NITROXIII CNN35XX-NFBE HSM Family

Certificate

Vendor resources (verify with the vendor)

Approved Algorithms (83)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for NITROXIII CNN35XX-NFBE HSM Family
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C1["[high] Firmware / bootloader<br/>versions disclosed<br/>(identity, not provenance)<br/><i>CNN35XX-NFBE-FW-*, CNN35XX-NFBE-FW-*,…</i>"]
    C2["[high] Firmware update / recovery<br/>/ rollback services<br/><i>Firmware Update<br/>CN_FW_UPDATE_BEGIN CN_FW_UPDATE CN_FW_UPDATE_END<br/>CN_SMAPP_UPDATE_BEGIN</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>CN_ZEROIZE<br/>CN_APP_INITIALIZE<br/>CN_APP_FINALIZE</i>"]
    C4["[high] Physical/logical<br/>interfaces (some 'blocked<br/>in firmware')<br/><i>PCIe Interface (P1)<br/>USB Port (J2)<br/>Serial Port</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>linux<br/>uboot<br/>bootloader</i>"]
  end
  subgraph Inference["Derived inference"]
    I1["Component identity is<br/>disclosed, but provenance<br/>and patch lineage are not."]
    I2["Trusted code is reachable<br/>through update and<br/>recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I4["Interface reachability may<br/>vary by boot stage and<br/>lifecycle state."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R1["Do the vendor version<br/>strings obscure the<br/>upstream baseline, fork<br/>lineage, or known-CVE<br/>exposure?"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R4["Are interfaces blocked<br/>before the bootloader<br/>runs, or only after<br/>approved mode starts?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E1["SBOM / component baselines<br/>· patch and backport<br/>manifest · CVE disposition"]
    E2["update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E4["lifecycle reachability<br/>matrix · boot-stage<br/>interface timing ·<br/>factory/recovery/error-state<br/>access controls"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C1 --> I1 --> R1 --> E1
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C4 --> I4 --> R4 --> E4
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C1,C2,C3,C4,C5,C6 clue;
  class I1,I2,I3,I4,I5,I6 infer;
  class R1,R2,R3,R4,R5,R6 risk;
  class E1,E2,E3,E4,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for NITROXIII CNN35XX-NFBE HSM Family
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C1["[high] Firmware / bootloader versions disclosed (identity, not provenance)<br/><i>CNN35XX-NFBE-FW-*, CNN35XX-NFBE-FW-*,…</i><br/>src: certificate.firmwareVersions"]
    C2["[high] Firmware update / recovery / rollback services<br/><i>Firmware Update<br/>CN_FW_UPDATE_BEGIN CN_FW_UPDATE CN_FW_UPDATE_END<br/>CN_SMAPP_UPDATE_BEGIN</i><br/>src: securityPolicy.services"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>CN_ZEROIZE<br/>CN_APP_INITIALIZE<br/>CN_APP_FINALIZE</i><br/>src: securityPolicy.services"]
    C4["[high] Physical/logical interfaces (some 'blocked in firmware')<br/><i>PCIe Interface (P1)<br/>USB Port (J2)<br/>Serial Port</i><br/>src: securityPolicy.portsAndInterfaces"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>linux<br/>uboot<br/>bootloader</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C1,C2,C3,C4 clueHigh;
  class C5,C6 clueLow;

Security Policy, page by page

seuthur FIPS 140-3 Level 3 NITROX III CNN35XX-NFBE HSM Family Document number: Document Version: Revision Date: CNN35xx-NFBE-SPD-L3 Version 2.09-0703 03/11/2026 This document may be reproduced only in its original entirety [without revision].

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Revision History Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Contents 2.5.1 2.5.2 2.10 2.11 2.12 2.13 4.1.1 4.1.2 4.2.1 4.2.2 4.2.3 4.2.4 10.1 11.1 11.2 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy 11.3 11.4 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy List of Tables Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy List of Figures Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy The cryptographic module meets the overall requirements applicable to Level 3 security of FIPS 140-3. Table 1

• Security Levels [Number Below] N/A N/A N/A

The NITROXIII CNN35XX-NFBE HSM Family module (hereafter referred to as the module or HSM) by Marvell is a high-performance purpose-built security solution for crypto acceleration. The module provides a FIPS 140-3 overall Level 3 security solution. The module is deployed in a PCIe slot to provide crypto and TLS 1.0/1.1/1.2 acceleration in a secure manner to the system host. It is typically deployed in a server or an appliance to provide crypto offload. The module’s functions are accessed over the PCIe interface via opcodes defined by the module. The module is a hardware multi-chip embedded cryptographic module. The module provides cryptographic primitives to accelerate approved and allowed algorithms for TLS 1.0/1.1/1.2 and SSH. The cryptographic functionality includes modular exponentiation, random number generation, and hash processing, along with protocol specific complex instructions to support TLS 1.0/1.1/1.2 security protocols using the embedded NITROXIII chip. The module implements password based single factor perimeter of the PCIe card itself, as depicted in section 2.13. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy The configuration of hardware and firmware for this validation is: Table 2

• Hardware Part Numbers Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy LP is a low-frequency part, where Nitrox III chip runs at 500MHz; otherwise, it runs at 600MHz. The LiquidSecurity Appliance is a network accessible, remote configurable, multi-tenant server platform to enable private and Hybrid cloud deployments of NITROX III CNN35XX-NFBE HSM. The LiquidSecurity Appliance is outside the module’s cryptographic boundary and therefore out of scope of this validation. CNN35XX-NFBE-G Firmware: CNN35XX-NFBE-FW-2.09-0702 CNN35XX-NFBE-FW-2.09-0703 CNN35XX-NFBE-G Secure Machine: CNN35XX-NFBE-SMW-2.09-0702 CNN35XX-NFBE-G Bootloader: CNN35XX-UBOOT-4.03-03 Note: These binaries do not have extensions. The module is considered to be operating in the approved mode only when it is running the firmware/bootloader versions listed above. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy The module supports different performance options as listed above in the hardware identifier. The physical hardware and firmware are identical across all options. The underlying hardware has multiple identical cryptographic engines which are enabled or disabled using an option parameter set at manufacturing time. During Manufacturing, the number of cryptographic cores, Key stores and Partitions are enabled by configuration for different Part number. Please refer to Table 2

• Hardware Part Numbers for further details. CNL and CNN part numbers employ the same hardware and firmware; the only difference is the vendor configuration, where CNL part numbers have certificate authentication enabled during manufacturing via the CN_INIT_TOKEN service. The major blocks of the module are: General purpose MIPS-based control processor, crypto processors, RAM memory, NOR and eMMC flash for persistent storage, USB interfaces, and PCIe gen-2 x8 interfaces. There are no excluded components within the Module. Table 3
• Cryptographic Module Specification Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

The module supports the following modes of operation:

1. Non-Approved mode of operation
2. Approved Level 3 mode of operation The module is initialized into one of the modes specified above during the module initialization period (see section 11 Life-Cycle Assurance for initialization procedure). The value of the parameter fipsState passed into the call specifies the mode. The following are the allowed values for fipsState parameters:

The indicator of Approved mode is obtained by using the Get Status service. The fipsState field of Get Status service (CN_TOKEN_INFO) indicates the mode. CSPs are not shared between the Approved and non-Approved modes of operation.

The module provides an Approved mode of operation, comprising all services described in Section 2.8 below. In this mode, the module allows only Approved or allowed algorithms. Request for any nonApproved/allowed algorithm is rejected.

The Module supports a Non-Approved mode implementing the non-Approved algorithms listed in Table 7. In this mode, the module also allows Approved or allowed algorithms.

The module is an SR-IOV enabled intelligent PCIe adapter with 1 physical function and 128 virtual functions. In addition to the crypto offloads, this adapter can provide secure key storage with up to 64 partitions, including master partition. Each partition will have its own users to manage the partition and own configuration policies and hence each partition can be treated as a virtual HSM. HSM always has one default partition called HSM Master partition and this contains configuration of the complete HSM and default configuration of any additional partitions that are created. Only one HSM partition can be assigned to one SR-IOV virtual function of HSM adapter and vice-versa. Keys belonging to one partition are not accessible from other partition. This is achieved through a secure binding between partition and the PCIe virtual function. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

This is the default partition with only one user, called the Master Crypto Officer (MCO). This partition represents the operating state of the whole HSM adapter; i.e., initialization of HSM is nothing but initializing this partition with required configuration and MCO credentials. Zeroizing this partition will erase all HSM partitions in the adapter. The HSM must be initialized and the MCO should already be logged in to create more partitions on the adapter. The MCO can backup and restore complete partition including user data, partition configuration and user keys. All the backup data is encrypted with Backup keys.

Each partition will have a different set of users to manage it and a dedicated key storage and crypto resources associated. A partition will have a default configuration supplied by the master partition and can be changed (within limits) during the partition initialization. When a partition is created by the MCO, it will be in a zeroized state and has to be initialized to do any keystore management or crypto function offloads. Partition initialization will create the Partition Crypto Officer (PCO). The PCO can later create up to 1024 users (PCO or PCU) on demand. Each user will have a unique user name to identify themselves. The User has to login to the partition/vHSM to issue any authorized commands. Users are authenticated using passwords submitted during the user creation.

The End-to-End encryption feature in the module allows an application to initiate an TLS connection with the firmware to ensure the confidentiality of the data communicated over PCIe path. The connection is based on TLS v1.2 with the cipher-suite TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (known to OpenSSL as AES128-GCM-SHA256, AES256-GCM-SHA384, ECDHE_RSA_AES128-GCMSHA256, and ECDHE_RSA_AES256-GCM-SHA384). The module will act as server, and host application will act as client. The server private key will be the partition private key PAK which is generated for each pHSM when the pHSM/partition is created. The server certificate used for the SSL connection is the partition certificate PAC. The complete chain will be validated by the host application (CavClient) before establishing the TLS connection. The End-to-End encryption feature is enabled using the initialization configuration parameters. Once this feature is enabled, all commands except the initialize and open session are encrypted.

This section provides the list of supported cryptographic algorithms segregated based on the operating mode.

The cryptographic module supports the following Approved algorithms. Only the algorithms/modes listed in the table below are used in the module. Note: All symmetric key sizes represent the key strength. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Table 4

• Approved Algorithms Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy B.3.3 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy KAS-ECCSSC Sp80056Ar3 SP 80056Cr1 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy KAS-ECCSSC Sp80056Ar3 KAS-KDFOneStep(SP 80056Ar3) KAS-ECCSSC Sp80056Ar3 SP 80056Cr1 KAS-ECCSSC Sp80056Ar3 Sp80056Cr1 KAS-ECCSSC Sp80056Ar3 Sp80056Cr1 KAS-ECCSSC Sp80056Ar3 Sp80056Cr1 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 (SP 800135r1) KAS-ECCSSC Sp80056Ar3 KAS-IFCSSC Sp80056Cr1 KAS-IFCSSC Sp80056Cr1 KAS-IFCSSC Sp80056Cr1 Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy N/A N/A

• AES-GCM (#A1203)
• IG C.H Notes:
• Ivs are generated randomly, and IG C.H Option #2 applies.
• IV is generated internally to the cryptographic module.
• SP 800-38D §8.2.2 is used for GCM IV construction.
• IV’s random field is a 128-bit random number.
• For IV restoration conditions guidance, refer to section 11.4 User Guidance.
• Approved RBG (Hash DRBG #C830): SP 800-90Ar1 DRBG, HASH_DRBG SHA2-512 AES-GCM (#C839)
• IG C.H Scenario #1:
• TLS 1.2 or other applications can offload GCM operations.
• For TLS-1.2 protocol, IV constructed as described in RFC 5288.
• Refer Section 2.12 for the TLS 1.2 AES GCM supported cipher suites
• IV is generated internally to the cryptographic module.
• The module triggers a handshake to establish new encryption keys and Ivs when the IV exhausts the maximum possible values for the given session key.
• SP 800-38D §8.2.2 is used for GCM IV construction.
• IG C.H Scenario #2:
• Ivs are generated randomly and IG C.H Option #2 applies. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

• IV’s free field is a 4-byte counter IV’s random field is a 96-bit random number. IV’s random field is incremented by 1. IV’s random field wouldn’t overflow 96bits in the lifetime of the module.
• For IV restoration conditions guidance, refer to section 11.4 User Guidance.
• Internal Approved RBG (Hash DRBG #C830): SP 800-90A DRBG, HASH_DRBG SHA2-512.
• CKG SP 800-133Rev2 (Vendor affirmed)
• SP 800-133Rev2 Section 5.1 Asymmetric signature key generation using unmodified DRBG output SP 800-133Rev2
• SP 800-133Rev2 Section 5.2 Asymmetric key establishment, key generation using unmodified DRBG output
• SP 800-133Rev2 Section 6.1 Direct symmetric key generation using unmodified DRBG output
• SP 800-133Rev2 Section 6.2.1 Derivation of symmetric keys from a key agreement shared secret.
• SP 800-133Rev2 Section 6.2.2 Derivation of symmetric keys from a pre-shared key
• PBKDF (SP 800-132) (#A1196)
• PBKDF with HMAC password strength
• The password is a minimum of 8 characters, case-sensitive alpha-numeric. As such there are (26*2+10)^8 = 62^8 possible minimum-length passwords, and the false acceptance rate is 1 in 62^8 which is less than 1 in 1,000,000.
• A maximum of 20 password attempts are possible before permanent lockout. Therefore the probability of false authentication over any timeframe is 20 in 62^8, which is less than 1 in 100,000. (The number of allowed login attempts prior to lockout is configured during module initialization but cannot exceed 20.)
• Lockout of MCO automatically zeroizes the module in the next reboot. In all other cases, lockout can be unset by deleting the partition.
• PBKDF with HMAC Iteration Count and Justification
• Iteration count should be at least 1000, following the recommendation in SP 800132r2.
• Salt length is 16 bytes The cryptographic module supports the following non-Approved algorithms that are allowed for use in Approved mode. Table 5
• Non-Approved Algorithms Allowed in the Approved Mode of Operation Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy The support of TLS 1.0/1.1, v1.2 protocol by the module is restricted to the TLS Key Derivation Function and the crypto operation. This functionality of the module is used by the user of the module as part of TLS protocol negotiation. No parts of the TLS protocol, other than the KDF, have been reviewed or tested by the CAVP or the CMVP.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

The cryptographic module supports the following non-Approved algorithms available only in nonApproved mode. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

The module supports the algorithms for the following cipher suites using Approved and allowed algorithms and key sizes:

• TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 For cipher suites using GCM, the IV is generated per RFC 5288. The module supports GCM cipher suites compatible with SP 800-52 Rev2. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

Figure 1

• Top View and Bottom View of Cryptographic Module (HW-1.0) Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Figure 2

• Top View and Bottom View of Cryptographic Module ( HW-2.0) Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Figure 3

• Top View and Bottom View of Cryptographic Module (HW-3.0) Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Cryptographic Module Interfaces Table 8 describes the module ports and interfaces: Table 8

• Ports and Interfaces Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Roles, Services, and Authentication Note: Service interface documentation details specific service inputs and outputs: Document name: LiquidSecurity-2.09-0702-Driver-APIs-html.zip Version: 2.09-0702 Release date: 04/26/2024 To access the document, complete the below steps.

1. Open the following link to open the Marvell Public Driver Downloads page: https://www.marvell.com/support/downloads.html#
2. Choose CATEGORY, PLATFORM, and PART NUMBER as shown in the following screenshot; then click the APPLY button. Two results will display; select “LiquidSecurity-2.09-0702-Driver-APIs-html" to download. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy 3. This pops up a window to accept the “MARVELL LIMITED USE LICENSE AGREEMENT”. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Click I Accept to accept the terms and Conditions; the Service Interface document will be downloaded.

4. After the Interface document is downloaded, extract the archive with the Password “LS-FIPS140-3”.
5. To access the Services, open the index.html file; then select LiquidSecurity Opcodes > Recommended APIs from the left pane. The page depicted in the following snapshot displays: Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy 6. Click the Recommended API for each opcode (services) for the input and output details. Table 10

• Roles, Service Commands, Input and Output Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

• CN_CERT_AUTH_GET_CERT includes the opcode CN_CERT_AUTH_GET_CERT_CHAIN.
• CN_CERT_AUTH_STORE_CERT includes the opcode CN_CERT_AUTH_STORE_CERT_CHAIN.

The module supports the following roles. One identity is allowed for each role, per partition.

During the manufacturing stage, each HSM goes through the following process:

• An RSA key pair called the HSM FIPS Master Authentication Key (FMAK) is generated on HSM. CSR is requested out of HSM and signed by the Manufacturer Authentication Root Certificate (MARC). The generated certificate is called the HSM FIPS Master Authentication Certificate (FMAC).
• A 256-bit MKBK encrypted with the FMAK public key is loaded into the HSM.
• Program Performance settings and capabilities Appliance Compatibility mode, run random operations, Encrypted channels.
• Program Serial Number and Max Operating Temperature The same above steps are followed by the manufacturer once the HSM is moved to manufacturer reset after manufacturer zeroize. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

The master partition supports only the Master Crypto Officer role (MCO). This role is used to configure non-master partitions (create, provision, resize, delete) but cannot access their resources (e.g., cannot manage or use non-master partition keys). This role is authenticated with username and password (one-factor) and optionally with signature as well (two-factor). Refer to Section 4.3 for details.

Each Non-Master Partition supports four (4) distinct operator roles as described below. The module enforces the separation of roles using identity-based authentication. Re-authentication is required to change roles. Except for Pre-CO, concurrent operators are allowed; however, only one operator is allowed per login session.

During partition initialization, default credentials are used to create a Pre-CO or a PCO. The Pre-CO is a restricted role primarily for configuring certificates and setting up a PCO. Once a PCO is set up for a partition, the Pre-CO role is no longer accessible. Because the Pre-CO is essentially a restricted PCO, it does not have its own column in Table 12. Instead, PCO capabilities in Table 12 are marked with an asterisk (*) to indicate Pre-CO can run these services. This role is authenticated with username and password (one-factor) only.

This role has access to administrative services of the partition and can configure PCU and AU identities. This role is authenticated with username and password (one-factor) and optionally with signature as well (two-factor).

This role has access to all cryptographic services offered by the partition; its purpose is operational use of the module. This role is authenticated with username and password (one-factor) and optionally with signature as well (two-factor).

This role has access to partition audit logs and can create end-to-end encrypted channels. It is to set up and synchronize clusters. This role is authenticated with username and password (one-factor) only. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy The module enforces identity-based authentication. A role is explicitly selected at authentication. If a given identity is not allocated with the role, then the authentication will fail with appropriate error. The partitions (see Sections 4.41 and 4.2 for details). If the given user identity is not allocated for a role, then authentication will be failed with appropriate error. The module allows one identity per role, per All the user roles should be authenticated with Level 3 based authentication mechanisms. MCO, Pre-CO, Table 11

• Roles and Required Identification and Authentication Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Table 12

• Roles and Authentication

G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP metadata is updated. The module writes the SSP. The write access is typically performed after a SSP is imported into the module, or the module generates an SSP, or the module overwrites an existing SSP. E = Execute: The module uses the SSP in performing a cryptographic operation. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Table 13

• Approved Services Z Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy G G Z R E E G G E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 E W E E R W E G Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 R W G G Security Policy W W W W E E E W W W E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy AU/UNAUTH AU/UNAUTH E E R G G G E G G E G E E E R Marvell Semiconductor, Inc. R E R

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 M. E E G E R R R R R G Security Policy MCO/UNAUTH E E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E E W E E L Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy MCO/ UNAUTH G E E E G N/A Z Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy MCO/UNAUTH E E E G G E E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E R E R R R R G Z E E E E G Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E E G E W W W W W Z R R R R R R Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 W E W W W W W E W E Marvell Semiconductor, Inc. Z

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E E E E G R E E G G R E Marvell Semiconductor, Inc. G G E G G G R G E

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy G G E G E G G G W E G Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy W G,W G, E G R E W E Z R R R Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy R W G E G G R Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy W R W Z E T Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E N/A N/A G E Marvell Semiconductor, Inc. W

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E R R W Marvell Semiconductor, Inc. E W E Z

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 E E Security Policy E E R Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 G Security Policy E E E E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy E E E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 G Security Policy E E Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy All Approved services can be executed in the Non-Approved services mode with indicator of “success with fips_state=0”. Approved services that also support the use of non-approved security functions are enumerated in the Non-Approved Services table below with their supported non-approved security functions. The indicator is success for all approved services when the partition is operated in the Approved mode. Table 14

• Non-Approved Services N/A N/A Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy /ECDSA (noncompliant) EDDSA (noncompliant) EDDSA (noncompliant) Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy N/A N/A N/A N/A N/A N/A Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy ECDSA (noncompliant)

• Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 • • Security Policy ECDSA (noncompliant) The indicator is success for all Non-Approved services only when the partition is operated in the nonapproved mode. The Non-Approved services will fail with RET_POLICY_MISMATCH when the partition is Software/Firmware Security During the bootup, the following integrity tests are run:

1. Bootloader runs a 32-bit CRC verification algorithm to validate the bootloader image itself.
2. Then, bootloader runs the firmware Integrity tests based on RSA 2048-bit SHA2-256 signature.
3. Integrity tests are part of POST and can be triggered by MCO through the CN_INVOKE_FIPS
4. Module Firmware has two components, Firmware (FW) and Secure Machine World (SMW) as listed in Section 2.1. The two components are as follows: Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy a. Firmware (FW): CNN35XX-NFBE-FW-2.09-0702 b. Secure Machine World : CNN35XX-NFBE-SMW-2.09-0702

5. Module Firmware is binary executable and is not open source. Operational Environment The module implements a limited operational environment. Area 6 modifiable Operational Environment requirements do not apply to the module in this validation. The module runs SMP Linux 4.9 which is part of the firmware image CNN35XX-NFBE-FW-2.09-0702.
6. The image does not run arbitrary applications or create new application flows. All the execution flows are pre-defined for each service in the module.
7. The image runs a monolithic application and manages the cryptographic software solely through intended services. Physical Security

The module’s cryptographic boundary is defined to be the outer perimeter of the hard epoxy enclosure containing the hardware and firmware components. The module is opaque and completely conceals the internal components of the cryptographic module. The epoxy enclosure of the module prevents physical access to any of the internal components without having to destroy the module. There are no operatorrequired actions. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy

The module is coated in hard epoxy, such that any physical breach attempt leaves behind evidence of tamper. This is shown in the figure below. Figure 4

• Cryptographic Module Showing Tamper Evidence Top: Minor tamper to the epoxy only Bottom: Major tamper, damaging circuitry While the module is designed to prevent successful tampering (any physical breach to module circuitry is likely to destroy the module, as per FIPS 140-3 Level 3 Physical Security requirements), the module should still be checked periodically for attempts. Guidelines are provided in the table below. Table 15
• Physical Security Inspection Guidelines If the module is found to be meaningfully damaged or tampered with (e.g., circuitry is showing, or other significant damage has occurred), it should be removed from usage and destroyed. Marvell Semiconductor, Inc.

NITROX III CNN35XX-NFBE HSM Family Version 2.09-0703 Security Policy Table 16

• EFP/EFT Table 17
• Hardness Testing Temperature ranges Non-Invasive Security At the time of this validation, no approved non-invasive attack mitigation test metrics are defined. Sensitive Security Parameters Management

The Manufacturer FIPS Data Encryption Key (MFDEK) and HSM Master Partition Master Encryption Key are stored in plaintext form in the EEPROM. The Partition Master Encryption Key (PMEK) is stored encrypted under the HSM Master Partition Master Encryption Key. All other keys and CSPs stored in the persistent memory are encrypted by the MFDEK, HSM Master Partition Master Encryption Key, or PMEK. All general-purpose user CSPs are generated/created by the PCU and these CSPs can be shared between multiple PCUs. The module itself enforces that the SSPs cannot be shared between the approved and non-approved modes. Note:

• The SSPs are zeroized securely by writing zeros to memory when in zeroization.
• Private or secret keys are always encrypted when doing export /import, and key encapsulation mechanisms are listed in the respective CSP row of Table 18
• SSPs.
• All CSPs from Table 18 are entered through automated electronic entry mechanisms. The below notations are used to indicate the CSP zeroization and memory de-allocation method in “Table SSPs”. D: Manually zeroized (key deletion via CN_DESTROY_OBJECT service) E: Zeroized right after used (memory is wiped with zeros immediately after use) Marvell Semiconductor, Inc.