Palo Alto Networks SD-WAN ION Core Crypto Module

Certificate

Approved Algorithms (39)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Palo Alto Networks SD-WAN ION Core Crypto Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Self-Test<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Palo Alto Networks SD-WAN ION Core Crypto Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Self-Test<br/>Show Status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

Palo Alto Networks SD-WAN ION Core Crypto Module Software Version: 1.0 Documentation Version: 1.3 Last Update: June 11, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies. Revision Date: June 11, 2024 Document Version: 1.3

The table below provides the security levels of the various sections of FIPS 140-3 in relation to the Palo Alto Networks SD-WAN ION Core Crypto Module with software version 1.0, hereinafter referred to as the Module. The Palo Alto Networks SD-WAN ION Core Crypto Module is utilized in hardware and software ION form factors. These enable the integration of a diverse set of wide area network (WAN) connection types, improve application performance and visibility, enhance security and compliance, and reduce the overall cost and complexity of a WAN. The Module contains the following libraries:

• Palo Alto Networks SD-WAN Instant-On Network (ION) Crypto Library - I Palo Alto Networks SD-WAN Instant-On Network (ION) Crypto Library - II [Number Below] Table 1
• Security Levels N/A N/A N/A The module is designed to meet an overall security level of 1. The module is a software module running on a multi-chip standalone general-purpose computing platform. FIPS 140-3 conformance testing was performed at Security Level 1 with the following configurations noted in the table 2 below. # © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 3

Table 2

• Tested Operational Environments # Table 3
• Vendor Affirmed Operational Environments The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when ported to an operational environment which is not listed on the validation certificate. Modes of Operation The module has one approved mode of operation and is always in approved mode of operation after initial operations are performed (See Section 11). The module does not claim implementation of a degraded mode of operation. Section 4 provides details on the service indicator implemented by the module. The tables below list all Approved or Vendor-affirmed security functions of the module, including specific key size(s) (in bits unless noted otherwise) employed for Approved services, and implemented modes of operation. There are some algorithm modes that were tested but not implemented by the module. Only the algorithms, modes, and key sizes that are implemented by the module are shown in these tables. N/A N/A

© 2024 Palo Alto Networks, Inc. Module

N/A N/A N/A N/A N/A © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 5

N/A N/A N/A Table 4

• Approved Algorithms (Crypto Library
• I) N/A N/A

© 2024 Palo Alto Networks, Inc.

N/A N/A N/A Table 5

• Approved Algorithms (Crypto Library
• II) Notes:
• The module’s AES-GCM implementation conforms to FIPS 140-3 IG C.H scenario #1 following RFC 5288 for TLS. The module is compatible with TLSv1.2 and provides support for the acceptable GCM cipher suites from SP 80052 Rev1, Section 3.3.1. The operations of one of the two parties involved in the TLS key establishment scheme were performed entirely within the cryptographic boundary of the module being validated. The counter portion of the IV is set by the module within its cryptographic boundary. When the IV exhausts the maximum number of possible values for a given session key, the first party, client or server, to encounter this condition will trigger a handshake to establish a new encryption key. In case the module’s power is lost and then restored, a new key for use with the AES GCM encryption/decryption shall be established.
• No parts of the SSH, TLS, SNMP and IPSec/IKE protocols, other than the KDFs, have been tested by the CAVP and CMVP. Table 6 - Entropy Certificates Notes:
• ESV Cert. #E68 is for the module running on tested platform ION-1200, ION 1200-C-NA, ION 1200-C-ROW, ION 1200-C-5G-WW, ION 1200-S, ION 1200-S-C-NA, ION 1200-S-C-ROW, ION 1200-S-C-5G-WW and ION 3200 ESV Cert. #E71 is for the module running on tested platform ION 5200 and ION 9200 Palo Alto Networks SD-WAN ION Core Crypto Module 7

As the module can only be operated in the Approved mode of operation with algorithms listed in Tables 4 - 5, the following options defined in SP 800-140B are not applicable for this document: ● ● ● Non-Approved Algorithms Allowed in Approved Mode of Operation Non-Approved Algorithms Allowed in Approved Mode of Operation with No Security Claimed Non-Approved Algorithms Not Allowed in Approved Mode of Operation Cryptographic Boundary Figure 1 below depicts the cryptographic boundary (yellow area with the blue dashed lines) and the physical perimeter (red dashed line). The cryptographic boundary includes all of the software components of the cryptographic libraries. The physical perimeter is the Tested Operational Environment’s Physical Perimeter (TOEPP) on which the module runs. Figure 1– Cryptographic Boundary

3. Cryptographic Module Interfaces The module’s physical perimeter encompasses the case of the tested platform mentioned in Table
4. The module provides its logical interfaces via Application Programming Interface (API) calls. The logical interfaces provided by the module are mapped onto the FIPS 140-3 interfaces (data input, data output, control input, control output and status output) as follows. N/A N/A N/A N/A N/A N/A Table 7 – Ports and Interfaces

© 2024 Palo Alto Networks, Inc. Module

4. Roles, Services, and Authentication The module supports role-based authentication, and provides a Crypto Officer role. The Crypto Officer role has the ability to perform all tasks and administrative actions. N/A N/A Z N/A N/A N/A N/A N/A N/A G/R/W/E G/R/W/E © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 9

© 2024 Palo Alto Networks, Inc. Module

G/R/W/E G/R/W/E G/R/W/E Table 9

• Approved Services © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 11

G = Generate: The module generates or derives the SSP. W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Unauthenticated Services Unauthenticated Users can run the self-test service by power-cycling the tested platform.

5. Software/Firmware Security Integrity Techniques The module performs the Software Integrity test by using HMAC-SHA2-256 (HMAC Cert. #A3566) during the PreOperational Self-Test. A Software Integrity Test Key (non-SSP) was preloaded to the module’s binary at the factory and used for firmware integrity test only at the pre-operational self-test. At Module’s initialization, the integrity of the runtime executable is verified using an HMAC-SHA2-256 digest which is compared to a value computed at build time. If at the load time the MAC does not match the stored, known MAC value, the module would enter an Error state with all crypto functionality inhibited. Integrity Test On-Demand Integrity test is performed as part of the Pre-operational self-tests. It is automatically executed at power-on. The operator can power-cycle or reboot the module to initiate the software integrity test on-demand. This automatically performs the integrity test of all firmware components included within the boundary of the module.
6. Operational Environment The module is a modifiable operational environment as per FIPS 140-3 Level 1 specifications. The operating system is restricted to a single operator mode of operation. The application that makes calls to the module is the single user of the module even when the application is serving multiple clients. See Table 2 for details regarding what platforms the module was tested on.
7. Physical Security As the module is a software only module, the physical security requirements are not applicable.
8. Non-Invasive Security No approved non-invasive attack mitigation test metrics are defined at this time.
9. Sensitive Security Parameters Establishment N/A N/A

© 2024 Palo Alto Networks, Inc.

Establishment (Curves: P256, Curves: P256, N/A (Curves: P256, (Curves: P256, N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 13

© 2024 Palo Alto Networks, Inc.

(Curves: P256, (Curves: P256, (Curves: P256, (Curves: P256, (Curves: P256, N/A Establishment (Curves: P256, N/A N/A N/A N/A N/A N/A N/A Table 10– SSPs Table 11 - Non-Deterministic Random Number Generation Specification Palo Alto Networks SD-WAN ION Core Crypto Module 15

The modules perform the following self-tests, including the pre-operational self-tests and Conditional self-tests. Pre-Operational Self-Tests Table 12 - Pre-Operational Self-Tests The modules also perform the following Cryptographic Algorithm Self-Tests (CASTs), which can be initiated by rebooting the module. All self-tests run without operator intervention. Table 13

• CASTs (Crypto Library I)

© 2024 Palo Alto Networks, Inc. Module

Table 14

• CASTs (Crypto Library II) 4.5. Conditional Pair-Wise Consistency Tests Table 16 - Conditional Pair-Wise Consistency Tests (Crypto Library I) Table 17 - Conditional Pair-Wise Consistency Tests (Crypto Library II) Periodic/On-Demand Self-Test The module performs on-demand self-tests initiated by the operator, by power cycling or rebooting the tested platform. The full suite of self-tests is then executed. The same procedure may be employed by the operator to perform periodic It is recommended that the Crypto Officer perform periodic testing of the module’s on-demand self-tests every 60 days to ensure all components are functioning correctly. Error Handling If any of the above-mentioned self-tests fail, the module reports the cause of the error and enters an error state (there is only one error state). In the Error State, no cryptographic services are provided, and data output is prohibited. The only method to recover from the error state is to reboot the module and perform the self-tests, including the pre-operational software integrity test and the conditional CASTs. The module will only enter into the operational state after successfully © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 17

passing the pre-operational firmware integrity test and the conditional CASTs. The table 18 below shows the different causes that lead to the Error State and the status indicators reported. Table 18 - Error State Indicators

11. Life-Cycle Assurance The sections below highlight the details for each stage. Secure Delivery Procedures The module is built into ION 6.1. There is no standalone delivery of the module as a software library. The vendor’s internal development process guarantees that the correct version of the module goes with the intended OS. Secure Operation The module meets all the Level 1 requirements for FIPS 140-3. Follow the secure operations provided below to place the module in the Approved mode. The software version is 1.0. The module is initiated into the Approved mode of operation via the following procedure. Note that a Palo Alto ION device running ION 6.1 is needed to access the APIs of the module.
12. Prepare ION device for use and power-on
13. Using the Controller, navigate to the device that is to be initiated
14. Select “FIPS” a. Click “proceed” to begin initialization procedure
15. The module will begin initialization that includes the following: a. Zeroization of any sensitive information or data b. Power cycle of the device followed by running all self-tests
16. Once initialization is complete, the module provides the following status output: a. Device Mode: “fips” b. Once the module has completed initialization into the Approved mode of operation, any non-Approved configurations/algorithms are rejected automatically by the module and an error message is output. End of Life / Sanitization End of life dates for the module are announced publicly via Palo Alto Networks’ services website. Crypto Officers should follow the procedure below for the secure destruction of their module: Note: This process will cause the module to no longer function after it has wiped all configurations and keys.

© 2024 Palo Alto Networks, Inc. Module

1. Access the module as Crypto Officer
2. Execute command: “disable system” a. Confirm command
3. Module will begin zeroization process and wipe all security parameters and configurations
4. Mitigation of Other Attacks This module is not designed to mitigate against any other attacks outside of the FIPS 140-3 scope. © 2024 Palo Alto Networks, Inc. Palo Alto Networks SD-WAN ION Core Crypto Module 19

Referenced URLs

• www.paloaltonetworks.com
• https://www.paloaltonetworks.com/company/trademarks.html