Oracle Linux 9 OpenSSL FIPS Provider

Certificate

Approved Algorithms (337)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Oracle Linux 9 OpenSSL FIPS Provider
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery<br/>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Status Output<br/>Show Status<br/>Self-Test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Oracle Linux 9 OpenSSL FIPS Provider
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery<br/>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Status Output<br/>Show Status<br/>Self-Test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Oracle Linux 9 OpenSSL FIPS Provider FIPS 140-3 Level 1 Validation Software Version: 3.0.7-b27cdeb3ba51be46 Last Updated: 2025-05-16 Prepared by: atsec information security corporation

4516 Seton Center Pkwy, Suite 250

Austin, TX 78759 www.atsec.com Document Version 1.3 ©Oracle Corporation

Title: Oracle Linux 9 OpenSSL FIPS Provider Security Policy Date: May 14th, 2025 Contributing Authors: Oracle Linux Engineering Security Evaluations – Global Product Security atsec information security Oracle Corporation World Headquarters

Austin, TX 78741 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 www.oracle.com change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. Oracle specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may be reproduced or distributed whole and Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Oracle Linux 9 OpenSSL FIPS Provider Security Policy i

Oracle Linux 9 OpenSSL FIPS Provider Security Policy iii

This document is the non-proprietary FIPS 140-3 Security Policy for software version 3.0.7-b27cdeb3ba51be46 of the Oracle Linux 9 OpenSSL FIPS Provider. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for Other documentation is proprietary to their authors.

In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

Table 1 describes the individual security areas of FIPS 140-3, as well as the security levels of those individual areas. Table 1 - Security Levels Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Purpose and Use: The Oracle Linux 9 OpenSSL FIPS Provider (hereafter referred to as “the module”) is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) for use by other applications that require cryptographic functionality. The module consists of one software component, the “FIPS provider”, which implements the FIPS requirements, and the cryptographic functionality provided to the operator. Module Type: Software Module Embodiment: Multi-chip standalone Module Characteristics: N/A Cryptographic Boundary: Figure 1 shows the cryptographic boundary of the module, its interfaces with the operational environment and the flow of information between the module and operator (depicted through the arrows). Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1 – Block Diagram Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 2 - Software, Firmware, Hybrid Tested Operating Environments Executable Code Sets: Table 3 - Executable Code Sets Vendor Affirmed Operating Environments: Table 4 - Vendor Affirmed Operational Environments Note: the CMVP makes no statement as to the correct operation of the module or the security strengths of the generated SSPs when so ported if the specific operational environment is not listed on the validation certificate.

There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.

Modes List and Description: Table 5 - Modes List and Description Oracle Linux 9 OpenSSL FIPS Provider Security Policy

After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. Mode change instructions and status indicators: The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the service that was requested. Degraded Mode Description: The module does not implement a degraded mode of operation. Approved Algorithms: Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

1 This algorithm is referred to as “Single Step KDF” or “SSKDF” by OpenSSL.

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Algorithm Name 7627 Extended Master Secret TLS 1.3 KDF (CVL) with SHA2-256, SHA2-384

CAVP Numbers #A4310

Algorithms Capabilities

OE (Implementation) Oracle Linux 9 on KVM on Oracle Linux 8 on Ampere® Altra® Q80-30: SHA_ASM, SHA_CE Oracle Linux 9 on KVM on Oracle Linux 8 on Intel® Xeon® Platinum 8358: SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_SSSE3 Oracle Linux 9 on Marvell OCTEON III: SHA_ASM Oracle Linux 9 on KVM on Oracle Linux 8 on AMD EPYCTM 7001 Series AMD EPYC 7J13: TLS v1.3 Oracle Linux 9 on KVM on Oracle Linux 8 on Ampere® Altra® Q80-30: TLS v1.3 Oracle Linux 9 on KVM on Oracle Linux 8 on Intel® Xeon® Platinum 8358: TLS v1.3 Oracle Linux 9 on Marvell OCTEON III: TLS v1.3

Reference RFC 8446

Vendor Affirmed Algorithms: Table 7 - Vendor Affirmed Algorithms Non-Approved, Allowed Algorithms: The module does not implement non-approved algorithms allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: The module does not implement non-approved algorithms allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 8 - Non-Approved, Not Allowed Algorithms

D.G Table 9 - Security Function Implementation

The Crypto Officer shall consider the following requirements and restrictions when using the module. For TLS 1.2, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. The module is compliant with SP 800-52r2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288 and 8446. The module does not implement the TLS protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Alternatively, the Crypto Officer can use the module’s API to perform AES GCM encryption using internal IV generation. These IVs are always 96 bits and generated using the approved DRBG internal to the module’s boundary, compliant with Scenario 2 of FIPS 140-3 IG C.H. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the EVP_EncryptInit_ex2 API function with a non-NULL iv value. When this is the case, the API will set a non-approved service indicator. Finally, for TLS 1.3, the AES GCM implementation uses the context of Scenario 5 of FIPS 140-3 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC8446 of August 2018, using the cipher-suites that explicitly select AES GCM as the encryption/decryption cipher (Appendix B.4 of RFC8446). The module supports acceptable AES GCM cipher suites from Section

3.3.1 of SP800-52r2. The module’s implementation of AES GCM is used together with an application that runs outside the

module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key.

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance with SP 800-132 and FIPS 140-3 IG D.N, the following requirements shall be met:

• Derived keys shall only be used in storage applications. The MK shall not be used for other purposes. The length of the MK or DPK shall be of 112 bits or more.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
• The length of the password or passphrase shall be at least 8 characters, and shall consist of lowercase, uppercase, and numeric characters. The probability of guessing the value is estimated to be at most 10-8. Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks.
• A portion of the salt, with a length of at least 128 bits (this is verified by the module to determine the service is approved), shall be generated randomly using the SP 800-90Ar1 DRBG provided by the module.
• The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The module only allows minimum iteration count to be 1000.

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 220 AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit. To meet the requirement stated in IG C.I, the module implements a check to ensure that the two AES keys used in AES XTS mode are not identical.

The module offers DH and ECDH shared secret computation services compliant to the SP 800-56Ar3 and meeting IG D.F scenario

2 path (1). To meet the required assurances listed in section 5.6 of SP 800-56Ar3, the module shall be used together with an

application that implements the “TLS protocol” and the following steps shall be performed.

• The entity using the module, must use module's "Key pair generation" service for generating DH/ECDH ephemeral keys. This meets the assurances required by key pair owner defined in the section 5.6.2.1 of SP 800-56Ar3.
• As part of the module's shared secret computation (SSC) service, the module internally performs the public key validation the peer's public key passed in as input to the SSC function. This meets the public key validity assurance required by the sections 5.6.2.2.1/5.6.2.2.2 of SP 800-56Ar3.
• The module does not support static keys. Therefore, the "assurance of peer's possession of private key" is not applicable. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The module provides the following legacy uses as defined in SP 800-131rev2: • RSA Signature Verification, under FIPS 186-4, allows verifying signatures with a bit size of 1024, along with the approved Entropy Information: RNG Information: The module employs two Deterministic Random Bit Generator (DRBG) implementations based on SP 800-90Ar1. These DRBGs are used internally by the module (e.g. to generate seeds for asymmetric key pairs and random numbers for security functions). They can also be accessed using the specified API functions. The following parameters are used:

1. Private DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate secret random values (e.g. during asymmetric key pair generation). It can be accessed using RAND_priv_bytes.
2. Public DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate general purpose random values that do not need to remain secret (e.g. initialization vectors). It can be accessed using RAND_bytes. For seeding, the DRBG that is seeded with 384 bits of seed material, corresponding to 384 bits of entropy, obtained from the SP800-90B compliant entropy source above in Table
3. During reseeding, the DRBG obtains 256 bits of seed material, corresponding to 256 bits of entropy. These DRBGs will always employ prediction resistance. More information regarding the configuration and design of these DRBGs can be found in the module’s manual pages. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 11 - Key Generation Oracle Linux 9 OpenSSL FIPS Provider Security Policy

For DH, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919 (TLS) as listed in Table 12. Note that the module only implements key pair generation, key pair verification, and shared secret computation. SSH KDF, TLS 1.2 KDF (RFC 7627), TLS 1.3 KDF implementations shall only be used to generate secret keys in the context of the SSH, TLS 1.2, or TLS 1.3 protocols, respectively. Note that TLS 1.2 KDF must be compliant with RFC 7627 to be considered approved. ANS X9.42 KDF and ANS X9.63 KDF implementations shall only be used to generate secret keys in the context of an ANS X9.42-

No other part of the IKE, SSH or TLS protocols, other than the approved cryptographic algorithms and the KDFs listed above, have been tested by the CAVP and CMVP. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 13 - Ports and Interfaces The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design.

The module does not implement a trusted channel. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The module does not implement authentication. Table 14 - Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module. No support is provided for multiple concurrent operators.

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Name Message Authentication Code Verification Shared Secret Computation Key Derivation Key-Based Key Derivation Password- Based Key Derivation Key Pair Generation

Description Verify a MAC tag Compute a Shared Secret Derive a key Derive a key from a key Derive a key from a password Generate a key pair

Indicator EVP_PKEY_derive returns 1 EVP_KDF_*_FIPS_INDICATO R_APPROVED EVP_PKEY_generate returns 1

Inputs AES Key, message, MAC tag HMAC Key, message, MAC tag DH Private Key, DH Public Key EC Private Key, EC Public Key TLS Pre- Master Secret TLS Master Secret Shared Secret Key- Derivation Key Password DH Group

Outputs Pass/fail Shared Secret TLS Master Secret TLS Derived Key Derived Key Module Generated DH Private Key, Module Generated

Security Functions HMAC-SHA2-384, HMAC-SHA2-512, HMAC-SHA2- 512/224, HMAC- SHA2-512/256, HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 AES CMAC, AES GMAC HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512, HMAC-SHA2- 512/224, HMAC- SHA2-512/256, HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, HMAC-SHA3-512 KAS-FFC-SSC KAS-ECC-SSC TLS 1.2 KDF (RFC 7627) (CVL), TLS 1.3 KDF (CVL) TLS 1.2 KDF (RFC 7627) (CVL), TLS 1.3 KDF (CVL) KDA OneStep, KDA HKDF, KDF, ANS X9.42 KDF (CVL), ANS X9.63 KDF (CVL), SSH KDF (CVL) KBKDF PBKDF2 Safe Primes Key Generation CKG

Roles

SSP Access AES Key: W, E HMAC Key: W, E DH Private Key: W, E; DH Public Key: W, E; Shared Secret: G, R EC Private Key: W, E; EC Public Key: W, E; Shared Secret: G, R TLS Pre-Master Secret: G; TLS Master Secret: G TLS Master Secret: E; TLS Derived Key: G, R Shared Secret: W, E; KDA HKDF Derived key: G, R; KDA OneStep Derived key: G, R; SSH KDF Derived Key: G, R ANS X9.42 KDF Derived key: G, R; ANS X9.63 KDF Derived key: G, R; Key-Derivation Key: W, E; KBKDF Derived Key: G, R Password: W, E; PBKDF2 Derived Key: G, R Module Generated DH Private Key: G, R; Module Generated DH Public Key: G, R; Intermediate Key Generation Value: G, E, Z

R; Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Name Key Pair Verification Key Wrapping Key Unwrapping Random Number Generation Signature Verification Signature Generation

Description Verify a key pair. Safe primes key pair verification, ECDSA key pair verification Wrap a key Unwrap a key Generate random bytes Verify a digital signature Generate a digital signature

Indicator EVP_PKEY_public_check or EVP_PKEY_private_check or EVP_PKEY_check returns 1 EVP_EncryptFinal_ex returns 1 EVP_DecryptFinal_ex returns 1 EVP_RAND_generate returns 1 RSA: OSSL_*_FIPSINDICATOR_AP PROVED and EVP_SIGNATURE_*_FIPS_IN DICATOR_APPROVED ECDSA: OSSL_*_FIPSINDICATOR_AP PROVED

Inputs Curve Modulus DH Private Key, DH Public Key EC Private Key, EC Public Key AES Key, key to be wrapped AES Key, key to be unwrapped Output length Message, EC public key or RSA Public Key, signature, hash algorithm Message, EC Private Key or RSA Private Key, hash algorithm

Outputs DH Public Key Module Generated EC Private Key, Module Generated EC Public Key Module Generated RSA Private Key, Module Generated RSA Public Key Pass/fail Wrapped key Unwrappe d key Random bytes Pass/fail Signature

Security Functions ECDSA KeyGen CKG RSA KeyGen CKG Safe Prime KeyVer, ECDSA KeyVer AES CCM, GCM (internal IV), AES KW, AES KWP AES CCM, GCM (external IV), AES KW, AES KWP CTR_DRBG HMAC_DRBG Hash_DRBG RSA PKCS#1 v1.5 and PSS with SHA-224, SHA- 256, SHA-384, SHA-512, SHA- 512/224, SHA- 512/256 ECDSA (P-224, P- 256, P-384, P- 521) with SHA- 224, SHA-256, SHA-384, SHA- 512, SHA- 512/224, SHA- 512/256, SHA3- 224, SHA3-256, SHA3-384, SHA3-

Roles

SSP Access Module Generated EC Private Key: G, R; Module Generated EC Public Key: G, R; Intermediate Key Generation Value: G, E, Z Module Generated RSA Private Key: G, R; Module Generated RSA Public Key: G, R Intermediate Key Generation Value: G, E, Z DH Public Key: W, E; DH Private Key: W, E; EC Private Key: W, E; EC Public Key: W, E AES Key: W, E AES Key: W, E Entropy Input: W, E; DRBG Seed: E, G; Internal State (V, Key): E, G Entropy Input: W, E; DRBG Seed: E, G; Internal State (V, C): E, G RSA Public Key: W, E; ECDSA Public Key: W, E RSA Private Key: W, E; ECDSA Private Key: W, E

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Name Show Version Show Status Self-Test Zeroization

Description Return the module name and version information Return the module status Perform the CASTs and integrity tests Zeroize all SSPs

Indicator None None None None

Inputs N/A N/A N/A Any SSP

Outputs Module name and version Module status Pass/fail N/A

Security Functions 512 N/A N/A SHA-1, SHA-512, SHA3-256, AES ECB, AES GCM, KBKDF, KDA OneStep, HKDF, ANS X9.42 KDF (CVL), ANS X9.63 KDF (CVL), SSH KDF (CVL), TLS 1.2 KDF (RFC 7627) (CVL), TLS 1.3 KDF (CVL), PBKDF2, CTR_DRBG, Hash_DRBG, HMAC_DRBG, KAS-FFC-SSC, KAS-ECC-SSC, RSA PKCS#1 v1.5, ECDSA See Table 23 for specifics N/A

Roles

SSP Access N/A N/A N/A All SSPs: Z

Table 15 - Approved Services Table 15 above lists the approved services. The following convention is used to specify access rights to SSPs:

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation. To interact with the module, a calling application must use the EVP API layer provided by OpenSSL. This layer will delegate the request to the FIPS provider, which will in turn perform the requested service. Additionally, this EVP API layer can be used to retrieve the approved service indicator for the module. The redhat_ossl_query_fipsindicator() function indicates whether an EVP API function is approved. After a cryptographic service was performed by the module, the API context associated with this request can contain a parameter (listed below) which represents the approved service indicator.
• OSSL_CIPHER_PARAM_*_FIPS_INDICATOR
• OSSL_MAC_PARAM_*_FIPS_INDICATOR
• OSSL_KDF_PARAM_*_FIPS_INDICATOR Oracle Linux 9 OpenSSL FIPS Provider Security Policy

• OSSL_SIGNATURE_PARAM_*_FIPS_INDICATOR
• OSSL_ASYM_CIPHER_PARAM_*_FIPS_INDICATOR

Table 16 - Non-Approved Services

The module does not load external software or firmware.

The module does not implement a bypass capability. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The module does not implement a self-initiated cryptographic output capability. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The integrity of the module is verified by comparing a HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time. If the integrity test fails, the module enters the error state.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity test may be invoked on-demand by unloading and subsequently re-initializing the module, or by calling the OSSL_PROVIDER_self_test function. This will perform (among others) the software integrity test. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Type of Operating Environment: modifiable: the module executes on a general purpose operating system (Oracle Linux 9), which allows modification, loading, and execution of software that is not part of the validated module. How Requirements are Satisfied: The operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

The module shall be installed as stated in Section 11.1. There are no concurrent operators. The module does not have the capability of loading software or firmware from an external source. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The module is comprised of software only and therefore this section is not applicable. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

This module does not implement any non-invasive security mechanism and therefore this section is not applicable. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 17 - Storage Areas The module does not support entry and output of SSPs beyond the physical perimeter of the operational environment. The SSPs are provided to the module via API input parameters in the plaintext form and output via API output parameters in the plaintext form to and from the calling application running on the same operational environment. Table 19 - SSP Zeroization Methods Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 20 - SSP Information First Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Name key KDA OneStep Derived key KDA HKDF Derived key ANS X9.42 KDF Derived key ANS X9.63 KDF Derived key SSH KDF Derived key Entropy Input DRBG Seed DRBG Internal State (V, Key) DRBG Internal State (V, C) DH Public Key DH Private Key Module Generated DH Public Key Module Generated DH Private Key EC Public Key EC Private Key Module Generated EC Public Key

Used By Key Derivation Key Derivation Random Number Generation Shared Secret Computation, Key Pair Verification Shared Secret Computation Shared Secret Computation, Signature Verification, Key Pair Verification Shared Secret Computation, Signature Generation, Key Pair Verification Shared Secret Computation

Inputs/Outputs N/A N/A N/A N/A API input parameters (input) API output parameters (output) API input parameters (input) API output parameters (output)

Storage

Storage Duration From generation until DRBG seed is created While the DRBG is being instantiated From DRBG instantiation until DRBG termination For the duration of the service

Zeroization

Type CSP (Compliant with IG D.L) PSP CSP PSP CSP PSP CSP PSP

Related SSPs Shared secret Shared secret Shared secret Shared secret Shared secret DRBG Seed Entropy Input DRBG Internal State (V, C) DRBG Internal State (V, Key) DRBG Seed DRBG Seed DH Private Key Shared Secret DH Public Key Shared Secret Module Generated DH Private Key Intermediate key generation value Module Generated DH Public Key Intermediate key generation value EC Private Key Shared Secret EC Public Key Shared Secret Module Generated EC Private Key Intermediate key generation value

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Name Module Generated EC Private Key RSA Private Key RSA Public Key Module Generated RSA Private Key Module Generated RSA Public Key Intermediate Key Generation Value TLS Pre-Master Secret TLS Master Secret TLS Derived Key

Used By Digital Signature Generation Digital Signature Verification N/A Key Pair Generation Key Derivation

Inputs/Outputs API input parameters (input) API output parameters (output) N/A N/A N/A API output parameters (output)

Storage

Storage Duration

Zeroization Automatically Free Cipher Handle, Module Reset

Type CSP CSP PSP CSP PSP CSP CSP CSP CSP

Related SSPs Module Generated EC Public Key Intermediate key generation value RSA Public Key RSA Private Key Module Generated RSA Public Key Intermediate key generation value Module Generated RSA Private Key Intermediate key generation value Module Generated RSA Public Key, Module Generated RSA Private Key, Module Generated DH Public Key, Module Generated DH Private Key, Module Generated EC Public Key, Module Generated EC Private Key TLS Master Secret DH Public Key DH Private Key EC Public Key EC Private Key TLS Pre-Master Secret TLS Derived Secret TLS Master Secret

Table 21 - SSP Information Second

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2030. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The RSA, ECDSA algorithm as implemented by the module conforms to FIPS 186-4, which has been superseded by FIPS 186-5. FIPS 186-4 will be withdrawn on February 3, 2024. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Table 22 - Pre-Operational Self-Tests The pre-operational software integrity test is performed automatically (after the CASTs) when the module is powered on before before the software integrity test is performed. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-test has passed successfully. If the pre-operational self-test fails, the module transitions to the error state.

5.6.2.1.4) Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Algorithm AES-GCM KBKDF KDA OneStep HKDF ANS X9.42 KDF (CVL) ANS X9.63 KDF (CVL) SSH KDF (CVL) TLS 1.2 KDF (CVL) TLS 1.3 KDF (CVL) PBKDF2 CTR_DRBG

Implementation AESNI_AVX, AESNI_CLMULNI, AESNI_ASM, BAES_CTASM_AVX, BAES_CTASM_CLMULNI, BAES_CTASM_ASM, AESASM_AVX, AESASM_CLMULNI, AESASM_ASM, CE_GCM_UNROLL8_EOR3, CE_GCM, VPAES_GCM, AES_C_GCM KBKDF KDA TLS v1.3 SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_AVX, SHA_SSSE3, SHA_CE SHA3_ASM, SHA_CE, SHA3_CE, SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_AVX, SHA_SSSE3, SHA_CE SSH_ASM, SSH_SHANI, SSH_AVX2, SSH_AVX, SSH_SSSE3 SHA_CE, SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_AVX, SHA_SSSE3, SHA_CE TLS v1.3 SHA_CE, SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_AVX, SHA_SSSE3, SHA_CE DRBG_3

Test Properties 256-bit keys, 96- bit IVs, 128-bit plaintext, 128- bit additional data Counter mode, HMAC-SHA2- 256, 128-bit input key SHA-224, 392-bit input secret SHA-256, 48-bit input secret SHA-1 with AES- 128, KW, 160-bit input secret SHA-256, 192-bit input secret SHA-1, 1056-bit input secret SHA-256, 84-bit input secret Extract and expand modes, SHA-256 SHA-256, 24- character password, 288- bit salt, Iteration count: 4096 AES-128 with prediction resistance and derivation function

Test Method

Type

Indicator

Details Encryption Decryption Key Derivation Instantiate, Generate, Reseed, Generate (compliant

Conditions

Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Algorithm Hash_DRBG HMAC_DRBG KAS-FFC-SSC KAS-ECC-SSC RSA ECDSA

Implementation DRBG_3 DRBG_3 C C SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_SSSE3, SHA_CE, NEON SHA_ASM, SHA_SHANI, SHA_AVX2, SHA_AVX, SHA_SSSE3, SHA_CE

Test Properties SHA-256 with prediction resistance SHA-1 with prediction resistance ffdhe2048 P-256 PKCS#1 v1.5 with SHA-256 and 2048-bit key SHA-256 and P- 224, P-256, P- 384, and P-521

Test Method

Type

Indicator

Details with SP 800- 90Ar1 Section 11.3) Shared Secret Computation Signature Generation Signature Verification Signature Generation Signature Verification

Conditions

Table 23 - Conditional Self-Tests

The module performs self-tests on all approved cryptographic algorithms as part of the approved services supported in the approved mode of operation, using the tests shown in Table 23. Services are not available, and data output (via the data output interface) is inhibited during the self-tests. If any of these tests fails, the module transitions to the error state.

Upon generation of a DH, EC or RSA key pair, the module will perform a pair-wise consistency test (PCT) as shown in Table 23, which provides some assurance that the generated key pair is well formed. The test for DH consists of the PCT described in Section 5.6.2.1.4 of SP 800-56Ar3. For EC or RSA key pairs, the tests consist of performing signature generation and verification using the generated key pairs. Services are not available, and data output (via the data output interface) is inhibited during

The module does not implement any periodic self-tests.

Table 24 - Error States In the error state, the output interface is inhibited, and the module accepts no more inputs or requests (as the module is no longer running). Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The software integrity tests and CASTs can be invoked on demand by unloading and subsequently re-initializing the module. Additionally, the integrity test may be invoked on-demand by calling the OSSL_PROVIDER_self_test function. The PCTs can be invoked on demand by requesting the Key Pair Generation service. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

The module is distributed as a part of the Oracle Linux 9 (OL9) RPM package in the form of openssl-libs-3.0.7-24.0.3.el9_fips RPM package that is located in the “Oracle Linux 9 Security Validation (Update 3)” yum repository (ol9_u3_security_validation). Also, the module can be distributed using the openssl-fips-provider-3.0.7-6.0.1.el9_5 RPM package. The module can achieve the approved mode by:

• For installation add the fips=1 option to the kernel command line during the system installation. During the software selection stage, do not install any third-party software.
• Switching the system into the approved mode after the installation. Execute the fips-mode-setup -–enable command. Restart the system. In both cases, the Crypto Officer must verify the Oracle Linux 9 system operates in approved mode by executing the fips-modesetup –check command, which should output “FIPS mode is enabled.” For more information on Oracle Linux 9 system FIPS validated environment, please see Oracle Linux 9 product documentation. After installation of the openssl-libs-3.0.7-24.0.3.el9_fips RPM package, the Crypto Officer must execute the openssl list providers command. The Crypto Officer must ensure that the FIPS provider is listed in the output as follows: fips name: Oracle Linux Linux 9 OpenSSL FIPS Provider version: 3.0.7-b27cdeb3ba51be46 status: active The cryptographic boundary consists only of the FIPS provider as listed. If any other OpenSSL or third-party provider is invoked, the user is not interacting with the module specified in this Security Policy.

The Approved and Non-Approved modes of operation are specified in Section 2.4. The administrative functions are specified in the Approved Services table. All the logical interfaces are specified in Section 3.1.

The approved and non-approved security functions available to users are listed in Section 2. The physical ports and logical interfaces available to users are specified in Section 3.1. The approved and non-approved modes of operation are specified in Section 2.4. All the algorithm-specific information is listed in Section 2.7.

There are no maintenance requirements.

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, the openssl-libs-3.0.7-24.0.3.el9_fips RPM package can be uninstalled from the Oracle Linux 9 system. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Certain cryptographic subroutines and algorithms are vulnerable to timing analysis. The module mitigates this vulnerability by using constant-time implementations. This includes, but is not limited to:

• Big number operations: computing GCDs, modular inversion, multiplication, division, and modular exponentiation (using Montgomery multiplication)
• Elliptic curve point arithmetic: addition and multiplication (using the Montgomery ladder)
• Vector-based AES implementations In addition, RSA, ECDSA, ECDH, and DH employ blinding techniques to further impede timing and power analysis. No configuration is needed to enable the aforementioned countermeasures. Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Glossary and Abbreviations Oracle Linux 9 OpenSSL FIPS Provider Security Policy

References Oracle Linux 9 OpenSSL FIPS Provider Security Policy

Oracle Linux 9 OpenSSL FIPS Provider Security Policy