PQCryptoLib

Certificate

Vendor resources (verify with the vendor)

Approved Algorithms (29)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for PQCryptoLib
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>upgrade</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for PQCryptoLib
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>upgrade</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

PQCryptoLib PQShield LTD PQCryptoLib Non-Proprietary FIPS 140-3 Security Policy Document Version: v1.0.0 Date: 26 July 2024 Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Table of Contents 1. 2. 2.1 2.2 2.3 2.3.1 2.3.2 2.4 2.4.1 2.5 3. 4. 4.1 4.2 4.3 5. 6. 7. 8. 9. 9.1 9.2 9.3 10. 11. 11.1 11.2 11.3 11.4 12. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib 13. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib List of Tables Table 7

• Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security List of Figures Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib hereafter denoted the Module. The Module is a library of cryptographic primitives with a C interface offering security against quantum adversaries. PQShield is a spin-out of the University of Oxford which provides expertise in the design and implementation of quantum-resistant cryptography for software and hardware applications. The FIPS 140-3 security levels for the Module are as follows: Table 1

• Security Levels N/A N/A N/A Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib 2. Cryptographic Module Specification The Module is classified as a software cryptographic module. It is a software library of cryptographic primitives with unified and easy to use API. The Module is intended for use by US Federal agencies or other markets that require FIPS 140-3 validated general purpose cryptographic library running on GPC. 2.1 Operational Environment A. Software module PQCryptoLib cryptographic module is tested on the following operational environment. Table 2

• Tested Operational Environments # Table 3
• Executable Code Sets - Software/Firmware/Hybrid # 1.0.0 N/A N/A PQShield also performed testing of the module on the following Operational Environments: Table 4
• Vendor Affirmed Operational Environments # Operational Environment listed in Table 4 were not tested. No claim is made as to the correct operation of the module or the security strengths of the generated keys when ported to an operational environment which is not listed on the validation certificate. Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib 2.2 Cryptographic Boundary The Module is a software library providing cryptographic services through application program interface (API) for use by Applications running in the user space of underlying operating system. The Module’s embodiment is defined as multi-chip standalone. The Figure 1 shows the cryptographic boundary of the Module, its interfaces with the tested operational environment’s physical perimeter (TOEPP) and flow of information between the Module and operator (a calling function of an Application using services of the Module). The software library is called libpqcrypto.so.1.0.0 (software version 1.0.0) that is intended to link with the Application. The Module can run in a multi- threaded environment, it requires POSIX thread library (pthread). The Module may call the CPU directly, that is done by performance optimized functions and to get entropy from the CPU. The module performs no communications other than with the calling application, tested operational environment and the CPU. Figure 1 - Module Block Diagram: Logical relationship of the Module to the other hardware and software components of the GPC. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib 2.3 The Module supports Approved mode of operation only. The Module does not support degraded mode and operates only in normal mode.

The Approved mode of operation is configured after the CO loads the module into memory, all self-tests are completed successfully, and only Approved algorithms are invoked. See Table 5 below for the list of approved algorithms.

Non-approved mode of operation is not supported. 2.4 Security Functions The Module implements the Approved and Non-Approved but Allowed cryptographic functions listed in the tables below. Table 5 - Approved Algorithms 2.4.B]1) 3) 3) Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib

1. No parts of this protocol, other than TLS v1.3 KDF, have been tested by the CAVP and CMVP.
2. Hash_DRBG is instantiated through the API. The security strength for random bit generation assumes that the random bit generator has been provided with at least 256-bits of entropy.
3. ECDSA always uses SHA2-256 for hashing the input message
4. Truncated HMAC is CAVP-validated, but not used by the Module
5. ECDH implements ECC CDH primitive from [56Ar3] by using curve P-256. No KDF is applied on the output.
6. If run as a recipient, implementation performs partial public key validation compatible with an algorithm specified in [56Ar3], section 5.6.2.3.4. Document Version 1.0.0 PQShield Public Material – May be reproduced only in its original entirety (without revision).

PQCryptoLib Table 6

• Vendor Affirmed Algorithms NOTE: The module does not implement any Non-Approved Algorithms Allowed in the Approved Mode of Operation. Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib NOTE: The module does not implement any Non-Approved Algorithms Not Allowed in the Approved Mode of Operation. Table 8 - Security Function Implementations Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib C.C Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib C.C Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Establishment Pairwise KeyEstablishment Establishment Pairwise KeyEstablishment DRBG KASSSC Per [IG] D.F Scenario 2 path (2), [56Ar3] compliant key agreement scheme where testing is performed separately for the shared secret computation and a KDF compliant with [135] without key confirmation. Per [IG] D.F Scenario 2 path (2), [56Ar3] compliant key agreement scheme where testing is performed separately for the shared secret computation and a KDF compliant with KDA without key confirmation. Per [IG] D.F Scenario 2 path (2), [56Ar3] compliant key agreement scheme where testing is performed separately for the shared secret computation and a KDF compliant with KDA without key confirmation. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

The Module supports KDF used by TLS protocol version 1.3. 2.5 Rules of Operation The Module is intended to link with the Application. To initialize the Module, the code of an application that wishes to use the Module, must include pqcl.h and fips.h header files. This allows an application to use the Module Initialization service. The Module Initialization service must be used to initialize the Module. The Module is initialized after the Module Initialization service returns with success. The Module Initialization service automatically detects and enables PAA if available. After the Module is initialized, the PAA can be disabled by calling the Disable PAA service. This service can be called only after successful initialization of the Module. The Module Initialization service runs pre-operational and conditional self-tests and the Disable PAA service runs conditional self-tests. The Zeroize service zeroizes the state of internal DRBGs. It must be explicitly called by the CO before the Module is unloaded from the application using it. In addition, the CO can zeroize individual SSPs as described in Section 9.4. Overall Security Design

• The Module provides one distinct operator role, namely Crypto Officer (CO).
• The Module does not provide authentication.
• The Module allows the operator to initiate power-up self-tests by power cycling power or resetting the Module.
• Pre-Operational self-tests do not require any operator action.
• Data output is inhibited during key generation, self-tests, zeroization, and error states.
• Status information does not contain CSPs or sensitive data that if misused could lead to a compromise of the Module.
• There are no restrictions on which keys or SSPs are zeroized by the zeroization service.
• The Module does not support concurrent operators.
• The Module does not support a maintenance interface or role.
• The Module does not support manual SSP establishment method.
• The Module does not have any proprietary external input/output devices used for entry/output of data.
• The Module stores plaintext CSPs.
• The Module does not output intermediate key values.
• The Module does not provide bypass services. Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib The Module is a software-only implementation. All keys, encrypted data, and control information are exchanged through calls to library functions (logical interfaces). As a software module, it has no access to the physical ports (physical covers, manual controls, physical status indicators) and hence those ports are the same as those of the GPC it runs on. The Module’s ports and associated FIPS defined logical interface categories are listed in Table 9. Table 9

• Ports and Interfaces N/A N/A N/A N/A N/A N/A N/A All the services of the Module return either numeric values of type pqcl_result_t or nothing. The return values are defined and described in the header files of the module. The PQCL_SUCCESS is a return value indicates success and values prefixed with PQCL_ERROR_ indicate some sort of failure. There is one exception, namely the Status enquiry service returns state of the library. When the Module is performing self-tests, during zeroization or is in the error state, all output on the Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib 4. Roles, Services and Authentication 4.1 Assumption of Roles and Related Services The Module implements a single instance of one authorized role: Crypto Officer (CO). The role is implicitly assumed by the entity accessing services implemented by the module and is authorized to access all services provided by the module. Only one concurrent user is allowed, namely, a CO is considered the owner of executing thread. The Module does not support a maintenance role or bypass capability. Table 10 lists all operator roles supported by the Module and their related services. Table 10

• Roles, Service Commands, Input and Output Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

2) Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib

1. Ensures PAA is disabled and runs set of self-tests.
2. Initializes internal structures, enables PAA if available. It runs integrity checks, critical function testing and set of self-tests. 4.2 Authentication Methods The Module does not support authentication. 4.3 Services All security services implemented by the Module are listed in Table 11 and Table 12 below. The SSPs modes of access are defined as: • G = Generate: The Module generates or derives the SSP. • R = Read: The SSP is read from the Module (e.g. the SSP is output). • W = Write: The SSP is updated, imported, or written to the Module. • E = Execute: The Module uses the SSP in performing a cryptographic operation. • Z = Zeroize: The Module zeroizes the SSP The “Indicator” column describes security service indicator (described in [IG] 2.4.C) used by the service. All the indicators are defined below in Table
3. Table 11 – Approved Services N/A N/A N/A N/A Z W, R, R, W, R, R, Document Version 1.0.0 PQShield Public Material – May be reproduced only in its original entirety (without revision).

PQCryptoLib N/A N/A Z, Z R, R W, W Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Z W, W N/A N/A N/A N/A N/A Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Z, Z R, R W, W N/A N/A N/A N/A Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib N/A N/A N/A N/A N/A N/A Z The following table contains non-approved, allowed services running in approved mode of operation. All those services implement Key Encapsulation Mechanism but are non-security relevant. Namely we do not declare any security on the keys generated by those algorithms. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Table 12 – Non-Approved Services

5. Software/Firmware Security The Module is composed of the software component delivered as a library (dynamic loadable shared object library) in a binary form. The software component is protected with the HMAC-SHA2-512 integrity testing technique described in Table
6. The integrity tests are always performed upon module initialization phase (described in §2.5) and can be performed on demand by power cycling the Module. In case the integrity test fails, the library is moved into ERROR state and the Module needs to be unloaded from the memory of the Application that uses the Module. The method used for integrity testing is detailed in Table
7. Document Version 1.0.0 PQShield Public Material – May be reproduced only in its original entirety (without revision).

PQCryptoLib 6. Operational Environment The Module operates under a modifiable operational environment as per the FIPS 140-3 definitions. The tested operational environment is listed in Table 2 above. In addition, PQShield claims that the Module can be ported on the operational environment listed in Table 4; no statement is made regarding the correct operation of the Module on the Vendor Affirmed Operational Environments. The Module runs on a GPC running one of the tested operational environments. Each tested operational environment manages processes in a logically separated manner, each process is assigned a private memory space, access to that space is restricted to the process running the Module and trusted parts of the operational environment. Process private memory space is used to store CSPs and SSPs. The CO role is considered the owner of the calling application that instantiates the module. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib

7. Physical Security Physical security is not applicable to software-only modules.
8. Non-Invasive Security The Module does not implement any mitigation method against non-invasive attack.
9. Sensitive Security Parameter (SSP) Management The SSPs generation column shown in Table 13 are defined as: • G1 = FIPS 186-4 compliant ECDSA key generation by testing candidate methods described in [186], subsection B.4.2. • G2 = Symmetric key generated by internal CAVP validated Hash_DRBG • G3 = Generated by the entropy source • G4 = Derived from internal state of Hash_DRBG • G5 = Generated by Hash_df hash derivation function of Hash_DRBG • G6 = KDK generated in two-step key derivation with HMAC used as PRF [56Cr2] • G7 = DKM generated by TLS v1.3 KDF [RFC8446] • G8 = Counter initialized to 0 and incremented during execution of an algorithm • G9 = Value modified during initialization and execution of the module The SSPs establishment column shown in Table 13 are defined as: • A1 = SP800-56A rev3 compliant ECDH key agreement (128 bit) • A2 = Derived using SP 800-108 compliant KDF The SSPs storage column shown in Table 13 are defined as: • S1 = Only stored in volatile memory (RAM) in plaintext • S2 = Publicly known value stored within the module code, validated by integrity check The SSPs import/export column shown in Table 13 are defined as: • E1 = Input in plaintext by the calling application • E2 = Public key output in plaintext • E3 = Secret key output in plaintext The SSPs zeroization column shown in Table 13 are defined as: • Z1 = Zeroized by Module power cycle or hard reset. • Z2 = Zeroized by the internal zeroization function by overwriting with a fixed pattern, that is octetstring filled with 0. • Z3 = Overwriting by new working state of Hash_DRBG during reseeding process Document Version 1.0.0 PQShield Public Material – May be reproduced only in its original entirety (without revision).

PQCryptoLib 9.1 Sensitive Security Parameters (SSP) All SSPs used by the Module are described in this section. All usage of these SSPs by the Module is described in the services detailed in 4.3. N/A N/A DRBGSEED N/A N/A N/A N/A N/A N/A N/A N/A Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision). Related keys Use Zeroization Storage Establishment Import/Export Security Function and Cert. Number Strength Key/SSP Name/Type Table 13
• SSPs

HKDFKDK ECDSAPRV ECDHPRV ECDH-KZ N/A N/A N/A N/A N/A N/A N/A N/A randomnessextraction step the keyderivation Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision). Related keys Use Zeroization Storage Establishment Import/Export Security Function and Cert. Number Strength Key/SSP Name/Type PQCryptoLib ECDH-KPRV ECDH-KPRV

N/A N/A Related keys N/A Use Storage Zeroization Establishment Security Function and Cert. Number Import/Export Generation Strength Key/SSP Name/Type PQCryptoLib N/A N/A N/A TLSCHTS N/A TLSCATS N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

N/A N/A ECDSAPUB ECDHPUB 9.2 N/A N/A N/A N/A Related keys Use N/A Zeroization N/A N/A Storage Establishment Generation Import/Export Security Function and Cert. Number Strength Key/SSP Name/Type PQCryptoLib 0. except TLSPSK DRBG Entropy Source The RNG module leverages two different entropy sources, one provided by the CPU and the other provided by operational environment. The RDSEED is a CPU instruction, used to get entropy directly from the Intel CPU. Additionally, the Module uses the entropy from environmental noise. This is done by using getrandom system call. Returned bytes from both sources are XORd together and provided to the RNG initialization function as an entropy. In case entropy source fails to produce entropy, the RNG initialization procedure sets FSM to an ERROR state, resulting in the Module being not available for use in approved mode operation. The module conforms to FIPS 140-3 IG 9.3.A scenario 2b, thus the following caveat is applicable: No assurance of the minimum strength of generated SSPs (e.g., keys). Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib Table 14

• Non-Deterministic Random Number Generation Specification 9.3 Zeroization of SSPs SSPs are zeroized when the appropriate operation context is destroyed, after Zeroize service has completed an operation or on power cycling/reboot of host platform. Input and output interfaces are inhibited while zeroization is performed. The ZSI indicator must be used to check if zeroization was successful. Zeroization needs to be performed under the control of the Crypto Officer. SSPs are overwritten with fixed pattern (octet-string filled with 0) and hence are not retrievable upon zeroization. Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib The Module performs self-tests to ensure the proper operation. Per FIPS 140-3, these are categorized as either pre-operational self-tests or conditional self-tests. Pre-operational self–tests are available on demand by power cycling the Module and calling the Module Initialization service. The module uses critical functions, namely hash-based DRBG and HMAC-SHA2-512. The critical functions are tested both during pre-operational and conditional testing run. There is only one self-tests error state, and it is described in the table below: Table 15

• Error States and Indicators The Module performs the following pre-operational self-tests: Table 16
• Pre-Operational Self-Test The Module performs the following conditional self-tests: Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib Table 17

• Conditional Self-Tests Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib KDA TwoStep Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib The Module provides the operator dedicated query function to determine whether the current security service in use is approved. Security services implemented by the Module are grouped by type. The Module provides one query function for each type of service. Details of usage are described in the product documentation. Table 18 defines a mapping between the identifier of the service indicator (used in the tables above) and Table 18

• Service Indicators Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib 11. Life-Cycle Assurance

The Module is delivered in a form of dynamically linkable software library and the API declared in the header files. The Module is intended to be linked with the Application. The library is delivered in a tarball file, that contains linkable software library and the API declared in the header files, as well as documentation. To install the library, an operator needs to unpack the tarball to target directory of its choice. Following command should be used: mkdir -p /opt/pqshield/pqcryptolib tar xvf pqcryptolib_v1.0.0.0_amd64_linux.tar.gz \ -C /opt/pqshield/pqcryptolib An application that wishes to use the Module includes pqcl.h and fips.h header files in its source code and link the application against binary file of the Module. The Module is initialized by the Application, by calling the Module Initialization service. That function must be called and finished before any other API function of the module is used. Error code returned by the function must be checked. In case of successful initialization, the function returns PQCL_SUCCESS code and any other code returned by the function indicates initialization failure. The deinitialization of the library is done by the Application by calling the Zeroization service. The initialization process automatically detects and enables PAA if available. To disable PAA operator must call the pqcl_disable_hwa() service. The service can be called only after successful initialization of the library.

This software module has no specific requirements regarding maintenance. The module is disposed by deleting the binary file of the Module.

Both Administrator and non-Administrator guidance is provided in the Users Manual, which is delivered with the Module.

When the Module is at end of life, the customers of the Module are informed via PQShield’s customer service capabilities. After the 6-month window, the access rights to the FIPS branch in a repository storing the source code of the Module are change to more restrictive, so that only administrators can access and read from the FIPS branch of the Module. This effectively makes it impossible to release new version of the Module. The Module does not possess persistent storage of SSPs. The SSP value only exists in volatile memory and that value vanishes when the Module is powered off. The secure sanitization of the Module is done by powering the Module off. The deprecation of the Module is done by upgrading it to the newer version. During upgrade process the old version of the Module is removed and replaced with a new version. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib 12. Mitigation of Other Attacks The Module is not designed to mitigate against other attacks. Document Version 1.0.0 PQShield Public Material

• May be reproduced only in its original entirety (without revision).

PQCryptoLib 13. References and Definitions The following standards are referred to in this Security Policy. Table 19

• References Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

PQCryptoLib Table 20

• Acronyms and Definitions Document Version 1.0.0 PQShield Public Material
• May be reproduced only in its original entirety (without revision).

Referenced URLs

• https://pages.nist.gov/ACVP/draft-hammett-acvp-kdf-tls-v1.3.html
• https://datatracker.ietf.org/doc/html/rfc8446