Palo Alto Networks Core Crypto Module

Certificate

Approved Algorithms (55)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Palo Alto Networks Core Crypto Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Status Output<br/>Self-test<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C3,C5,C6 clue;
  class I3,I5,I6 infer;
  class R3,R5,R6 risk;
  class E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Palo Alto Networks Core Crypto Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Status Output<br/>Self-test<br/>Show Status</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C3,C5,C6 clueLow;

Security Policy, page by page

Palo Alto Networks Core Crypto Module Version: 1.7 Revision Date: July 23, 2025 Palo Alto Networks, Inc.​ www.paloaltonetworks.com​ © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies. ​

The table below provides the security levels of the various sections of FIPS 140-3 in relation to the Palo Alto Networks Core Crypto Module (hereafter referred to as the Module). Table 1 - Security Levels The Palo Alto Networks Core Crypto Module is a software cryptographic module that can run on various environments. The module is designed to run on various hardware devices (multi-chip standalone embodiment) and contains a cryptographic boundary. The cryptographic boundary includes all of the logical software components of the module. The physical perimeter is defined by the enclosure around the hardware on which it runs. See below for more details regarding the platforms. Once initialized, the module provides only an Approved mode of operation that only includes Approved algorithms and key sizes. There is no mechanism to enable non-Approved algorithms or functions. The module is built into PAN-OS/Panorama/WildFire 10.2,11.0, 11.1 and 11.2. It is delivered with the respective Device OS. There is no standalone delivery of the module as a software library. The vendor’s internal development process guarantees that the correct version of the module goes with its intended OS. The Module’s software version for this validation is 1.0 or 1.1 (see note under table 2) and is defined as a software cryptographic module

• the cryptographic boundary (CB) includes all of the software components of the module. The physical perimeter (PP) is defined by the enclosure around the host hardware platform. The module includes the following files that compose the module:
• ​ libssl.so.1.1 and libcrypto.so.1.1, libssl_dpt13.so.1.1 and libcrypto_dpt13.so.1.1, fips_selftest, fips_selftest_dp bg_intg_fips.py, panfastdgst © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 3

Non-Compliant State Failure to follow the directions in the Approved Mode of Operation above and Section 11 will result in the module operating in a non-compliant state. Note: For Operational Environments which use Panorama or WildFire as the Operating System in Table 2, algorithms from A4207 are not supported. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 4

© 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 5

© 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 6

Table 2 - Tested Operational Environments Note: Operational Environments #27-33 and #88 - 91 in Table 2 were tested using software version 1.1 of the module. All other OE’s were tested using version 1.0 of the module. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 7

Table 3 - Vendor Affirmed Operational Environments The cryptographic modules support the following Approved algorithms. Only the algorithms, modes, and key sizes specified in this table are used by the module. The CAVP certificate may contain more tested options than listed in this table. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 8

© 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 9

D.G. D.G. D.G. D.G. (2). © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 10

(2). (2). Table 4 - Approved Algorithms The module does not have any algorithms that fall under:

• ​ Non-Approved Algorithms Allowed in the Approved Mode of Operation
• ​ Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed
• ​ Non-Approved Algorithms Not Allowed in the Approved Mode of Operation
• ​ For TLS, The GCM implementation meets Scenario 1 of IG C.H: it is used in a manner compliant with the ciphersuites from section 3.3.1 of SP 800-52rev2 and in accordance with Section 4 of RFC 5288 for TLS key establishment, and ensures when the nonce_explicit part of the IV exhausts all possible values for a given session key, that a new TLS handshake is initiated per sections 7.4.1.1 and 7.4.1.2 of RFC 5246. During operational testing, the module was tested against an independent version of TLS and found to behave correctly. o​ From this RFC 5288, the GCM cipher suites in use are TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• ​ No parts of the TLS protocol, other than the KDF, have been tested by the CAVP/CMVP. The module is compliant to IG C.F: The module utilizes Approved modulus sizes 2048, 3072, and 4096 bits for RSA signatures. This functionality has been CAVP tested as noted above. The minimum number of Miller Rabin tests for each modulus size is implemented according to Table C.2 of FIPS 186-4. For modulus size 4096, the module implements the largest number of Miller-Rabin tests shown in Table C.2. RSA SigVer is CAVP tested for all three supported modulus sizes as noted above. The module does not perform FIPS © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 11

186-2 SigVer. All supported modulus sizes are CAVP testable and tested as noted above. The module does not implement RSA key transport in the approved mode. In all the above cases, the nonce_explicit is always generated deterministically. AES GCM keys are zeroized when the module is power-cycled. For each new TLS session, a new AES GCM key is established. Figure 1 - Cryptographic Boundary © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 12

Figure 1A - Physical Perimeter © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 13

3. Cryptographic Module Interfaces The module is a software module and does not have any physical ports, but the hardware platform that the module executes on has physical ports. The module does not support a control output interface. Table 5 - Ports and Interfaces © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 14

4. Roles, Services, and Authentication Roles The module implements only one role, which is the Crypto Officer (CO) role. There is no User role supported. The module does not support operator authentication. The CO role is implicitly assumed by the entity accessing services implemented by the module. No further authentication is required. The module does not provide a maintenance role or bypass capability. Services The Approved services supported by the module are noted in the following table: Table 6 - Roles, Service Commands, Input and Output © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 15

The following table defines the relationship between access to SSPs and the different module services. The module performs key generation in accordance with the applicable protocol/algorithm. The resulting generated seed used in the asymmetric key generation is the unmodified output from SP800-90A DRBG. The calling application is responsible for storage of generated keys returned by the module. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 16

C, Table 7 - Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Note: There is no table for non-Approved services as the module only supports Approved services. 5. Software/Firmware Security The module performs the Software Integrity test by using HMAC-SHA-256 (HMAC Cert. #A4206) and ECDSA signature verification (ECDSA Cert. #A4206) during the Pre-Operational Self-Test. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 17

6. Operational Environment The module will operate in a modifiable operational environment per the FIPS 140-3 definition. The operating system shall be restricted to a single operator mode of operation (i.e., concurrent operators are explicitly excluded). The external application that makes calls to the module is the single user of the module, even when the application is serving multiple clients. For a listing of tested environments, see Table 2 and Table 3 above. The module is also available in other environments besides the tested environment if the module’s show status outputs the proper name and version as noted in Section
7. The CMVP allows user porting of a validated software module to an operational environment which was not included as part of the validation testing. An operator may install and run the Palo Alto Networks Crypto Module on any general purpose computer (GPC) or platform using the specified hypervisor and operating system on the validation certificate or other compatible operating and/or hypervisor system and affirm the modules continued FIPS 140-3 validation compliance. The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when ported and executed in an operational environment not listed on the validation certificate.
8. Physical Security There are no applicable FIPS 140-3 physical security requirements as this is a software module.
9. Non-Invasive Security No approved non-invasive attack mitigation test metrics are defined at this time.
10. Sensitive Security Parameters The following table details all the sensitive security parameters utilized by the module. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 18

N/A © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 19

© 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 20

Table 10 - Sensitive Security Parameters Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. Table 11 - Non-Deterministic Random Number Generation Specification Note: These entropy sources are provided by the platforms themselves listed in Table 2 and Table 3, which are external to the module itself. © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 21

The cryptographic module automatically performs the following tests below when the module is loaded (i.e. at power on or reboot). The operator can command the module to perform the pre-operational and cryptographic algorithm self-tests by cycling power of the module; these tests do not require any additional operator action. Table 12 - Pre-Operational Self-Test Table 13 - Conditional Cryptographic Algorithm Self-Tests © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 22

Table 15 - Conditional Critical Function Tests Error Handling In the event of a conditional test failure, the module will output a description of the error. These are summarized below. Table 16 - Errors and Indicators

11. Life-Cycle Assurance The module is provided directly to solution developers, and is not directly available for the general public to download. The Palo Alto Networks Core Crypto Module is not distributed as a standalone library, and can only be used in conjunction with the platforms listed in Table 2 and Table
12. For details regarding secure installation, initialization, startup, and operation of the module, see below. The steps below are required to place the module in a compliant state. Failure to do so will result in the module operating in a non-compliant state. Secure Operation The module is initialized via the following procedure: 1.​ During the initial boot-up, break the boot sequence by entering “maint” to access the main menu a.​ Note: PAN-OS / Panorama / WildFire version 10.2, 11.0, 11.1, or 11.2 is required to access APIs of the module 2.​ Select “Continue” 3.​ Select “Set FIPS-CC Mode” option to enter “FIPS-CC” mode (i.e. Approved mode) 5.​ When prompted, select “Reboot” and the module will re-initialize and continue into “FIPS-CC” mode a.​ The module will perform all necessary self-tests as part of initialization © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 23

6.​ The module will provide a status output indicator via the PAN-OS/Panorama/WildFire API that queries the module, and provide the following: a.​ “FIPS-CC Failure”: In event of an initialization failure, the module will provide this output b.​ “FIPS-CC mode enabled successfully”: Module provides this output if initialization is successful The module’s show status can be seen by initiating the following command, which provides the name of the module and version:

• ​ Enter “debug system crypto-module-version” ○​ The module will output the name and version (example):
• ​ Palo Alto Networks Core Crypto Module
• ​ Version 1.0 End of Life / Sanitization Cryptographic Officers should follow the procedure below for secure destruction of the module. Note: PAN-OS/Panorama/WildFire 10.2, 11.0, 11.1, or 11.2 is required to access the APIs of the module. 1.​ Command the module to enter maintenance-mode (Note: This is not the FIPS 140-3 maintenance mode) 2.​ Once reboot is complete, select “Continue” and select “Factory Reset” 3.​ The module will perform the zeroization procedure and provide the following output once complete: a.​ “Factory Reset Status: Success” 12. Mitigation of Other Attacks The module is not designed to mitigate any specific attacks outside the scope of FIPS 140-3. These requirements are not applicable. Appendix A - References [FIPS 140-3] FIPS Publication 140-3 Security Requirements for Cryptographic Modules © 2025 Palo Alto Networks, Inc. Palo Alto Networks Core Crypto Module Security Policy 24