Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Certificate

Approved Algorithms (203)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery<br/>update</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Symmetric encryption<br/>Symmetric decryption<br/>Symmetric encryption (for data storage)</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery<br/>update</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Symmetric encryption<br/>Symmetric decryption<br/>Symmetric encryption (for data storage)</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

Canonical Ltd. Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module version 1.9.4-3ubuntu3+Fips1.2 Document version 1.1 Last updated: 2024-08-30 Prepared by: Prepared for: atsec information security corporation Canonical Ltd.

5th Floor Austin, TX 78759 London, SE1 0SU www.atsec.com www.canonical.com

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table of Contents © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module List of Tables Table 2: Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid ...12 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module List of Figures © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

This document is the non-proprietary FIPS 140-3 Security Policy for version 1.9.43ubuntu3+Fips1.2 of the Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module. It has a one-to-one mapping to the [SP 800-140B] standard, starting with Section B.2.1 named “General” that maps to Section 1 in this document and ending with Section B.2.12 named “Mitigation of Other Attacks” that maps to Section 12 in this document.

N/A N/A Table 1: Security Levels © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Purpose and Use: The module is software library implementing general purpose cryptographic algorithms. The module provides cryptographic services to applications running in the user space of the underlying operating system through an application program interface (API). The module is implemented as a set of shared library / binary file; as shown in Figure 1. The shared library file constitutes the cryptographic boundary. Module Type: Software Module Embodiment: Multi-Chip standalone Module Characteristics: Cryptographic Boundary: The Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets) table in Section 2.2 lists the software components of the cryptographic module, which defines its cryptographic boundary. Tested Operational Environment’s Physical Perimeter (TOEPP) [O]: The physical perimeter is comprised in a General Purpose Computer. Figure 1: Block Diagram © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Identification Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): 1.9.43ubuntu3+Fips1.2 N/A N/A Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: SYS-1019PWTR N/A 1.9.43ubuntu3+Fips1.2 N/A 1.9.43ubuntu3+Fips1.2 N/A 1.9.43ubuntu3+Fips1.2 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module SYS-1019PWTR N/A 1.9.43ubuntu3+Fips1.2 N/A 1.9.43ubuntu3+Fips1.2 N/A 1.9.43ubuntu3+Fips1.2 Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

There are no excluded components from the module.

Modes List and Description: © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Nonapproved NonApproved Table 5: Modes List and Description Mode Change Instructions and Status [O]: When the module starts up successfully, after passing all the pre-operational self-test, the module is operating in the approved mode of operation by default and can only be transitioned into the non-approved mode by calling one of the non-approved services listed in the Non-Approved Services table. See Section 4 for the details on service indicator provided by the module that identifies when an approved service is called. There is no degraded mode of operation implemented within the module.

Approved Algorithms: © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table 6: Approved Algorithms The table above lists all implemented modes of operation for every security function employed for approved services by the module. Vendor-Affirmed Algorithms: © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module N/A Table 7: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table 8: Non-Approved, Not Allowed Algorithms The table above lists non-approved algorithms that are not allowed in the approved mode of operation. These algorithms are used by the non-approved services listed in the Non-Approved Services table.

HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module HMAC-SHA3224 HMAC-SHA3224 HMAC-SHA3224 HMAC-SHA3224 HMAC-SHA3256 HMAC-SHA3256 HMAC-SHA3256 HMAC-SHA3256 HMAC-SHA3384 HMAC-SHA3384 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module HMAC-SHA3384 HMAC-SHA3384 HMAC-SHA3512 HMAC-SHA3512 HMAC-SHA3512 HMAC-SHA3512 SHA2512/224:N/A SHA2512/256:N/A © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module AsymKeyPairKeyGen AsymKeyPairKeyVer © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table 9: Security Function Implementations © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

The AES algorithm in XTS mode can be only used for the cryptographic protection of data on storage devices, as specified in [SP800-38E]. The AES-XTS shall not be used for other purposes, such as the encryption of data in transit. In addition, the length of a single data unit encrypted with the XTS-AES shall not exceed 2²⁰ AES blocks, that is 16MB of data. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical.

The module provides password-based key derivation (PBKDF), compliant with SP800132. The module supports option 1a from Section 5.4 of [SP800-132], in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance with [SP800-132] and FIPS 140-3 IG D.N, the following requirements shall be met.

• Derived keys shall only be used in storage applications. The Master Key (MK) shall not be used for other purposes. The module accepts a minimum length of

A portion of the salt, with a length of at least 128 bits, shall be generated randomly using the SP800-90A DRBG. The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The module only allows minimum iteration count to be 1000. Passwords or passphrases, used as an input for the PBKDF, shall not be used as cryptographic keys. The minimum length of the password or passphrase accepted by the module is

scenario of all digits, is estimated to be at most 10-14. Combined with the minimum iteration count, this provides an acceptable trade-off between user experience and security against brute-force attacks. The calling application shall also observe the rest of the requirements and recommendations specified in [SP800-132]. © 2024 Canonical Ltd. / atsec information security.

Table 10: Entropy Certificates 2.2.0) Table 11: Entropy Sources The module provides an SP800-90A-compliant Deterministic Random Bit Generator (DRBG) for creation of key components of asymmetric keys, and random number generation. The seeding (and automatic reseeding) of the DRBG is done with getrandom(). The DRBG supports the Hash_DRBG, HMAC_DRBG and CTR_DRBG mechanisms. The DRBG is initialized during module initialization; the module loads by default the DRBG using the HMAC_DRBG mechanism with SHA-256 and without prediction resistance. A different DRBG mechanism can be chosen by invoking the gcry_control(GCRYCTL_DRBG_REINIT) function. The module uses an [SP800-90B]-compliant entropy source specified in the table above. This entropy source is located within the module’s physical perimeter, but outside of the module’s cryptographic boundary. This is in compliance with IG 9.3.A Resolution 1(b). The module obtains 384 bits to seed the DRBG, and 256 bits to reseed it. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module The module performs the DRBG health tests as defined in Section 11.3 of [SP80090A].

The module provides an [SP800-90Arev1]-compliant Deterministic Random Bit Generator (DRBG) for the creation of key components of asymmetric keys and random number generation. The Cryptographic Key Generation (CKG) methods implemented in the module for Approved services in approved mode are compliant with Section 4 example 1 of [SP800-133rev2]. For generating RSA and ECDSA keys, the module implements asymmetric key generation services compliant with [FIPS186-4]. A seed (i.e., the random value) used in asymmetric key generation is directly obtained from the [SP800-90Arev1] DRBG. Additionally, the module implements the PBKDF2 key derivation method compliant with option 1a of SP 800-132. This implementation shall only be used to derive keys for use in storage applications.

The module provides the following key transport mechanisms:

• AES Key wrapping using AES-KW.
• AES Key wrapping using AES-CCM. According to Table 2: Comparable strengths in [SP 800-57rev5], the key sizes of AES provide the following security strength in approved mode of operation: AES key wrapping in KW mode provides between 128 and 256 bits of encryption strength.
• AES key wrapping using AES-CCM provides between 128 and 256 bits of encryption strength.

The module does not support any industry protocols listed within the publication of SP 800-135rev1. Therefore, this section is not applicable.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

N/A N/A N/A N/A Table 12: Ports and Interfaces As a software-only module, the module does not have physical ports. The operator can only interact with the module through the API provided by the module. Thus, the physical ports are interpreted to be the physical ports of the hardware platform on which the module runs. All data output via data output interface is inhibited when the module is performing pre-operational test or zeroization or when the module enters error state.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

N/A for this module. The module does not support authentication.

Table 13: Roles The module supports the Crypto Office role only. This sole role is implicitly assumed by the operator of the module when performing a service.

o e) s o © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module m

• W,E m
• W,E
• G,E G,E s e) © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s t precompu precompu t A A

• A G,E A G,E
• W,E
• W,E © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s A

• A W,E )
• W,E A )
• A W,E A o © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s ) m r m A W,E m r

• W,E G,W,E (V C ): G,W,E (V G,W,E © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

• Hashbased C
• W,E AESbased
• W,E
• W,E d
• W,E s © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s o : W,E G,R e N/A e

• N/A
• Z Z © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s Z A Z A Z :Z Z (V C ): Z © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module s (V Z Z Selftests m selftests N/A selftest o e n N/A e's n

• Table 14: Approved Services The table above lists the approved services. For each service, the table lists the associated cryptographic algorithm(s), the role to perform the service, the cryptographic keys or CSPs involved, and their access type(s). The following convention is used to specify access rights to a CSP:
• G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroize: The module zeroizes the SSP. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module • N/A: the calling application does not access any CSP or key during its operation. The details of the approved cryptographic algorithms including the CAVP certificate numbers can be found in the Approved Services table. In order to check whether it utilizes an approved security function or not, the operator is responsible to invoke the gcry_control() API along with dedicated controls in the form of API input parameters. The module implements the following controls depending on the requested service:

1. GCRYCTL_FIPS_SERVICE_INDICATOR_CIPHER - For symmetric algorithms.
2. GCRYCTL_FIPS_SERVICE_INDICATOR_KDF - For KDF functions.
3. GCRYCTL_FIPS_SERVICE_INDICATOR_PK_FLAGS - For asymmetric functions.1
4. GCRYCTL_FIPS_SERVICE_INDICATOR_MD - For digest functions.
5. GCRYCTL_FIPS_SERVICE_INDICATOR_MAC - For MAC functions.
6. GCRYCTL_FIPS_SERVICE_INDICATOR_FUNCTION - For non-approved public key functions. In addition to that, for some of the below-mentioned services, the approved service indicator corresponds to the successful completion of the service. This affects the following APIs: 1. gcry_randomize, gcry_random_bytes, gcry_random_bytes_secure – API for Random number generation service. 2. gcry_mpi_ec_curve_point – API for Public key verification service. For all approved services, GPG_ERR_NO_ERROR (i.e., “0”) return code indicates the service is approved. In case the dedicated functions are used in conjunction with the APIs representing the requested services, the operator is responsible to check that all of the called functions return GPG_ERR_NO_ERROR (i.e., “0”). For all non-approved services, "non-zero" return code indicates the service is not approved.

The list of public key flags allowed in approved mode of operation is described in 0. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table 15: Non-Approved Services The table above lists the non-approved services. The details of the non-approved cryptographic algorithms available in non-approved mode can be found in the NonApproved, Not Allowed Algorithms table.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

The integrity of the module is verified comparing the HMAC-SHA2-256 value calculated at run time with the HMAC-SHA2-256 value stored in the .hmac file that was computed at build time for each software component of the module. If the HMAC values do not match, the test fails and the module enters the Error state.

Integrity tests are performed as part of the Pre-Operational Self-Tests. The module provides the Self-Test service to perform self-tests on demand which includes the pre-operational self-test (i.e., integrity test) and cryptographic algorithm self-tests (CASTs). This service can be invoked relying on the gcry_control(GCRYCTL_SELFTEST) API function call or by powering-off and reloading the module. During the execution of the on-demand self-tests, services are not available, and no data output or input is possible. In addition, the integrity tests cannot be modified. In order to verify whether the self-tests have succeeded and the module is in the Operational state, the calling application may invoke the gcry_control(GCRYCTL_OPERATIONAL_P). The function will return TRUE if the module is in the operational state, FALSE if the module is in the Error state.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Type of Operational Environment: Modifiable How Requirements are Satisfied [O]: The module shall be installed as stated in Section 11. The operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

The application that requests cryptographic services is the single user of the module, even when the application is serving multiple clients. In the approved mode of operation, the ptrace(2) system call, the debugger (gdb(1)), and strace(1) shall be not used.

The module does not support multiple concurrent operators. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

N/A for this module. The module is comprised of software only, and therefore this section is not applicable.

Number: Not applicable. Placement: Not applicable. Surface Preparation: Not applicable. Operator Responsible for Securing Unused Seals: Not applicable. Part Numbers: Not applicable.

Not applicable. Table 16: EFP/EFT Information Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Table 17: Hardness Testing Temperatures Not applicable.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

This module does not implement any non-invasive security mechanism, and therefore this section is not applicable.

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Table 18: Storage Areas stored in the RAM in plaintext form. SSPs are provided to the module by the calling process and are destroyed when released by the appropriate zeroization function calls.

m Table 19: SSP Input-Output Methods output. The SSPs are provided to the module via API input parameters in plaintext form and output via API output parameters in plaintext form within the physical perimeter of the operational environment. This is allowed by [FIPS140-3_IG] 9.5.A, according to the “CM Software to/from App via TOEPP Path” entry on the Key Establishment Table. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module Table 20: SSP Zeroization Methods system calls. The application that is acting as the CO is responsible for calling the appropriate zeroization functions provided in the module's API and listed in the table above. Calling gcry_free(), which will zeroize the SSPs and also invoke the corresponding API functions listed above to zeroize SSPs. The zeroization functions the regular memory deallocation operating system call. In case of abnormal © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module termination, or swap in/out of a physical memory page of a process, the keys in physical memory are overwritten by the Linux kernel before the physical memory is allocated to another process. The completion of a zeroization routine(s) will indicate that a zeroization procedure succeeded. All data output is inhibited during zeroization.

h y - 112256 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module h y - 112256 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module h y - 112256 - 112256 Table 21: SSP Table 1 s n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module n n s n s s n s s n s s n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module n s s n e s n s n n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module n n n n Table 22: SSP Table 2 The tables above summarize the Sensitive Security Parameters (SSPs) that are used by the cryptographic services implemented in the module.

The SHA-1 algorithm, as implemented by the module, will be non-approved for all purposes starting January 1, 2030. The RSA algorithm as implemented by the module conforms to FIPS 186-4, which has been superseded by FIPS 186-5. FIPS 186-4 has been withdrawn since February 3, 2024. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

Not applicable. © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module

s HMACSHA2-256 n y l HMACSHA2-256 n y l HMACSHA2-256 n y l HMACSHA2-256 n y l HMACSHA2-256 n y l Table 23: Pre-Operational Self-Tests The module performs the integrity test using HMAC-SHA-256. Further details of the integrity test are provided in Section 5.1.

d e T l s © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l T l T l T l T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e AESCMAC s T l T l T l n AESCMAC T l n AESCMAC T l n AESCMAC T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l T l T l T l T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l T l T l T l T l T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l T l T l HMACSHA2-256 T l HMACSHA2-256 T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e HMACSHA2-256 HMACSHA2-256 s T l T l HMACSHA2-256 T l (FIPS1864) (A3700) T l (FIPS1864) (A3701) T l T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s (FIPS1864) (A3704) T l (FIPS1864) (A3705) T l (FIPS1864) (A3700) T l (FIPS1864) (A3701) T l (FIPS1864) (A3703) T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e (FIPS1864) (A3704) (FIPS1864) (A3705) s T l T l (FIPS1864) (A3700) T l (FIPS1864) (A3701) T l (FIPS1864) (A3703) T l (FIPS1864) (A3704) T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s (FIPS1864) (A3705) T l (FIPS1864) (A3700) T l (FIPS1864) (A3701) T l (FIPS1864) (A3703) T l (FIPS1864) (A3704) T l © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e (FIPS1864) (A3705) HMACSHA-1 HMACSHA-1 s T l T l n T l n HMACSHA-1 T l n HMACSHA-1 T l n HMACSHA-1 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s HMACSHA-1 T l n HMACSHA-1 T l n HMACSHA2-224 T l n HMACSHA2-224 T l n HMACSHA2-224 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e HMACSHA2-224 HMACSHA2-224 HMACSHA2-256 s T l n T l n T l n HMACSHA2-256 T l n HMACSHA2-256 T l n HMACSHA2-256 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s HMACSHA2-256 T l n HMACSHA2-384 T l n HMACSHA2-384 T l n HMACSHA2-384 T l n HMACSHA2-384 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e HMACSHA2-384 HMACSHA2-512 HMACSHA2-512 s T l n T l n T l n HMACSHA2-512 T l n HMACSHA2-512 T l n HMACSHA2-512 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s HMACSHA3-224 T l n HMACSHA3-224 T l n HMACSHA3-224 T l n HMACSHA3-256 T l n HMACSHA3-256 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e HMACSHA3-256 HMACSHA3-384 HMACSHA3-384 s T l n T l n T l n HMACSHA3-384 T l n HMACSHA3-512 T l n HMACSHA3-512 T l n © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s HMACSHA3-512 T l n T l Passwordbased key T l Passwordbased key T l Passwordbased key © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l Passwordbased key T l Passwordbased key T l Passwordbased key © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l Passwordbased key T l Passwordbased key T l Passwordbased key © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d e s T l Passwordbased key (FIPS1864) (A3700) with SHA2256 (FIPS1864) (A3701) with SHA2256 (FIPS1864) (A3703) with SHA2256 © 2024 Canonical Ltd. / atsec information security.

Canonical Ltd. Ubuntu 22.04 Libgcrypt Cryptographic Module d (FIPS1864) (A3704) with SHA2256 (FIPS1864) (A3705) e s with SHA2256 (FIPS1864) (A3700) with SHA2256 (FIPS1864) (A3701) with SHA2256 (FIPS1864) (A3703) with SHA2256 (FIPS1864) (A3704) © 2024 Canonical Ltd. / atsec information security.