PAN-OS 10.1 VM-Series

Certificate

Approved Algorithms (32)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for PAN-OS 10.1 VM-Series
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for PAN-OS 10.1 VM-Series
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

PAN-OS 10.1 VM-Series Version: 1.2 Revision Date: April 18, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.

The PAN-OS 10.1.5 VM-Series module is available in multiple capacity options (e.g. VM-50, VM-50 Lite, VM-100, VM-300, VM-500, VM-700; note that these are sets of configuration options rather than actual module variants). All models can be deployed as guest virtual machines on VMware ESXi, Hyper-V, and Linux server that is running the KVM (Kernel-based Virtual Machine) using a common base image distributed in a compatible hypervisor format. The PAN-OS VM-Series is the virtualized form factor of the Palo Alto Networks next-generation firewall. The VM-Series is used to protect applications/data from cyber threats using Palo Alto Networks’ next-generation firewall and advanced threat prevention features. The cryptographic module meets the overall requirements applicable to Level 1 security of FIPS 140-3. Table 1 - Security Levels ISO/IEC 24759 Section 6. FIPS 140-3 Section Title Security Level

2                                 Cryptographic Module Specification           1
3                                 Cryptographic Module Interfaces              1
4                                 Roles, Services, and Authentication          3
5                                 Software/Firmware Security                   1
6                                 Operational Environment                      1
7                                 Physical Security                            N/A
8                                 Non-Invasive Security                        N/A
9                                 Sensitive Security Parameter Management      1
11                                Life-Cycle Assurance                         3
12                                Mitigation of Other Attacks                  N/A
Overall Level                                 1 2. Cryptographic Module Specification Table 2 - Tested Operational Environments Operating System                 Hardware Platform                   Processor               PAA/Acceleration Vmware ESXi v7.0                 Dell PowerEdge R740                  Intel Gold 6248                 N/A KVM 4 on Ubuntu 20.04            Dell PowerEdge R740                  Intel Gold 6248                 N/A Hyper-v 2019 on Microsoft        Dell PowerEdge R740                  Intel Gold 6248                 N/A Hyper-V Server 2019 © 2024 Palo Alto Networks, Inc.                                                  PAN-OS 10.1 VM-Series Security Policy 3

Table 3 - Vendor Affirmed Operational Environments Operating System Hardware Platform Amazon Web Services (AWS)* x86 Architecture Microsoft Azure* (Note: Specific processor/hardware is dependent on Google Cloud Platform (GCP)* Instance/Machine Type selected for operation system) *Note: These operational environments are Vendor Affirmed. Operator Porting Rules The CMVP allows user porting of a validated software module to an operational environment which was not included as part of the validation testing. An operator may install and run a VM-series firewall on any general purpose computer (GPC) or platform using the specified hypervisor and operating system on the validation certificate or other compatible operating and/or hypervisor system and affirm the modules continued FIPS 140-3 validation compliance. The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when ported and executed in an operational environment not listed on the validation certificate. `Approved Mode of Operation The following procedure will put the module into the Approved mode of operation:

• During initial boot up, break the boot sequence via the console port connection (by entering “maint”) to access the main menu.
• Select “Continue.”
• Select the “Set FIPS-CC Mode” option to enter FIPS-CC mode.
• Select “Enable FIPS-CC Mode”.
• When prompted, select “Reboot” and the module will re-initialize and continue into FIPS-CC mode (Approved mode).
• The module will reboot.
• In FIPS-CC mode, the console port is available only as a status output port.
• Once the module has finished booting, the Crypto Officer can authenticate using the default credentials that come with the module
• Once authenticated, the module will automatically require the operator to change their password; and the default credential is overwritten The module will automatically indicate the Approved mode of operation in the following manner:
• Status output interface will indicate “**** FIPS-CC MODE ENABLED ****” via the CLI session.
• Status output interface will indicate “FIPS-CC mode enabled successfully” via the console port.
• The module will display “FIPS-CC” at all times in the status bar at the bottom of the web interface. Should one or more power-up self-tests fail, the Approved mode of operation will not be achieved. Feedback will consist of:
• The module will reboot and enter a state in which the reason for the reboot can be determined.
• The module will output “FIPS-CC failure.”
• To determine which self-test caused the system to reboot into the error state, connect the console cable and follow the on-screen instructions to view the self-test output. Note: Disabling FIPS-CC mode causes a complete factory reset, which is described in the Zeroization section below. © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 4

Non-Compliant State Failure to follow the directions in the Approved Mode of Operation above or rules noted in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. Zeroization To perform the zeroization service, follow the procedure below:

• Access the module’s CLI via SSH, and command the module to enter maintenance mode; the module will reboot
• Note: Establish a serial connection to the console port
• After reboot, select “Continue.”
• Select “Factory Reset.”
• The module will perform a zeroization, and provide the following message once complete: o “Factory Reset Status: Success” Approved and Allowed Algorithms The cryptographic modules support the following Approved algorithms. Only the algorithms, modes, and key sizes specified in this table are used by the module. The CAVP certificate may contain more tested options than listed in this table. Table 4
• Approved Algorithms Conditioning Component Intel Conditioner for AES-CBC-MAC SP 800-90B Entropy Source [SP 800-38C] Decryption [SP 800-38D] Decryption AES 256 bits with Counter DRBG A2244 CTR DRBG Derivation Function Random Bit Generator [SP 800-90Arev1] ECDSA KeyGen Key Generation ECDSA KeyVer (FIPS Public Key Validation ECDSA SigGen (FIPS Signature Generation A2244 ECDSA SigVer (FIPS 186-4) ECDSA SigVer Signature Verification © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 5

A2244                                                                        HMAC-SHA-1 with λ=96,        Authentication for HMAC-SHA-1 [FIPS 198-1]    HMAC [FIPS 198-1]                                                                      protocols A2244                   HMAC-SHA2-256                                        HMAC-SHA2-256 with           Authentication for [FIPS 198-1]                                         λ=256                        protocols A2244                   HMAC-SHA2-384                                        HMAC-SHA2-384 with           Authentication for [FIPS 198-1]                                         λ=384                        protocols A2244                   HMAC-SHA2-512                                        HMAC-SHA2-512 with           Authentication for [FIPS 198-1]                                         λ=512                        protocols A2244                                                                                                     Key Exchange Engine ID: A2244                                              KDF                       TLS v1.2 Hash Algorithm:     TLS (FIPS 186-4)               (FIPS 186-4) A2244                                                                        with hashes (FIPS 186-4)               (FIPS 186-4) IG C.F) with hashes (FIPS 186-4)               (FIPS 186-4) +++ This Hash algorithm is not supported for ANSI Digital Signature A2244                   SHA-1 [FIPS 180-4]         SHA component of HMAC) Digital Signature component of HMAC) Digital Signature component of HMAC) Digital Signature © 2024 Palo Alto Networks, Inc.                                                       PAN-OS 10.1 VM-Series Security Policy 6

Non-Digital Signature component of HMAC) Digital Signature Non-Digital Signature component of HMAC) Safe Primes Key           Safe Primes Key                                            Safe Primes Key Generation [RFC 3526]     Generation                                                 Generation Safe Primes Key           Safe Primes Key                                            Safe Primes Key Verification [RFC 3526]   Verification                                               Verification AES-CBC or AES-CTR plus SP 800-38A, FIPS 198-1, 128, 192, and 256-bit keys    Key Wrapping HMAC Cert. A2244          [SP 800-38F]              wrapping and unwrapping) per IG D.G. bits of encryption strength SP 800-38C and SP AES-CCM Cert. A2244                                                              128-bit keys providing 128    Key Wrapping [SP 800-38F]              wrapping and unwrapping) bits of encryption strength per IG D.G. SP 800-38D and SP            AES-GCM [SP 800-38F]              wrapping and unwrapping)     providing 128 or 256 bits per IG D.G.                  of encryption strength KAS-ECC-SSC Cert.                                   SP 800-56Arev3. KAS-FFC      P-256 and P-384 curves Key Exchange with #A2244, KDF IKEv2 Cert.   KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path   providing 128 or 192 bits protocol KDF #A2244                                              (2).                         of encryption strength #A2244, KDF SSH Cert.                                                            curves providing 128, 192,    Key Exchange with KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path #A2244                                                                           or 256 bits of encryption     protocol KDF (2). #A2244, KDF TLS Cert.                                                            curves providing 128, 192,    Key Exchange with KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path #A2244                                                                           or 256 bits of encryption     protocol KDF (2). Key Exchange with #A2244, KDF IKEv2 Cert.   KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path   2048-bit key providing 112 protocol KDF Key Exchange with #A2244, KDF SSH Cert.     KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path   2048-bit key providing 112 protocol KDF Key Exchange with #A2244, KDF TLS Cert.     KAS [SP 800-56Arev3]      per IG D.F Scenario 2 path   2048-bit key providing 112 protocol KDF Note:The seeds used for Cryptographic Key Section 5.1, Section 5.2     Generation; SP 800Affirmed                  (SP 800-133rev2)                                                                     generation are produced

using the unmodified/direct output of the DRBG © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 7

• For TLS, The GCM implementation meets Scenario 1 of IG C.H: it is used in a manner compliant with SP 800-52 and in accordance with Section 4 of RFC 5288 for TLS key establishment, and ensures when the nonce_explicit part of the IV exhausts all possible values for a given session key, that a new TLS handshake is initiated per sections 7.4.1.1 and 7.4.1.2 of RFC 5246. During operational testing, the module was tested against an independent version of TLS and found to behave correctly.
• From this RFC 5288, the GCM cipher suites in use are TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• For IPsec/IKEv2, The GCM implementation meets Scenario 1 of IG C.H: it is used in a manner compliant with RFCs 4106 and 7296 (RFC 5282 is not applicable, as the module does not use GCM within IKEv2 itself), and ensures when the module exhausts all possible values for a given session key that this triggers a rekey condition. During operational testing, the module was tested against an independent version of IPsec with IKEv2 and found to behave correctly.
• For SSH, the module meets Scenario 1 of IG C.H. The module conforms to RFCs 4252, 4253, and 5647. The fixed field is 32 bits in length and is derived using the SSH KDF; this ensures the fixed field is unique for any given GCM session. The invocation field is 64 bits in length and is incremented for each invocation of GCM; this prevents the IV from repeating until the entire invocation field space of 264 is exhausted, which can take hundreds of years. (In FIPS-CC Mode, SSH rekey is automatically configured at 1 GB of data or 1 hour, whichever comes first.) In all the above cases, the nonce_explicit is always generated deterministically. AES GCM keys are zeroized when the module is power-cycled. For each new TLS or SSH session, a new AES GCM key is established. The cryptographic module supports the following non-Approved algorithms that are allowed for use in the Approved mode of operation: The module does not have any algorithms that fall under: - Non-Approved Algorithms Allowed in the Approved Mode of Operation - Non-Approved Algorithms Not Allowed in the Approved Mode of Operation Table 5 - Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed MD5 Only allowed as the PRF in TLSv1.1 per IG 2.4.A Message digest used in TLSv1.0 / v1.1 KDF only Table 6 - Supported Protocols in the Approved Mode Supported Protocols* TLSv1.1, v1.2 SSHv2 SNMPv3 IPsec and IKEv2 *Note: These protocols have not been tested or reviewed by the CMVP or the CAVP. © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 8

Cryptographic Boundary The PAN-OS 10.1.5 VM-Series is a software cryptographic module and requires an underlying general purpose computer (GPC) environment. The module consists of a GPC (multi-chip standalone embodiment) with the cryptographic boundary defined below. The cryptographic boundary (CB) includes all of the software components of the module, which is included in the file noted in Section 11 (PanOS_vm-10.1.5) and also the configuration file that resides on the virtual machine’s virtual disk. The physical perimeter (PP) is defined by the enclosure around the host GPC on which it runs. Figure 1 depicts the boundary and illustrates the hardware components of a GPC. Figure 1 - Cryptographic Boundary 3. Cryptographic Module Interfaces The module is a software only module that operates on a general purpose computing (GPC) platform. The physical ports and logical interfaces are consistent with a GPC operating environment. The module supports the following FIPS 140-3 logical interfaces: Table 7 - Ports and Interfaces Physical Port Logical Interface Data that passes over port/interface Power Power In Power supplies Console, GPC I/O Status Output Self-test status output N/A Control Output N/A Ethernet Data input, control input, HTTPS, TLS, SNMP, IPsec, and SSH traffic data. data output, status output © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 9

The module’s physical and electrical characteristics, manual controls, and physical indicators are provided by the host GPC; the hypervisors provide virtualized ports and interfaces which map to the GPCs’ physical ports and interfaces (i.e., network interfaces and GPC inputs/outputs). 4. Roles, Services, and Authentication Roles and Services While in the Approved mode of operation, all CO and User services are accessed via SSH or TLS sessions. Approved and allowed algorithms, relevant CSPs and public keys related to these protocols are accessed to support the following services. CSP access by services is further described in the following tables. Table 8 - Roles, Service Commands, Input and Output Crypto Officer       Show Version               Query module for version                Module provides version Crypto Officer,      Security Configuration     Configuring and managing                Confirmation of service User                 Management                 cryptographic parameters and            via Configuration Logs setting/modifying security policy, including creating User accounts and additional CO accounts via CLI or WebUI Crypto Officer       Other Configuration        Networking parameter                    Confirmation of service configuration, logging configuration,   via Configuration Logs and other non-security relevant configuration via CLI or WebUI Crypto Officer,      View Other                 Query module for current                Confirmation of service User                 Configuration              non-security relevant configuration     via Configuration Logs via WebUI or CLI Crypto Officer,      Show Status                Query status and version of the         Module status information User, RA VPN,                                   module via WebUI or CLI                 via CLI or System Logs RA VPN, S-S VPN      VPN                        Initialize VPN connection               Confirmation of service via System Logs Crypto Officer       Software Update            Loading new image                       Message output noting version updated Unauthenticated      Zeroize                    Initiate zeroization command            The device will overwrite all CSPs and provide status of completion Unauthenticated                                 Power cycling the module                Self-test status output via system logs Unauthenticated      Show Status                View status of the module via           Module status via the © 2024 Palo Alto Networks, Inc.                                                  PAN-OS 10.1 VM-Series Security Policy 10

The zeroization procedure is invoked when the operator initiates the service. The operator must be in control of the module during the entire procedure to ensure that it has successfully completed. During the zeroization procedure, no other services are available. Note: Additional information on the configuration options the module provides can be found at https://docs.paloaltonetworks.com/ Assumption of Roles The modules support four distinct operator roles, User and Cryptographic Officer (CO), Remote Access VPN, and Site-to-site VPN. The cryptographic modules enforce the separation of roles using unique authentication credentials associated with operator accounts. The modules do not provide a maintenance role or bypass capability. The modules all support the use of a password (i.e. Memorized Secret as per SP 800-140E). Upon first boot, the module requires that the Cryptographic Officer change the password from the default one to a custom one. The module automatically enforces a minimum password length of at least 8 characters. In FIPS-CC mode, the module automatically enforces a maximum of 10 failed attempts. Passwords stored in the module are hashed using SHA-256, and any passwords that are transported into/out of the module are protected via TLS 1.2. Table 9 – Roles and Authentication Role Authentication Method Authentication Strength Cryptographic Officer Memorized Secret (Unique Password-based Username/password) and/or The minimum length is eight (8) characters1 Single-Factor Cryptographic Software (95 possible characters). The probability that (certificate common name / public a random attempt will succeed or a false key-based authentication) acceptance will occur is 1/(958) which is less User Memorized Secret (Unique than 1/1,000,000. The probability of Username/password) and/or successfully authenticating to the module Single-Factor Cryptographic Software within one minute is 10/(958), which is less (certificate common name / public than 1/100,000. The firewall’s configuration key-based authentication supports at most ten failed attempts to Remote Access VPN (RA VPN) Memorized Secret (Unique authenticate in a one-minute period. (certificate common name / public The security modules support public-key key-based authentication based authentication using RSA 2048 and certificate-based authentication using RSA 2048, RSA 3072, RSA 4096, ECDSA P-256, The minimum equivalent strength supported is 112 bits. The probability that a random attempt will succeed is 1/(2112) which is less than 1/1,000,000. The probability of In FIPS-CC Mode, the module checks and enforces the minimum password length of eight (8) as specified in SP 800-63B. Passwords are securely stored hashed with salt value, with very restricted access control, and rate limiting mechanism for authentication attempts. © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 11

successfully authenticating to the module within a one minute period is 3,600,000/(2112), which is less than 1/100,000. The firewall supports at most 60,000 new sessions per second to authenticate in a one-minute period. Site-to-Site VPN (S-S VPN) IKE/IPSec Pre-shared keys - The pre-shared key authentication method Identification with the IP Address and has a minimum security strength2 of 956. The authentication with the Pre-Shared probability of successfully authenticating to Key or certificate based the module is 1/(956), which is less than attempts is limited by the number of new connections per second supported (120,000) on the fastest platform of the Palo Alto Networks firewalls. The probability of successfully authenticating to the module within a one minute period is 7,200,000/(295), which is less than 1/100,000. The security modules support public-key based authentication using RSA 2048 and certificate-based authentication using RSA 2048, RSA 3072, RSA 4096, ECDSA P-256, The minimum equivalent strength supported is 112 bits. The probability that a random attempt will succeed is 1/(2112) which is less than 1/1,000,000. The probability of successfully authenticating to the module within a one minute period is 3,600,000/(2112), which is less than 1/100,000. The firewall supports at most 60,000 new sessions per second to authenticate in a one-minute period. Definition of CSPs Modes of Access The following table defines the relationship between access to CSPs and the different module services. The modes of access shown in the table are defined as: Note: The security strength (956) is based on the use of ASCII characters that are utilized, which surpasses the 6 character random number password allowance that sets a baseline minimum acceptable strength of 106 established by SP 800-63B. © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 12

G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Table 10 - Approved Services Service                Description          Approved Security         Keys and/or SSPs       Roles    Access rights to              Indicator Functions                                              Keys and/or SSPs Show Version       Query the module to   N/A                       N/A                      CO       N/A                 Version displayed via System display the version                                                                                   Logs / CLI / UI Security           Configuring and       CKG                       RSA Private Keys         CO       G/W/E               Configuration/System Logs including creating    186-4) User accounts and     KAS       KDF TLS,        TLS Pre-Master Secret    CO       G/E/Z               Configuration/System Logs accounts                        KDF TLS,        TLS Master Secret        CO       G/E/Z               Configuration/System Logs CKG,            TLS DHE/ECDHE Private             G/E/Z KeyGen (FIPS    TLS DHE/ECDHE Public              G/E/R/W/Z Safe Primes Safe Primes AES-CBC,        SSH Session Encryption   CO       G/E/Z               Configuration/System Logs KAS       KDF SSH         SSH DHE/ECDHE            CO       G/E/Z               Configuration/System Logs Private Components KAS-FFC-SSC     SSH DHE/ECDHE Public              G/E/R/W/Z Safe Primes     Components Safe Primes N/A                       CO, User, RA VPN         CO       G/E/W               Configuration/System Logs © 2024 Palo Alto Networks, Inc.                                                                   PAN-OS 10.1 VM-Series Security Policy 13

Counter DRBG,             Entropy Input String      CO      G/E            Configuration/System Logs ENT (P)                   DRBG Seed                 CO      G/E            Configuration/System Logs DRBG V                    CO      G/E            Configuration/System Logs DRBG Key                  CO      G/E            Configuration/System Logs KDF SNMP                  SNMPv3 Authentication     CO      W/E            Configuration/System Logs KDF SNMP                  SNMPv3 Privacy Secret     CO      W/E            Configuration/System Logs N/A                       Protocol Secrets          CO      W/E            Configuration/System Logs RSA SigVer (FIPS 186-4)   CA Certificates           CO      G/R/E/W        Configuration/System Logs ECDSA SigVer (FIPS        ECDSA Public Keys         CO      G/R/E/W        Configuration/System Logs RSA SigVer (FIPS 186-4)   RSA Public Keys           CO      G/R/E/W        Configuration/System Logs RSA SigVer (FIPS 186-4)   SSH Host Public Key       CO      G/R/E/W        Configuration/System Logs RSA SigVer (FIPS 186-4)   SSH Client Public Key     CO      W/E            Configuration/System Logs RSA SigVer (FIPS 186-4)   Public key for software   CO      W/E            Configuration/System Logs load test Other           Networking               RSA SigGen (FIPS 186-4)   RSA Private Keys          CO      G/W/E          Configuration/System Logs configuration, and       KAS       KDF TLS,        TLS Pre-Master Secret     CO      G/E/Z          Configuration/System Logs KDF TLS,        TLS Master Secret         CO      G/E/Z          Configuration/System Logs relevant configuration CKG,            TLS DHE/ECDHE Private     CO      G/E/Z          Configuration/System Logs KeyGen (FIPS    TLS DHE/ECDHE Public              G/E/R/W/Z Safe Primes Safe Primes HMAC-SHA-1                SSH Session               CO      G/Z            Configuration/System Logs AES-CBC, AES-CTR, or      SSH Session Encryption    CO      G/E/Z          Configuration/System Logs KAS       KDF SSH         SSH DHE/ECDHE             CO      G/E/Z          Configuration/System Logs Private Components KeyGen (FIPS    SSH DHE/ECDHE Public Safe Primes Safe Primes © 2024 Palo Alto Networks, Inc.                                                                    PAN-OS 10.1 VM-Series Security Policy 14

N/A                       CO, User, RA VPN           CO         G/E/W       Configuration/System Logs RSA SigVer (FIPS 186-4)   CA Certificates            CO         G/R/E/W     Configuration/System Logs RSA SigVer (FIPS 186-4)   SSH Host Public Key        CO         G/R/E/W     Configuration/System Logs RSA SigVer (FIPS 186-4)   SSH Client Public Key      CO         W/E         Configuration/System Logs View Other      Read-only of            N/A                       CO, User, RA VPN           CO, User   W/E         Configuration/System Logs Note: includes all items Show Status     Provides status         RSA SigGen (FIPS 186-4)   RSA Private Keys           CO, User   E           Configuration/System Logs information of the KAS      KDF TLS,         TLS Pre-Master Secret      CO, User   G/E/Z       Configuration/System Logs KDF TLS,         TLS Master Secret          CO, User   G/E/Z       Configuration/System Logs CKG,             TLS DHE/ECDHE Private      CO, User   G/E/Z       Configuration/System Logs KeyGen (FIPS     TLS DHE/ECDHE Public                  G/E/R/W/Z Safe Primes Safe Primes HMAC-SHA-1                SSH Session                CO, User   G/E/Z       Configuration/System Logs AES-CBC, AES-CTR, or      SSH Session Encryption     CO, User   G/E/Z       Configuration/System Logs KAS       KDF SSH         SSH DHE Public/Private     CO, User   G/E/Z       Configuration/System Logs ECDSA           SSH ECDHE                             G/E/R/W/Z Safe Primes Safe Primes © 2024 Palo Alto Networks, Inc.                                                                    PAN-OS 10.1 VM-Series Security Policy 15

VPN

Providenetwork accessforremote usersorsite-to-site connection

KTS KTS KTS KAS N/A ECDSASigVer(FIPS 186-4) RSASigVer(FIPS186-4) RSASigGen(FIPS186-4) ECDSASigGen(FIPS 186-4) KAS KTS KTS CKG, AES-CBCorAES-GCM CKG, HMAC-SHA-1 CounterDRBG, ENT(P) RSASigVer(FIPS186-4)) ECDSASigVer(FIPS 186-4)

HMAC-SHA-1 HMAC-SHA2- 256 HMAC-SHA2- 384 HMAC-SHA2- 512 AES-CBC AES-CCM AES-GCM KDFIKEv2 CKG, ECDSA KeyGen(FIPS 186-4), ECDSA KeyVer(FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, SafePrimes Key Generation, SafePrimes Key Verification KDFTLS, MD5 KDFTLS, MD5 CKG, ECDSA KeyGen(FIPS 186-4), ECDSA KeyVer(FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, SafePrimes Key Generation, SafePrimes Key Verification HMAC-SHA-1 HMAC-SHA2- 256 HMAC-SHA2- 384 AES-CBC AES-GCM

S-SVPNIPSec/IKE AuthenticationKeys S-SVPNIPSec/IKE SessionKeys S-SVPNIPSec/IKE DHE/ECDHEPrivate Components S-SVPNIPSec/IKE DHE/ECDHEPublic Components S-SVPNIPSec Pre-SharedKeys ECDSAPublicKeys RSAPublicKeys RSAPrivateKeys ECDSAPrivateKeys TLSPre-MasterSecret TLSMasterSecret TLSDHE/ECDHEPublic Components TLSDHE/ECDHEPrivate Components TLSHMACKeys TLSEncryptionKeys RAVPNIPSecSession Keys RAVPNIPSec Authentication EntropyInputString DRBGSeed DRBGV DRBGKey CACertificates

S-SVPN S-SVPN S-SVPN S-SVPN S-SVPN S-SVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN RAVPN

G/E/Z G/E/Z G/E/Z G/E/R/W/Z W/E W/E W/E E E G/E/Z G/E/Z G/E/R/W/Z G/E/Z G/E/Z G/E/Z G/E/Z G/E/Z G/E G/E G/E G/E W/E

Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs Configuration/SystemLogs

VPN           Provide network                   HMAC-SHA-1       S-S VPN IPSec/IKE       S-S VPN   G/E/Z        Configuration/System Logs KAS       KDF IKEv2        S-S VPN IPSec/IKE       S-S VPN   G/E/Z        Configuration/System Logs DHE/ECDHE Private Safe Primes Safe Primes N/A                        S-S VPN IPSec           S-S VPN   W/E          Configuration/System Logs ECDSA SigVer (FIPS         ECDSA Public Keys       S-S VPN   W/E          Configuration/System Logs RSA SigVer (FIPS 186-4)    RSA Public Keys         S-S VPN   W/E          Configuration/System Logs RSA SigGen (FIPS 186-4)    RSA Private Keys        RA VPN    E            Configuration/System Logs ECDSA SigGen (FIPS         ECDSA Private Keys      RA VPN    E            Configuration/System Logs KAS       KDF TLS,         TLS Pre-Master Secret   RA VPN    G/E/Z        Configuration/System Logs KDF TLS,         TLS Master Secret                 G/E/Z CKG,             TLS DHE/ECDHE Public    RA VPN    G/E/R/W/Z    Configuration/System Logs KeyGen (FIPS     TLS DHE/ECDHE Private   RA VPN    G/E/Z        Configuration/System Logs Safe Primes Safe Primes AES-CBC          TLS Encryption Keys     RA VPN    G/E/Z        Configuration/System Logs CKG,                       RA VPN IPSec Session    RA VPN    G/E/Z        Configuration/System Logs CKG,                       RA VPN IPSec            RA VPN    G/E/Z        Configuration/System Logs Counter DRBG,              Entropy Input String    RA VPN    G/E          Configuration/System Logs ENT (P)                    DRBG Seed               RA VPN    G/E          Configuration/System Logs DRBG V                  RA VPN    G/E          Configuration/System Logs DRBG Key                RA VPN    G/E          Configuration/System Logs RSA SigVer (FIPS 186-4))   CA Certificates         RA VPN    W/E          Configuration/System Logs © 2024 Palo Alto Networks, Inc.                                                                PAN-OS 10.1 VM-Series Security Policy 16

ECDSA SigVer (FIPS        ECDSA Public Keys         RA VPN   W/E            Configuration/System Logs RSA SigVer (FIPS 186-4)   RSA Public Keys           RA VPN   W/E            Configuration/System Logs Software         Provides a method to       RSA SigVer (FIPS 186-4)   Public key for firmware   CO       E              Configuration/System Logs Update           update the software of                               content load test the module Note: Includes all keys from Other Zeroize          Destroys all keys in       N/A                       All keys and SSPs         CO       Z              Zeroization indicator the module Self-Test        Initiates self-tests and   HMAC-SHA2-256,            Software integrity        CO       E              System Logs integrity test             ECDSA SigVer (FIPS        verification key Show Status      Provides status of the     N/A                       N/A                       All      R              LEDs Note: Configuration/System Logs for Approved services above will indicate FIPS-CC mode is enabled, configuration requirements from Section 11 are followed, and that the service succeeded. 5. Software/Firmware Security The module performs the Software Integrity test by using HMAC-SHA-256 (HMAC Cert. #A2244) during the Pre-Operational Self-Test. In addition, the module also conducts a software load test by using RSA 2048 with SHA-256 (Cert. #A2244) for the new validated software to be uploaded into the module. Any software loaded into this module that is not shown on the module certificate is out of scope of this validation, and requires a separate FIPS 140-3 validation. 6. Operational Environment The module is a modifiable operational environment as per FIPS 140-3 Level 1 specifications. The hypervisor environment provides an isolated operating environment and is the single operator of the virtual machine. The tested operating environments isolate virtual systems into separate isolated process spaces. Each process space is logically separated from all other processes by the operating environments software and hardware. The module functions entirely within the process space of the isolated system as managed by the single operational environment. This implicitly meets the FIPS 140-3 requirement that only one (1) entity at a time can use the cryptographic module. 7. Physical Security There are no applicable FIPS 140-3 physical security requirements. 8. Non-Invasive Security No Approved non-invasive attack mitigation test metrics are defined at this time. © 2024 Palo Alto Networks, Inc.                                                                        PAN-OS 10.1 VM-Series Security Policy 17

9. Sensitive Security Parameters The following table details all the sensitive security parameters utilized by the module. Table 11 - SSPs key - Used to trust a RSA SigVer (FIPS HDD – Zeroize root CA intermediate TLS or SSH Service CA and leaf /end entity managed as certificates for the verification of RSA SigVer signatures, peer authentication. (RSA 2048, 3072, or RSA Private keys for RSA SigGen TLS or SSH Service signatures, managed as certificates for the verification of peer authentication. generation of

112 bits RAM - FFC or EC component

112 bits Ephemeral values used

minimum in key agreement (DHE 2048, ECDHE Secret value used to KDF TLS, KAS SP Zeroize at derive the TLS Master random nonces © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 18

KDF TLS,                                                                Zeroize at        Secret value used to TLS Master Secret   N/A        MD5              KDF TLS      N/A          N/A                          session           derive the TLS session AES-CBC,                                                                Zeroize at Zeroize at Diffie Hellman or EC

112 bits RAM -

Diffie Hellman or EC

112 bits                                 SSH                           RAM -                         component (DH Group
RSA SigVer (RSA 2048, RSA 3072, N/A          N/A                          Zeroize Service   RSA 4096, ECDSA Public RSA key used to RSA SigVer                    Encrypted SSH Client Public   112 bits                                                               HDD/RAM –                     authenticate client. (FIPS 186-4)     N/A          via SSH or   N/A                          Zeroize Service

Used in all SSH connections to the security module’s Zeroize at        command line used in all SSH connections to the HMAC-SHA-1,                                                                               security module’s SSH Session                                                                                            Zeroize at Diffie-Hellman or EC DHE or ECDHE        112 bits                                                               RAM -                         component used in key Components                                                                                                               (DHE 2048, ECDHE Diffie-Hellman or EC DHE or ECDHE        112 bits                                                               RAM -                         component used in key Components                                                                                                               (DHE 2048, ECDHE Used to encrypt S-S VPN IPSec/IKE                                                         IPSec/IKE, KAS               Zeroize at HMAC-SHA2-512                                                                             authenticate the peer © 2024 Palo Alto Networks, Inc.                                                             PAN-OS 10.1 VM-Series Security Policy 19

Cert. #A2244                                                                         in an IKE/IPSec tunnel PSK used in conjunction with HMAC listed above for N/A        N/A                  N/A          via SSH or    N/A                Zeroize Service Pre-Shared Keys                                                                       plaintext                      Entered into the module by the Crypto Officer once Used to encrypt AES-CBC,                                                           Zeroize at        remote access Zeroize at        bits) N/A           N/A                session           Used in authentication termination       of remote access IPSec Used to check the integrity of all Software integrity              ECDSA SigVer                                          HDD verification key                (FIPS 186-4)                                          plaintext ECDSA P-256) Used to authenticate Public key for                  RSA SigVer HDD -                          and content to be software content     112 bits   (FIPS 186-4)         N/A          N/A           N/A                N/A plaintext                      installed on the load test                       Cert. #A2244 firewall (RSA 2048 N/A                             External     via SSH or    N/A                Zeroize Service   with a minimum length TLS                                                of eight (8) characters. Secrets used by HDD/RAM –                      RADIUS or TACACS+ Protocol Secrets     N/A        N/A                  N/A          via SSH or    N/A                Zeroize Service coming from the affirmed), Counter   Entropy as Entropy Input                                                                         RAM -                          entropy source #A2244,              SP 800-90B Input length = 384 DRBG seed coming Entropy as                                                      from the entropy SP 800-90B Seed length = 384 bits Entropy as DRBG Cert.                                            RAM -                          State (V) used in the #A2244,                                               plaintext                      generation of random SP 800-90B Entropy as #A2244,                                               plaintext                      generation of random SP 800-90B SNMPv3                                                                                                               Used to support N/A                             N/A                        N/A                Zeroize Service Used to support SNMPv3 Privacy                  KDF SNMP                          Encrypted           HDD/RAM –                      SNMPv3 services N/A                             N/A                        N/A                Zeroize Service © 2024 Palo Alto Networks, Inc.                                                        PAN-OS 10.1 VM-Series Security Policy 20

KDF SNMP N/A N/A Zeroize Service HMAC-SHA2-512 protocol key (160 bits) Privacy protocol Session Key KDF SNMP N/A N/A Zeroize Service Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. Table 12 - Non-Deterministic Random Number Generation Specification Entropy Source Minimum number of bits of Details Entropy provided by Intel’s CPU with RDSEED as the noise source where the noise samples have a ENT (P) Intel CPU with RDSEED 256 bits min-entropy rate of 0.6138 bits of entropy per bit Hardware entropy source of output. Due to the number of samples collected and the conditioning applied, the DRBG is seeded 10. Self-Tests The cryptographic module performs the following tests below. The operator can command the module to perform the power-up self-test by cycling power of the module; these tests do not require any operator action. Pre-operational Self-Tests Pre-operational Software Integrity Test

• Verified with HMAC-SHA-256 and ECDSA P-256 with SHA-256 Note: the ECDSA and HMAC-SHA-256 KATs are performed prior to the Software integrity test Conditional self-tests Cryptographic algorithm self-tests
• AES 128-bit ECB Encrypt Known Answer Test*
• AES 128-bit ECB Decrypt Known Answer Test* *Note: Supported by the module cryptographic implementation, but only utilized for CAST
• AES 128-bit CMAC Known Answer Test* *Note: Supported by the module cryptographic implementation, but only utilized for CAST
• AES 256-bit GCM Encrypt Known Answer Test
• AES 256-bit GCM Decrypt Known Answer Test
• AES 192-bit CCM Encrypt Known Answer Test
• AES 192-bit CCM Decrypt Known Answer Test
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Sign Known Answer Test
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Verify Known Answer Test
• RSA 2048-bit Encrypt Known Answer Test
• RSA 2048-bit Decrypt Known Answer Test Note: Encrypt/Decrypt are only used for self-tests © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 21

• ECDSA P-256 with SHA-512 Sign Known Answer Test
• ECDSA P-256 with SHA-512 Verify Known Answer Test
• HMAC-SHA-1 Known Answer Test
• HMAC-SHA-256 Known Answer Test
• HMAC-SHA-384 Known Answer Test
• HMAC-SHA-512 Known Answer Test
• SHA-1 Known Answer Test
• SHA-256 Known Answer Test
• SHA-384 Known Answer Test
• SHA-512 Known Answer Test
• SP 800-90Arev1 CTR DRBG Instantiate/Generate/Reseed Known Answer Tests
• SP 800-90Arev1 CTR DRBG Instantiate/Generate/Reseed Section 11.3 Health Tests
• SP 800-56Ar3 KAS-FFC-SSC 2048-bit Known Answer Test
• SP 800-56Ar3 KAS-ECC-SSC P-256 Known Answer Test
• SP 800-135rev1 TLS 1.0/1.1 KDF Known Answer Test
• SP 800-135rev1 TLS 1.2 KDF with SHA-256 Known Answer Test
• SP 800-135rev1 SSH KDF with SHA-256 Known Answer Test
• SP 800-135rev1 IKEv2 KDF with SHA-256 Known Answer Test
• Continuous Random Number Generator (RNG) test
• performed on DRBG
• SP 800-90B RCT/APT Health Tests on Entropy Source Conditional Pairwise Consistency Self-Tests
• RSA Pairwise Consistency Test
• ECDSA/KAS-ECC Pairwise Consistency Test
• KAS-FFC Pairwise Consistency Test Conditional Software Load test
• Software Load Test
• Verify RSA 2048 with SHA-256 signature on software at time of load Conditional Critical Functions Tests
• SP 800-56A Rev. 3 Assurance Tests (Based on Sections 5.5.2, 5.6.2, and 5.6.3) Error Handling In the event of a conditional test failure, the module will output a description of the error. These are summarized below. Table 13 - Errors and Indicators Cause of Error Error State Indicator Conditional Cryptographic Algorithm Self-Test or FIPS-CC mode failure. <Algorithm test> failed. Software Integrity Test Failure Conditional Pairwise Consistency or Critical Functions System log prints an error message. Test Failure Conditional Software Load Test Failure System prints Invalid image message. 11. Life-Cycle Assurance The vendor provided life-cycle assurance documentation describes configuration management, design, finite state model, development, testing, delivery & operation, end of life procedures, and guidance. For details regarding the approved mode of © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 22

operation, see “Approved Mode of Operation''. For details regarding secure installation, initialization, startup, and operation of the module, see below. Installation Instructions The module can be retrieved by downloading PanOS_vm-10.1.5 from the support site (https://support.paloaltonetworks.com/Support/Index), and a checksum (SHA-256) is available to ensure the module is correct: o 10.1.5: 018fd6b322d1d65023751496ac3f9a7c4890fdd523f9d5a9145c752447b492cb Alternatively, the VM-Series version can be obtained by running the following commands via CLI (as an authorized administrator): 1. request system software check 2. request system software download version 10.1.5 3. request system software install version 10.1.5 4. request restart system Palo Alto Network provides an Administrator Guide for additional information noted in the “Reference Documents” section of this Security Policy. The module design corresponds to the module security rules noted in the section below. Module Enforced Security Rules When FIPS-CC mode is enabled, the module runs all the required items noted in Section 10 Self-tests. This section documents the security rules enforced by the cryptographic module to implement the security requirements of this FIPS 140-3 Level 1 module.

1. The cryptographic module provides four distinct operator roles. These are the User role, Remote Access VPN role, Site-to-site VPN role, and the Cryptographic Officer role.
2. The cryptographic module provides identity-based authentication.
3. The cryptographic module clears previous authentications when a power cycle is performed.
4. If the cryptographic module remains inactive in any valid role for the administrator specified time interval, the module will automatically log out the operator. The CO will configure the period of inactivity.
5. When configured, the module enforces a timed access protection mechanism that supports at most ten authentication attempts per minute. After the administrator specified number of consecutive unsuccessful password validation attempts have occurred, the cryptographic module shall enforce a wait period of at least one (1) minute before any more login attempts can be attempted. This wait period shall be enforced even if the module power is momentarily removed.
6. When the module has not been placed in a valid role, the operator does not have access to any cryptographic services.
7. The module supports the generation of key material with the approved DRBG. The entropy provided must be equal to or greater than the security strength of the key being generated. The approved DRBG requests a minimum of 256 bits of entropy per every 384 bits of seed input.
8. The operator can command the module to perform the power-up self-test by cycling power of the module.
9. Power-up self-tests do not require any operator action. © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 23

10. Data output is inhibited during power-up self-tests, zeroization, and error states.
11. Status information does not contain CSPs or sensitive data that if misused could lead to a compromise of the module.
12. There are no restrictions on which keys or CSPs are zeroized by the zeroization service.
13. The module does not support a maintenance interface or role.
14. The module does not have any external input/output devices used for entry/output of data.
15. The module does not enter or output plaintext CSPs.
16. The module does not output intermediate key generation values.
17. Pre-shared keys used for IKE/IPsec must be at least 6 bytes in length, but no more than 255 bytes. Vendor Imposed Security Rules In FIPS-CC mode, the following rules shall apply:
18. The operator should not enable TLSv1.0 or use RSA for key wrapping; it is disabled by default. a. Checked via CLI using “show shared” command
19. The operator should not enable TLSv1.3, it is disabled by default. a. Checked via CLI using “show profiles” command
20. If using RADIUS, it must be configured using TLS. a. Checked via CLI using “show shared” command
21. If using TACACS+, configure the service route via an IPSec tunnel, and ensure the TACACS+ server is configured for a minimum password length of eight (8) characters or greater. a. Checked via CLI using “show deviceconfig” command Failure to follow these Security Rules will cause the module to operate in a non-compliant state. Key to Entity The cryptographic module associates all keys (secret, private, or public) stored within, entered into or output from the module with authenticated operators of the module. Keys stored within the module are only made available to authenticated operators via TLS or SSH. Keys are only input or output from the module by the authenticated operator via a SSH/TLS/IPsec protected communication. Any attempt to intervene in the key to entity relationship would require defeating the module TLS/SSH/IPsec encryption and authentication/integrity mechanism.
22. Mitigation of Other Attacks The module is not designed to mitigate any specific attacks outside the scope of FIPS 140-3. These requirements are not applicable.
23. References [FIPS 140-3] FIPS Publication 140-3 Security Requirements for Cryptographic Modules Palo Alto Networks Administrator’s Guide: https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/10-1/pan-os-admin/pan-os-admin.pdf © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 24

14. Definitions and Acronyms AES

• Advanced Encryption Standard CA
• Certificate Authority CLI
• Command Line Interface CO
• Crypto-Officer CSP
• Critical Security Parameter CVL
• Component Validation List DB9
• D-sub series, E size, 9 pins DES
• Data Encryption Standard DH
• Diffie-Hellman DRBG
• Deterministic Random Bit Generator EDC
• Error Detection Code ECDH
• Elliptical Curve Diffie-Hellman ECDSA
• Elliptical Curve Digital Signature Algorithm FIPS
• Federal Information Processing Standard HMAC
• (Keyed) Hashed Message Authentication Code KDF
• Key Derivation Function LED
• Light Emitting Diode RJ45
• Networking Connector RNG –Random number generator RSA
• Algorithm developed by Rivest, Shamir and Adleman SHA
• Secure Hash Algorithm SNMP
• Simple Network Management Protocol SSH
• Secure Shell TLS
• Transport Layer Security USB
• Universal Serial Bus VGA
• Video Graphics Array © 2024 Palo Alto Networks, Inc. PAN-OS 10.1 VM-Series Security Policy 25