Key
Peer public key used
for generating shared
secrets in IKE, SSH,
and TLS
[for SSH] Between
2048 and 6144 bits
[for TLS] Between
2048 and 4096 bits
[for IKE] 2048 bits -
[for SSH] Between
112 and 176 bits
[for TLS] Between
112 and 150 bits
[for IKE] 112 bits
Public/Private -
PSP
DH Key
Agreement for
SSH (CP)
DH Key
Agreement for
IKE (CP)
DH Key
Agreement for
TLS (CP)
ECDH Private
Key
Private key used for
generating shared
secrets in SSH and TLS
Between 224 and
512 bits - Between
112 and 256 bits
Public/Private -
CSP
ECDSA
KeyGen
(FIPS186-4)
(A3943)
ECDSA
KeyGen
(FIPS186-5)
(A3943)
ECDSA
KeyGen
(FIPS186-4)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A7126)
ECDH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (DP-FW)
ECDH Key
Agreement for
TLS (DP-HW)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 65 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
ECDH Public Key Public key used by
peer for generating
shared secrets in SSH
and TLS
Between 224 and
512 bits - Between
112 and 256 bits
Public/Private -
PSP
ECDSA
KeyGen
(FIPS186-4)
(A3943)
ECDSA
KeyGen
(FIPS186-5)
(A3943)
ECDSA
KeyGen
(FIPS186-4)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A7126)
ECDH Peer
Public Key
Peer public key used
for generating of
shared secrets in SSH
and TLS
Between 224 and
512 bits - Between
112 and 256 bits
Public/Private -
PSP
ECDH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (DP-FW)
ECDH Key
Agreement for
TLS (DP-HW)
RSA Private Key Private key used in TLS
key transport
functions
2048 or 3072 bits -
112 or 128 bits
Public/Private -
CSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA Key
Transport for
TLS (CP)
RSA Key
Transport for
TLS (DP-FW)
RSA Public Key Public key used by
peer in TLS key
transport functions
2048 or 3072 bits -
112 or 128 bits
Public/Private -
PSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA Key
Transport for
TLS (CP)
RSA Key
Transport for
TLS (DP-FW)
SSH Private Key Private key used for
authentication during
SSH session
negotiation; RBA
Authentication for
LDAP; GSLB
configuration sync
[for RSA] 2048 or
3072 bits [for
ECDSA] Between
224 and 512 bits -
[for RSA] 112 or
128 bits [for
ECDSA] Between
112 and 256 bits
Public/Private -
CSP
DH Key
Agreement
for SSH (CP)
ECDH Key
Agreement
for SSH (CP)
DH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
SSH (CP)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 66 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
SSH Public Key Public key used by
peer for
authentication during
SSH session
negotiation; RBA
Authentication for
LDAP; GSLB
configuration sync
[for RSA] 2048 or
3072 bits [for
ECDSA] Between
224 and 512 bits -
[for RSA] 112 or
128 bits [for
ECDSA] Between
112 and 256 bits
Public/Private -
PSP
ECDSA
KeyGen
(FIPS186-5)
(A7126)
RSA KeyGen
(FIPS186-5)
(A7126)
DH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
SSH (CP)
SSH Peer Public
Key
Peer public key used
for authentication
during SSH session
negotiation; RBA
Authentication for
LDAP; GSLB
configuration sync
[for RSA] 2048 or
3072 bits [for
ECDSA] Between
224 and 512 bits -
[for RSA] 112 or
128 bits [for
ECDSA] Between
112 and 256 bits
Public/Private -
PSP
DH Key
Agreement for
SSH (CP)
ECDH Key
Agreement for
SSH (CP)
SSH Session Key Symmetric key used
for encryption and
decryption of SSH
session packets
Between 128 and
256 bits - Between
128 and 256 bits
Symmetric Key
- CSP
KDF SSH
(A7126)
AES for SSH (CP)
SSH
Authentication
Key
Key used for
authentication of SSH
session packets
Between 160 and
512 bits - Between
128 and 256 bits
Authentication
- PSP
KDF SSH
(A7126)
HMAC for SSH
(CP)
IKEv1 Shared
Secret
Secret value used for
deriving the IKEv1
SKEYID
- Shared Secret -
CSP
KAS-FFC-SSC
Sp800-56Ar3
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv1 PSK Pre-shared key used
for authentication of
secure key exchange
during IKEv1 Phase 1
- Authentication
- CSP
IKEv1 SKEYID Secret value used for
deriving other IKEv1
secrets
- Secret - CSP KDF IKEv1
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv1 SKEYID_e Secret value for
deriving IKE Session
Key
- Secret - CSP KDF IKEv1
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv1 SKEYID_a Secret value for
deriving IKE
Authentication Key
- Secret - CSP KDF IKEv1
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv1 SKEYID_d Secret value used for
deriving IPsec keys
- Secret - CSP KDF IKEv1
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv1 Session
Key
Symmetric key used
for encryption and
decryption of IKE
messages
Between 128 and
256 bits - Between
128 and 256 bits
Symmetric Key
- CSP
KDF IKEv1
(A7126)
AES for
IKE/IPsec (CP)
IKEv1
Authentication
Key
Key used for
authentication of IKE
messages
Between 160 and
512 bits - Between
128 and 256 bits
Authentication
- CSP
KDF IKEv1
(A7126)
HMAC for
IKE/IPsec (CP)
IKEv2 Shared
Secret
Secret value used for
deriving the IKEv1
SKEYID
- Shared Secret -
CSP
KAS-FFC-SSC
Sp800-56Ar3
(A7126)
DH Key
Agreement for
IKE (CP)
IKEv2 SKEYSEED - Shared Secret -
CSP
KDF IKEv2
(A7126)
DH Key
Agreement for
IKE (CP)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 67 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
IKEv2 Session
Key
Symmetric key used
for encryption and
decryption of IKEv2
messages
Between 128 and
256 bits - Between
128 and 256 bits
Symmetric Key
- CSP
KDF IKEv2
(A7126)
AES for
IKE/IPsec (CP)
IKEv2
Authentication
Key
Key used for
authentication of
IKEv2 messages
Between 160 and
512 bits - Between
128 and 256 bits
Authentication
- CSP
KDF IKEv2
(A7126)
HMAC for
IKE/IPsec (CP)
IPsec Session
Key
Symmetric key used
for encryption and
decryption of IPsec
message traffic
- Symmetric Key
- CSP
KDF IKEv1
(A7126)
KDF IKEv2
(A7126)
AES for
IKE/IPsec (CP)
IPsec
Authentication
Key
Key used for
authentication of
IPsec message traffic
- Authentication
- CSP
KDF IKEv1
(A7126)
KDF IKEv2
(A7126)
HMAC for
IKE/IPsec (CP)
TLS Private Key Private key used for
TLS session
authentication Private
key used for SAML
authentication (RSA
only) Private key used
for OpenID
authentication (RSA
only)
[for RSA] Between
2048 and 4096 bits
[for ECDSA]
Between 224 and
512 bits - [for RSA]
Between 112 and
150 bits [for
ECDSA] Between
112 and 256 bits
Public/Private -
CSP
ECDSA
KeyGen
(FIPS186-4)
(A3943)
ECDSA
KeyGen
(FIPS186-5)
(A3943)
ECDSA
KeyGen
(FIPS186-4)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A7126)
RSA KeyGen
(FIPS186-5)
(A7126)
SigGen for TLS
Authentication
(CP)
SigGen for TLS
Authentication
(DP-FW)
SigGen for TLS
Authentication
(DP-HW)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 68 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
TLS Public Key Public key used by
peer for TLS session
authentication
[for RSA public key]
Between 2048 and
4096 bits [for
ECDSA public key]
Between 224 and
512 bits - [for RSA
public key]
Between 112 and
150 bits [for
ECDSA public key]
Between 224 and
512 bits
Public/Private -
PSP
ECDSA
KeyGen
(FIPS186-4)
(A3943)
ECDSA
KeyGen
(FIPS186-5)
(A3943)
ECDSA
KeyGen
(FIPS186-4)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A3944)
ECDSA
KeyGen
(FIPS186-5)
(A7126)
RSA KeyGen
(FIPS186-5)
(A7126)
TLS Peer Public
Key
Peer public key used
for TLS session
authentication
[for RSA public key]
Between 2048 and
4096 bits [for
ECDSA public key]
Between 224 and
512 bits - [for RSA
public key]
Between 112 and
150 bits [for
ECDSA public key]
Between 224 and
512 bits
Public/Private -
PSP
SigVer for TLS
Authentication
(CP)
SigVer for TLS
Authentication
(CP) (legacy)
SigVer for TLS
Authentication
(DP-FW)
SigVer for TLS
Authentication
(DP-FW) (legacy)
SigVer for TLS
Authentication
(DP-HW)
SigVer for TLS
Authentication
(DP-HW)
(legacy)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 69 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
TLS Session Key Symmetric key used
for encryption and
decryption of TLS
session packets
[for AES key] 128
or 256 bits [for
AES GCM key] 128
or 256 bits - [for
AES key] 128 or
256 bits [for AES
GCM key] 128 or
256 bits
Symmetric Key
- CSP
KDF TLS
(A3943)
KDF TLS
(A3944)
TLS v1.2 KDF
RFC7627
(A3943)
TLS v1.2 KDF
RFC7627
(A3944)
TLS v1.2 KDF
RFC7627
(A7126)
TLS v1.3 KDF
(A3943)
AES for TLS (CP)
AES for TLS (DP-
FW)
AES for TLS (DP-
HW)
TLS
Authentication
Key
Key used for
authentication of TLS
session packets
Between 160 and
384 bits - Between
128 and 256 bits
Authentication
- CSP
KDF TLS
(A3943)
TLS v1.2 KDF
RFC7627
(A3943)
TLS v1.3 KDF
(A3943)
TLS v1.2 KDF
RFC7627
(A3944)
TLS v1.2 KDF
RFC7627
(A7126)
HMAC for TLS
(CP)
HMAC for TLS
(DP-FW)
HMAC for TLS
(DP-HW)
TLS Ticket
Encryption Key
Symmetric key used
for encryption and
decryption of TLS
session tickets
128 bits - 128 bits Symmetric Key
- CSP
Hash DRBG
(A3943)
AES for TLS
Tickets
TLS Ticket
Authentication
Key
Key used for
authentication of TLS
session tickets
- 256 bits Authentication
- CSP
Hash DRBG
(A3943)
HMAC for TLS
Tickets
SNMPv3 Privacy
Key
Symmetric key used
for encryption and
decryption of SNMPv3
packets
128 bits - 128 bits Symmetric Key
- CSP
KDF SNMP
(A7126)
AES for SNMPv3
SNMPv3
Authentication
Key
Key used for
authentication of
SNMPv3 packets
160 bits - 128 bits Authentication
- CSP
KDF SNMP
(A7126)
HMAC for
SNMPv3
DNS Private KSK Private key used to
sign the DNS Public
ZSK
Between 2048 and
4096 bits -
Between 112 and
150 bits
Public/Private -
CSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA SigGen for
DNSSec
DNS Public KSK Public key used to
verify the DNS Public
ZSK
Between 1024 and
4096 bits -
Between 80 and
150 bits
Public/Private -
PSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA SigVer for
DNSSec
RSA SigVer for
DNSSec (legacy)
DNS Private ZSK Private key used to
sign records in a DNS
zone
Between 2048 and
4096 bits -
Between 112 and
150 bits
Public/Private -
CSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA SigGen for
DNSSec
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 70 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
DNS Public ZSK Public key used to
verify records in a DNS
zone
Between 1024 and
4096 bits -
Between 80 and
150 bits
Public/Private -
PSP
RSA KeyGen
(FIPS186-5)
(A7126)
RSA SigVer for
DNSSec
RSA SigVer for
DNSSec (legacy)
Firmware Load
Integrity Key
Used to verify the new
firmware image prior
to load
2048 bits - 112 bits Public/Private -
Neither
RSA SigVer for
Firmware Load
Integrity
PEM Passphrase Derivation of PEM Key - Alphanumeric
String - CSP
AES for
Encrypting TLS
Private Key
AES-GCM IV IV for AES-GCM 96 and 128-bits - Initialization
Vector - CSP
TLS v1.2 KDF
RFC7627
(A3943)
TLS v1.3 KDF
(A3943)
TLS v1.2 KDF
RFC7627
(A3944)
Counter
DRBG
(A7126)
KDF SSH
(A7126)
TLS v1.2 KDF
RFC7627
(A7126)
AES for Disk
Encryption
AES for SSH (CP)
AES for TLS (CP)
AES for TLS (DP-
FW)
AES for TLS (DP-
HW)
SSH Shared
Secret
Shared secret used to
derive the SSH Session
Key and SSH
Authentication Key
- Shared Secret -
CSP
KAS-ECC-SSC
Sp800-
56Ar3
(A7126)
KAS-FFC-SSC
Sp800-
56Ar3
(A7126)
DH Key
Agreement
for SSH (CP)
ECDH Key
Agreement
for SSH (CP)
TLS Pre-Master
Secret
Shared secret used to
derive the TLS Master
Secret
- Pre-Master
Secret - CSP
KAS-ECC-SSC
Sp800-56Ar3
(A3943)
KAS-ECC-SSC
Sp800-56Ar3
(A7126)
KAS-FFC-SSC
Sp800-56Ar3
(A7126)
DH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (DP-FW)
ECDH Key
Agreement for
TLS (DP-HW)
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 71 of 103
Name Description Size - Strength
Type -
Category
Generated
By
Established
By
Used By
TLS Master
Secret
Secret used to derive
the TLS Session Key
and TLS
Authentication Key
- Master Secret -
CSP
KDF TLS
(A3943)
TLS v1.2 KDF
RFC7627
(A3943)
TLS v1.3 KDF
(A3943)
TLS v1.2 KDF
RFC7627
(A7126)
DH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (CP)
ECDH Key
Agreement for
TLS (DP-FW)
ECDH Key
Agreement for
TLS (DP-HW)
Hash DRBG
Entropy
Entropy input for Hash
DRBG
- Entropy - CSP SHA3-256
(A3513)
Hash DRBG
(A3943)
Hash DRBG
Seed
Seed material for Hash
DRBG
- DRBG Seed -
CSP
Hash DRBG
(A3943)
Hash DRBG
(A3943)
Hash DRBG 'V'
Value
Internal state value
used with Hash DRBG
- Internal State
Value - CSP
Hash DRBG
(A3943)
Hash DRBG
(A3943)
Hash DRBG 'C'
Value
Internal state value
used with Hash DRBG
- Internal State
Value - CSP
Hash DRBG
(A3943)
Hash DRBG
(A3943)
CTR DRBG
Entropy
Entropy input for CTR
DRBG
- Entropy - CSP SHA3-256
(A3513)
Counter DRBG
(A7126)
CTR DRBG Seed Seed material for CTR
DRBG
- DRBG Seed -
CSP
Counter
DRBG
(A7126)
Counter DRBG
(A7126)
CTR DRBG 'V'
Value
Internal state value
used with CTR DRBG
- Internal State
Value - CSP
Counter
DRBG
(A7126)
Counter DRBG
(A7126)
CTR DRBG 'Key'
Value
Internal state value
used with CTR DRBG
- Internal State
Value - CSP
Counter
DRBG
(A7126)
Counter DRBG
(A7126)
SNMPv3 Privacy
Passphrase
Derivation of the
SNMPv3 Privacy Key
- Alphanumeric
String - CSP
AES for SNMPv3
SNMPv3
Authentication
Passphrase
Derivation of the
SNMPv3
Authentication Key
- Alphanumeric
String - CSP
HMAC for
SNMPv3
LDAP Admin
Password
Used to bind to the
LDAP server
- Alphanumeric
String - CSP
ZebOS Router
Password
Router authentication - Alphanumeric
String - CSP
Cluster
Password
(Alphanumeric
string)
Authentication to the
cluster coordinator
node in a cluster
configuration
- Alphanumeric
String - CSP
Operator
Password
Authentication to the
module via an external
authentication service
- Alphanumeric
String - CSP
Table 21: SSP Table 1
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
KEK Fragment 1 On Disk:Plaintext Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK Fragment 2:Used
With
KEK:Generates
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 72 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
KEK Fragment 2 On Disk:Plaintext Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK Fragment 1:Used
With
KEK:Generates
KEK In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Completion of KEK
operation
KEK Fragment
1:Generated from
KEK Fragment
2:Generated from
PEM Key On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
PEM Passphrase:Derived
From
AES Key Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
AES GCM Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
HMAC Key On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
CA Public Key Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Plaintext
DH Private Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Public Key:Paired
With
DH Peer Public Key:Used
With
IKEv1 SKEYID:Computes
SSH Shared
Secret:Computes
TLS Pre-Master
Secret:Computes
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 73 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
DH Public Key Exported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Private Key:Paired
With
DH Peer Public Key Imported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Private Key:Used
With
IKEv1 SKEYID:Computes
SSH Shared
Secret:Computes
TLS Pre-Master
Secret:Computes
ECDH Private Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
ECDH Public Key :Paired
With
ECDH Peer Public Key
:Used With
SSH Shared
Secret:Computes
TLS Pre-Master
Secret:Computes
ECDH Public Key Exported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
ECDH Private Key :Paired
With
ECDH Peer Public
Key
Imported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
ECDH Private Key :Used
With
SSH Shared
Secret:Computes
TLS Pre-Master
Secret:Computes
RSA Private Key Imported
encrypted form via
RSA key transport
(CP)
Imported
encrypted form via
RSA key transport
(DP-FW)
Exported
encrypted form via
RSA key transport
(CP)
Exported
encrypted form via
RSA key transport
(DP-FW)
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted By
RSA Public Key:Paired
With
RSA Public Key Exported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
RSA Private Key :Paired
With
SSH Private Key Exported
encrypted form via
part of config
backup file
On Disk:Plaintext Until
zeroization
method is
initiated
CLI command (SSH
private keys)
SSH Public Key:Paired
With
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 74 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
SSH Public Key Exported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SSH Private Key:Paired
With
SSH Peer Public Key Imported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SSH Private Key:Used
With
SSH Session Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SSH Shared
Secret:Derived From
SSH Authentication
Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SSH Shared
Secret:Derived From
IKEv1 Shared
Secret
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Private Key:Derived
From
DH Peer Public
Key:Derived From
IKEv1 SKEYID:Derives
IKEv1 PSK Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 Shared
Secret:Derived From
IKEv1 SKEYID_e:Derives
IKEv1 SKEYID_a:Derives
IKEv1 SKEYID_d:Derives
IKEv1 SKEYID_e In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID:Derived
From
IKEv1 Session
Key:Derives
IKEv1 SKEYID_a In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID:Derived
From
IKEv1 Authentication
Key:Derives
IKEv1 SKEYID_d In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID:Derived
From
IKEv1 Session Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID_e:Derived
From
IKEv1
Authentication Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID_a:Derived
From
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 75 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
IKEv2 Shared
Secret
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Private Key:Derived
From
DH Peer Public
Key:Derived From
IKEv2 SKEYSEED:Derives
IKEv2 SKEYSEED In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv2 Shared
Secret:Derived From
IKEv2 Session Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv2 SKEYSEED:Derived
From
IKEv2
Authentication Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv2 SKEYSEED:Derived
From
IPsec Session Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID:Derived
From
IKEv1 Shared
Secret:Derived From
IKEv2 Shared
Secret:Derived From
IPsec
Authentication Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
IKEv1 SKEYID:Derived
From
IKEv1 Shared
Secret:Derived From
IKEv2 Shared
Secret:Derived From
TLS Private Key Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
PEM Key:Encrypts
TLS Public Key:Paired
With
TLS Peer Public Key:Used
With
TLS Public Key Exported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
TLS Private Key:Paired
With
TLS Peer Public Key Imported plaintext
form via public key
certificate
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
TLS Private Key:Used
With
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 76 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
TLS Session Key In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
TLS Master
Secret:Derived From
TLS Authentication
Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
TLS Master
Secret:Derived From
TLS Ticket
Encryption Key
In Volatile
Memory:Plaintext
On Disk:Encrypted
Until
zeroization
method is
initiated
Reboot/Remove
power
CLI command (KEK
fragments)
KEK:Encrypted by
TLS Ticket
Authentication Key
In Volatile
Memory:Plaintext
On Disk:Encrypted
Until
zeroization
method is
initiated
Reboot/Remove
power
CLI command (KEK
fragments)
KEK:Encrypted by
SNMPv3 Privacy
Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SNMPv3 Privacy
Passphrase :Derived
From
SNMPv3
Authentication Key
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
SNMPv3 Authentication
Passphrase:Derived From
DNS Private KSK Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
PEM Key:Encrypted by
DNS Private KSK:Paired
With
DNS Public KSK Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Exported
encrypted form via
part of config
backup file
On Disk:Plaintext DNS Private KSK:Paired
With
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 77 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
DNS Private ZSK Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
PEM Key:Encrypted by
DNS Public ZSK:Paired
With
DNS Public ZSK Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Exported
encrypted form via
part of config
backup file
On Disk:Plaintext DNS Private ZSK:Paired
With
Firmware Load
Integrity Key
Imported plaintext In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
PEM Passphrase Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
In Volatile
Memory:Plaintext
On Disk:Encrypted
Until
zeroization
method is
initiated
Reboot/Remove
power
CLI command (KEK
fragments)
KEK:Encrypted by
AES-GCM IV In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
AES GCM Key:Paired
With
SSH Session Key:Paired
With
TLS Session Key:Paired
With
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 78 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
SSH Shared Secret In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
DH Public Key:Derived
From
DH Private Key:Derived
From
ECDH Public Key :Derived
From
ECDH Private Key
:Derived From
SSH Session Key:Derives
SSH Authentication
Key:Derives
TLS Pre-Master
Secret
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Completion of TLS
key derivation
Reboot/Remove
power
DH Peer Public
Key:Derived From
DH Private Key:Derived
From
ECDH Peer Public Key
:Derived by
ECDH Private Key
:Derived by
TLS Master
Secret:Derives
TLS Master Secret In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Session
termination
TLS Pre-Master
Secret:Derived From
TLS Session Key:Derives
TLS Authentication
Key:Derives
Hash DRBG
Entropy
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Hash DRBG Seed:Derives
Hash DRBG Seed In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Hash DRBG Seed:Derived
From
Hash DRBG 'V' Value
:Derives
Hash DRBG 'C'
Value:Derives
Hash DRBG 'V'
Value
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Hash DRBG Seed:Derived
From
Hash DRBG 'C'
Value:Paired With
Hash DRBG 'C'
Value
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Hash DRBG Seed:Derived
From
Hash DRBG 'V' Value
:Paired With
CTR DRBG Entropy In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
CTR DRBG Seed:Derives
CTR DRBG Seed In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
CTR DRBG Seed:Derived
From
CTR DRBG 'V'
Value:Derives
CTR DRBG 'Key'
Value:Derives
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 79 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
CTR DRBG 'V' Value In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
CTR DRBG Seed:Derived
From
CTR DRBG 'Key'
Value:Paired With
CTR DRBG 'Key'
Value
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
CTR DRBG Seed:Derived
From
CTR DRBG 'V'
Value:Paired With
SNMPv3 Privacy
Passphrase
Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
SNMPv3
Authentication
Passphrase
Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 80 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
LDAP Admin
Password
Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
ZebOS Router
Password
Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
Cluster Password
(Alphanumeric
string)
Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Imported plaintext
via local console
Exported
encrypted form via
part of config
backup file
On Disk:Encrypted Until
zeroization
method is
initiated
CLI command (KEK
fragments)
KEK:Encrypted by
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 81 of 103
Name Input - Output Storage
Storage
Duration
Zeroization Related SSPs
Operator Password Imported
encrypted form via
SSH
Imported
encrypted form via
TLS (CP)
Imported
encrypted form via
TLS (DP-FW)
Imported
encrypted form via
TLS (DP-HW)
Exported
encrypted form via
part of config
backup file
In Volatile
Memory:Plaintext
Until
zeroization
method is
initiated
Reboot/Remove
power
Table 22: SSP Table 2
9.5 Transitions
The following list specifies applicable transition periods or timeframes where an algorithm or key length
transitions from Approved to non-Approved:
• The module includes implementations of 1024-bit RSA signature verification that comply with FIPS PUB
186-2 and FIPS PUB 186-4. These publications have been superseded by FIPS PUB 186-5, and these
implementations are now allowed for legacy use only.
• The module includes implementations of SHA-1 for MAC generation and digital signature verification.
SHA-1 will be non-Approved for all uses starting January 1, 2031.
• In compliance with NIST SP 800-131A Rev. 2, the module supports algorithms and key lengths that provide
a minimum of 112 bits of security strength for applying cryptographic protection. Starting January 1, 2031,
the minimum security strength for applying cryptographic protection will be 128 bits, and security
strengths between 112 bits and 128 bits will be allowed for legacy use only to process information that is
already protected.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 82 of 103
10. Self-Tests
The module performs pre-operational self-tests and conditional self-tests. Pre-operational tests are performed
between the time the cryptographic module is powered and before the module transitions to the operational
state. Conditional self-tests are performed by the module during module operation when certain conditions exist.
The following sections list the self-tests performed by the module, their expected error status, and the error
resolutions.
10.1 Pre-Operational Self-Tests
The table below lists the pre-operational self-tests performed by the module.
Algorithm or Test
Test
Properties
Test Method Test Type Indicator Details
RSA SigVer
(FIPS186-4) (A3943)
2048-bit;
SHA2-512
Firmware
Integrity
SW/FW
Integrity
"FIPS Post Failed" message
in /var/log/ns.log
RSA 2048 digital signature
verification with SHA2-512
Table 23: Pre-Operational Self-Tests
10.2 Conditional Self-Tests
The table below lists the conditional self-tests performed by the module.
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CBC
(A7126)
128-bit KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Encrypt During module
start-up after
successful
completion of the
integrity test
AES-GCM
(A7126)
128-bit KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Encrypt During module
start-up after
successful
completion of the
integrity test
Counter
DRBG (A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Instantiate/Generate/Reseed During module
start-up after
successful
completion of the
integrity test
KAS-FFC-SSC
Sp800-56Ar3
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Primitive "Z" computation test During module
start-up after
successful
completion of the
integrity test
KAS-ECC-SSC
Sp800-56Ar3
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Primitive "Z" computation test During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 83 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
ECDSA SigGen
(FIPS186-5)
(A7126)
P-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Sign During module
start-up after
successful
completion of the
integrity test
ECDSA SigVer
(FIPS186-5)
(A7126)
P-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Verify During module
start-up after
successful
completion of the
integrity test
HMAC-SHA-1
(A7126)
SHA-1 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
HMAC-SHA2-
256 (A7126)
SHA2-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
HMAC-SHA2-
512 (A7126)
SHA2-512 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
PBKDF
(A7126)
SHA-1 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
RSA SigGen
(FIPS186-5)
(A7126)
2048-bit;
SHA2-256
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Sign During module
start-up after
successful
completion of the
integrity test
RSA SigVer
(FIPS186-5)
(A7126)
2048-bit;
SHA2-256
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Verify Before integrity
test
SHA-1
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
SHA2-256
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
SHA2-512
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 84 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
KDF IKEv1
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
IKEv1 KDF Test During module
start-up after
successful
completion of the
integrity test
KDF IKEv2
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
IKEv2 KDF Test During module
start-up after
successful
completion of the
integrity test
KDF SSH
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
SSH KDF Test During module
start-up after
successful
completion of the
integrity test
TLS v1.2 KDF
RFC7627
(A7126)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
TLS v1.2 Test During module
start-up after
successful
completion of the
integrity test
AES-CBC
(A3943)
128-bit KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Encrypt During module
start-up after
successful
completion of the
integrity test
AES-GCM
(A3943)
128-bit KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Encrypt During module
start-up after
successful
completion of the
integrity test
KAS-ECC-SSC
Sp800-56Ar3
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Primitive "Z" computation test During module
start-up after
successful
completion of the
integrity test
ECDSA SigGen
(FIPS186-5)
(A3943)
P-256 KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Sign During module
start-up after
successful
completion of the
integrity test
ECDSA SigVer
(FIPS186-5)
(A3943)
P-256 KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Verify During module
start-up after
successful
completion of the
integrity test
Hash DRBG
(A3943)
AES, 256-bit,
with
derivation
function
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Instantiate/Generate/Reseed During module
start-up after
successful
completion of the
integrity test
HMAC-SHA-1
(A3943)
128 bits KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 85 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
HMAC-SHA2-
256 (A3943)
256 bits KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
HMAC-SHA2-
512 (A3943)
256 bits KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
RSA SigGen
(FIPS186-5)
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Sign During module
start-up after
successful
completion of the
integrity test
RSA SigVer
(FIPS186-5)
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Verify During module
start-up after
successful
completion of the
integrity test
SHA-1
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
During module
start-up after
successful
completion of the
integrity test
SHA2-256
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
During module
start-up after
successful
completion of the
integrity test
SHA2-512
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
During module
start-up after
successful
completion of the
integrity test
KDF TLS
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
TLS Test During module
start-up after
successful
completion of the
integrity test
TLS v1.2 KDF
RFC7627
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
TLS v1.2 Test During module
start-up after
successful
completion of the
integrity test
TLS v1.3 KDF
(A3943)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
TLS v1.3 Test During module
start-up after
successful
completion of the
integrity test
SHA3-256
(A3513)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 86 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-CBC
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Encrypt During module
start-up after
successful
completion of the
integrity test
AES-GCM
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Encrypt During module
start-up after
successful
completion of the
integrity test
KAS-ECC-SSC
Sp800-56Ar3
(A3944)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Primitive "Z" computation test During module
start-up after
successful
completion of the
integrity test
ECDSA SigGen
(FIPS186-5)
(A3944)
P-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Sign During module
start-up after
successful
completion of the
integrity test
ECDSA SigVer
(FIPS186-5)
(A3944)
P-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Verify During module
start-up after
successful
completion of the
integrity test
HMAC-SHA-1
(A3944)
SHA-1 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
HMAC-SHA2-
256 (A3944)
SHA2-256 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
HMAC-SHA2-
512 (A3944)
SHA2-512 KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Hashed message authentication During module
start-up after
successful
completion of the
integrity test
RSA SigGen
(FIPS186-5)
(A3944)
2048-bit;
SHA2-256
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Sign During module
start-up after
successful
completion of the
integrity test
RSA SigVer
(FIPS186-5)
(A3944)
2048-bit;
SHA2-256
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Verify During module
start-up after
successful
completion of the
integrity test
SHA-1
(A3944)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 87 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
SHA2-256
(A3944)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
SHA2-512
(A3944)
KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
During module
start-up after
successful
completion of the
integrity test
KDF TLS
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
TLS Test During module
start-up after
successful
completion of the
integrity test
TLS v1.2 KDF
RFC7627
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
TLS v1.2 Test During module
start-up after
successful
completion of the
integrity test
ECDSA digital
signature PCT
(CP)
PCT PCT Message is
displayed and
logged if errored
Sign/verify Upon generation
of a key pair for
ECDSA signature
functions
DH key
agreement
PCT (CP)
PCT PCT Message is
displayed and
logged if errored
Key agreement Upon generation
of a key pair for
DH key agreement
functions
ECDH key
agreement
PCT (CP)
PCT PCT Message is
displayed and
logged if errored
Key agreement Upon generation
of a key pair for
ECDH key
agreement
functions
RSA digital
signature PCT
(CP)
PCT PCT Message is
displayed and
logged if errored
Sign/verify Upon generation
of a key pair for
RSA signature
functions
RSA key
transport PCT
(CP)
PCT PCT Message is
displayed and
logged if errored
Encrypt/decrypt Upon generation
of a key pair for
RSA key transport
functions
Firmware
Load Test
2048-bit RSA
SigVer; SHA2-
512
SW/FW
Load
Test
SW/FW
Load
Message is
displayed and
logged if errored
RSA signature verification 2048-
bit software load test
Upon performing a
firmware update
ECDSA digital
signature PCT
(DP-FW)
PCT PCT Message is
displayed and
logged if errored
Sign/verify Upon generation
of a key pair for
ECDSA signature
functions
ECDH key
agreement
PCT (DP-FW)
PCT PCT Message is
displayed and
logged if errored
Key agreement Upon generation
of a key pair for
ECDH key
agreement
functions
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 88 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
RSA digital
signature PCT
(DP-FW)
PCT PCT Message is
displayed and
logged if errored
Sign/verify Upon generation
of a key pair for
RSA signature
functions
RSA key
transport PCT
(DP-FW)
PCT PCT Message is
displayed and
logged if errored
Encrypt/decrypt Upon generation
of a key pair for
RSA key transport
functions
Entropy
Adaptive
Proportion
Test
APT CAST Message is
displayed and
logged if errored
Adaptive Proportion Test on
entropy source
During module
start-up after
successful
completion of the
integrity test
Entropy
Repetition
Count Test
RCT CAST Message is
displayed and
logged if errored
Repetition Count Test on
entropy source
During module
start-up after
successful
completion of the
integrity test
ECDSA digital
signature PCT
(DP-HW)
PCT PCT Message is
displayed and
logged if errored
Sign/verify Upon generation
of a key pair for
ECDSA signature
functions
ECDH key
agreement
PCT (DP-HW)
PCT PCT Message is
displayed and
logged if errored
Key agreement Upon generation
of a key pair for
ECDH key
agreement
functions
AES-CBC
Decrypt
(A7126)
128-bit KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Decrypt During module
start-up after
successful
completion of the
integrity test
AES-GCM
Decrypt
(A7126)
128-bit KAT CAST "POST FAILED"
message in
/var/log/FIPS-
post.log
Decrypt During module
start-up after
successful
completion of the
integrity test
AES-CBC
Decrypt
(A3943)
128-bit KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Decrypt During module
start-up after
successful
completion of the
integrity test
AES-GCM
Decrypt
(A3943)
128-bit KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Decrypt During module
start-up after
successful
completion of the
integrity test
AES-CBC
Decrypt
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Decrypt During module
start-up after
successful
completion of the
integrity test
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 89 of 103
Algorithm or
Test
Test
Properties
Test
Method
Test
Type
Indicator Details Conditions
AES-GCM
Decrypt
(A3944)
KAT CAST "FIPS POST Failed"
message in
/var/log/ns.log
Decrypt During module
start-up after
successful
completion of the
integrity test
KDF SNMP
(A7126)
KAT CAST “POST FAILED”
message in
/var/log/FIPS-
post.log
SSH KDF Test During module
start-up after
successful
completion of the
integrity test
Table 24: Conditional Self-Tests
To ensure all conditional CASTs are performed prior to the first operational use of the associated algorithm, all
CASTs are performed during the module’s initial start-up sequence. CASTs for algorithms used in the pre-
operational integrity test are performed prior to the integrity test itself; all other CASTs are executed immediately
after the successful completion of the integrity test.
10.3 Periodic Self-Test Information
The module permits operators to initiate the pre-operational integrity test and conditional CASTs on demand for
periodic testing of the module. The following table lists the applicable self-tests and the associated methods for
test initiation.
Algorithm or Test Test Method Test Type Period Periodic Method
RSA SigVer (FIPS186-4)
(A3943)
Firmware Integrity SW/FW Integrity On Demand Manually
Table 25: Pre-Operational Periodic Information
Algorithm or Test Test Method Test Type Period Periodic Method
AES-CBC (A7126) KAT CAST On Demand Manually
AES-GCM (A7126) KAT CAST On Demand Manually
Counter DRBG (A7126) KAT CAST On Demand Manually
KAS-FFC-SSC Sp800-
56Ar3 (A7126)
KAT CAST On Demand Manually
KAS-ECC-SSC Sp800-
56Ar3 (A7126)
KAT CAST On Demand Manually
ECDSA SigGen (FIPS186-
5) (A7126)
KAT CAST On Demand Manually
ECDSA SigVer (FIPS186-
5) (A7126)
KAT CAST On Demand Manually
HMAC-SHA-1 (A7126) KAT CAST On Demand Manually
HMAC-SHA2-256
(A7126)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A7126)
KAT CAST On Demand Manually
PBKDF (A7126) KAT CAST On Demand Manually
RSA SigGen (FIPS186-5)
(A7126)
KAT CAST On Demand Manually
RSA SigVer (FIPS186-5)
(A7126)
KAT CAST On Demand Manually
SHA-1 (A7126) KAT CAST On Demand Manually
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 90 of 103
Algorithm or Test Test Method Test Type Period Periodic Method
SHA2-256 (A7126) KAT CAST On Demand Manually
SHA2-512 (A7126) KAT CAST On Demand Manually
KDF IKEv1 (A7126) KAT CAST On Demand Manually
KDF IKEv2 (A7126) KAT CAST On Demand Manually
KDF SSH (A7126) KAT CAST On Demand Manually
TLS v1.2 KDF RFC7627
(A7126)
KAT CAST On Demand Manually
AES-CBC (A3943) KAT CAST On Demand Manually
AES-GCM (A3943) KAT CAST On Demand Manually
KAS-ECC-SSC Sp800-
56Ar3 (A3943)
KAT CAST On Demand Manually
ECDSA SigGen (FIPS186-
5) (A3943)
KAT CAST On Demand Manually
ECDSA SigVer (FIPS186-
5) (A3943)
KAT CAST On Demand Manually
Hash DRBG (A3943) KAT CAST On Demand Manually
HMAC-SHA-1 (A3943) KAT CAST On Demand Manually
HMAC-SHA2-256
(A3943)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3943)
KAT CAST On Demand Manually
RSA SigGen (FIPS186-5)
(A3943)
KAT CAST On Demand Manually
RSA SigVer (FIPS186-5)
(A3943)
KAT CAST On Demand Manually
SHA-1 (A3943) KAT CAST On Demand Manually
SHA2-256 (A3943) KAT CAST On Demand Manually
SHA2-512 (A3943) KAT CAST On Demand Manually
KDF TLS (A3943) KAT CAST On Demand Manually
TLS v1.2 KDF RFC7627
(A3943)
KAT CAST On Demand Manually
TLS v1.3 KDF (A3943) KAT CAST On Demand Manually
SHA3-256 (A3513) KAT CAST On Demand Manually
AES-CBC (A3944) KAT CAST On Demand Manually
AES-GCM (A3944) KAT CAST On Demand Manually
KAS-ECC-SSC Sp800-
56Ar3 (A3944)
KAT CAST On Demand Manually
ECDSA SigGen (FIPS186-
5) (A3944)
KAT CAST On Demand Manually
ECDSA SigVer (FIPS186-
5) (A3944)
KAT CAST On Demand Manually
HMAC-SHA-1 (A3944) KAT CAST On Demand Manually
HMAC-SHA2-256
(A3944)
KAT CAST On Demand Manually
HMAC-SHA2-512
(A3944)
KAT CAST On Demand Manually
RSA SigGen (FIPS186-5)
(A3944)
KAT CAST On Demand Manually
RSA SigVer (FIPS186-5)
(A3944)
KAT CAST On Demand Manually
SHA-1 (A3944) KAT CAST On Demand Manually
SHA2-256 (A3944) KAT CAST On Demand Manually
SHA2-512 (A3944) KAT CAST On Demand Manually
KDF TLS (A3944) KAT CAST On Demand Manually
TLS v1.2 KDF RFC7627
(A3944)
KAT CAST On Demand Manually
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 91 of 103
Algorithm or Test Test Method Test Type Period Periodic Method
ECDSA digital signature
PCT (CP)
PCT PCT
DH key agreement PCT
(CP)
PCT PCT
ECDH key agreement
PCT (CP)
PCT PCT
RSA digital signature
PCT (CP)
PCT PCT
RSA key transport PCT
(CP)
PCT PCT
Firmware Load Test SW/FW Load Test SW/FW Load
ECDSA digital signature
PCT (DP-FW)
PCT PCT
ECDH key agreement
PCT (DP-FW)
PCT PCT
RSA digital signature
PCT (DP-FW)
PCT PCT
RSA key transport PCT
(DP-FW)
PCT PCT
Entropy Adaptive
Proportion Test
APT CAST On Demand Manually
Entropy Repetition
Count Test
RCT CAST On Demand Manually
ECDSA digital signature
PCT (DP-HW)
PCT PCT
ECDH key agreement
PCT (DP-HW)
PCT PCT
AES-CBC Decrypt
(A7126)
KAT CAST On Demand Manually
AES-GCM Decrypt
(A7126)
KAT CAST On Demand Manually
AES-CBC Decrypt
(A3943)
KAT CAST On Demand Manually
AES-GCM Decrypt
(A3943)
KAT CAST On Demand Manually
AES-CBC Decrypt
(A3944)
KAT CAST On Demand Manually
AES-GCM Decrypt
(A3944)
KAT CAST On Demand Manually
KDF SNMP (A7126) KAT CAST On Demand Manually
Table 26: Conditional Periodic Information
10.4 Error States
The table below describes the module’s error states and error status indicators.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 92 of 103
Name Description Conditions Recovery Method Indicator
Critical Error
(from pre-
operational
tests)
Terminal state where
the boot sequence
and entire system is
halted.
Module fails
pre-operational
integrity test.
Manual restart must
be initiated (clearing
the error state) and
the module must pass
the pre-operational
integrity test.
NetScaler Control Plane Cryptographic Library *
Failure is indicated by a system halt and "POST
Failed" in /var/log/FIPS-post.log. * Successful
completion of the self-tests is indicated by
"POST Success" in /var/log/FIPS-post.log.
NetScaler Data Plane Cryptographic Library *
Failure is indicated by a system halt and "FIPS
Post Failed" in /var/log/ns.log. * Successful
completion of the self-tests is indicated by "FIPS
POST Successful" in /var/log/ns.log.
Critical Error
(from
conditional
CASTs)
Terminal state where
cryptographic
operations are halted
and the module
inhibits all data
output from the
module.
Module fails a
conditional
CAST.
The module logs the
error and
automatically reboots
to an unconfigured
state (clearing the
error state).
NetScaler Control Plane Cryptographic Library *
Failure is indicated by a system halt and "POST
Failed" in /var/log/FIPS-post.log. * Successful
completion of the self-tests is indicated by
"POST Success" in /var/log/FIPS-post.log.
NetScaler Data Plane Cryptographic Library *
Failure is indicated by a system halt and "FIPS
Post Failed" in /var/log/ns.log. * Successful
completion of the self-tests is indicated by "FIPS
POST Successful" in /var/log/ns.log.
Soft Error Temporary state
resulting from failure
of a conditional PCT
or other non-CAST
conditional self-test.
Module fails a
conditional PCT
or other non-
CAST
conditional self-
test.
The module logs the
error and displays an
error message
(clearing the error
state). The module is
immediately
recovered.
* Failure is indicated by the display of the
following message: "Internal failure in SSL
cert/key generation tool". * Successful
completion of the conditional self-test is
indicated by the absence of an error message.
Table 27: Error States
If the module experiences repeated errors or continuously goes to a halted state, the module is considered to be
malfunctioning or compromised, and CSG Customer Support must be contacted.
10.5 Operator Initiation of Self-Tests
Module operators can initiate the pre-operational integrity test and conditional CASTs on demand by
rebooting/power-cycling the module.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 93 of 103
11. Life-Cycle Assurance
The sections below describe how to ensure the module is operating in its validated configuration, including the
following:
• Procedures for secure installation, initialization, startup, and operation of the module
• Maintenance requirements
• Administrator and non-Administrator guidance
Operating the module without following the guidance herein (including the use of undocumented services) will
result in non-compliant behavior and is outside the scope of this Security Policy.
11.1 Installation, Initialization, and Startup Procedures
The module is shipped to the customer in a non-configured state. The CO is responsible for all initial setup activities,
including installing and configuring the module firmware. Prior to the installation, the CO should become familiar
with the document entries within the NetScaler 14.1 section on CSG’s NetScaler online product documentation
portal.
The following sections provide references to step-by-step instructions for the installation of the module, as well
as the steps necessary to configure the module for operation in the Approved mode.
11.1.1 Tamper-Evident Seal Inspection
When the module is first received, the CO shall confirm placement of all tamper-evident seals (refer to section 7
of this document for details regarding label placement). If any seals show signs of tampering, the CO must contact
CSG Customer Support immediately.
11.1.2 Installation
For detailed guidance regarding the installation of the module, please refer to the following articles on the
NetScaler MPX online documentation portal:
• NetScaler MPX hardware-software compatibility matrix
• Prepare for Installation
• Install the hardware
The above entries include the NetScaler MPX support matrix and usage guidelines, prerequisites for setting up the
appliance, and installation instructions. To install the required license files, the CO shall follow the guidance in the
Licensing overview article on the online product documentation portal. Once the license files are installed, reboot
the module so all licenses are applied.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 94 of 103
11.1.3 Initialization
After installation is complete, the CO is responsible for initializing the module. The CO can use the Web GUI or CLI
to perform the configuration steps to prepare the module for operation. General configuration steps must be
complete before performing configuration steps necessary to place the module in the Approved mode of
operation. Guidance for first-time setup is provided in the Initial configuration article found on the online product
documentation portal.
Once general configuration steps have been completed, the CO shall perform these additional security-relevant
initialization steps to ensure that the module operates in its Approved mode:
• Configure the password/passphrase policies
• Replace the default TLS certificate
• Disable HTTP access to the Web GUI
• Enable external authentication
• Disable local authentication
• Disable non-compliant TLS 1.2 KDF
To accomplish these tasks, the CO shall follow the procedures detailed in the sections below.
11.1.3.1 Configure the Password/Passphrase Policies
Passphrases are used to derive keys using PBKDF. The CO shall configure strong password/passphrase policies.
This is accomplished with the following steps from the Web GUI:
1. In the Configuration navigation pane, go to System and click the Settings node.
2. In the Settings section, click the Change Global System Settings link.
3. In the Strong Password field, select Enable All.
4. In the Min Password Length field, type “8”.
5. Click OK.
11.1.3.2 Replace the Default TLS Certificate
By default, the module includes a factory-provisioned RSA certificate for TLS connections (ns-server.cert and
ns-server.key). This certificate is not intended for use in production deployments and must be replaced. The
CO shall replace the default certificate with a newly generated certificate after the initial installation.
To replace the default TLS certificate, the CO shall follow these steps:
1. Run the following CLI command to set the hostname of the module: set ns hostName [hostname]
2. From the Web GUI, complete the following procedure to create a Certificate Signing Request (CSR):
a. In the Configuration navigation pane, go to Traffic Management and click the SSL node.
b. In the SSL Certificates section, click the Create Certificate Request link.
c. Make sure to provide values for all the required fields marked with an “*” and then click Create.
Note that the Common Name field will contain the value of hostname created in step 1 above.
3. Submit the CSR file to a trusted CA. The CSR file is available in the /nsconfig/ssl directory.
4. After receiving the certificate from the trusted CA, copy the file to the /nsconfig/ssl directory.
5. From the Web GUI, navigate to Traffic Management > SSL and choose ns-server-certificate.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 95 of 103
6. Click Update.
7. In the Certificate File Name field, choose the certificate file that was received from the CA. Use
the Browse option to choose the file that you have received from CA after signing. Choose
the Browse > Local option if the file is saved on your workstation/local drive.
8. In the Private Key File Name field, specify the default private key file name (ns-server.key).
9. Select the No Domain Check option.
10. Click OK.
For more information, please refer to the Citrix Support Knowledge Center article CTX122521 on the online
product documentation portal.
11.1.3.3 Disable HTTP Access to the Web GUI
Traffic to the administrative interface and Web GUI is protected by configuring the module to use HTTPS17
. Once
the module has been configured to use new TLS and SSH certificates, the CO shall disable HTTP access to the GUI
management interface with the following CLI command:
set ns ip <NSIP> -gui SECUREONLY
11.1.3.4 Enable External Authentication
Once the module is configured in Approved mode and the nsroot account is disabled, then external
authentication must be configured. The CO shall follow the guidance in the External user authentication article
found on the online product documentation portal to configure external system authentication.
The CO shall ensure the following before enabling external authentication:
• A secure connection is established with the external authentication server.
• Shell access is disabled for all profiles on the external authentication server.
11.1.3.5 Disable Local Authentication
The nsroot account is a default account with root CLI access (superuser) privileges that is required for initial
configuration. During initial configuration, the CO shall disable local system authentication to block access to all
local accounts (including the nsroot account), and the CO shall ensure that superuser privileges are not assigned
to any user account. To disable local system authentication and enable external system authentication, the CO
shall run the following CLI command:
set system parameter -localauth disabled
11.1.3.6 Disable Non-Compliant TLS 1.2 KDF
The module includes implementations of the TLS 1.2 KDFs that are compliant with RFC 7627 (with the extended
master secret) and with RFC 5246 (with the non-EMS master secret). To disable support for the non-EMS KDF, the
CO shall do the following:
• For the control plane, add the following line to the /etc/ssl/openssl.conf file (under fips_sect):
17
HTTPS – Hypertext Transfer Protocol Secure
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 96 of 103
disable-no-ems-kdf =1
• For the data plane, configure the following CLI under SSL profile:
set ssl profile <profile name> -allowLegacyKDF NO
set ssl profile <profile name> -allowextendedMasterSecret YES
11.1.4 Startup
No additional startup steps are required to be performed by end-users.
11.2 Administrator Guidance
Once installed and configured, the Crypto Officer is responsible for maintaining and monitoring the status of the
module to ensure that it is running in its Approved mode. This section provides guidance that the Crypto Officer
must follow to ensure that the module is operating in its Approved mode.
11.2.1 Status Information
The CO shall be responsible for regularly monitoring the module’s status for the Approved mode of operation.
When configured according to the CO’s guidance, the module only operates in the Approved mode. Thus, the
current status of the module when operational is always in the Approved mode.
11.2.2 Versioning Information
An operator can view the versioning information by any of the following methods:
• Using the CLI:
o show ns info - shows details about the software, including software version, enabled and
disabled features, and configured network information
o show ns version – shows version and build number of the appliance
o show ns hardware – shows details of the appliance hardware and information such as the host
ID18
and serial number
• Using the RESTful Nitro API with the GET method:
https://module-ip-address>/nitro/v5/config/nshardware
https://module-ip-address>/nitro/v5/config/nsversion
• Using the Web GUI by navigating to Configuration > System > System Information
18
ID – Identifier
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 97 of 103
These methods will display general system and hardware information about the module, including the platform
version, CPU information, and appliance serial number. Additionally, the Web GUI’s dashboard includes a system
overview section with information such as system HA state, system master state, and system uptime.
The versioning output “NetScaler NS14.1, version NS14.1-FIPS” denotes the module name NetScaler MPX and
module version 14.1.FIPS, which can be correlated with the module’s validation record.
11.2.3 Additional Administrator Policies and Guidance
This section notes additional policies below that must be followed by the CO:
• All private keys (except for SSH private keys) must be stored as PEM files in encrypted format using one
of the Approved encryption algorithms listed in section 2.5.1.
• Upon successful bootup of the module, the module is configured by default to use only NIST SP 800-52
Rev. 2 recommended cipher suites for TLS connections. If modified, the CO shall ensure that only
Approved cipher suites are configured while in the Approved mode. It is recommended to use the list of
Approved TLS cipher suites in section 3.3 of NIST SP 800-52 Rev. 2 as guidance.
• The module must be configured to use PSK-based authentication for IPsec connections. The CO shall
provide a PSK value when configuring IPsec profiles via the GUI, CLI, or API. Configuring digital certificate-
based authentication for IPsec connections is prohibited while in the Approved mode of operation.
• Kerberos traffic management/SSO shall not be configured or used in the Approved mode of operation.
• The CO must ensure that the “Key” and “AutoKey” authentication parameters are not set when adding
NTP servers via the GUI, CLI, or API.
• The module has built-in CA tools used to create self-signed certificates for testing purposes. While the
feature does include the generation of keys, those keys are not considered CSPs (as they are not being
used for production purposes). The CO shall ensure that all certificates are signed using a trusted CA and
not by a self-signed certificate.
• The TLS Ticket Encryption Key and TLS Ticket Authentication Key can be entered manually via the CLI or
generated by the module using the data plane DRBG. Operators shall not enter these keys manually.
• If any irregular activity is noticed or the module is consistently reporting errors, then CSG Customer
Support should be contacted.
11.3 Non-Administrator Guidance
Operators with the User role do not have the ability to configure sensitive information on the module. They must
be diligent in selecting strong passwords and must not reveal their password to anyone. Additionally, they must
be careful to protect any secret or private keys in their possession.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 98 of 103
11.4 Design and Rules
By design, the module follows or enforces the following rules of operation:
• The module provides two distinct operator roles: User and Cryptographic Officer.
• An operator does not have access to any cryptographic services prior to assuming an authorized role.
• The module performs all self-tests without any operator action required.
• The module inhibits data output during key generation, self-tests, zeroization, and error states.
• Status information output by the module does not contain CSPs or sensitive data that if misused could
lead to a compromise of the module.
• The module does not support a maintenance interface or role.
• The module does not support manual SSP establishment methods.
• The module does not have any proprietary external input/output devices used for entry/output of data.
• The module does not output intermediate key values.
• The module does not provide bypass services or ports/interfaces.
11.5 End of Life
To securely wipe all information (including licenses, configuration, images, and scripts) stored on the module, the
CO shall follow the instructions in the Wiping the data from your NetScaler article found on the online product
documentation portal.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 99 of 103
12. Mitigation of Other Attacks
The module does not claim to mitigate any attacks beyond the FIPS 140-3 Level 2 requirements for this validation.
Therefore, per ISO/IEC 19790:2012 section 7.12, requirements for this section are not applicable.
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 100 of 103
Appendix A. Acronyms and Abbreviations
Table 28 provides definitions for the acronyms and abbreviations used in this document.
Table 28. Acronyms and Abbreviations
Acronym Definition
AES Advanced Encryption Standard
API Application Programming Interface
CA Certificate Authority
CAST Cryptographic Algorithm Self-Test
CBC Cipher Block Chaining
CLI Command Line Interface
CCCS Canadian Centre for Cyber Security
CCM Counter with CBC-MAC
CMVP Cryptographic Module Validation Program
CO Cryptographic Officer
CPU Central Processing Unit
CSP Critical Security Parameter
CSR Certificate Signing Request
CTR Counter
CVL Component Validation List
DH Diffie-Hellman
DRBG Deterministic Random Bit Generator
ECB Electronic Code Book
ECC Elliptic Curve Cryptography
ECDH Elliptic Curve Diffie-Hellman
ECDSA Elliptic Curve Digital Signature Algorithm
EMS Extended Master Secret
FFC Finite Field Cryptography
FIPS Federal Information Processing Standard
Gbps Gigabits per second
GCM Galois/Counter Mode
GMAC Galois Message Authentication Code
GUI Graphical User Interface
HA High Availability
HMAC (keyed-) Hash Message Authentication Code
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 101 of 103
Acronym Definition
HTTP Hypertext Transfer Protocol
HTTPS Hypertext Transfer Protocol Secure
IKE Internet Key Exchange
IPsec Internet Protocol Security
KAS Key Agreement Scheme
KAS-ECC-SSC Key Agreement Scheme - Elliptic Curve Cryptography - Shared Secret Computation
KAS-FFC-SSC Key Agreement Scheme - Finite Field Cryptography - Shared Secret Computation
KAT Known Answer Test
KDF Key Derivation Scheme
KTS Key Transport Scheme
KW Key Wrap
KWP Key Wrap with Padding
LDAP Lightweight Directory Access Protocol
LOM Lights-Out Management
MAC Message Authentication Code
NIST National Institute of Standards and Technology
OS Operating System
PBKDF Password-Based Key Derivation Function
PCT Pairwise Consistency Test
PEM Privacy Enhanced Mail
PKCS Public Key Cryptography Standard
PSK Pre-Shared Key
PSP Public Security Parameter
PSS Probabilistic Signature Scheme
RSA Rivest Shamir Adleman
REST Representational State Transfer
RFC Request for Comment
RNG Random Number Generator
RSA Rivest, Shamir, and Adleman
SAML Security Assurance Markup Language
SHA Secure Hash Algorithm
SHS Secure Hash Standard
SNMP Simple Network Management Protocol
SP Special Publication
SQL Structured Query Language
SSC Shared Secret Computation
FIPS 140-3 Non-Proprietary Security Policy, Version 0.4 June 11, 2026
NetScaler MPX
©2026 Cloud Software Group
This document may be freely reproduced and distributed whole and intact including this copyright notice.
Page 102 of 103
Acronym Definition
SSH Secure Shell
SSL Secure Sockets Layer
SSP Sensitive Security Parameter
TCP Transmission Control Protocol
TLS Transport Layer Security
URL Uniform Resource Locator
Prepared by:
Corsec Security, Inc.
12600 Fair Lakes Circle, Suite 210
Fairfax, VA 22033
United States of America
Phone: +1 703 267 6050
Email: info@corsec.com
Web: www.corsec.com