This page was not yet optimized for use on mobile devices.
Edge Security Cryptographic Module
Certificate details
| Certificate ID | #4963 |
|---|---|
| Status | active |
| Validation dates | 10.02.2025 |
| Sunset date | 09-02-2030 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | Multi-Chip Embedded |
| Caveat | None |
| Exceptions |
|
| Description | Ultra I&C’s Edge Security Module provides built-in OSI layer 3 IPsec and Layer 2 VLAN encryption capabilities. As a hardware-based embedded cryptographic module, it serves a secured platform for customizable security applications. |
| Vendor | Ultra Intelligence and Communications http://www.ultra.group |
| Lab | Gossamer Security Solutions |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES-, AES, CAST, HMACAsymmetric Algorithms
RSA 2048, RSA 4096, ECDH, ECDSA, ECC, Diffie-Hellman, DHE, DHHash functions
SHA-1, SHA3-256, SHA3-384, SHA3-512Schemes
MACProtocols
TLS v1.2, TLS v1.3, TLS, TLSv1.2, TLSv1.3, TLS 1.3, IKEv2, IKE, IPsec, VPNRandomness
DRBG, RBGLibraries
OpenSSLElliptic Curves
P-256, P-384, P-521, P-512Block cipher modes
CTR, GCMTrusted Execution Environments
PSP, SSCSecurity level
level 2, Level 2Certification process
out of scope, fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validationStandards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, SP 800-38A, SP 800-38C, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, PKCS 1, RFC7627, RFC 5288, RFC8446, RFC 7296Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 4963,
"dgst": "7db926c9ac2fbebe",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"ECDSA KeyGen (FIPS186-4)A3316",
"RSA SigGen (FIPS186-4)A3316",
"AES-GCMA3318",
"AES-CBCA3318",
"KDF IKEv2A3316",
"Safe Primes Key GenerationA3316",
"ECDSA SigVer (FIPS186-4)A3316",
"KDF SNMPA3316",
"SHA-1A3316",
"KAS-ECC-SSC Sp800-56Ar3A3316",
"#A3318",
"SHA2-512A3318",
"SHA2-384A3318",
"AES-CCMA3318",
"ECDSA SigGen (FIPS186-4)A3316",
"TLS v1.3 KDFA3316",
"RSA KeyGen (FIPS186-4)A3316",
"HMAC-SHA-1A3316",
"SHA2-256A3318",
"HMAC-SHA2-512A3318",
"AES-ECBA3316",
"#A3316",
"HMAC-SHA2-384A3318",
"Counter DRBGA3316",
"HMAC-SHA2-256A3318",
"KAS-FFC-SSC Sp800-56Ar3A3316",
"TLS v1.2 KDF RFC7627A3316",
"RSA SigVer (FIPS186-4)A3316"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 1,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A3316",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3318",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3316",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-CCM",
"cavpCertName": "A3318",
"properties": "Key Length - 128, 192, 256",
"reference": "SP 800-38C"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A3316",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3316",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "A3318",
"properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 192, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "Counter DRBG",
"cavpCertName": "A3316",
"properties": "Prediction Resistance - No, Yes Mode - AES-128, AES-192, AES-256 Derivation Function Enabled - No",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512, SHA3-256, SHA3-384, SHA3-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2- 512, SHA3-256, SHA3-384, SHA3-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3316",
"properties": "Key Length - Key Length: 128",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3316",
"properties": "Key Length - Key Length: 128",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A3318",
"properties": "Key Length - Key Length: 128",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3316",
"properties": "Key Length - Key Length: 192",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 384",
"cavpCertName": "A3318",
"properties": "Key Length - Key Length: 192",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3316",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 512",
"cavpCertName": "A3318",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A3316",
"properties": "Domain Parameter Generation Methods - P-256 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A3316",
"properties": "Domain Parameter Generation Methods - FB, FC, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, MODP-2048 Scheme - dhEphem - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A3316",
"properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 224-8192 Increment 8 Derived Keying Material Length - Derived Keying Material Length: 1024-16384 Increment 8, Derived Keying Material Length: 384-16384 Increment 8 Hash Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SNMP (CVL)",
"cavpCertName": "A3316",
"properties": "Password Length - Password Length: 64, 8192",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Key Generation Mode - B.3.3 Modulo - 2048, 3072 Primality Tests - Table C.2 Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Signature Type - PKCS 1.5 Modulo - 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A3316",
"properties": "Signature Type - PKCS 1.5 Modulo - 1024, 2048, 3072",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A3316",
"properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3316",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3316",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3318",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3316",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A3318",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3316",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3318",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
"cavpCertName": "A3316",
"properties": "Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "TLS v1.3 KDF (CVL)",
"cavpCertName": "A3316",
"properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
"reference": "SP 800-135 Rev. 1"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Create User Accounts",
"indicator": "N/A",
"inputs": "Command s to create the other role\u0027s account",
"name": "Create User Account",
"outputs": "Status of the completion of account status",
"rolesSspAccess": "3e-Local - 3e-Local Password: W,Z - 3e- CryptoOffic er Password: W,Z - 3e- Administrat or Password: W,Z",
"secFunImpl": "None"
},
{
"description": "Command s to configure the network",
"indicator": "N/A",
"inputs": "Command s to configure the network",
"name": "Configure Network",
"outputs": "Status of the completion of network configurati on status",
"rolesSspAccess": "3e-Local 3e- CryptoOffic er 3e- Administrat or",
"secFunImpl": "None"
},
{
"description": "Command used to show Module\u0027s Status",
"indicator": "N/A",
"inputs": "Command used to show Module\u0027s Status",
"name": "Show Status",
"outputs": "Module\u0027s operational status",
"rolesSspAccess": "3e-Local 3e- CryptoOffic er 3e- Administrat or",
"secFunImpl": "None"
},
{
"description": "Show module\u0027s ID and versioning information",
"indicator": "N/A",
"inputs": "Command to show Module\u0027s ID and version",
"name": "Show Version",
"outputs": "Module\u0027s ID and versioning information",
"rolesSspAccess": "3e-Local 3e- CryptoOffic er 3e- Administrat or",
"secFunImpl": "None"
},
{
"description": "3e-Local role authenticat ion",
"indicator": "N/A",
"inputs": "3e-Local authenticat ion request",
"name": "3e-Local Authenticat ion",
"outputs": "Status of the 3e- Local authenticat ion",
"rolesSspAccess": "3e-Local - 3e-Local Password: W - 3e-Local Password:",
"secFunImpl": "None"
},
{
"description": "3e- CryptoOffic er role authenticat ion",
"indicator": "N/A",
"inputs": "3e- CryptoOffic er authenticat ion request",
"name": "3e- CryptoOffic er Authenticat ion",
"outputs": "Status of the 3e- CryptoOffic er authenticat ion",
"rolesSspAccess": "Z 3e- CryptoOffic er - 3e- CryptoOffic er Password: W,Z",
"secFunImpl": "None"
},
{
"description": "3e- Administrat or role authenticat ion",
"indicator": "N/A",
"inputs": "3e- Administrat or authenticat ion request",
"name": "3e- Administrat or Authenticat ion",
"outputs": "Status of the 3e- Administrat or authenticat ion",
"rolesSspAccess": "3e- Administrat or - 3e- Administrat or Password: W,Z",
"secFunImpl": "None"
},
{
"description": "End User role authenticat ion",
"indicator": "N/A",
"inputs": "End User authenticat ion request",
"name": "End User Authenticat ion",
"outputs": "Status of the End User authenticat ion",
"rolesSspAccess": "End User - IPSec/IKE Pre-shared Secret: W,Z",
"secFunImpl": "None"
},
{
"description": "Zeroize all SSPs",
"indicator": "N/A",
"inputs": "Command to zeroize the module",
"name": "Perform Zeroization",
"outputs": "Status of the SSPs zeroization",
"rolesSspAccess": "3e-Local - DRBG Entropy Input: Z - DRBG",
"secFunImpl": "None"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Seed: Z - DRBG Internal State V Value: Z - DRBG Key: Z - 3e-Local Password: Z - 3e- CryptoOffic er Password: Z - 3e- Administrat or Password: Z - Firmware Load Test Key: Z - TLS ECDH Private Key: Z - TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS Master Secret: Z - TLS",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryption Key: Z - TLS Authenticat ion Key: Z - IPsec/IKE DH Private Key: Z - IPSec/IKE DH Public Key: Z - IPSec/IKE Peer DH Public Key: Z - IPSec/IKE DH Shared Secret: Z - IPSec/IKE ECDH Private Key: Z - IPSec/IKE ECDH Public Key: Z - IPSec/IKE Peer ECDH Public Key: Z - IPSec/IKE ECDH Shared Secret: Z - IPSec/IKE ECDSA Private Key: Z - IPSec/IKE",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDSA Public Key: Z - IPSec/IKE RSA Private Key: Z - IPSec/IKE RSA Public Key: Z - IPSec/IKE Pre-shared Secret: Z - SKEYSEE D: Z - IPSec/IKE Encryption Key: Z - IPSec/IKE Authenticat ion Key: Z - SNMPv3 Shared Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticat ion Key: Z - VLAN Encryption Key: Z - VLAN Authenticat ion Key: Z 3e- CryptoOffic er - DRBG Entropy Input: Z - DRBG",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Seed: Z - DRBG Internal State V Value: Z - DRBG Key: Z - 3e-Local Password: Z - 3e- CryptoOffic er Password: Z - 3e- Administrat or Password: Z - Firmware Load Test Key: Z - TLS ECDH Private Key: Z - TLS ECDH Public Key: Z - TLS Peer ECDH Public Key: Z - TLS ECDH Shared Secret: Z - TLS RSA Private Key: Z - TLS RSA Public Key: Z - TLS Master Secret: Z - TLS",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Encryption Key: Z - TLS Authenticat ion Key: Z - IPsec/IKE DH Private Key: Z - IPSec/IKE DH Public Key: Z - IPSec/IKE Peer DH Public Key: Z - IPSec/IKE DH Shared Secret: Z - IPSec/IKE ECDH Private Key: Z - IPSec/IKE ECDH Public Key: Z - IPSec/IKE Peer ECDH Public Key: Z - IPSec/IKE ECDH Shared Secret: Z - IPSec/IKE ECDSA Private Key: Z - IPSec/IKE",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "ECDSA Public Key: Z - IPSec/IKE RSA Private Key: Z - IPSec/IKE RSA Public Key: Z - IPSec/IKE Pre-shared Secret: Z - SKEYSEE D: Z - IPSec/IKE Encryption Key: Z - IPSec/IKE Authenticat ion Key: Z - SNMPv3 Shared Secret: Z - SNMPv3 Encryption Key: Z - SNMPv3 Authenticat ion Key: Z - VLAN Encryption Key: Z - VLAN Authenticat ion Key: Z 3e-Local",
"secFunImpl": "Functions"
},
{
"description": "Perform self-tests",
"indicator": "Self-Test service completio n status",
"inputs": "Command to trigger self-tests",
"name": "Perform Self-Test",
"outputs": "Status of the self- tests results",
"rolesSspAccess": "3e- CryptoOffic er",
"secFunImpl": "None"
},
{
"description": "Perform firmware update",
"indicator": "Firmware update service",
"inputs": "Command to trigger",
"name": "Firmware Update",
"outputs": "Status of the updated",
"rolesSspAccess": "3e-Local - Firmware Load Test",
"secFunImpl": "Firmware Load"
},
{
"description": "",
"indicator": "completio n status",
"inputs": "firmware update",
"name": "",
"outputs": "firmware installation",
"rolesSspAccess": "Key: R,E 3e- CryptoOffic er - Firmware Load Test Key: R,E",
"secFunImpl": ""
},
{
"description": "Configure TLS (v1.2/v1.3) Function",
"indicator": "TLS configurati on completio n status",
"inputs": "Command s to configure TLS (v1.2/v1.3)",
"name": "Configure TLS (v1.2/v1.3) Function",
"outputs": "Status of the completion of TLS (v1.2/v1.3) configurati on",
"rolesSspAccess": "3e-Local - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z - TLS ECDH Private Key: W,Z - TLS ECDH Public Key: W,Z - TLS Peer ECDH Public Key: W,Z - TLS ECDH Shared Secret: W,Z - TLS RSA Private Key: W,Z - TLS RSA Public Key: W,Z - TLS",
"secFunImpl": "KAS-ECC- KeyGen TLS KAS (ECC) TLS-KTS (AES-GCM) TLS-KTS (AES and HMAC) TLS RSA KeyGen TLS RSA SigGen TLS RSA SigVer TLS Session Encrypt/Dec rypt TLS Session Authenticati on TLS Keying Materials Developmen t DRBG Function"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Master Secret: W,Z - TLS Encryption Key: W,Z - TLS Authenticat ion Key: W,Z 3e- CryptoOffic er - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z - TLS ECDH Private Key: W,Z - TLS ECDH Public Key: W,Z - TLS Peer ECDH Public Key: W,Z - TLS ECDH Shared Secret: W,Z - TLS RSA Private",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: W,Z - TLS RSA Public Key: W,Z - TLS Master Secret: W,Z - TLS Encryption Key: W,Z - TLS Authenticat ion Key: W,Z",
"secFunImpl": ""
},
{
"description": "Configure SNMPv3 Function",
"indicator": "SNMPv3 configurati on completio n status",
"inputs": "Command s to configure SNMPv3",
"name": "Configure SNMPv3 Function",
"outputs": "Status of the completion of SNMPv3 configurati on",
"rolesSspAccess": "3e-Local - SNMPv3 Shared Secret: W,Z - SNMPv3 Encryption Key: W,Z - SNMPv3 Authenticat ion Key: W,Z 3e- CryptoOffic er - SNMPv3 Shared Secret: W,Z - SNMPv3 Encryption Key: W,Z - SNMPv3 Authenticat ion Key: W,Z",
"secFunImpl": "SNMP Session Encrypt/Dec rypt SNMP Session Authenticati on SNMP Keying Materials Developmen t"
},
{
"description": "Configure IPsec/IKEv 2 Function",
"indicator": "IPsec/IKE v2 configurati on completio n status",
"inputs": "Command s to configure IPsec/IKEv 2",
"name": "Configure IPsec/IKEv 2 Function",
"outputs": "Status of the completion of IPsec/IKEv 2 configurati on",
"rolesSspAccess": "3e-Local - IPsec/IKE DH Private Key: W,Z - IPSec/IKE DH Public Key: W,Z",
"secFunImpl": "KAS-ECC- KeyGen KAS-FFC- KeyGen IPSec/IKE KAS (ECC) IPSec/IKE KAS (FFC)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IPSec/IKE Peer DH Public Key: W,Z - IPSec/IKE DH Shared Secret: W,Z - IPSec/IKE ECDH Private Key: W,Z - IPSec/IKE ECDH Public Key: W,Z - IPSec/IKE Peer ECDH Public Key: W,Z - IPSec/IKE ECDH Shared Secret: W,Z - IPSec/IKE ECDSA Private Key: W,Z - IPSec/IKE ECDSA Public Key: W,Z - IPSec/IKE RSA Private Key: W,Z - IPSec/IKE",
"secFunImpl": "IPSec/IKE ECDSA KeyGen IPSec/IKE ECDSA SigGen IPSec/IKE ECDSA SigVer IPSec/IKE RSA KeyGen IPSec/IKE RSA SigGen IPSec/IKE RSA SigVer IPSec Session Encrypt/Dec rypt IPSec Session Authenticati on IPSec/IKE Keying Materials Developmen t DRBG Function"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "RSA Public Key: W,Z - IPSec/IKE Pre-shared Secret: W,Z - SKEYSEE D: W,Z - IPSec/IKE Encryption Key: W,Z - IPSec/IKE Authenticat ion Key: W,Z - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z 3e- CryptoOffic er - IPsec/IKE DH Private Key: W,Z - IPSec/IKE DH Public Key: W,Z - IPSec/IKE Peer DH Public Key: W,Z - IPSec/IKE DH Shared Secret:",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,Z - IPSec/IKE ECDH Private Key: W,Z - IPSec/IKE ECDH Public Key: W,Z - IPSec/IKE Peer ECDH Public Key: W,Z - IPSec/IKE ECDH Shared Secret: W,Z - IPSec/IKE ECDSA Private Key: W,Z - IPSec/IKE ECDSA Public Key: W,Z - IPSec/IKE RSA Private Key: W,Z - IPSec/IKE RSA Public Key: W,Z - IPSec/IKE Pre-shared Secret: W,Z - SKEYSEE",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "D: W,Z - IPSec/IKE Encryption Key: W,Z - IPSec/IKE Authenticat ion Key: W,Z - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z",
"secFunImpl": ""
},
{
"description": "Configure VLAN Encryption",
"indicator": "VLAN Encryptio n configurati on completio n status",
"inputs": "Command s to configure VLAN Encryption",
"name": "Configure VLAN Encryption",
"outputs": "Status of the completion of VLAN Encryption configurati on",
"rolesSspAccess": "3e-Local - VLAN Encryption Key: W,Z - VLAN Encryption Key: W,Z 3e- CryptoOffic er - VLAN Encryption Key: W,Z - VLAN Encryption Key: W,Z",
"secFunImpl": "VLAN Session Encrypt/Dec rypt VLAN Session Authenticati on"
},
{
"description": "Run TLS (v1.2/v1.3) Function",
"indicator": "TLSv1.2/1 .3 service completio n status",
"inputs": "Initiate TLSv1.2 tunnel establishm ent request",
"name": "Run TLS (v1.2/v1.3) Function",
"outputs": "Status of TLSv1.2 tunnel establishm ent",
"rolesSspAccess": "3e-Local - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Seed: W,Z",
"secFunImpl": "KAS-ECC- KeyGen TLS KAS (ECC) TLS-KTS (AES-GCM) TLS-KTS (AES and HMAC) TLS RSA KeyGen TLS RSA"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Internal State V Value: W,Z - DRBG Key: W,Z - TLS ECDH Private Key: W,Z - TLS ECDH Public Key: W,Z - TLS Peer ECDH Public Key: W,Z - TLS ECDH Shared Secret: W,Z - TLS RSA Private Key: W,Z - TLS RSA Public Key: W,Z - TLS Master Secret: W,Z - TLS Encryption Key: W,Z - TLS Authenticat ion Key: W,Z 3e- CryptoOffic er - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG",
"secFunImpl": "SigGen TLS RSA SigVer TLS Session Encrypt/Dec rypt TLS Session Authenticati on TLS Keying Materials Developmen t DRBG Function"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Internal State V Value: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z - TLS ECDH Private Key: W,Z - TLS ECDH Public Key: W,Z - TLS Peer ECDH Public Key: W,Z - TLS ECDH Shared Secret: W,Z - TLS RSA Private Key: W,Z - TLS RSA Public Key: W,Z - TLS Master Secret: W,Z - TLS Encryption Key: W,Z - TLS Authenticat ion Key: W,Z 3e- Administrat or - DRBG",
"secFunImpl": "Functions"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z - TLS ECDH Private Key: W,Z - TLS ECDH Public Key: W,Z - TLS Peer ECDH Public Key: W,Z - TLS ECDH Shared Secret: W,Z - TLS RSA Private Key: W,Z - TLS RSA Public Key: W,Z - TLS Master Secret: W,Z - TLS Encryption Key: W,Z - TLS Authenticat ion Key: W,Z",
"secFunImpl": "Functions"
},
{
"description": "Run SNMPv3 Function",
"indicator": "SNMPv3 service",
"inputs": "Initiate SNMPv3 tunnel",
"name": "Run SNMPv3 Function",
"outputs": "Status of SNMPv3 tunnel",
"rolesSspAccess": "3e-Local - SNMPv3 Shared",
"secFunImpl": "SNMP Session Encrypt/Dec"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "n",
"indicator": "completio n status",
"inputs": "establishm ent request",
"name": "",
"outputs": "establishm ent",
"rolesSspAccess": "Secret: W,Z - SNMPv3 Encryption Key: W,Z - SNMPv3 Authenticat ion Key: W,Z 3e- CryptoOffic er - SNMPv3 Shared Secret: W,Z - SNMPv3 Encryption Key: W,Z - SNMPv3 Authenticat ion Key: W,Z 3e- Administrat or - SNMPv3 Shared Secret: W,Z - SNMPv3 Encryption Key: W,Z - SNMPv3 Authenticat ion Key:",
"secFunImpl": "rypt SNMP Session Authenticati on SNMP Keying Materials Developmen t"
},
{
"description": "Run IPsec/IKEv 2 Function",
"indicator": "IPsec/IKE v2 service completio n status",
"inputs": "Initiate IPsec/IKEv 2 tunnel establishm ent request",
"name": "Run IPsec/IKEv 2 Function",
"outputs": "Status of IPSec/IKE v2 tunnel establishm ent",
"rolesSspAccess": "W,Z 3e-Local - IPsec/IKE DH Private Key: W,Z - IPSec/IKE DH Public Key: W,Z - IPSec/IKE Peer DH Public Key:",
"secFunImpl": "KAS-ECC- KeyGen KAS-FFC- KeyGen IPSec/IKE KAS (ECC) IPSec/IKE KAS (FFC) IPSec/IKE ECDSA KeyGen IPSec/IKE"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "W,Z - IPSec/IKE DH Shared Secret: W,Z - IPSec/IKE ECDH Private Key: W,Z - IPSec/IKE ECDH Public Key: W,Z - IPSec/IKE Peer ECDH Public Key: W,Z - IPSec/IKE ECDH Shared Secret: W,Z - IPSec/IKE ECDSA Private Key: W,Z - IPSec/IKE ECDSA Public Key: W,Z - IPSec/IKE RSA Private Key: W,Z - IPSec/IKE RSA Public Key: W,Z - IPSec/IKE",
"secFunImpl": "Functions ECDSA SigGen IPSec/IKE ECDSA SigVer IPSec/IKE RSA KeyGen IPSec/IKE RSA SigGen IPSec/IKE RSA SigVer IPSec Session Encrypt/Dec rypt IPSec Session Authenticati on IPSec/IKE Keying Materials Developmen t DRBG Function"
},
{
"description": "Descriptio",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Pre-shared Secret: W,Z - SKEYSEE D: W,Z - IPSec/IKE Encryption Key: W,Z - IPSec/IKE Authenticat ion Key: W,Z - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z 3e- CryptoOffic er - IPsec/IKE DH Private Key: W,Z - IPSec/IKE DH Public Key: W,Z - IPSec/IKE Peer DH Public Key: W,Z - IPSec/IKE DH Shared Secret: W,Z - IPSec/IKE ECDH",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: W,Z - IPSec/IKE ECDH Public Key: W,Z - IPSec/IKE Peer ECDH Public Key: W,Z - IPSec/IKE ECDH Shared Secret: W,Z - IPSec/IKE ECDSA Private Key: W,Z - IPSec/IKE ECDSA Public Key: W,Z - IPSec/IKE RSA Private Key: W,Z - IPSec/IKE RSA Public Key: W,Z - IPSec/IKE Pre-shared Secret: W,Z - SKEYSEE D: W,Z - IPSec/IKE Encryption",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: W,Z - IPSec/IKE Authenticat ion Key: W,Z - DRBG Entropy Input: W,Z - DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z 3e- Administrat or - IPsec/IKE DH Private Key: W,Z - IPSec/IKE DH Public Key: W,Z - IPSec/IKE Peer DH Public Key: W,Z - IPSec/IKE DH Shared Secret: W,Z - IPSec/IKE ECDH Private Key: W,Z - IPSec/IKE ECDH Public Key: W,Z - IPSec/IKE",
"secFunImpl": "Functions"
},
{
"description": "Descriptio n",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Peer ECDH Public Key: W,Z - IPSec/IKE ECDH Shared Secret: W,Z - IPSec/IKE ECDSA Private Key: W,Z - IPSec/IKE ECDSA Public Key: W,Z - IPSec/IKE RSA Private Key: W,Z - IPSec/IKE RSA Public Key: W,Z - IPSec/IKE Pre-shared Secret: W,Z - SKEYSEE D: W,Z - IPSec/IKE Encryption Key: W,Z - IPSec/IKE Authenticat ion Key: W,Z - DRBG Entropy Input: W,Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DRBG Seed: W,Z - DRBG Internal State V Value: W,Z - DRBG Key: W,Z",
"secFunImpl": ""
},
{
"description": "Run VLAN Encryption",
"indicator": "VLAN Encryptio n service completio n status",
"inputs": "Initiate VLAN Encryption tunnel establishm ent request",
"name": "Run VLAN Encryption",
"outputs": "Status of VLAN Encryption tunnel establishm ent",
"rolesSspAccess": "3e-Local - VLAN Encryption Key: W,Z - VLAN Encryption Key: W,Z 3e- CryptoOffic er - VLAN Encryption Key: W,Z - VLAN Encryption Key: W,Z 3e- Administrat or - VLAN Encryption Key: W,Z - VLAN Encryption Key: W,Z",
"secFunImpl": "VLAN Session Encrypt/Dec rypt VLAN Session Authenticati on"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "The minimum length is eight (8) characters (94 possible characters). The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8) which is less than 1/1,000,000. As the module supports at most ten failed attempts to authenticate in a one- minute period, the probability of successfully",
"mechanism": "Password Based",
"name": "Password- based Authentication",
"perMinute": "The probability of successfully authenticating to the module within one minute is 10/(94^8). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed or a false acceptance will occur is 1/(94^8). Please refer to Description section in this table for more details"
},
{
"description": "authenticating to the module within one minute is 10/(94^8), which is less than 1/100,000. This calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 Integer digits, 52 alphabetic characters, and 32 special characters providing 94 characters to choose from in total.",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits, which provides 112 bits of security strength. The probability that a random attempt will succeed is 1/(2^112) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one-minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112), which is less than 1/100,000.",
"mechanism": "RSA SigVer (FIPS186-4) (A3316)",
"name": "RSA-based Authentication",
"perMinute": "the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^112). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^112). Please refer to Description section in this table for more details"
},
{
"description": "The modules support ECDSA public-key based authentication mechanism using a minimum of curve P- 256, which provides 128 bits of security strength. The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. For multiple attacks during a one-minute period, as the module at its highest can support at most 17,000 new sessions per second to authenticate in a one-minute period, the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128), which is less than 1/100,000.",
"mechanism": "ECDSA SigVer (FIPS186-4) (A3316)",
"name": "ECDSA- based Authentication",
"perMinute": "the probability of successfully authenticating to the module within a one minute period is 17,000 * 60 = 1,020,000/(2^128). Please refer to Description section in this table for more details",
"strength": "The probability that a random attempt will succeed is 1/(2^128) which is less than 1/1,000,000. Please refer to Description section in this table for more details"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "AES-CBC (A3316)",
"condition": "Power up",
"details": "Encrypt",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A3316)",
"condition": "Power up",
"details": "Decrypt",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A3316)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A3316)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A3316)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A3316)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A3316)",
"condition": "Power up",
"details": "CTR_DRBG Instantiate",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A3316)",
"condition": "Power up",
"details": "CTR_DRBG Generate",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "Counter DRBG (A3316)",
"condition": "Power up",
"details": "CTR_DRBG Reseed",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "AES-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186- 4) (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186- 4) (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3",
"condition": "Power up",
"details": "KAS-ECC- SSC Primitive Z",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "P-256 with SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "(A3316) KAS-FFC- SSC Sp800- 56Ar3 (A3316)",
"condition": "Power up",
"details": "KAS-FFC- SSC Primitive Z",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "MODP- 2048",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-384 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-512 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186- 4) (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "2048 bits",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186- 4) (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "2048 bits",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SNMP (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.2 KDF RFC7627 (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "TLS v1.3 KDF (A3316)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A3318)",
"condition": "Power up",
"details": "Encryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A3318)",
"condition": "Power up",
"details": "Decryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A3318)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CCM (A3318)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A3318)",
"condition": "Power up",
"details": "Authenticated Encryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-GCM (A3318)",
"condition": "Power up",
"details": "Authenticated Decryption",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3318)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A3318)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-384 (A3318)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-512 (A3318)",
"condition": "Power up",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A3318)",
"condition": "Power up",
"details": "SHA-1",
"indicator": "Module is in normal state",
"testMethod": "Known Answer Test (KAT)",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "KAS (A3316)",
"condition": "Before the first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAS-ECC Pairwise Consistency Test (PCT)",
"testProps": "P-256 with SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS (A3316)",
"condition": "Before the first operational use",
"details": "N/A",
"indicator": "Module is in normal state",
"testMethod": "KAS-FFC Pairwise Consistency Test (PCT)",
"testProps": "MODP- 2048",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186- 4) (A3316)",
"condition": "Before the first operational use",
"details": "ECDSA",
"indicator": "Module is in normal state",
"testMethod": "ECDSA Pairwise Consistency Test (PCT)",
"testProps": "P-256 with SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186- 4) (A3316)",
"condition": "Before the first operational use",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "RSA Pairwise Consistency Test (PCT)",
"testProps": "2048 bits",
"type": "PCT"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186- 4) (A3316)",
"condition": "while doing the firmware upload test",
"details": "RSA",
"indicator": "Module is in normal state",
"testMethod": "Firmware Load Test",
"testProps": "RSA 4096 bits with SHA2-256",
"type": "SW/FW Load"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "Self-tests failure",
"description": "If self-test tests fail, the module is put into an error state",
"indicator": "System Halt",
"name": "Error State",
"recoveryMethod": "Reboot the module"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "90 days",
"inspectGuidance": "Tamper evidence tapes should be checked for nicks and scratches that make the metal case visible through the nicked or scratched seal. Tamper Evidence Label (TEL) may show any of the following as evidence of tampering or removal: TEL is not preset in the positions prescribed (as shown above); TEL has been cut; TEL is not stuck down well, or is loose; Self- destruction of the TEL (broken bits or shreds) present as from",
"mechanism": "Tamper Evidence Seals"
},
{
"inspectFreq": "",
"inspectGuidance": "an attempt of removal; Tracking numbers do not match those recorded. In addition, Please note that the TELs are not orderable. Please contact [email protected] for more information.",
"mechanism": ""
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "The module is only operated in Approved mode of operation.",
"name": "Approved Mode",
"statusIndicator": "N/A",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Data input into the module for all the services defined in Tables 8-11, including TLSv1.2, TLSv1.3, IPsec/IKEv2 and VLAN Encryption services data",
"logicalInterface": "Data Input",
"physicalPort": "Ethernet Port 1, Ethernet Port 2"
},
{
"data": "Data input into the module for all the services defined in Tables 8-11, including TLSv1.2, TLSv1.3, IPsec/IKEv2 and VLAN Encryption services data",
"logicalInterface": "Data Output",
"physicalPort": "Ethernet Port 1, Ethernet Port 2"
},
{
"data": "Control data input into the module for all the services defined in Tables 8-11, including TLSv1.2, TLSv1.3, IPsec/IKEv2 and VLAN Encryption services data. RESET Pin is used to send the control signal to reset the module",
"logicalInterface": "Control Input",
"physicalPort": "Ethernet Port 1, Ethernet Port 2 and RESET PIN"
},
{
"data": "Status Information output from the module",
"logicalInterface": "Status Output",
"physicalPort": "Ethernet Port 1, Ethernet Port 2 and GPIO status PIN"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password-based Authentication",
"name": "3e-Local",
"operatorType": "Crypto Officer",
"type": "Identity"
},
{
"authMethodList": "Password-based Authentication",
"name": "3e-CryptoOfficer",
"operatorType": "Crypto Officer",
"type": "Identity"
},
{
"authMethodList": "Password-based Authentication",
"name": "3e-Administrator",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "RSA-based Authentication ECDSA-based Authentication",
"name": "End User",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "RSA SigVer (FIPS186-4) (A3316)",
"details": "Module conducts RSA SigVer KAT prior to firmware integrity test",
"indicator": "Module is in normal state",
"testMethod": "KAT",
"testProps": "Modulus: 4096 bits with SHA2- 256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "External (Outside the Module\u0027s Boundary )",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Module Public Key Output",
"sfiAlgo": "",
"source": "Module"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Plaintext",
"name": "Peer Public Key Input",
"sfiAlgo": "",
"source": "External (Outside the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input encrypted by GCM",
"sfiAlgo": "TLS-KTS (AES- GCM)",
"source": "External (Outside the"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "",
"sfiAlgo": "",
"source": "Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "Password/Secre t Input encrypted by AES and HMAC",
"sfiAlgo": "TLS-KTS (AES and HMAC)",
"source": "External (Outside the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "VLAN SSPs Input via TLS- KTS (GCM)",
"sfiAlgo": "TLS-KTS (AES- GCM)",
"source": "External (Outside the Module\u0027s Boundary )"
},
{
"dest": "Module",
"distribution": "Automated",
"entry": "Electroni c",
"format": "Encrypte d",
"name": "VLAN SSPs Input via TLS- KTS (AES and HMAC)",
"sfiAlgo": "TLS-KTS (AES and HMAC)",
"source": "External (Outside the Module\u0027s Boundary )"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "CO issues zeroization service: \"Factory Default\" to zeroize all SSPs",
"method": "Zeroization command",
"operatorId": "Module Reboot",
"rationale": "The zeroization command will erase all SSPs stored in the RAM or in the Flash of the module."
},
{
"description": "Zeroization requirements are not applicable",
"method": "N/A",
"operatorId": "N/A",
"rationale": "SSPs used solely for self-test purposes in module\u0027s self-test need not meet zeroization requirements"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Volatile memory",
"name": "RAM",
"persistance": "Dynamic"
},
{
"description": "Non-Volatile memory",
"name": "Flash",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "1.0",
"hwVersion": "1.0",
"modelPartNum": "Edge Security Model (ESM-110)",
"processors": "Marvell CN9130"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "Ultra I\u0026C OpenSSL",
"name": "CKG",
"reference": "The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per sections 4 and 5 in SP800-133rev2 (vendor affirmed) and FIPS 140-3 IG D.H. A seed (i.e., the random value) used in asymmetric key generation is a direct output from SP800-90Arev1 CTR_DRBG"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 17
},
"ECDH": {
"ECDH": 94
},
"ECDSA": {
"ECDSA": 55
}
},
"FF": {
"DH": {
"DH": 45,
"DHE": 1,
"Diffie-Hellman": 3
}
},
"RSA": {
"RSA 2048": 1,
"RSA 4096": 6
}
},
"certification_process": {
"OutOfScope": {
"fails. Any firmware loaded into the module that is not shown on the module certificate, is out of scope of this validation and requires a separate FIPS 140-3 validation": 1,
"out of scope": 1
}
},
"cipher_mode": {
"CTR": {
"CTR": 1
},
"GCM": {
"GCM": 17
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 1
}
},
"crypto_protocol": {
"IKE": {
"IKE": 9,
"IKEv2": 10
},
"IPsec": {
"IPsec": 1
},
"TLS": {
"TLS": {
"TLS": 162,
"TLS 1.3": 4,
"TLS v1.2": 8,
"TLS v1.3": 8,
"TLSv1.2": 9,
"TLSv1.3": 4
}
},
"VPN": {
"VPN": 4
}
},
"crypto_scheme": {
"MAC": {
"MAC": 4
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 38,
"P-384": 26,
"P-512": 7,
"P-521": 12
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 2,
"#2": 1,
"#3316": 1,
"#5": 1
}
},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 2,
"AES-128": 1,
"AES-192": 1,
"AES-256": 4,
"DRBG 384": 1,
"HMAC- SHA-1": 2,
"HMAC-SHA-1": 10,
"PKCS 1": 2,
"RSA 2048": 1,
"RSA 4096": 6,
"SHA-1": 9,
"SHA2- 256": 1,
"SHA2- 384": 1,
"SHA2- 512": 2,
"SHA2-224": 1,
"SHA2-256": 23,
"SHA2-384": 8,
"SHA2-512": 7,
"SHA2256": 1,
"SHA3-256": 2,
"SHA3-384": 2,
"SHA3-512": 2
}
},
"fips_security_level": {
"Level": {
"Level 2": 2,
"level 2": 2
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 9
},
"SHA3": {
"SHA3-256": 2,
"SHA3-384": 2,
"SHA3-512": 2
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 109
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 11,
"FIPS 180-4": 7,
"FIPS 186-4": 7,
"FIPS 198-1": 7,
"FIPS186-4": 27
},
"NIST": {
"SP 800-135": 4,
"SP 800-38A": 3,
"SP 800-38C": 2,
"SP 800-38D": 2,
"SP 800-56A": 3,
"SP 800-90A": 1
},
"PKCS": {
"PKCS 1": 2
},
"RFC": {
"RFC 5288": 1,
"RFC 7296": 1,
"RFC7627": 5,
"RFC8446": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 19,
"AES-": 4,
"AES-128": 1,
"AES-192": 1,
"AES-256": 4
},
"CAST": {
"CAST": 70
}
},
"constructions": {
"MAC": {
"HMAC": 17
}
}
},
"tee_name": {
"AMD": {
"PSP": 10
},
"IBM": {
"SSC": 6
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"ECDSA KeyGen (FIPS186-4)A3316",
"RSA SigGen (FIPS186-4)A3316",
"AES-GCMA3318",
"AES-CBCA3318",
"KDF IKEv2A3316",
"Safe Primes Key GenerationA3316",
"ECDSA SigVer (FIPS186-4)A3316",
"KDF SNMPA3316",
"SHA-1A3316",
"KAS-ECC-SSC Sp800-56Ar3A3316",
"SHA2-512A3318",
"SHA2-384A3318",
"AES-CCMA3318",
"ECDSA SigGen (FIPS186-4)A3316",
"TLS v1.3 KDFA3316",
"RSA KeyGen (FIPS186-4)A3316",
"HMAC-SHA-1A3316",
"SHA2-256A3318",
"HMAC-SHA2-512A3318",
"AES-ECBA3316",
"HMAC-SHA2-384A3318",
"Counter DRBGA3316",
"HMAC-SHA2-256A3318",
"KAS-FFC-SSC Sp800-56Ar3A3316",
"TLS v1.2 KDF RFC7627A3316",
"RSA SigVer (FIPS186-4)A3316"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3318",
"#A3316"
]
},
"policy_metadata": {
"/Author": "Richard Wang",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20250207074147-05\u002700\u0027",
"/Creator": "Acrobat PDFMaker 24 for Word",
"/Keywords": "",
"/ModDate": "D:20250207074302-05\u002700\u0027",
"/Producer": "Adobe PDF Library 24.5.96",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 763881,
"pdf_hyperlinks": {
"_type": "Set",
"elements": []
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 64
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "88a2ce6072e0400d5ba7867253bb088cc16e04ddbb94cf37ed55b9c85e802024",
"source_hash": "c29ffed3ac3226a1b81314758e24e37eb2f96e757cc7ee5bc25debcd51bd77c7",
"txt_hash": "9b5033b9f448b66c91d0ecbe63c79e8953297630df5bb75f2f9ffdc7bca4381f"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "None",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/February 2025_030325_1258.pdf",
"date_sunset": "2030-02-09",
"description": "Ultra I\u0026C\u2019s Edge Security Module provides built-in OSI layer 3 IPsec and Layer 2 VLAN encryption capabilities. As a hardware-based embedded cryptographic module, it serves a secured platform for customizable security applications.",
"embodiment": "Multi-Chip Embedded",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "Edge Security Cryptographic Module",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-02-10",
"lab": "Gossamer Security Solutions",
"validation_type": "Initial"
}
],
"vendor": "Ultra Intelligence and Communications",
"vendor_url": "http://www.ultra.group"
}
}