Panorama Virtual Appliance 10.2

Certificate

Approved Algorithms (30)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Panorama Virtual Appliance 10.2
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Panorama Virtual Appliance 10.2
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Panorama Virtual Appliance 10.2 Version: 1.2 Revision Date: August 28, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.

The Panorama Virtual Appliance 10.2 from Palo Alto Networks Inc., hereafter referred to as “Panorama VM” or the “cryptographic module” are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 1 requirements. The Panorama VM provides a centralized monitoring and management of multiple Palo Alto Networks next-generation (NG) firewalls and Wildfire appliances. For purposes of this validation, the exact software version of the module tested was 10.2.3-h1. The cryptographic module meets the overall requirements applicable to Level 1 security of FIPS 140-3. Table 1 - Security Levels ISO/IEC 24759 Section 6. FIPS 140-3 Section Title Security Level

2                Cryptographic Module Specification                 1
3                Cryptographic Module Interfaces                    1
4                Roles, Services, and Authentication                3
5                Software/Firmware Security                         1
6                Operational Environment                            1
7                Physical Security                                N/A
8                Non-Invasive Security                            N/A
9                Security Parameter Management                      1
11                Life-Cycle Assurance                               3
12                Mitigation of Other Attacks                      N/A
Overall Level                                       1 2.        Cryptographic Module Specification The tested operational environments are highlighted in Table 2. Table 2 – Tested Operational Environments Operating System              Hardware Platform                   Processor            PAA/Acceleration VMware ESXi v7.0             Dell PowerEdge R740               Intel Gold 6248              N/A KVM on Ubuntu 20.04           Dell PowerEdge R740               Intel Gold 6248              N/A Hyper-V 2019 on Microsoft       Dell PowerEdge R740               Intel Gold 6248              N/A Hyper-V Server 2019 © 2024     Palo Alto Networks, Inc.                                                   Panorama VM 10.2 Security Policy 3

Table 3

• Vendor Affirmed Operational Environments Operating System Hardware Platform Amazon Web Services (AWS) x86 Architecture Microsoft Azure (Note: Specific processor/hardware is dependent on Google Cloud Platform (GCP) Instance/Machine Type selected for operation system) Operator Porting Rules The CMVP allows user porting of a validated software module to an operational environment which was not included as part of the validation testing. An operator may install and run this module on any general purpose computer (GPC) or platform using the specified hypervisor and operating system on the validation certificate or other compatible operating and/or hypervisor system and affirm the module's continued FIPS 140-3 validation compliance. The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when ported and executed in an operational environment not listed on the validation certificate. Approved Mode of Operation The following procedure will initialize the modules into the Approved mode of operation:
• During initial boot up, break the boot sequence via the console port connection (by pressing the maint button when instructed to do so) to access the main menu.
• Select “Continue.”
• Select the “Set FIPS-CC Mode” option to initialize the Approved mode.
• Select “Enable FIPS-CC Mode”.
• When prompted, select “Reboot” and the module will re-initialize and continue into the Approved mode of operation (FIPS-CC mode).
• The module will reboot.
• In “FIPS-CC” mode, the console port is available only as a status output port.
• Once the module has finished booting, the Crypto Officer can authenticate using the default credentials that come with the module
• Once authenticated, the module will automatically require the operator to change their password; and the default credential is overwritten The module will automatically indicate the Approved mode of operation in the following manner:
• Status output interface will indicate “**** FIPS-CC MODE ENABLED ****” via the CLI session.
• Status output interface will indicate “FIPS-CC mode enabled successfully” via the console port.
• The module will display “FIPS-CC” at all times in the status bar at the bottom of the web interface.
• The module will display “fips-cc” when “show system info” is entered via the CLI Should one or more self-tests fail in Section 10, the Approved mode of operation will not be achieved. Feedback will consist of:
• The module will output “FIPS-CC failure”
• The module will reboot and enter a state in which the reason for the reboot can be determined.
• To determine which self-test caused the system to reboot into the error state, connect the console cable and follow the on-screen instructions to view the self-test output. Note: Disabling “FIPS-CC” mode causes a complete factory reset, which is described in the Zeroization section below. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 4

Non-Compliant State Failure to follow the directions in the Approved Mode of Operation above and Section 11 will result in the module operating in a non-compliant state. Selecting Panorama, Management-Only, and Log Collector System Modes The Panorama VM supports multiple configurations that provide varying services. The Cryptographic Officer can initialize the module into different System Mode. The module supports the following System Modes:

• Panorama
• Management-Only
• Log Collector The default and primary mode of operation is Panorama mode. An additional mode, Log Collector mode, focuses primarily on log gathering instead of management. The final mode supported by the module is Management-Only, which focuses primarily on management functions without logging capabilities. To convert the module from the default mode, Panorama mode, to Log Collector or Management-Only mode, follow the steps below: Convert the Panorama VM from Panorama mode to Log Collector or Management-Only mode:
• Log into the CLI via SSH, CO is authenticated with username/password
• Enter “request system system-mode logger” or “request system system-mode management-only”
• Enter “Y” to confirm the change to the selected mode.
• The system will reboot and perform the required power on self-tests. Convert the Panorama VM from Log Collector or Management-Only mode to Panorama mode:
• Log into the CLI via SSH, CO is authenticated with username/password
• Enter “request system system-mode panorama”
• Enter “Y” to confirm the change to the selected mode.
• The system will reboot and perform the required power on self-tests Note: Changing the System Mode does not change FIPS-CC Mode. Zeroization The following procedure will zeroize the module:
• Access the module’s CLI via SSH, and command the module to enter maintenance mode (“debug system maintenance-mode”); the module will reboot
• Note: Establish a serial connection to the console port
• After reboot, select “Continue.”
• Select “Factory Reset”
• The module will perform a zeroization, and provide the following message once complete: o “Factory Reset Status: Success” Note: Following the completion of this procedure, the module will be placed back into an uninitialized state. Uninitialized State If the module does not successfully transition into the Approved mode of operation, or zeroization is performed, the module will be in an uninitialized state. It is required to initialize the module in order to perform cryptographic functions. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 5

Approved and Allowed Algorithms The cryptographic modules support the following Approved algorithms. Only the algorithms, modes, and key sizes specified in this table are used by the module. The CAVP certificate may contain more tested options than listed in this table. Table 4 – Approved Algorithms Cert and Standard Strength(s) Component Vetted conditioning component for ESV

Counter DRBG A2907                         Counter DRBG    AES 256 bits with Derivation Function Enabled     Random Bit Generator ECDSA KeyGen       ECDSA KeyGen                                                      Key Generation (FIPS 186-4)       (FIPS 186-4) ECDSA KeyVer       ECDSA KeyVer                                                      Public Key Validation (FIPS 186-4)       (FIPS 186-4) ECDSA SigGen       ECDSA SigGen    P-256, P-384, P-521 with SHA2-224, SHA2-256,      Signature Generation (FIPS 186-4)       (FIPS 186-4)    SHA2-384, and SHA2-512 A2907                                                                                           Signature Verification (FIPS 186-4)       (FIPS 186-4)    SHA2-256, SHA2-384, and SHA2-512 HMAC            HMAC-SHA-1 with λ=160                             Authentication for protocols [FIPS 198-1] HMAC                                                              Authentication for protocols [FIPS 198-1] HMAC            HMAC-SHA2-256 with λ=256                          Authentication for protocols [FIPS 198-1] HMAC            HMAC-SHA2-384 with λ=384                          Authentication for protocols [FIPS 198-1] HMAC            HMAC-SHA2-512 with λ=512                          Authentication for protocols [FIPS 198-1] KDF SNMP [SP                       Engine ID: © 2024   Palo Alto Networks, Inc.                                                             Panorama VM 10.2 Security Policy 6

TLS1.2 KDF with hashes SHA-1 and +++ This Hash algorithm is not supported for ANSI X9.31 Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Safe Primes Key Safe Primes Key Safe Primes Key Safe Primes Key and HMAC Key Wrapping 800-38F] wrapping and 256 bits of encryption strength unwrapping) per IG D.G. 800-38F] of encryption strength #A2907 wrapping and © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 7

unwrapping) per IG D.G. SP 800-90B ESV Palo Alto Networks DRNG Entropy Source Entropy SC Cert. #A2907, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF KDF SSH 800-56Arev3] 192, or 256 bits of encryption strength Scenario 2 path (2). SC Cert. #A2907, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF Scenario 2 path (2). SC Cert. #A2907, KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF Scenario 2 path (2). SC Cert. #A2907, KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF Scenario 2 path (2). Key Generation Note: The seeds used for asymmetric Vendor CKG (SP Section 5.1, Section Cryptographic Key Generation; SP 800-133 and key pair generation are produced using Affirmed 800-133rev2) 5.2 IG D.H (asymmetric seeds). the unmodified/direct output of the ** The module is compliant to IG C.H: GCM is used in the context of TLS and SSH:

• For TLS, The GCM implementation meets Scenario 1 of IG C.H: it is used in a manner compliant with SP 800-52 and in accordance with Section 4 of RFC 5288 for TLS key establishment, and ensures when the nonce_explicit part of the IV exhausts all possible values for a given session key, that a new TLS handshake is initiated per sections 7.4.1.1 and 7.4.1.2 of RFC 5246. During operational testing, the module was tested against an independent version of TLS and found to behave correctly.
• From this RFC 5288, the GCM cipher suites in use are: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• For SSH, the module meets Scenario 1 of IG C.H. The module conforms to RFCs 4252, 4253, and 5647. The fixed field is 32 bits in length and is derived using the SSH KDF; this ensures the fixed field is unique for any given GCM session. The invocation field is 64 bits in length and is incremented for each invocation of GCM; this prevents the IV from repeating until the entire invocation field space of 264 is exhausted, which can take hundreds of years. (in FIPS-CC Mode, SSH rekey is automatically configured at 1 GB of data or 1 hour, whichever comes first) © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 8

In all the above cases, the nonce explicit is always generated deterministically. Also, AES GCM keys are zeroized when the module is power-cycled. For each new TLS or SSH session, a new AES GCM key is established. The module is compliant to IG C.F.: The module utilizes approved modulus sizes 2048, 3072, and 4096 bits for RSA signatures. This functionality has been CAVP tested as noted above. The minimum number of Miller Rabin tests for each modulus size is implemented according to Table C.2 of FIPS 186-4. For modulus size 4096 the module implements the largest number of Miller-Rabin tests shown in Table C.2. RSA SigVer is CAVP tested for all three supported modulus sizes as noted above. The module does not perform FIPS 186-2 SigVer. All supported modulus sizes are CAVP testable and tested as noted above. The module does not implement RSA key transport in the approved mode. The module does not have any algorithms that fall under: - Non-Approved Algorithms Allowed in the Approved Mode of Operation - Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed - Non-Approved Algorithms Not Allowed in the Approved Mode of Operation Table 5 - Supported Protocols in the Approved Mode Supported Protocols* TLS 1.2 SSHv2 SNMPv3 *Note: These protocols have not been tested or reviewed by the CMVP or the CAVP. Cryptographic Boundary The Panorama Virtual Appliance is a software cryptographic module and requires an underlying general purpose computer (GPC) environment. The module consists of a GPC (multi-chip standalone embodiment) with the cryptographic boundary defined below. The cryptographic boundary (CB) includes all of the software components of the module, which is included in the file name in Section 11 (Panorama_pc-10.2.3-h1) and also the configuration file that resides on the virtual machine’s virtual disk. The physical perimeter (PP) is defined by the enclosure around the host GPC on which it runs. Figure 1 depicts the boundary and illustrates the hardware components of a GPC. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 9

Figure 1 – Cryptographic Boundary 3.       Cryptographic Module Interfaces The Panorama VM is designed to operate on a general-purpose computer (GPC) platform. The module supports the following FIPS 140-3 interfaces, which have physical and logical ports consistent with a GPC operating environment. The module does not implement a control output interface. Table 6 –Ports and Interfaces Physical Port                 Logical Interface                Data that passes over port/interface Power                  Power                                  Power supplies Console, GPC I/O       Status Output                          Self-test status output Ethernet               Data input, control input, control     HTTPS, TLS, SNMP, and SSH traffic data. output, data output, status output © 2024    Palo Alto Networks, Inc.                                                    Panorama VM 10.2 Security Policy 10

4.       Roles, Services, and Authentication Roles and Services While in the Approved mode of operation, all CO and User services are accessed via SSH or TLS sessions. Approved and allowed algorithms, relevant CSPs and public keys related to these protocols are accessed to support the following services. CSP access by services is further described in the following tables. Table 7 – Roles, Service Commands, Input and Output Show Version                   Query module for version              Module provides version Access web portal              Connect to web portal from TLS        Confirmation of service via Access CLI                     Connect to SSH server from SSH        Confirmation of service via System Provisioning            Configuring and managing system       Confirmation of service via CO                                       configurations (e.g., IP address,     Configuration Logs system time, etc.) via CLI or WebUI Panorama Software Update       Loading new image                        Message output noting version CO                                                                               updated successfully via System Panorama Manager Setup         Configuring and managing Manager Confirmation of service via via CLI or WebUI Manage Panorama                Configuring and managing                Confirmation of service via Administrative Access          Administrative configurations (e.g., Configuration Logs authentication method, etc.) via CLI or WebUI Configure High Availability    Configuring and managing High           Confirmation of service via CLI or WebUI Panorama Certificate           Configuring and managing                Confirmation of service via CO        Management                     certificates via CLI or WebUI           Configuration Logs Panorama Log Setting           Configuring and managing log          Confirmation of service via CO                                       settings via CLI or WebUI             Configuration Logs Panorama Server Profiles       Configuring and managing Server       Confirmation of service via CLI or WebUI Setup Managed Devices and      Configuring and managing Managed Confirmation of service via Configure Managed Log          Configuring and managing Managed Confirmation of service via or WebUI CO,        Zeroize                        Zeroize from CLI                      Zeroization Indicator © 2024    Palo Alto Networks, Inc.                                                         Panorama VM 10.2 Security Policy 11

CO, User, Self-Test Run self-test via CLI or WebUI Output results via System Logs Show Status Show status via CLI or WebUI FIPS-CC Mode Indicator System Audit View system audit records via CLI or Audit records via System Logs Monitor System Status and View system status records via CLI or System status via System Logs Panorama Log Collector Setup Configuring and managing Log Confirmation of service via CO Collectors configurations via CLI or Configuration Logs. Assumption of Roles The module supports distinct operator roles. The cryptographic module in Panorama or Management-Only mode enforces the separation of roles using unique authentication credentials associated with operator accounts. The Log Collector mode only supports one role, the Crypto-Officer (CO) role. The module does not provide a maintenance role or bypass capability. Table 8 - Roles and Authentication Role Authentication Method Authentication Strength Minimum length is eight1 (8) characters (95 possible characters). The probability that a random attempt will succeed or a false acceptance Memorized Secret (Unique will occur is 1/(958) which is less than 1/1,000,000. The probability of Username/password) and/or successfully authenticating to the module within one minute is Single-Factor Cryptographic 10/(958), which is less than 1/100,000. The module’s configuration Software (certificate common supports at most ten failed attempts to authenticate in a one-minute Certificate/Public key-based The security modules support public-key based authentication using Memorized Secret (Unique Username/password) and/or The minimum equivalent strength supported is 112 bits. The Single-Factor Cryptographic probability that a random attempt will succeed is 1/(2112) which is less User than 1/1,000,000. The probability of successfully authenticating to name / public key-based the module within a one minute period is 10/(2112), which is less than authentication) 1/100,000. The module supports at most 10 failed attempts and locks out afterwards. Definition of CSPs Modes of Access The following table defines the relationship between access to CSPs and the different module services. The modes of access shown in the table are defined as: In FIPS-CC Mode, the module checks and enforces the minimum password length of eight (8) as specified in SP 800-63B. Passwords are securely stored hashed with salt value, with very restricted access control, and rate limiting mechanism for authentication attempts. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 12

G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Note: Unless otherwise specified, all services are available in all system modes. If there is a service that is specific to a certain system mode, it is noted in the Description column. Table 9 – Approved Services Functions                SSPs                                 rights to Query the module to                                                                                              Version displayed via Show Version                                     N/A                                    N/A                    CO      N/A display the version                                                                                              System Logs / CLI / UI RSA SigVer (186-4)                     CA Certificates                G/R/E/W RSA SigVer (186-4)                     RSA Public Keys                G/R/E/W ECDSA SigVer (186-4)                   ECDSA Public Keys              G/R/E/W TLS Pre-Master Secret           G/E/Z KDF TLS TLS Master Secret               G/E/Z CKG,                           TLS DHE/ECDHE Private G/E/Z KAS    ECDSA KeyGen (FIPS 186-4),     Components Connect to module’s web              ECDSA KeyVer (FIPS 186-4),     TLS DHE/ECDHE Public Access web                                              Safe Primes Key Generation,                                    G/E/Z CO                   System Logs portal                                                  Safe Primes Key Verification (Panorama or G/E/Z DRBG Seed DRBG Key Counter DRBG, ESV                                                     G/E DRBG V Entropy Input String SSH Session Authentication Keys SSH Session                    G/E/Z Encryption Keys Private Components Connect to module’s CLI via                                                                 CO, Safe Primes Key Generation                                    G/E/R/W/Z Public Components Safe Primes Key DRBG Seed DRBG Key Counter DRBG, ESV                                                     G/E DRBG V Entropy Input String © 2024        Palo Alto Networks, Inc.                                                                           Panorama VM 10.2 Security Policy 13

Perform panorama debug functions, manage Panorama support information and switch Provisioning                                                                                                                            Configuration logs Logger modes. (Panorama or Download and install                                                  Public Key for                                 System and Software                                          RSA SigVer (FIPS 186-4)                                        CO        W/E software updates                                                      Software Load Test                             Configuration logs CKG                                    RSA Private Keys                   G/W/E RSA KeyGen (FIPS 186-4) RSA SigGen (FIPS 186-4) CKG                                    ECDSA Private Keys                 G/W/E ECDSA KeyGen ( FIPS 186-4) ECDSA SigGen (FIPS 186-4) RSA SigVer (FIPS 186-4)                RSA Public Keys                   G/R/E/W ECDSA SigVer (FIPS 186-4)              ECDSA Public Keys                 G/R/E/W SNMPv3 Authentication             W/E SNMPv3 Privacy Secret             W/E HMAC-SHA-1                            Authentication Key                G/E/Z AES-CFB128                            Session Key                       G/E/Z RSA SigVer (FIPS 186-4) ECDSA SigVer                          CA Certificates                   G/R/E/W Presents configuration        (FIPS 186-4) options for management interfaces and                                                       TLS Pre-Master Secret             G/E/Z communication for peer                KDF TLS TLS Master Secret                 G/E/Z RADIUS).                              CKG,                           TLS DHE/ECDHE Private Manager Setup                                                                                                                           Configuration logs revert and validate                   ECDSA KeyVer (FIPS 186-4),     TLS DHE/ECDHE Public and state role                        Safe Primes Key Generation,                                      G/E/R/W/Z Safe Primes Key Verification AES-CBC, AES-CTR               SSH Session Encryption            G/E/Z KAS     KDF SSH                        SSH DHE/ECDHE Private             G/E/Z Safe Primes Key Generation,    SSH DHE/ECDHE Public              G/E/R/W/Z Safe Primes Key Verification   Components DRBG Seed Counter DRBG, ESV                      DRBG Key                          G/E © 2024         Palo Alto Networks, Inc.                                                                               Panorama VM 10.2 Security Policy 14

DRBG V Entropy Input String Define access control         N/A                          CO, User Password             G/E/W methods via admin profiles, configure administrators      RSA SigVer (FIPS 186-4)      SSH Client Public Key         W/E Configure local user                                                               CO Administrative                                                                                                          Configuration logs database, authentication      RSA SigVer (FIPS 186-4) Access                                                                       SSH Host Public Key           G/R/E/W profiles, sequence of         ECDSA SigVer (FIPS 186-4) Configure High Availability   RSA SigVer (FIPS 186-4)      RSA Public Key                G/R/E/W communication settings Configure High CO                 Configuration Logs Availability                                    ECDSA SigVer (FIPS 186-4)    ECDSA Public Key              G/R/E/W (Panorama or Management-Only Mode) ECDSA SigGen (FIPS 186-4)                 RSA Private Keys G/R/W/E      Configuration Logs RSA SigGen                   ECDSA Private Keys (FIPS 186-4) Manage RSA/ECDSA              ECDSA SigVer Panorama          certificates and private      (FIPS 186-4)                 RSA Public Keys G/R/W/E      Configuration Logs Management        revocation status, and         (FIPS 186-4) usage; show status.                                        DRBG Seed DRBG Key Counter DRBG, ESV                                          G/E          System Logs DRBG V Entropy Input String Configure log forwarding Panorama Log N/A                          N/A                     CO    N/A          Configuration Logs Management-Only Mode) SNMPv3 Authentication         W/E KDF SNMP (CVL)              Secret Configure communication                                   SNMPv3 Privacy Secret         W/E parameters and information for peer          HMAC-SHA-1                  Authentication Key            G/E/Z Server Profiles AES-CFB128                  Session Key                   G/E/Z Set-up and define managed devices, device groups for Configure device deployment applications and licenses Setup Managed     View current deployment Devices and       information on the            N/A                          N/A                     CO    N/A          Configuration Logs allows you to manage software/firmware versions and schedule updates on the managed firewalls and managed log collectors. (Panorama or Management-Only Mode) Setup and manage other Log Collector management, Configure         communication and storage System and Managed Log       settings                      N/A                          CO, User Password       CO    G/E/W Configuration logs Collectors        View current deployment information on the managed Log Collectors. It © 2024       Palo Alto Networks, Inc.                                                                 Panorama VM 10.2 Security Policy 15

also allows you to manage software/firmware versions and schedule updates on managed log collectors. (Panorama or Management-Only Mode) Zeroize           Overwrite all CSPs             N/A                                   All keys and SSPs       CO        Z            Zeroization Indicator Run power up self-tests on Self-Test         demand by power cycling        N/A                                                                     E            System Logs Verification Key        User the module. CO,                    FIPS-CC Mode Show Status       View status of the module      N/A                                   N/A                               N/A Allows review of limited configuration and system status via SNMPv3, logs, and configuration screens. System Audit                                     N/A                                   N/A                               N/A          System Logs configuration commit (Panorama or Management-Only Mode) Review system status via the panorama system CLI, and Logs (Panorama or Management-Only Mode) CKG                                   RSA Private Keys                   G/W/E RSA KeyGen (FIPS 186-4) RSA SigGen (FIPS 186-4) CKG                                   ECDSA Private Keys                 G/W/E ECDSA KeyGen ( FIPS 186-4) ECDSA SigGen (FIPS 186-4) RSA SigVer (FIPS 186-4)               RSA Public Keys                   G/R/E/W ECDSA SigVer (FIPS 186-4)             ECDSA Public Keys                 G/R/E/W TLS Pre-Master Secret             G/E/Z KDF TLS TLS Master Secret                 G/E/Z Presents configuration options for management               CKG,                           TLS DHE/ECDHE Private interfaces and                       ECDSA KeyGen (FIPS 186-4),     Components communication for peer               ECDSA KeyVer (FIPS 186-4),     TLS DHE/ECDHE Public Panorama Log                                           Safe Primes Key Generation,                             CO       G/E/R/W/Z Collector Setup                                        Safe Primes Key Verification revert and validate Panorama configurations              HMAC-SHA2-256                  TLS HMAC Keys G/E/Z (Log Collector mode) HMAC-SHA-1                     SSH Session                       G/E/Z AES-CBC, AES-CTR               SSH Session Encryption            G/E/Z KDF SSH (CVL)                  SSH DHE/ECDHE Private             G/E/Z © 2024        Palo Alto Networks, Inc.                                                                              Panorama VM 10.2 Security Policy 16

Safe Primes Key Generation, Safe Primes Key Verification DRBG Seed DRBG V Counter DRBG, ESV G/E DRBG Key Entropy Input String Note: Configuration/System Logs for Approved services above will indicate FIPS-CC mode is enabled and that the service succeeded.

5. Software/Firmware Security The module performs the Software Integrity test by using HMAC-SHA-256 (HMAC Cert. #A2907) during the Pre-Operational Self-Test. In addition, the module also conducts a software load test by using RSA 2048 with SHA-256 (Cert. #A2907) for the new validated software to be uploaded into the module. Any software loaded into this module that is not shown on the module certificate is out of scope of this validation, and requires a separate FIPS 140-3 validation. The pre-operational self-tests can be initiated by power cycling the module. When this is performed, the module automatically runs the cryptographic algorithm self-tests in addition to the pre-operational software integrity test.
6. Operational Environment The module is a modifiable operational environment as per FIPS 140-3 Level 1 specifications. The hypervisor environment provides an isolated operating environment and is the single operator of the virtual machine. The tested operating environments isolate virtual systems into separate isolated process spaces. Each process space is logically separated from all other processes by the operating environments software and hardware. The module functions entirely within the process space of the isolated system as managed by the single operational environment. This implicitly meets the FIPS 140-3 requirement that only one (1) entity at a time can use the cryptographic module.
7. Physical Security The module is a software only module; FIPS 140-3 physical security requirements are not applicable.
8. Non-Invasive Security There are currently no defined Approved non-invasive attack mitigation test metrics in SP 800-140F.
9. Sensitive Security Parameters Management The following table details all the sensitive security parameters utilized by the module. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 17

Table 10 – SSPs ECDSA/RSA Public key Used to trust a root CA RSA SigVer (FIPS                                                                  HDD – intermediate CA and TLS or SSH                                                       leaf /end entity at session RSA public keys managed as certificates for the verification of RSA SigVer                       Session Key and peer RSA Private keys for generation of RSA SigGen                       TLS or SSH                                                       signatures, at session managed as certificates for the verification of and peer ECDSA Private key for ECDSA SigGen                     TLS or SSH                                                       generation of signatures at session Ephemeral values used Ephemeral values used Secret value used to KAS SP                                                         Zeroize at      derive the TLS Master KDF TLS TLS Pre-Master Secret   N/A                            800-56A Rev. N/A               N/A           RAM – plaintext   session         Secret along with client
3                                                              termination     and server random
Zeroize at      Secret value used to KDF TLS TLS Master Secret       N/A                            KDF TLS       N/A              N/A           RAM – plaintext   session         derive the TLS session © 2024      Palo Alto Networks, Inc.                                                                           Panorama VM 10.2 Security Policy 18

800-56A Rev. 3 public component Plaintext SSH                                                         public component RSA SigVer (FIPS 186-4)                                                                                          SSH Host Public Key SSH Host Public Key                                                        N/A             N/A Public RSA key used to RSA SigVer
112 - 150                                   Encrypted via                    HDD/RAM –          Zeroize           authenticate client.
SSH Client Public Key                      (FIPS 186-4)     N/A                            N/A

Used in all SSH connections to the Zeroize at        security module’s KDF SSH        N/A                              RAM - plaintext    session           command line interface. Authentication keys used in all SSH connections to the Zeroize at        security module’s KDF SSH           N/A                              RAM - plaintext    session           command line interface Used to check the integrity of verification key                            ECDSA SigVer (Note: This is not considered               (FIPS 186-4) an SSP)                                     Cert. #A2907 Used to authenticate Public key for software content load test Cert. #A2907                                                                                          on the module (RSA Authentication string SHA2-256                        Encrypted via                    HDD - a password CO, User Password              N/A                          External                       N/A                               Zeroize Service     with a minimum length of eight (8) characters. Encrypted via                    HDD/RAM –                            Secrets used by RADIUS Protocol Secrets               N/A         N/A              N/A                            N/A                                Zeroize Service Entropy input string Entropy as                                                                         coming from the Entropy Input String           256 bits                       per          N/A             N/A              RAM - plaintext   Power cycle        entropy source Input length = 384 bits CKG (vendor        Entropy as                                                                        DRBG seed coming from DRBG Seed                       256 bits    affirmed), Counter per          N/A             N/A              RAM - Plaintext   Power cycle       the entropy source © 2024        Palo Alto Networks, Inc.                                                                                 Panorama VM 10.2 Security Policy 19

Seed length = 384 bits Entropy as DRBG state Key used in the generation of a random SP 800-90B Entropy as DRBG state V used in the generation of a random SP 800-90B SNMPv3 Authentication Used to support SNMPv3 KDF SNMP Encrypted via HDD/RAM

• (Minimum 8 characters) Used to support SNMPv3 KDF SNMP Encrypted via HDD/RAM
• (Minimum 8 characters) KDF SNMP N/A N/A Privacy protocol SNMPv3 Session Key KDF SNMP N/A N/A encryption key Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. The module utilizes the following entropy source, which is internal to the physical perimeter of the host GPC. Table 11 - Non-Deterministic Random Number Generation Specification Entropy Source Minimum number of bits of entropy Details Palo Alto Networks DRNG Entropy 256 bits Source Entropy source provides full entropy, which is provided in the 384 bit seed. 10. Self-Tests The cryptographic module performs the following tests below. The operator can command the module to perform the pre-operational and cryptographic algorithm self-tests by cycling power of the module. The pre-operational and conditional self-tests are performed automatically and do not require any additional operator action. Pre-operational Self-Tests Pre-operational Software Integrity Test
• Verified with HMAC-SHA-256 and ECDSA P-256 © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 20

Note: the ECDSA and HMAC-SHA-256 KATs are performed prior to the Software integrity test Conditional self-tests Cryptographic algorithm self-tests

• AES 128-bit ECB Encrypt Known Answer Test
• AES 128-bit ECB Decrypt Known Answer Test
• AES 128-bit CMAC Known Answer Test*
• AES 256-bit GCM Encrypt Known Answer Test
• AES 256-bit GCM Decrypt Known Answer Test
• AES 192-bit CCM Encrypt Known Answer Test*
• AES 192-bit CCM Decrypt Known Answer Test *
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Sign Known Answer Test
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Verify Known Answer Test
• RSA 2048-bit Encrypt Known Answer Test*
• RSA 2048-bit Decrypt Known Answer Test*
• ECDSA P-256 with SHA-512 Sign Known Answer Test
• ECDSA P-256 with SHA-512 Verify Known Answer Test
• HMAC-SHA-1 Known Answer Test
• HMAC-SHA-256 Known Answer Test
• HMAC-SHA-384 Known Answer Test
• HMAC-SHA-512 Known Answer Test
• SHA-1 Known Answer Test
• SHA-256 Known Answer Test
• SHA-384 Known Answer Test
• SHA-512 Known Answer Test
• DRBG SP 800-90Arev1 Instantiate/Generate/Reseed Known Answer Tests
• SP 800-90Arev1 Instantiate/Generate/Reseed Section 11.3 Health Tests
• SP 800-56Ar3 KAS-FFC-SSC 2048-bit Known Answer Test
• SP 800-56Ar3 KAS-ECC-SSC P-256 Known Answer Test
• SP 800-135rev1 TLS 1.2 with SHA-256 KDF Known Answer Test
• SP 800-135rev1 SSH KDF with SHA-256 Known Answer Test
• SP 800-135rev1 IKEv2 KDF Known Answer Test*
• SP 800-90B RCT/APT Health Tests on Entropy Source Note: The SP 800-90B Health Tests are implemented by the entropy source. *Note: Supported by the module cryptographic implementation, but only utilized for CAST Conditional Pairwise Consistency Self-Tests
• RSA Pairwise Consistency Test
• ECDSA/KAS-ECC Pairwise Consistency Test
• KAS-FFC Pairwise Consistency Test Conditional Software Load test
• Software Load Test
• Verify RSA 2048 with SHA-256 signature on software at time of load Conditional Critical Functions Tests
• SP 800-56A Rev. 3 Assurance Tests (Based on Sections 5.5.2, 5.6.2, and 5.6.3) Error Handling In the event of a conditional test failure, the module will output a description of the error. These are summarized below. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 21

Table 12 - Errors and Indicators Cause of Error Error State Indicator Conditional Cryptographic Algorithm Self-Test or Software FIPS-CC mode failure. <Algorithm test> failed. Integrity Test Failure Conditional Pairwise Consistency or Critical Functions Test System log prints an error message. Conditional Software Load Test Failure System prints Invalid image message.

11. Life-cycle Assurance The vendor provided life-cycle assurance documentation describes configuration management, design, finite state model, development, testing, delivery & operation, end of life procedures, and guidance. For details regarding the approved mode of operation, see “Approved Mode of Operation''. For details regarding secure installation, initialization, startup, and operation of the module, see below. Installation Instructions The module can be retrieved by downloading Panorama_pc-10.2.3-h1 Palo Alto Network provides an Administrator Guide for additional information noted in the “References” section of this Security Policy. The module design corresponds to the module security rules. Module Enforced Security Rules This section documents the security rules enforced by the cryptographic module to implement the security requirements of this FIPS 140-3 Level 1 module.
12. The cryptographic module shall provide distinct operator roles. When the module has not been placed in a valid role, the operator shall not have access to any cryptographic services.
13. The cryptographic module shall clear previous authentications on power cycle.
14. The module shall support the generation of key material with the approved DRBG. The entropy provided must be greater than or equal to the strength of the key being generated.
15. Data output shall be inhibited during self-tests and error states.
16. Processes performing key generation and zeroization processes shall be logically isolated from the logical data output paths.
17. The module does not output intermediate key generation values.
18. Status information output from the module shall not contain CSPs or sensitive data that if misused could lead to a compromise of the module.
19. There are no restrictions on which keys or CSPs are zeroized by the zeroization service.
20. The module maintains separation between concurrent operators.
21. The module does not support a maintenance interface or role.
22. The module does not have any external input/output devices used for entry/output of data.
23. The module does not enter or output plaintext CSPs.
24. The cryptographic module provides identity-based authentication. © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 22

Vendor Imposed Security Rules In FIPS-CC mode, the following rules shall apply:

1. When FIPS-CC mode is enabled, the operator shall not install plugins. a. Checked via CLI using “show plugins installed”
2. When FIPS-CC mode is enabled, the operator shall not use TACACS+. RADIUS may be used but must be protected by TLS protocol. a. Checked via CLI using “show deviceconfig” command Key to Entity The cryptographic module associates all keys (secret, private, or public) stored within, entered into or output from the module with authenticated operators of the module. Keys stored within the module are only made available to authenticated operators via TLS or SSH. Keys are only input or output from the module by the authenticated operator via a SSH or TLS protected communication. Any attempt to intervene in the key to entity relationship would require defeating the module TLS or SSH encryption and authentication/integrity mechanism.
3. Mitigation of Other Attacks This module is not designed to mitigate other attacks outside the scope of FIPS 140-3.
4. References [FIPS 140-3] FIPS Publication 140-3 Security Requirements for Cryptographic Modules [AGD] Panorama Administrator’s Guide Version 10.2
5. Definitions and Acronyms AES – Advanced Encryption Standard CA – Certificate Authority CLI – Command Line Interface CO – Crypto-Officer CSP – Critical Security Parameter CVL – Component Validation List DB9 – D-sub series, E size, 9 pins DES – Data Encryption Standard DH – Diffie-Hellman DRBG – Deterministic Random Bit Generator EDC – Error Detection Code ECDH – Elliptical Curve Diffie-Hellman ECDSA – Elliptical Curve Digital Signature Algorithm FIPS – Federal Information Processing Standard HMAC – (Keyed) Hashed Message Authentication Code KDF – Key Derivation Function LED – Light Emitting Diode RJ45 – Networking Connector © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 23

RNG –Random number generator RSA

• Algorithm developed by Rivest, Shamir and Adleman SHA
• Secure Hash Algorithm SNMP
• Simple Network Management Protocol SSH
• Secure Shell TLS
• Transport Layer Security USB
• Universal Serial Bus VGA
• Video Graphics Array © 2024 Palo Alto Networks, Inc. Panorama VM 10.2 Security Policy 24