| Standard | FIPS 140-3 |
|---|---|
| Overall level | 2 |
| Module type | Hardware |
| Embodiment | Multi-Chip Stand Alone |
| Status | Historical |
| Caveat | Interim Validation. When operated in approved mode and when installed, initialized and configured as specified in Section 11 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy |
| Vendor | Palo Alto Networks, Inc. |
| Algorithm | ACVP Cert |
|---|---|
| AES-CBC | A2906 |
| AES-CFB128 | A2906 |
| AES-CTR | A2906 |
| AES-GCM | A2906 |
| Conditioning Component AES-CBC-MAC SP800-90B | A2165 |
| Conditioning Component AES-CBC-MAC SP800-90B | A2518 |
| Counter DRBG | A2906 |
| ECDSA KeyGen (FIPS186-4) | A2906 |
| ECDSA KeyVer (FIPS186-4) | A2906 |
| ECDSA SigGen (FIPS186-4) | A2906 |
| ECDSA SigVer (FIPS186-4) | A2906 |
| HMAC-SHA-1 | A2906 |
| HMAC-SHA2-224 | A2906 |
| HMAC-SHA2-256 | A2906 |
| HMAC-SHA2-384 | A2906 |
| HMAC-SHA2-512 | A2906 |
| KAS-ECC-SSC Sp800-56Ar3 | A2906 |
| KAS-FFC-SSC Sp800-56Ar3 | A2906 |
| KDF SNMP | A2906 |
| KDF SSH | A2906 |
| KDF TLS | A2906 |
| RSA KeyGen (FIPS186-4) | A2906 |
| RSA SigGen (FIPS186-4) | A2906 |
| RSA SigVer (FIPS186-4) | A2906 |
| Safe Primes Key Generation | A2906 |
| Safe Primes Key Verification | A2906 |
| SHA-1 | A2906 |
| SHA2-224 | A2906 |
| SHA2-256 | A2906 |
| SHA2-384 | A2906 |
| SHA2-512 | A2906 |
flowchart LR
%% Deterministic review-risk graph for Panorama 10.2 M-200, M-300, M-600 and M-700
%% Review prompts and evidence gaps, NOT vulnerability findings.
subgraph CMVP["CMVP-disclosed clues"]
C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update<br/>Firmware Load</i>"]
C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>application</i>"]
end
subgraph Inference["Derived inference"]
I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
end
subgraph Risk["Reviewer question"]
R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
end
subgraph Evidence["Evidence needed to close"]
E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
end
C2 --> I2 --> R2 --> E2
C3 --> I3 --> R3 --> E3
C5 --> I5 --> R5 --> E5
C6 --> I6 --> R6 --> E6
classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
class C2,C3,C5,C6 clue;
class I2,I3,I5,I6 infer;
class R2,R3,R5,R6 risk;
class E2,E3,E5,E6 evidence;flowchart LR
%% Deterministic clue tier for Panorama 10.2 M-200, M-300, M-600 and M-700
%% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
subgraph CMVP["CMVP-disclosed clues (deterministic)"]
C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update<br/>Firmware Load</i><br/>src: text:keyword"]
C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>application</i><br/>src: text:keyword"]
end
classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
class C2,C3,C5,C6 clueLow;Panorama 10.2 M-200, M-300, M-600 and M-700 Version: 1.1 Revision Date: August 1, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
| # | Section | Page |
|---|
1. General The Panorama 10.2 M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as “Panorama M-Series”, “Panorama HW”, “modules”, or the “cryptographic modules” are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall. The Panorama M-Series management appliances’ individual management and logging components can be separated in a distributed manner to accommodate large volumes of log data. Panorama M-Series management appliances can be deployed in the following ways:
The cryptographic module meets the overall requirements applicable to Level 2 security of FIPS 140-3. Table 1 - Security Levels ISO/IEC 24759 FIPS 140-3 Section Title Security Section 6. Level
Overall Level 2 © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 4
Convert the M-600/M-700 appliance from PAN-DB mode to the Panorama Manager mode:
[SP 800-38D] Decryption Counter DRBG A2906 Counter DRBG AES 256 bits with Derivation Function Enabled Random Bit Generator [SP 800-90Arev1] ECDSA KeyGen Key Generation A2906 ECDSA KeyGen P-256, P-384, P-521 (FIPS 186-4) ECDSA KeyVer (FIPS Public Key Validation A2906 ECDSA KeyVer P-256, P-384, P-521 186-4) ECDSA SigGen P-256, P-384, P-521 with SHA2-224, SHA2-256, Signature Generation A2906 ECDSA SigGen (FIPS 186-4) SHA2-384, and SHA2-512 ECDSA SigVer (FIPS P-256, P-384, P-521 with SHA-1, SHA2-224, A2906 ECDSA SigVer Signature Verification 186-4) SHA2-256, SHA2-384, and SHA2-512 A2906 HMAC-SHA-1 [FIPS HMAC HMAC-SHA-1 with λ=96, 160 Authentication for protocols 198-1] A2906 HMAC-SHA2-224 HMAC-SHA2-224 with λ=224 HMAC Authentication for protocols [FIPS 198-1] A2906 HMAC-SHA2-256 HMAC HMAC-SHA2-256 with λ=256 Authentication for protocols [FIPS 198-1] A2906 HMAC-SHA2-384 HMAC HMAC-SHA2-384 with λ=384 Authentication for protocols [FIPS 198-1] A2906 HMAC-SHA2-512 HMAC HMAC-SHA2-512 with λ=512 Authentication for protocols [FIPS 198-1] KAS-ECC-SSC KAS Ephemeral Unified Model: P-256/P-384/P-521 A2906 Key Exchange Sp800-56Ar3 KAS-FFC-SSC SP A2906 KAS dhEphem: MODP-2048 Key Exchange 800-56Ar3 Engine ID: KDF SNMP [SP A2906 SNMPv3 KDF 80001F88043030303030 SNMPv3 800-135rev1] (CVL) 343935323630 KDF SSH [SP SHA-1, SHA2-256, A2906 SSHv2 KDF SSH 800-135rev1] (CVL) SHA2-512 KDF TLS [SP TLS1.2 KDF A2906 TLS v1.2 Hash Algorithm: SHA2-256, SHA2-384 TLS 800-135rev1] (CVL) RSA KeyGen RSA KeyGen Key Pair Generation SA2906 2048, 3072, and 4096 bits (FIPS 186-4) (FIPS 186-4) (ANSI X9.31, RSASSA-PKCS1_v1-5, RSA SigGen RSA SigGen Signature Generation A2906 RSASSA-PSS): 2048, 3072, and 4096-bit with (FIPS 186-4) (FIPS 186-4) hashes 256/384/512S (ANSI X9.31, RSASSA-PKCS1_v1-5, RSASSA-PSS): 2048, 3072, 4096-bit (per IG C.F) with hashes SHA-1/224+++/256/384/512 RSA SigVer RSA SigVer A2906 (Signature Verification) Signature Verification (FIPS 186-4) (FIPS 186-4) +++ This Hash algorithm is not supported for ANSI X9.31 Digital Signature Generation/Verification SHA-1 A2906 SHA-1 [FIPS 180-4] SHA Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-224 [FIPS A2906 SHA2 SHA-224 180-4] Non-Digital Signature Applications (e.g. component of HMAC) SHA2-256 [FIPS Digital Signature A2906 SHA2 SHA-256 180-4] Generation/Verification © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 8
Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-384 [FIPS A2906 SHA2 SHA-384 180-4] Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-512 [FIPS A2906 SHA2 SHA-512 180-4] Non-Digital Signature Applications (e.g. component of HMAC) Safe Primes Key Safe Primes Key A2906 Generation [RFC MODP-2048 Safe Primes Key Generation Generation 3526] Safe Primes Key Safe Primes Key A2906 Verification [RFC MODP-2048 Safe Primes Key Verification Verification 3526] SP 800-38A, FIPS AES Cert. # 198-1, and SP A2906 and KTS 800-38F. KTS (key 128, 192, and 256-bit keys providing 128, 192, or HMAC Key Wrapping [SP 800-38F] wrapping and 256 bits of encryption strength Cert. # unwrapping) per IG A2906 D.G. SP 800-38D and SP AES-GCM 800-38F. KTS (key KTS 128 and 256-bit keys providing 128 or 256 bits Cert. # wrapping and Key Wrapping [SP 800-38F] of encryption strength A2906 unwrapping) per IG D.G. ESV Cert. SP 800-90B ESV Palo Alto Networks DRNG Entropy Source Entropy #E64 ESV Cert. SP 800-90B ESV Palo Alto Networks DRNG Entropy Source Entropy #E65 ESV Cert. SP 800-90B ESV Palo Alto Networks DRNG Entropy Source Entropy #E66 KAS-ECC-S SC Cert. SP 800-56Arev3. #A2906, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF KDF SSH 800-56Arev3] 192, or 256 bits of encryption strength Scenario 2 path (2). Cert. #A2906 KAS-ECC-S SC Cert. SP 800-56Arev3. #A2906, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF KDF TLS 800-56Arev3] 192, or 256 bits of encryption strength Scenario 2 path (2). Cert. #A2906 KAS-FFC-S SC Cert. SP 800-56Arev3. #A2906, KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF KDF SSH 800-56Arev3] strength Scenario 2 path (2). Cert. #A2906 KAS-FFC-S SP 800-56Arev3. SC Cert. KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF #A2906, 800-56Arev3] strength Scenario 2 path (2). KDF TLS © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 9
Cert. #A2906 Key Generation Cryptographic Key Vendor CKG Section 5.1, Section Note: Seeds used for asymmetric key Generation; SP 800Affirmed (SP 800-133rev2) 5.2 pair generation are produced using the
unmodified/direct output of the DRBG The module is compliant to IG C.H: GCM is used in the context of TLS and SSH:
Table 4 - Supported Protocols in the Approved Mode TLSv1.2 SSHv2 SNMPv3 *Note: these protocols were not reviewed or tested by the CMVP or CAVP. Module Diagrams Figures 1 - 8 depict the modules and their interfaces. Please refer to the appendices for depictions of the modules with the physical kits installed. Figure 1 - M-200 Front Figure 2 - M-200 Rear Figure 3 - M-300 Front Figure 4 - M-300 Rear Figure 5 - M-600 Front © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 11
Figure 6 - M-600 Rear Figure 7 - M-700 Front Figure 8 - M-700 Rear 3. Cryptographic Module Interfaces The modules are multi-chip standalone modules with ports and interfaces as shown below. The modules do not implement a control output interface. Table 5 - Ports and Interfaces Physical Interface Logical Interface Data that passes over port/interface LED Status output Module status via LED indicators Power Power N/A RJ45 Console Status output Self-test output © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 12
RJ45 Ethernet Data input, control input, control output, TLS, SSH data output, status output SFP+ Data input, control input, data output, TLS (M-600, M-700) status output 4. Roles, Services, and Authentication Assumption of Roles The module supports distinct operator roles. The cryptographic module in Panorama mode, Management-Only mode, or PAN-DB mode enforces the separation of roles using unique authentication credentials associated with operator accounts. The Log Collector mode only supports one role, the Crypto-Officer (CO) role. The module supports concurrent operators. The module does not provide a maintenance role or bypass capability. Table 6
Panorama Certificate Configuring and managing Confirmation of service via CO Management certificates via CLI or WebUI Configuration Logs Panorama Log Setting Configuring and managing log Confirmation of service via CO settings via CLI or WebUI Configuration Logs Panorama Server Profiles Configuring and managing Confirmation of service via CO Server configurations (e.g. Configuration Logs SNMP, etc.) via CLI or WebUI Setup Managed Devices and Configuring and managing Confirmation of service via Deployment Managed Devices configurations Configuration Logs CO (e.g., Versions, Licenses, etc.) via CLI or WebUI Configure Managed Log Configuring and managing Confirmation of service via CO Collectors Managed Log Collectors Configuration Logs configurations via CLI or WebUI CO, Zeroize Zeroize from CLI Zeroization Indicator Unauthentica ted CO, User, Self-Test Run self-test via CLI or WebUI Output results via System Logs Unauthentica ted Show Status Show status via CLI or WebUI FIPS-CC Mode Indicator CO, User System Audit View system audit records via Audit records via System Logs CO, User CLI or WebUI Monitor System Status and Logs View system status records via System status via System Logs CO, User CLI or WebUI Panorama Log Collector Setup Configuring and managing Log Confirmation of service via CO Collectors configurations via CLI Configuration Logs Panorama Pan-DB Setup Configuring and managing Confirmation of service via CO Pan-DB URL configurations via Configuration Logs CLI Manage Pan-DB Administrative Configuring and managing Confirmation of service via CO Access Administrator password via CLI Configuration Logs Table 7 - Roles and Authentication Role Authentication Method Authentication Strength CO Memorized Secret (Unique Password-based Username/password) and/or Minimum length is eight1 (8) characters (95 possible characters). Single-Factor Cryptographic The probability that a random attempt will succeed or a false Software (certificate common acceptance will occur is 1/(958) which is less than 1/1,000,000. name / public key-based The probability of successfully authenticating to the module authentication) within one minute is 10/(958), which is less than 1/100,000. The module’s configuration supports at most ten failed attempts to authenticate in a one-minute period. In FIPS-CC Mode, the module checks and enforces the minimum password length of eight (8) as specified in SP 800-63B. Passwords are securely stored hashed with salt value, with very restricted access control, and rate limiting mechanism for authentication attempts. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 14
Certificate/Public key-based The security modules support public-key based authentication using RSA 2048 and certificate-based authentication using RSA Memorized Secret (Unique 2048, RSA 3072, RSA 4096, ECDSA P-256, P-384, or P-521. Username/password) and/or Single-Factor Cryptographic The minimum equivalent strength supported is 112 bits. The Software (certificate common probability that a random attempt will succeed is 1/(2112) which is User less than 1/1,000,000. The probability of successfully name / public key-based authentication) authenticating to the module within a one minute period is 10/(2112), which is less than 1/100,000. The module in FIPS-CC mode allows at most 10 failed attempts before a lockout occurs. Access Control Policy While in the Approved mode of operation all authenticated services and CSPs are accessed via authenticated SSH or TLS sessions. Access is restricted to authenticated operators only and no interface is provided to modify the public or private key. SNMPv3 authentication is supported but is not a method of module administration and does not allow read/write access of CSPs. Approved and allowed algorithms, relevant CSP and public keys related to these protocols are used to access the following services. CSP access by services is further described in the following tables. Additional service information and administrator guidance for Panorama can be found at https://docs.paloaltonetworks.com/. The Crypto-Officer may access all services, and through the “management of administrative access” service may define multiple Crypto-Officer roles with limited services. The User role provides read-only access to the System Audit service. When configured in the default mode, Panorama Manager provides services via web-browser based interface and a command line interface (CLI). For the Panorama Log Collector mode and PAN-DB mode, only the CLI is available for management. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 15
SSP Access Rights The table below defines the relationship between access to CSPs and the different module services. The modes of access shown in the table are defined as: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Table 8 - Approved Services Service Description Approved Security Functions Keys and/or SSPs Roles Access rights to Indicator Keys and/or SSPs Show Version Query the module to display N/A N/A CO N/A Version displayed via the version System Logs / CLI / UI Perform panorama licensing, diagnostics, debug functions, manage Panorama support information and switch between Panorama System and System Provisioning N/A N/A CO N/A Management-only, and Configuration logs Logger modes. (Panorama or Management-Only Mode) Access web portal Connect to module’s web RSA SigVer (186-4) CA Certificates CO G/R/E/W System Logs portal to invoke services. RSA SigVer (186-4) RSA Public Keys G/R/E/W (Panorama or ECDSA SigVer (186-4) ECDSA Public Keys G/R/E/W Management-Only Mode) KAS KDF TLS (CVL) TLS Pre-Master G/E/Z Secret KDF TLS (CVL) TLS Master Secret G/E/Z CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/Z Safe Primes Key Public Components Generation, Safe Primes Key Verification KTS TLS HMAC Keys G/E/Z HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 16
Access CLI Connect to module’s CLI via KTS HMAC-SHA-1 SSH Session CO, User G/E/Z System Logs SSH HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM G/E/Z KAS KDF SSH (CVL) SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC SSH DHE/ECDHE G/E/R/W/Z KAS-FFC-SSC Public Components Safe Primes Key Generation Safe Primes Key Verification Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Panorama Firmware Download and install RSA SigVer (FIPS 186-4) Public Key for CO W/E System and Update firmware updates Firmware Load Test Configuration logs Panorama Manager Setup Presents configuration CKG RSA Private Keys CO G/W/E System and options for management RSA KeyGen (FIPS 186-4) Configuration logs interfaces and RSA SigGen (FIPS 186-4) communication for peer CKG ECDSA Private Keys G/W/E services (e.g., SNMP, ECDSA KeyGen RADIUS). ( FIPS 186-4) Import, Export, Save, Load, ECDSA SigGen revert and validate (FIPS 186-4) Panorama configurations and state role RSA SigVer (FIPS 186-4) RSA Public Keys G/R/E/W ECDSA SigVer (FIPS 186-4) ECDSA Public Keys G/R/E/W (Panorama or Management-Only Mode) KDF SNMP (CVL) SNMPv3 W/E Authentication Secret KDF SNMP (CVL) SNMPv3 Privacy W/E Secret HMAC-SHA-1 SNMPv3 G/E/Z HMAC-SHA2-224 Authentication Key HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CFB128 SNMPv3 Session Key G/E/Z RSA SigVer (FIPS 186-4) CA Certificates G/R/E/W ECDSA SigVer (FIPS 186-4) KAS KDF TLS (CVL) TLS Pre-Master G/E/Z Secret KDF TLS (CVL) TLS Master Secret G/E/Z CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), TLS DHE/ECDHE G/E/R/W/Z ECDSA KeyVer Public Components (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, Safe Primes Key Generation, Safe Primes Key Verification KTS HMAC-SHA2-256 TLS HMAC Keys G/E/Z HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 17
KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM KAS KDF SSH (CVL) SSH DHE/ECDHE G/E/Z KAS-ECC-SSC Private Components KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification SSH DHE/ECDHE G/E/R/W/Z Public Components Counter DRBG, ESV DRBG Seed CO G/E System and DRBG V Configuration Logs DRBG Key Entropy Input String Manage Panorama Define access control N/A CO, User Password CO G/E/W System and Administrative Access methods via admin profiles, Configuration logs configure administrators and password profiles Configure local user database, authentication profiles, sequence of RSA SigVer (FIPS 186-4) SSH Client Public Key W/E methods and access domains. (Panorama, Management-Only, or Log Collector Mode) RSA SigVer (FIPS 186-4) SSH Host Public Key G/R/E/W ECDSA SigVer (FIPS 186-4) Configure High Configure High Availability RSA SigVer (FIPS 186-4) RSA Public Key CO G/R/E/W Configuration Logs Availability communication settings (Panorama or Management-Only Mode) ECDSA SigVer (FIPS 186-4) ECDSA Public Key G/R/E/W Panorama Certificate Manage RSA/ECDSA ECDSA SigGen RSA Private Keys CO G/R/W/E System and Management certificates and private (FIPS 186-4) ECDSA Private Keys Configuration logs keys, certificate profiles, RSA SigGen revocation status, and (FIPS 186-4) usage; show status. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 18
(Panorama, ECDSA SigVer RSA Public Keys G/R/W/E Management-Only, or Log (FIPS 186-4) ECDSA Public Keys Collector Mode) RSA SigVer (FIPS 186-4) Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Panorama Log Setting Configure log forwarding N/A N/A CO N/A Configuration Logs (Panorama or Management-Only Mode) Panorama Server Profiles Configure communication KDF SNMP (CVL) SNMPv3 CO W/E System Logs parameters and information Authentication Secret for peer servers KDF SNMP (CVL) SNMPv3 Privacy W/E Secret (Panorama or Management-Only Mode) HMAC-SHA-1 SNMPv3 G/E/Z HMAC-SHA2-224 Authentication Key HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CFB128 SNMPv3 Session Key G/E/Z Setup Managed Devices Set-up and define managed N/A N/A CO N/A Configuration Logs and Deployment devices, device groups for firewalls Configure device deployment applications and licenses View current deployment information on the managed firewalls. It also allows you to manage firmware versions and schedule updates on the managed firewalls and managed log collectors. (Panorama or Management-Only Mode) Configure Managed Log Setup and manage other N/A CO, User Password CO G/E/W System and Collectors Log Collector management, Configuration logs communication and storage settings View current deployment information on the managed Log Collectors. It also allows you to manage firmware versions and schedule updates on managed log collectors. (Panorama or Management-Only Mode) Zeroize Zeroize all SSPs N/A All SSPs CO Z Zeroization Indicator Self-Test Run power up self-tests on N/A Firmware Integrity CO, User E System Logs demand by power cycling Verification Key the module. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 19
Show Status View status of the module N/A N/A CO, User N/A FIPS-CC Mode Indicator System Audit Allows review of limited N/A N/A CO, User N/A System Logs configuration and system status via SNMPv3, logs, dashboard, show status, and configuration screens. CO Only: Provides configuration commit capability. (Panorama, Management-Only, or PAN-DB Mode) Monitor System Status and Review system status via N/A N/A CO, User N/A System Logs Logs the panorama system CLI, dashboard and logs; show status. (Panorama or Management-Only Mode) CKG RSA Private Keys CO G/W/E System and Panorama Log Collector Presents configuration RSA KeyGen (FIPS 186-4) Configuration logs Setup options for management RSA SigGen (FIPS 186-4) interfaces and communication for peer services Import, Export, Save, Load, CKG ECDSA Private Keys G/W/E revert and validate ECDSA KeyGen Panorama configurations ( FIPS 186-4) and state. ECDSA SigGen (FIPS 186-4) (Log Collector Mode only) RSA SigVer (FIPS 186-4) RSA Public Keys G/R/E/W ECDSA SigVer (FIPS 186-4) ECDSA Public Keys G/R/E/W KAS KDF TLS (CVL) TLS Pre-Master G/E/Z Secret KDF TLS (CVL) TLS Master Secret G/E/Z CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/R/W/Z Safe Primes Key Public Components Generation, Safe Primes Key Verification © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 20
KTS HMAC-SHA2-256 TLS HMAC Keys G/E/Z HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM KAS KDF SSH SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Panorama Pan-DB Setup Presents configuration KAS KDF TLS (CVL) TLS Pre-Master CO G/E/Z System Logs options for management Secret interfaces and communication for peer services Import, Export, Save, Load, revert and validate KDF TLS (CVL) TLS Master Secret G/E/Z Panorama configurations and state. (PAN-DB Mode only) © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 21
CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/R/W/Z Safe Primes Key Public Components Generation, Safe Primes Key Verification KTS HMAC-SHA2-256 TLS HMAC Keys G/E/Z HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM KAS KDF SSH SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 22
Manage Pan-DB Update Administrator N/A CO, User Password CO G/E/W System and Administrative Access password. Configuration logs (PAN-DB Mode only) Note: Configuration/System Logs for Approved services above will indicate FIPS-CC mode is enabled and that the service succeeded.
Table 9 - Physical Security Inspection Guidelines Physical Security Recommended Frequency Inspection/Test Guidance Details Mechanism of Inspection/Test Tamper Evident 30 days (M-200, M-300) Verify integrity of tamper-evident seals in the Seals locations identified in Section 7 of this Security Policy.
30 days (M-200, M-300) Verify that opacity shields and side rails have not
Front and Rear been loosened or deformed from their original shape, thereby Opacity Shields reducing their effectiveness. Side Rails Top Overlays 30 days (M-200, M-300) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics. Tamper Evident 30 days (M-600, M-700) Verify integrity of tamper-evident seals in the Seals locations specified in Section 7 of this Security Policy. Front and Rear 30 days (M-600, M-700) Verify that the front and rear opacity shields Opacity Shields have not been deformed from their original shape, thereby reducing their effectiveness. Vent Overlays 30 days (M-600, M-700) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics. Refer to the following sections for instructions on installation and placement of the tamper seals and opacity shields. M-200 Tamper Seal Installation (15 Seals) 1. Replace the top cover with the physical top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). M-200 appliance—Remove the Void Warranty label that covers the left top cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the top cover (does not have vents) on the appliance until the release buttons click. Reinsert and slide cover into position and secure with the two (2) screws. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 24
Figure 9
Replace the front rack-mount brackets (one bracket on each side) that are part of the inner-rack rails with the rack-mount brackets by removing and then reinstalling two screws on each bracket. The handles have standoffs that are used to secure the front cover. Figure 12
M-300 appliance—Remove the Void Warranty label that covers the left top cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the physical kit top cover (does not have vents) on the appliance until the release buttons click. Reinsert and slide cover into position and secure with the two (2) screws. Figure 16
Replace the front rack-mount brackets (one bracket on each side) that are part of the inner-rack rails with the physical kit rack-mount brackets by removing and then reinstalling two screws on each bracket. The physical kit handles have standoffs that are used to secure the front cover. Figure 19
Remove the Void Warranty label that covers the left side cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the physical kit top cover (does not have vents) on the appliance until the release buttons click. Replace the two screws that you removed from the old cover Figure 23
Figure 24 – M-600: Front Cover Bracket
tamper-evident seals over the overlay stickers. Apply two (2) tamper-evident seals on the back side of the right rack handle (see seals #18 and #19 on the left side in Figure 54). Apply two (2) tamper-evident seals on the power supplies (see seals #11 and #12 with rear inset of Figure 53). Note: Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. M-600 Seal Placement (21 Seals) Figure 26
Figure 27
Figure 29 – M-700: Top Cover Replacement
Figure 31 – M-700: Physical Kit Front Cover
Figure 33
9. Sensitive Security Parameters The following table details all the sensitive security parameters utilized by the module. Table 10 - SSPs Key/SSP/Name Strength Security Generati Import/Exp Establishm Storage Zeroization1 Use & Related Keys /Type Function and on ort ent Cert. Number ECDSA/RSA Public key Used to trust a root CA RSA SigVer (FIPS HDD
Cert. #A2906 termination (ECDSA P-256, P-384, and P-521) RSA public keys managed as certificates for the verification of TLS or SSH signatures, RSA SigVer Session Key DRBG, FIPS HDD/RAM
128 bits minimum (FIPS 186-4) Encrypted or N/A Zeroize Service
Keys 186-4 plaintext operator authentication Cert. #A2906 Plaintext and peer TLS handshake authentication. (ECDSA P-256, P-384, or P-521) HDD
128 bits minimum (FIPS 186-4) Session Key N/A RAM - Zeroize at and authentication
Keys 186-4 plaintext Cert. #A2906 Encrypted session (P-256, P-384, or termination P-521) KAS-FFC or KAS-ECC Ephemeral values used TLS DHE/ECDHE KAS-ECC-SSC DRBG, SP Zeroize at session in key agreement Private 112 bits minimum KAS-FFC-SSC 800-56A Rev. N/A N/A RAM - plaintext termination (KAS-FFC MODP-2048, Components Cert. #A2906 3 KAS-ECC P-256, P-384, P-521) KAS-FFC or KAS-ECC Ephemeral values used TLS DHE/ECDHE KAS-ECC-SSC DRBG, SP Plaintext - TLS Zeroize at session in key agreement Public 112 bits minimum KAS-FFC-SSC 800-56A Rev. N/A N/A handshake termination (KAS-FFC MODP-2048, Components Cert. #A2906 3 KAS-ECC P-256, P-384, P-521) Secret value used to KAS SP derive the TLS Master TLS Pre-Master KDF TLS Zeroize at session N/A 800-56A Rev. N/A N/A RAM
3 and server random
nonces © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 40
Secret value used to TLS Master KDF TLS Zeroize at session N/A KDF TLS N/A N/A RAM
128 bits minimum AES-GCM KDF TLS N/A RAM - plaintext
Keys 800-56A Rev. 3 termination connections (GCM; Cert. #A2906 CBC) HMAC keys used in TLS HMAC-SHA2-256 TLS, KAS SP Zeroize at session connections (SHA-256, TLS HMAC Keys 256 bits minimum HMAC-SHA2-384 KDF TLS N/A RAM - plaintext 800-56A Rev. 3 termination SHA-384) Cert. #A2906 ( 256, 384 bits) KAS-FFC or KAS-ECC SSH public component KAS-ECC-SSC DRBG, SP DHE/ECDHE Zeroize at session (KAS-FFC MODP-2048,
112 bits minimum KAS-FFC-SSC 800-56A Rev. N/A N/A RAM - plaintext
Private termination KAS-ECC P-256, Cert. #A2906 3 Components KAS-ECC P-384, KAS-ECC P-521) KAS-FFC or KAS-ECC SSH Plaintext SSH public component KAS-ECC-SSC DRBG, SP handshake DHE/ECDHE Zeroize at session (KAS-FFC MODP-2048,
112 bits minimum KAS-FFC-SSC 800-56A Rev. N/A RAM - plaintext
Public termination KAS-ECC P-256, Cert. #A2906 3 Components KAS-ECC P-384, KAS-ECC P-521) RSA SigVer (FIPS 186-4) SSH Host Public Key SSH Host Public ECDSA SigVer DRBG, FIPS HDD/RAM
112 bits minimum N/A N/A Zeroize Service
Key (FIPS 186-4) 186-4 plaintext RSA 4096, ECDSA P-256, P-384, or P-521) Cert. #A2906 Public RSA key used to RSA SigVer SSH Client Public Encrypted via HDD/RAM
112 bits minimum (FIPS 186-4) N/A N/A Zeroize Service
Key SSH or TLS plaintext (RSA 2048, 3072, and Cert. #A2906
Used in all SSH connections to the AES-CBC, security module’s SSH Session AES-CTR, or SSH, KAS SP Zeroize at session
128 bits minimum KDF SSH N/A RAM - plaintext command line interface.
Encryption Keys AES-GCM 800-56A Rev. 3 termination (128, 192, or 256 bits: Cert. #A2906 CBC or CTR) (128 or 256 bits: GCM) Authentication keys used in all SSH connections to the HMAC-SHA-1 SSH Session security module’s HMAC-SHA2-256 SSH, KAS SP Zeroize at session Authentication 160 bits minimum KDF SSH N/A RAM - plaintext command line interface HMAC-SHA2-512 800-56A Rev. 3 termination Keys (HMAC-SHA-1, Cert. #A2906 HMAC-SHA2-256, HMAC-SHA2-512) (160, 256, 512 bits) Used to check the integrity of HMAC-SHA2-256, Firmware crypto-related code. ECDSA SigVer HDD integrity 128 bits N/A N/A N/A N/A (HMAC-SHA-256 and (FIPS 186-4) plaintext verification key ECDSA P-256) (Note: Cert. #A2906 This is not considered an SSP) Used to authenticate Public Key for RSA SigVer firmware and content to HDD Firmware Load 112 bits (FIPS 186-4) N/A N/A N/A N/A be installed on the plaintext Test Cert. #A2906 firewall (RSA 2048 with SHA-256) Authentication string CO, User SHA2-256 Encrypted via HDD - a password Zeroize N/A External N/A with a minimum length Password Cert. #A2906 SSH or TLS hash (SHA2-256) Service of eight (8) characters. Encrypted via HDD/RAM
CKG (vendor Entropy input string affirmed), Counter Entropy as coming from the Entropy Input DRBG
256 bits per N/A N/A RAM - plaintext Power cycle entropy source
String SP 800-90B Cert. #A2906 Input length = 384 bits CKG (vendor affirmed), Counter DRBG seed coming from Entropy as DRBG the entropy source DRBG Seed 256 bits per N/A N/A RAM - Plaintext Power cycle SP 800-90B Cert. #A2906 Seed length = 384 bits CKG (vendor affirmed), Counter AES 256 CTR DRBG Entropy as DRBG state Key used in the DRBG Key 256 bits per N/A N/A RAM - plaintext Power cycle generation of a random SP 800-90B Cert. #A2906 values CKG (vendor affirmed), Counter AES 256 CTR DRBG Entropy as DRBG state V used in the DRBG V 128 bits per N/A N/A RAM - plaintext Power cycle generation of a random SP 800-90B Cert. #A2906 values SNMPv3 Used to support SNMPv3 Authentication KDF SNMP Encrypted via HDD/RAM
128 bits minimum KDF SNMP N/A N/A encryption key
Key Cert. #A2906 Plaintext Service (AES-CFB 128) Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. Table 11
Pre-operational Self-Tests Pre-operational Firmware Integrity Test
Conditional Critical Functions Tests ● SP 800-56A Rev. 3 Assurance Tests (Based on Sections 5.5.2, 5.6.2, and 5.6.3) Error Handling In the event of a conditional test failure, the module will output a description of the error. These are summarized below. Table 12 - Errors and Indicators Cause of Error Error State Indicator Conditional Cryptographic Algorithm Self-Test or Firmware FIPS-CC mode failure. <Algorithm test> failed. Integrity Test Failure Conditional Pairwise Consistency or Critical Functions Test System log prints an error message. Failure Conditional Firmware Load Test Failure System prints Invalid image message.
Vendor imposed security rules In FIPS-CC mode, the following rules shall apply:
HMAC