AMD ASP Cryptographic CoProcessor ("Phoenix")

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for AMD ASP Cryptographic CoProcessor ("Phoenix")
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Status Output<br/>Show Status</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3 clue;
  class I2,I3 infer;
  class R2,R3 risk;
  class E2,E3 evidence;

flowchart LR
  %% Deterministic clue tier for AMD ASP Cryptographic CoProcessor ("Phoenix")
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Status Output<br/>Show Status</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3 clueLow;

Security Policy, page by page

Advanced Micro Devices (AMD) AMD ASP Cryptographic CoProcessor ("Phoenix") Prepared for: Advanced Micro Devices (AMD)

Santa Clara, CA 95054 www.amd.com Prepared by: atsec information security corporation

4516 Seton Center Parkway, Suite 250

Austin, TX 78759 © 2024 Advanced Micro Devices (AMD), atsec information security.

© 2024 Advanced Micro Devices (AMD), atsec information security.

This section is informative to the reader to reference cryptographic services and other services of AMD Ryzen PRO 7000 Series ASP Cryptographic CoProcessor (the “module”) from Advanced Micro Devices (AMD) (the “vendor”). Only the components listed in Section 2.1 are subject to the FIPS 140-3 validation. The CMVP (Cryptographic Module Validation Program) makes no statement as to the correct operation of the module or the security strengths of the generated keys (when supported) if the specific operational environment is not listed on the validation certificate. was further consolidated into this document by atsec information security together with other vendor-supplied documentation. In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

1 1

2 1

3 1

4 1

5 1

6 1

7 1

8 N/A

9 1

Purpose and Use: The AMD Ryzen PRO 7000 Series ASP Cryptographic CoProcessor (hereafter referred to as “the module”) supports the Ryzen PRO 7000 Series SoC (System on a Chip) by providing digital signature verification of the key database during secure boot procedures. © 2024 Advanced Micro Devices (AMD), atsec information security.

Module Type: Firmware-hybrid Module Embodiment: SingleChip Module Characteristics: Cryptographic Boundary: The cryptographic boundary of the module is defined as the fips_module binary, which performs self-tests, provides the service indicator, and shows status service, as well as the hardware implementations of RSA and SHA2-384 in the CCP, which are used to perform signature verification and verify the integrity of the fips_module binary. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the Ryzen PRO 7000 Series SoC in which the module operates. Figure 1: The AMD Ryzen PRO 7000 Series SoC, representing all versions of the tested platforms. © 2024 Advanced Micro Devices (AMD), atsec information security.

Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: Table 3: Tested Module Identification
• Hybrid Disjoint Hardware © 2024 Advanced Micro Devices (AMD), atsec information security.

Tested Operational Environments - Software, Firmware, Hybrid: Table 4: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module.

There are no components within the cryptographic boundary that are excluded from the FIPS 140-3 security requirements.

Modes List and Description: Table 5: Modes List and Description The module implements only one mode of operation, the approved mode, in which the approved services are available. No configuration is necessary for the module to operate and remain in the After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode.

Approved Algorithms: Table 6: Approved Algorithms © 2024 Advanced Micro Devices (AMD), atsec information security.

Vendor-Affirmed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: N/A for this module.

Table 7: Security Function Implementations

There is no algorithm specific information.

N/A for this module. N/A for this module.

The module does not implement any key generation methods.

The module does not implement any automated key establishment methods. © 2024 Advanced Micro Devices (AMD), atsec information security.

The module does not implement any industry protocols.

Table 8: Ports and Interfaces The logical interfaces are logically separated from each other by the API design. The power interface is physically separated from any other interface.

Table 9: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module. No support is provided for multiple concurrent operators.

© 2024 Advanced Micro Devices (AMD), atsec information security.

Table 10: Approved Services The approved service indicator can be retrieved using Microsoft HSTI and through the UEFI interactive shell tool. As the module only offers approved services, the indicator is always set when the module is operational. This is shown by the “FIPS mode: 1” output.

The module does not load external software or firmware.

The integrity of the firmware component of the module (“fips_module.bin”) is verified by comparing a SHA2-384 digest value calculated at run time with the SHA2-384 digest value stored in the module that was computed at build time. The integrity test is performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity tests can be invoked on demand by powering off and subsequently re-initializing the module or SoC, which will perform (among others) the firmware integrity test. © 2024 Advanced Micro Devices (AMD), atsec information security.

Type of Operational Environment: Non-Modifiable How Requirements are Satisfied: The operational environment provides context separation for the memory and registers utilized by the module. When these components are used by the module, no other process or subcomponent can access the information concurrently.

No configuration of the operational environment is required for the module to operate in an approved mode. Therefore, there are no rules, settings, or restrictions to the configuration of the operational environment.

The embodiment of the module is a single chip consisting of production-grade components. The coating is a standard sealing coat applied over the single chip. The module provides no additional physical security techniques. No actions are required to maintain the physical security of the

This module does not implement any non-invasive security mechanism and therefore this section is not applicable.

Table 11: Storage Areas SSPs are provided to the module by the calling process and are destroyed when released by the respective functions. © 2024 Advanced Micro Devices (AMD), atsec information security.

Table 12: SSP Input-Output Methods

Table 13: SSP Zeroization Methods All data output is inhibited during zeroization. Table 14: SSP Table 1 Table 15: SSP Table 2

The RSA algorithm as implemented by the module conforms to FIPS 186-4, which has been superseded by FIPS 186-5. FIPS 186-4 was withdrawn on February 3, 2024. © 2024 Advanced Micro Devices (AMD), atsec information security.

Table 16: Pre-Operational Self-Tests powered on before the module transitions into the operational state. While the module is executing the self-test, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-test passed successfully.

Table 17: Conditional Self-Tests The module performs self-tests on all approved cryptographic algorithms as part of the approved services supported in the approved mode of operation, using the tests shown in the table above. These self-tests are performed automatically before the firmware integrity test. Services are not available, and data output (via the data output interface) is inhibited during the self-tests. If any of these tests fails, the module transitions to the error state.

Table 18: Pre-Operational Periodic Information © 2024 Advanced Micro Devices (AMD), atsec information security.

Table 19: Conditional Periodic Information The module does not implement any periodic self-tests.

Table 20: Error States In the error state, the output interface is inhibited, and the module accepts no more inputs or requests (as the module is no longer running). The error code is output through the FW status register, which explains the error that has occurred.

All self-tests can be invoked on demand by unloading and subsequently re-initializing the module.

The procedures herein described are directed at OEMs for producing and configuring their BIOS so that the FIPS module is properly enabled to operate as the validated module in conformance with the rules in this Security Policy document. Once properly installed and enabled, no configuration is necessary for the module to operate and remain in the approved mode, as it is the only mode of operation of the module. To enable the FIPS capability 1. Reserve 16KiB at least for AMD Secure Processor level 1 directory, as the FIPS module requires additional 8KiB of ROM space for the AMD Secure Processor L1 Bootloader. © 2024 Advanced Micro Devices (AMD), atsec information security.

2. The Platform BIOS must include the file with “_FIPS” postfix in the file name as AMD Secure Processor entry 0x1. For example, the file PspBootLoader_stage1_prod_AB_RN_FIPS.sbin has “_FIPS” postfix in the file name. This file is thus a FIPS capable AMD Secure Processor boot loader. Conversely, the file PspBootLoader_stage1_prod_AB_RN.sbin does not have “_FIPS” postfix in the file name, making this file a non-FIPS capable AMD Secure Processor boot loader.
3. Set BIT 32 of AMD Secure Processor soft fuse chain (AMD Secure Processor entry 0xB) to enable FIPS capability. a. The BIT32 in AMD Secure Processor entry 0xB is defined as FIPS capability enablement. If 0, the FIPS capability is OFF; if 1, the FIPS capability is ON (i.e., the module is properly installed as the validated module described in this document). To verify whether FIPS capability is on
4. Boot the system into UEFI shell with secure boot disabled.
5. Use the UEFI shell version of the AFF Tool version 0.3 and beyond. This tool is provided by the vendor. Run the AFF Tool with the command: afftool --fips from the interactive UEFI shell provided by the BIOS. a. If it shows “FIPS mode: on”, this is the FIPS capable module installed. b. If it shows “FIPS mode: off”, the module (described in this document) is not installed. The screenshot in Figure 3 shows the usage of the AFF Tool. The output indicates that the FIPS module is not installed. In this condition, the module does not operate in conformance with this Security Policy document. Figure 3: AFF Tool indicates that the module is not installed. The screenshot in Figure 4 again shows the usage of the AFF Tool. The output demonstrates that the FIPS module is installed and thus will operate as the FIPS validated module according to the rules in this Security Policy document. © 2024 Advanced Micro Devices (AMD), atsec information security.

Figure 4: AFF Tool indicating that the module is installed.

All the functions, ports and logical interfaces described in this document are available to the Crypto Officer. The module only provides approved functions, and as such there are no special procedures to administer the approved mode of operation.

The module implements only the Crypto Officer. There are no requirements for non-administrator operators.

The bootloader (which acts as the operator of the module) initializes the fips_module.bin component by loading it into memory upon power-on. After the pre-operational self-tests are successfully concluded, the module automatically transitions to the operational state. In the operational state, the module automatically performs the signature verification of the key database using the RSA signature verification service, which is the sole service provided by the module. The key database, RSA public key, and signature are provided as input by the operator of the module (the bootloader). After the successful signature verification of the key database, the module unloads itself from memory, ceasing its operation. All the procedures described above are conducted without any human assistance. To perform the procedures again, the module must be reset, which will trigger a new boot.

There are no maintenance requirements. © 2024 Advanced Micro Devices (AMD), atsec information security.

The process for performing “End of Life” occurs at the chronological point of 10 years starting from manufacturing date of the module. As stated previously, the module does not possess persistent storage of SSPs. The SSP values only exists in volatile memory and those values vanish when the module is powered off. The procedure for secure sanitization of the module at the end of life is simply to power it off, which is the action of zeroization of the SSPs. As a result of this sanitization via power-off, the SSPs are removed from the module, so that the module may either be distributed to other operators or disposed.

The module does not offer mitigation of other attacks and therefore this section is not applicable. © 2024 Advanced Micro Devices (AMD), atsec information security.