| Standard | FIPS 140-3 |
|---|---|
| Overall level | 2 |
| Module type | Hardware |
| Embodiment | Multi-Chip Stand Alone |
| Status | Active |
| Sunset date | 9/22/2029 |
| Caveat | When installed, initialized and configured as specified in Section 11 of the Security Policy. The tamper evident seals and Physical Kit installed as indicated in the Security Policy. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy |
| Vendor | Palo Alto Networks, Inc. |
| Algorithm | ACVP Cert |
|---|---|
| AES-CBC | A2137 |
| AES-CFB128 | A2137 |
| AES-CTR | A2137 |
| AES-GCM | A2137 |
| Conditioning Component AES-CBC-MAC SP800-90B | A2165 |
| Counter DRBG | A2137 |
| ECDSA KeyGen (FIPS186-4) | A2137 |
| ECDSA KeyVer (FIPS186-4) | A2137 |
| ECDSA SigGen (FIPS186-4) | A2137 |
| ECDSA SigVer (FIPS186-4) | A2137 |
| HMAC-SHA-1 | A2137 |
| HMAC-SHA2-224 | A2137 |
| HMAC-SHA2-256 | A2137 |
| HMAC-SHA2-384 | A2137 |
| HMAC-SHA2-512 | A2137 |
| KAS-ECC-SSC Sp800-56Ar3 | A2137 |
| KAS-FFC-SSC Sp800-56Ar3 | A2137 |
| KDF SNMP | A2137 |
| KDF SSH | A2137 |
| KDF TLS | A2137 |
| RSA KeyGen (FIPS186-4) | A2137 |
| RSA SigGen (FIPS186-4) | A2137 |
| RSA SigVer (FIPS186-4) | A2137 |
| Safe Primes Key Generation | A2137 |
| Safe Primes Key Verification | A2137 |
| SHA-1 | A2137 |
| SHA2-224 | A2137 |
| SHA2-256 | A2137 |
| SHA2-384 | A2137 |
| SHA2-512 | A2137 |
flowchart LR
%% Deterministic review-risk graph for Panorama 10.1 on Hardware Appliances
%% Review prompts and evidence gaps, NOT vulnerability findings.
subgraph CMVP["CMVP-disclosed clues"]
C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update<br/>Firmware Load</i>"]
C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>application</i>"]
end
subgraph Inference["Derived inference"]
I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
end
subgraph Risk["Reviewer question"]
R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
end
subgraph Evidence["Evidence needed to close"]
E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
end
C2 --> I2 --> R2 --> E2
C3 --> I3 --> R3 --> E3
C5 --> I5 --> R5 --> E5
C6 --> I6 --> R6 --> E6
classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
class C2,C3,C5,C6 clue;
class I2,I3,I5,I6 infer;
class R2,R3,R5,R6 risk;
class E2,E3,E5,E6 evidence;flowchart LR
%% Deterministic clue tier for Panorama 10.1 on Hardware Appliances
%% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
subgraph CMVP["CMVP-disclosed clues (deterministic)"]
C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update<br/>Firmware Load</i><br/>src: text:keyword"]
C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>application</i><br/>src: text:keyword"]
end
classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
class C2,C3,C5,C6 clueLow;Palo Alto Networks Panorama 10.1 on Hardware Appliances Version: 1.2 Revision Date: February 13, 2025 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
| # | Section | Page |
|---|
1. General The Panorama 10.1 on Hardware Appliances from Palo Alto Networks Inc., hereafter referred to as “Panorama M-Series”, “modules”, or the “cryptographic modules” are multi-chip standalone hardware cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall. The Panorama M-Series management appliances’ individual management and logging components can be separated in a distributed manner to accommodate large volumes of log data. Panorama M-Series management appliances can be deployed in the following ways:
The cryptographic module meets the overall requirements applicable to Level 2 security of FIPS 140-3. Table 1 - Security Levels ISO/IEC 24759 FIPS 140-3 Section Title Security Section 6. Level
Overall Level 2 © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 4
2.Cryptographic Module Specification The configurations for this validation are highlighted in Table 2. Table 2 - Cryptographic Module Tested Configuration Module Hardware Firmware Distinguishing Features Version 910-000176 10.1.5 RJ45 interfaces, USB ports (disabled), LEDs Panorama M-200 Physical Kit: 920-000208 910-000073 10.1.5 RJ45 interfaces, USB ports (disabled), LEDs Panorama M-500 Physical Kit: 920-000145 910-000175 10.1.5 RJ45 interfaces, USB ports (disabled), LEDs, Panorama M-600 Physical Kit: 920-000209 SFP+ ports Approved Mode of Operation The following procedure will initialize the modules into the Approved mode of operation:
Convert the M-200/M-500/M-600 appliance from Panorama Log Collector mode to the Panorama mode:
ECDSA KeyGen Key Generation A2137 ECDSA KeyGen P-256, P-384, P-521 (FIPS 186-4) ECDSA KeyVer (FIPS Public Key Validation A2137 ECDSA KeyVer P-256, P-384, P-521 186-4) ECDSA SigGen P-256, P-384, P-521 with SHA2-224, SHA2-256, Signature Generation A2137 ECDSA SigGen (FIPS 186-4) SHA2-384, and SHA2-512 ECDSA SigVer (FIPS P-256, P-384, P-521 with SHA-1, SHA2-224, A2137 ECDSA SigVer Signature Verification 186-4) SHA2-256, SHA2-384, and SHA2-512 A2137 HMAC-SHA-1 [FIPS HMAC HMAC-SHA-1 with λ=160 Authentication for protocols 198-1] A2137 HMAC-SHA2-224 HMAC-SHA2-224 with λ=224 HMAC Authentication for protocols [FIPS 198-1] A2137 HMAC-SHA2-256 HMAC HMAC-SHA2-256 with λ=256 Authentication for protocols [FIPS 198-1] A2137 HMAC-SHA2-384 HMAC HMAC-SHA2-384 with λ=384 Authentication for protocols [FIPS 198-1] A2137 HMAC-SHA2-512 HMAC HMAC-SHA2-512 with λ=512 Authentication for protocols [FIPS 198-1] KAS-ECC-SSC KAS Ephemeral Unified Model: P-256/P-384/P-521 A2137 Key Exchange Sp800-56Ar3 KAS-FFC-SSC SP A2137 KAS dhEphem: MODP-2048 Key Exchange 800-56Ar3 KDF SNMP [SP Engine ID: A2137 SNMPv3 KDF SNMPv3 800-135rev1] (CVL) 80001F88043030303030343935323630 KDF SSH [SP A2137 SSHv2 KDF SHA-1, SHA2-256, SHA2-512 SSH 800-135rev1] (CVL) KDF TLS TLS 1.0/1.1 KDF, TLS v1.0/1.1 A2137 [SP 800-135rev1] TLS1.2 KDF TLS TLS v1.2 Hash Algorithm: SHA2-256, SHA2-384 (CVL) RSA KeyGen RSA KeyGen Key Pair Generation A2137 2048, 3072, and 4096 bits (FIPS 186-4) (FIPS 186-4) (ANSI X9.31, RSASSA-PKCS1_v1-5, RSA SigGen RSA SigGen Signature Generation A2137 RSASSA-PSS): 2048, 3072, and 4096-bit with (FIPS 186-4) (FIPS 186-4) hashes SHA2-256/384/512 (ANSI X9.31, RSASSA-PKCS1_v1-5, RSASSA-PSS): 2048, 3072, 4096-bit (per IG C.F) with hashes SHA-1 and SHA2-224+++/256/384/512 (Signature RSA SigVer RSA SigVer A2137 Verification) Signature Verification (FIPS 186-4) (FIPS 186-4) +++ This Hash algorithm is not supported for ANSI X9.31 Digital Signature Generation/Verification SHA-1 A2137 SHA-1 [FIPS 180-4] SHA Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-224 [FIPS A2137 SHA2 SHA-224 180-4] Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature SHA2-256 [FIPS A2137 SHA2 SHA-256 Generation/Verification 180-4] © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 8
Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-384 [FIPS A2137 SHA2 SHA-384 180-4] Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Generation/Verification SHA2-512 [FIPS A2137 SHA2 SHA-512 180-4] Non-Digital Signature Applications (e.g. component of HMAC) Safe Primes Key Safe Primes Key A2137 Generation [RFC MODP-2048 Safe Primes Key Generation Generation 3526] Safe Primes Key Safe Primes Key A2137 Verification [RFC MODP-2048 Safe Primes Key Verification Verification 3526] Conditioning Component A2165 AES-CBC-MAC 128 bits Intel Conditioner for Entropy Source AES-CBC-MAC SP 800-90B SP 800-38A, FIPS AES Cert. 198-1, and SP Key Wrapping. AES-CBC or AES-CTR #A2137 KTS 800-38F. KTS (key 128, 192, and 256-bit keys providing 128, 192, or with HMAC-SHA-1, HMAC-SHA2-256, and HMAC [SP 800-38F] wrapping and 256 bits of encryption strength HMAC-SHA2-384, or Cert. unwrapping) per IG HMAC-SHA2-512 #A2137 D.G. SP 800-38D and SP AES-GCM 800-38F. KTS (key KTS 128 and 256-bit keys providing 128 or 256 bits Cert. wrapping and Key Wrapping. AES-GCM. [SP 800-38F] of encryption strength #A2137 unwrapping) per IG D.G. ESV Cert. Palo Alto Networks DRNG RDSEED Entropy SP 800-90B ESV Entropy #E129 Source ESV Cert. SP 800-90B ESV Palo Alto Networks RTC Entropy Source Entropy #E130 KAS-ECC-S SC Cert. SP 800-56Arev3. #A2137, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF KDF SSH 800-56Arev3] 192, or 256 bits of encryption strength Scenario 2 path (2). Cert. #A2137 KAS-ECC-S SC Cert. SP 800-56Arev3. #A2137, KAS [SP P-256, P-384, and P-521 curves providing 128, KAS-ECC per IG D.F Key Exchange with protocol KDF KDF TLS 800-56Arev3] 192, or 256 bits of encryption strength Scenario 2 path (2). Cert. #A2137 KAS-FFC-S SC Cert. SP 800-56Arev3. #A2137, KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF KDF SSH 800-56Arev3] strength Scenario 2 path (2). Cert. #A2137 KAS-FFC-S SP 800-56Arev3. SC Cert. KAS [SP 2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F Key Exchange with protocol KDF #A2137, 800-56Arev3] strength Scenario 2 path (2). KDF TLS © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 9
Cert. #A2137 Key Generation Note:The seeds used for asymmetric Cryptographic Key Vendor CKG Section 5.1, Section key pair generation are produced using Generation; SP 800Affirmed (SP 800-133rev2) 5.2 the unmodified/direct output of the
DRBG The module is compliant to IG C.H: GCM is used in the context of TLS and SSH:
The following table documents the module’s algorithms that are non-approved and not allowed for use in the approved mode of operation. Table 4A - Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed Algorithm Caveat Use / Function MD5 Only allowed as the PRF in TLSv1.1 per IG 2.4.AOnly allowed as Message digest used in TLSv1.0 / v1.1 the PRF in TLSv1.0 and v1.1 per IG 2.4.A KDF only Table 5 - Supported Protocols in the Approved Mode Supported Protocol TLSv1.1, v1.2 SSHv2 SNMPv3 Note: these protocols were not reviewed or tested by the CMVP or CAVP. Module Diagrams Figures 1 - 6 depict the modules and their interfaces. The cryptographic boundary includes the physical perimeter of the enclosure of the appliance with the physical kit installed and all logical components within. Please refer to the appendices for depictions of the modules with the physical kits installed. Figure 1 - M-200 Front Figure 2 - M-200 Rear Figure 3 - M-500 Front © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 11
Figure 4 - M-500 Rear Figure 5 - M-600 Front Figure 6 - M-600 Rear 3.Cryptographic Module Interfaces The modules are multi-chip standalone modules with ports and interfaces as shown below. The modules do not implement a control output interface. Table 6 - Ports and Interfaces Physical Interface Logical Interface Data that passes over port/interface LED Status output Module status via LED indicators Power Power N/A RJ45 Console Status output Self-test output RJ45 Ethernet Data input, control input, control output, TLS, SSH data output, status output SFP+ Data input, control input, data output, TLS (M-600) status output © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 12
4.Roles, Services, and Authentication Assumption of Roles The module supports distinct operator roles. The cryptographic module in Panorama mode, Management-Only mode, or PAN-DB mode enforces the separation of roles using unique authentication credentials associated with operator accounts. The Log Collector mode only supports one role, the Crypto-Officer (CO) role. The module supports concurrent operators. The module does not provide a maintenance role or bypass capability. Table 7
CO, Zeroize Zeroize from CLI Zeroization Indicator Unauthenticat ed CO, User, Self-Test Run self-test via CLI or WebUI Output results via System Logs Unauthenticat ed Show Status Show status via CLI or WebUI FIPS-CC Mode Indicator CO, User System Audit View system audit records via CLI or Audit records via System Logs CO, User WebUI Monitor System Status and Logs View system status records via CLI System status via System Logs CO, User or WebUI Panorama Log Collector Setup Configuring and managing Log Confirmation of service via CO Collectors configurations via CLI Configuration Logs Panorama Pan-DB Setup Configuring and managing Pan-DB Confirmation of service via CO URL configurations via CLI Configuration Logs Manage Pan-DB Administrative Configuring and managing Confirmation of service via CO Access Administrator password via CLI Configuration Logs Table 10 - Roles and Authentication Role Authentication Method Authentication Strength CO Memorized Secret (Unique Password-based Username/password) and/or Minimum length is eight1 (8) characters (95 possible characters). Single-Factor Cryptographic The probability that a random attempt will succeed or a false Software (certificate common acceptance will occur is 1/(958) which is less than 1/1,000,000. name / public key-based The probability of successfully authenticating to the module authentication) within one minute is 10/(958), which is less than 1/100,000. The module’s configuration supports at most ten failed attempts to authenticate in a one-minute period. Certificate/Public key-based The security modules support public-key based authentication using RSA 2048 and certificate-based authentication using RSA Memorized Secret (Unique 2048, RSA 3072, RSA 4096, ECDSA P-256, P-384, or P-521. Username/password) and/or Single-Factor Cryptographic The minimum equivalent strength supported is 112 bits. The Software (certificate common probability that a random attempt will succeed is 1/(2112) which is User less than 1/1,000,000. The probability of successfully name / public key-based authentication) authenticating to the module within a one minute period is 10/(2112), which is less than 1/100,000. The module in FIPS-CC mode allows at most 10 failed attempts before a lockout occurs. In FIPS-CC Mode, the module checks and enforces the minimum password length of eight (8) as specified in SP 800-63B. Passwords are securely stored hashed with salt value, with very restricted access control, and rate limiting mechanism for authentication attempts. © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 14
Access Control Policy While in the Approved mode of operation all authenticated services and CSPs are accessed via authenticated SSH or TLS sessions. Access is restricted to authenticated operators only and no interface is provided to modify the public or private key. SNMPv3 authentication is supported but is not a method of module administration and does not allow read/write access of CSPs. Approved and allowed algorithms, relevant CSP and public keys related to these protocols are used to access the following services. CSP access by services is further described in the following tables. Additional service information and administrator guidance for Panorama can be found at https://docs.paloaltonetworks.com/. The Crypto-Officer may access all services, and through the “management of administrative access” service may define multiple Crypto-Officer roles with limited services. The User role provides read-only access to the System Audit service. When configured in the default mode, Panorama Manager provides services via web-browser based interface and a command line interface (CLI). For the Panorama Log Collector mode and PAN-DB mode, only the CLI is available for management. SSP Access Rights The table below defines the relationship between access to CSPs and the different module services. The modes of access shown in the table are defined as: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Table 11 - Approved Services Service Description Approved Security Functions Keys and/or SSPs Roles Access Indicator rights to Keys and/or SSPs Show Version Query the module to display N/A N/A CO N/A Version displayed via the version System Logs / CLI / UI Perform panorama licensing, diagnostics, debug functions, manage Panorama support information and switch System and System Provisioning between Panorama N/A N/A CO N/A Configuration logs Management-only, and Logger modes. (Panorama or Management-Only Mode) Access web portal Connect to module’s web RSA SigVer (186-4) CA Certificates CO, User G/R/E/W System Logs portal to invoke services. RSA SigVer (186-4) RSA Public Keys G/R/E/W (Panorama or ECDSA SigVer (186-4) ECDSA Public Keys G/R/E/W Management-Only Mode) KAS KDF TLS (CVL), TLS Pre-Master G/E/Z MD5 Secret KDF TLS (CVL), TLS Master Secret G/E/Z MD5 © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 15
CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/Z Safe Primes Key Public Components Generation, Safe Primes Key Verification KTS HMAC-SHA-1 TLS HMAC Keys G/E/Z HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z Counter DRBG, ESV DRBG Seed CO G/E System Logs DRBG V DRBG Key Entropy Input String Access CLI Connect to module’s CLI via KTS HMAC-SHA-1 SSH Session CO, User G/E/Z System Logs SSH HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM G/E/Z KAS KDF SSH (CVL) SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC SSH DHE/ECDHE G/E/R/W/ KAS-FFC-SSC Public Components Z Safe Primes Key Generation Safe Primes Key Verification Counter DRBG, ESV DRBG Seed CO G/E System Logs DRBG V DRBG Key Entropy Input String Panorama Firmware Download and install RSA SigVer (FIPS 186-4) Public Key for CO W/E System and Update firmware updates Firmware Load Test Configuration logs Panorama Manager Setup Presents configuration CKG RSA Private Keys CO G/W/E System and options for management RSA KeyGen (FIPS 186-4) Configuration logs interfaces and RSA SigGen (FIPS 186-4) communication for peer CKG ECDSA Private Keys G/W/E services (e.g., SNMP, ECDSA KeyGen RADIUS). ( FIPS 186-4) Import, Export, Save, Load, ECDSA SigGen revert and validate (FIPS 186-4) Panorama configurations and state role RSA SigVer (FIPS 186-4) RSA Public Keys G/R/E/W ECDSA SigVer (FIPS 186-4) ECDSA Public Keys G/R/E/W (Panorama or Management-Only Mode) KDF SNMP (CVL) SNMPv3 W/E Authentication Secret KDF SNMP (CVL) SNMPv3 Privacy W/E Secret HMAC-SHA-1 SNMPv3 G/E/Z HMAC-SHA2-224 Authentication Key HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CFB128 SNMPv3 Session Key G/E/Z © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 16
RSA SigVer (FIPS 186-4) CA Certificates G/R/E/W ECDSA SigVer (FIPS 186-4) KAS KDF TLS (CVL), TLS Pre-Master G/E/Z MD5 Secret KDF TLS (CVL), TLS Master Secret G/E/Z MD5 CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), TLS DHE/ECDHE G/E/R/W/ ECDSA KeyVer Public Components Z (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, Safe Primes Key Generation, Safe Primes Key Verification KTS HMAC-SHA-1 TLS HMAC Keys G/E/Z HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM KAS KDF SSH SSH DHE/ECDHE G/E/Z KAS-ECC-SSC Private Components KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification SSH DHE/ECDHE G/E/R/W/ Public Components Z Counter DRBG, ESV DRBG Seed CO G/E System Logs DRBG V DRBG Key Entropy Input String Manage Panorama Define access control N/A CO, User Password CO G/E/W System and Administrative Access methods via admin profiles, Configuration logs configure administrators and password profiles Configure local user database, authentication profiles, sequence of methods and access domains. © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 17
(Panorama, RSA SigVer (FIPS 186-4) SSH Client Public Key W/E Management-Only, or Log Collector Mode) RSA SigVer (FIPS 186-4) SSH Host Public Key G/R/E/W ECDSA SigVer (FIPS 186-4) Configure High Configure High Availability RSA SigVer (FIPS 186-4) RSA Public Key CO G/R/E/W Configuration Logs Availability communication settings (Panorama or Management-Only Mode) ECDSA SigVer (FIPS 186-4) ECDSA Public Key G/R/E/W Panorama Certificate Manage RSA/ECDSA ECDSA SigGen RSA Private Keys CO G/R/W/E System and Management certificates and private (FIPS 186-4) ECDSA Private Keys Configuration logs keys, certificate profiles, RSA SigGen revocation status, and (FIPS 186-4) usage; show status. (Panorama, ECDSA SigVer RSA Public Keys G/R/W/E Management-Only, or Log (FIPS 186-4) ECDSA Public Keys Collector Mode) RSA SigVer (FIPS 186-4) Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Panorama Log Setting Configure log forwarding N/A N/A CO N/A Configuration Logs (Panorama or Management-Only Mode) Panorama Server Profiles Configure communication KDF SNMP (CVL) SNMPv3 CO W/E System Logs parameters and information Authentication Secret for peer servers KDF SNMP (CVL) SNMPv3 Privacy W/E Secret (Panorama or Management-Only Mode) HMAC-SHA-1 SNMPv3 G/E/Z HMAC-SHA2-224 Authentication Key HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CFB128 SNMPv3 Session Key G/E/Z Setup Managed Devices Set-up and define managed N/A N/A CO N/A Configuration Logs and Deployment devices, device groups for firewalls Configure device deployment applications and licenses View current deployment information on the managed firewalls. It also allows you to manage firmware versions and schedule updates on the managed © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 18
firewalls and managed log collectors. (Panorama or Management-Only Mode) Configure Managed Log Setup and manage other N/A CO, User Password CO G/E/W System and Collectors Log Collector management, Configuration logs communication and storage settings View current deployment information on the managed Log Collectors. It also allows you to manage firmware versions and schedule updates on managed log collectors. (Panorama or Management-Only Mode) Zeroize Zeroize all SSPs N/A All SSPs CO, Z Zeroization Indicator Unauthenticated Self-Test Run power up self-tests on N/A Firmware Integrity CO, User, E System Logs demand by power cycling Verification Key Unauthenticated the module. Show Status View status of the module N/A N/A CO, User N/A FIPS-CC Mode Indicator System Audit Allows review of limited N/A N/A CO, User N/A System Logs configuration and system status via SNMPv3, logs, dashboard, show status, and configuration screens. CO Only: Provides configuration commit capability. (Panorama, Management-Only, or PAN-DB Mode) Monitor System Status and Review system status via N/A N/A CO, User N/A System Logs Logs the panorama system CLI, dashboard and logs; show status. (Panorama or Management-Only Mode) CKG RSA Private Keys CO G/W/E System and Panorama Log Collector Presents configuration RSA KeyGen (FIPS 186-4) Configuration logs Setup options for management RSA SigGen (FIPS 186-4) interfaces and communication for peer services Import, Export, Save, Load, CKG ECDSA Private Keys G/W/E revert and validate ECDSA KeyGen Panorama configurations ( FIPS 186-4) and state. ECDSA SigGen (FIPS 186-4) (Log Collector Mode only) © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 19
RSA SigVer (FIPS 186-4) RSA Public Keys G/R/E/W ECDSA SigVer (FIPS 186-4) ECDSA Public Keys G/R/E/W KAS KDF TLS (CVL), TLS Pre-Master G/E/Z MD5 Secret KDF TLS (CVL), TLS Master Secret G/E/Z MD5 CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/R/W/ Safe Primes Key Public Components Z Generation, Safe Primes Key Verification KTS HMAC-SHA-1 TLS HMAC Keys G/E/Z HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 20
KAS KDF SSH (CVL) SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Panorama Pan-DB Setup Presents configuration KAS KDF TLS (CVL), TLS Pre-Master CO G/E/Z System Logs options for management MD5 Secret interfaces and communication for peer services Import, Export, Save, Load, revert and validate KDF TLS (CVL), TLS Master Secret G/E/Z Panorama configurations MD5 and state. (PAN-DB Mode only) CKG, TLS DHE/ECDHE G/E/Z ECDSA KeyGen Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), KAS-ECC-SSC, KAS-FFC-SSC, TLS DHE/ECDHE G/E/R/W/ Safe Primes Key Public Components Z Generation, Safe Primes Key Verification KTS HMAC-SHA-1 TLS HMAC Keys G/E/Z HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC TLS Encryption Keys G/E/Z KTS AES-GCM TLS Encryption Keys G/E/Z KTS HMAC-SHA-1 SSH Session G/E/Z HMAC-SHA2-256 Authentication Keys HMAC-SHA2-512 © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 21
AES-CBC, SSH Session G/E/Z AES-CTR Encryption Keys KTS AES-GCM KAS KDF SSH (CVL) SSH DHE/ECDHE G/E/Z Private Components KAS-ECC-SSC KAS-FFC-SSC Safe Primes Key Generation, Safe Primes Key Verification Counter DRBG, ESV DRBG Seed G/E DRBG V DRBG Key Entropy Input String Manage Pan-DB Update Administrator N/A CO, User Password CO G/E/W System and Administrative Access password. Configuration logs (PAN-DB Mode only) Note: Configuration/System Logs for Approved services above will indicate FIPS-CC mode is enabled and that the service succeeded. 5.Software/Firmware Security The module performs the Firmware Integrity test by using HMAC-SHA-256 and ECDSA signature verification (HMAC and ECDSA Cert. #A2137) during the Pre-Operational Self-Test. In addition, the module also conducts the firmware load test by using RSA 2048 with SHA-256 (Cert. #A2137) for the new validated firmware to be uploaded into the module via the Panorama Firmware Update service. The Firmware Integrity Verification key and Public key for Firmware Load Test used for the Firmware Integrity and Firmware Load test, respectively, are generated externally and delivered as part of the module firmware image. The pre-operational self-tests can be initiated by power cycling the module. When this is performed, the module automatically runs the cryptographic algorithm self-tests in addition to the pre-operational firmware integrity test. © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 22
The module’s executable code is in the form of the compiled firmware image loaded onto the module. 6.Operational Environment The FIPS 140-3 Area 5 Operational Environment requirements are not applicable because the module contains a non-modifiable operational environment. The operational environment is limited since the module includes a firmware load service to support necessary updates. New firmware versions within the scope of this validation must be validated through the FIPS 140-3 CMVP. Any other firmware loaded into this module is out of the scope of this validation and requires a separate FIPS 140-3 validation. 7.Physical Security Physical Security Mechanisms The multi-chip standalone modules are production quality containing standard passivation. Chip components are protected by an opaque enclosure. There are tamper-evident seals that are applied on the modules by the Crypto-Officer. There are fifteen (15) for the M-200, twelve (12) for the M-500, and twenty-one (21) for the M-600. All unused seals are to be controlled by the Crypto-Officer. The seals prevent removal of the opaque enclosure without evidence. The Crypto-Officer must ensure that the module surface is clean and dry. Tamper evident seals must be pressed firmly onto the adhering surfaces during installation and once applied, the Crypto-Officer shall permit 24 hours of cure time for all tamper evident seals. The seals prevent removal of the opaque enclosure without evidence. The Crypto-Officer should inspect the seals and shields for evidence of tamper every 30 days. If the seals show evidence of tamper, the Crypto-Officer should assume that the modules have been compromised and contact support. Note: For ordering information, see Table 2 for physical kit part numbers and versions. Opacity shields are included in the physical kits. Operator Required Actions The following table provides information regarding the various physical security mechanisms, and their recommended frequency of inspection/test. Table 14 - Physical Security Inspection Guidelines Physical Security Recommended Frequency Inspection/Test Guidance Details Mechanism of Inspection/Test Tamper Evident 30 days (M-200) Verify integrity of tamper-evident seals in the locations Seals identified in Appendix B of this Security Policy.
30 days (M-200) Verify that opacity shields and side rails have not been
Front and Rear loosened or deformed from their original shape, thereby reducing Opacity Shields their effectiveness. Side Rails Top Overlays 30 days (M-200) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics. Tamper Evident 30 days (M-500, M-600) Verify integrity of tamper-evident seals in the Seals locations specified in Appendix A and C. © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 23
Front and Rear 30 days (M-500, M-600) Verify that the front and rear opacity shields Opacity Shields have not been deformed from their original shape, thereby reducing their effectiveness. Vent Overlays 30 days (M-500, M-600) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics. Refer to the following sections for instructions on installation and placement of the tamper seals and opacity shields. M-200 Tamper Seal Installation (15 Seals) 1. Replace the top cover with the physical top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). M-200 appliance—Remove the Void Warranty label that covers the left top cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the top cover (does not have vents) on the appliance until the release buttons click. Reinsert and slide cover into position and secure with the two (2) screws. Figure 7
2. On the left side of the M-200, firmly apply seven (7) tamper-evident seals as indicated in the illustration. Figure 8
Replace the front rack-mount brackets (one bracket on each side) that are part of the inner-rack rails with the rack-mount brackets by removing and then reinstalling two screws on each bracket. The handles have standoffs that are used to secure the front cover. Figure 10
5. Attach the physical kit back cover to the back of the appliance. Slide the back cover onto the back of the appliance, insert two M4 x 0.7 x 8mm (one (1) screw on each side), and turn the screws clockwise to secure the cover. 6. Apply a tamper-evident seal to each location shown in the following M-200 illustrations. Ensure you apply two (2) tamper-evident seals on the power supplies (see seals #14 and #15 on the rear illustration). Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. Figure 12
M-500 Tamper Seal Installation (15 Seals) Step 1: Remove the two pull handles and front modules on the left and right side of the appliance by removing the three (3) screws located behind each handle/module. There is no need to disconnect the LED circuit board attached to the end of the ribbon cable. Retain these screws for Step
Figure 15
Figure 17
Figure 19
Cover the vent openings as shown in Figure 21 by applying one (1) overlay sticker over the left side vent and one (1) overlay sticker over the right side vent. Each overlay requires two (2) tamper seals as shown in Figure 46 (A). Also apply one (1) additional tamper seal as shown in Figure 22 (B) #5. Figure 21
Figure 23
Figure 25
Figure 26
Figure 28
Figure 29
Figure 31
Table 15 - SSPs Key/SSP/Name Strength Security Generati Import/Exp Establishm Storage Zeroization1 Use & Related Keys /Type Function and on ort ent Cert. Number ECDSA/RSA Public key Used to trust a root CA RSA SigVer (FIPS HDD
Cert. #A2137 termination (ECDSA P-256, P-384, and P-521) RSA public keys managed as certificates for the verification of TLS or SSH signatures, RSA SigVer Session Key DRBG, FIPS HDD/RAM
128 - 256 bits (FIPS 186-4) Encrypted or N/A Zeroize Service
Keys 186-4 plaintext operator authentication Cert. #A2137 Plaintext and peer TLS handshake authentication. (ECDSA P-256, P-384, or P-521) HDD
128 - 256 bits (FIPS 186-4) Session Key N/A RAM - Zeroize at and authentication
Keys 186-4 plaintext Cert. #A2137 Encrypted session (P-256, P-384, or termination P-521) KAS-FFC or KAS-ECC Ephemeral values used TLS DHE/ECDHE KAS-ECC-SSC DRBG, SP Zeroize at session in key agreement Private 128 - 256 bits KAS-FFC-SSC 800-56A Rev. N/A N/A RAM - plaintext termination (KAS-FFC MODP-2048, Components Cert. #A2137 3 KAS-ECC P-256, P-384, P-521) KAS-FFC or KAS-ECC Ephemeral values used TLS DHE/ECDHE KAS-ECC-SSC DRBG, SP Plaintext - TLS Zeroize at session in key agreement Public 128 - 256 bits KAS-FFC-SSC 800-56A Rev. N/A N/A handshake termination (KAS-FFC MODP-2048, Components Cert. #A2137 3 KAS-ECC P-256, P-384, P-521) KAS-ECC-SSC Secret value used to KDF TLS Cert. or derive the TLS Master TLS Pre-Master #A2137, Zeroize at session
112 bits minimum KAS-FFC-SSC, N/A N/A RAM
Secret MD5 (No Security termination SP 800-56A and server random Claimed) Rev. 3 nonces KDF TLS Cert. Secret value used to TLS Master #A2137, KDF TLS Zeroize at session
384 bits N/A N/A RAM
Secret MD5 (No Security (CVL) termination keys Claimed) © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 39
AES (128 or 256 bit) AES-CBC or TLS Encryption KDF TLS TLS, KAS SP Zeroize at session keys used in TLS
128 or 256 bits AES-GCM N/A RAM - plaintext
Keys (CVL) 800-56A Rev. 3 termination connections (GCM; Cert. #A2137 CBC) HMAC keys used in TLS HMAC-SHA2-256 connections KDF TLS TLS, KAS SP Zeroize at session TLS HMAC Keys 160 - 256 bits HMAC-SHA2-384 N/A RAM - plaintext (HMAC-SHA-1, (CVL) 800-56A Rev. 3 termination Cert. #A2137 HMAC-SHA2-256/384) (160, 256, 384 bits) KAS-FFC or KAS-ECC SSH public component KAS-ECC-SSC DRBG, SP DHE/ECDHE Zeroize at session (KAS-FFC MODP-2048,
112 - 256 bits KAS-FFC-SSC 800-56A Rev. N/A N/A RAM - plaintext
Private termination KAS-ECC P-256, Cert. #A2137 3 Components KAS-ECC P-384, KAS-ECC P-521) KAS-FFC or KAS-ECC SSH Plaintext SSH public component KAS-ECC-SSC DRBG, SP handshake DHE/ECDHE Zeroize at session (KAS-FFC MODP-2048,
112 - 256 bits KAS-FFC-SSC 800-56A Rev. N/A RAM - plaintext
Public termination KAS-ECC P-256, Cert. #A2137 3 Components KAS-ECC P-384, KAS-ECC P-521) RSA SigVer (FIPS 186-4) SSH Host Public Key SSH Host Public ECDSA SigVer DRBG, FIPS HDD/RAM
112 - 256 bits N/A N/A Zeroize Service
Key (FIPS 186-4) 186-4 plaintext RSA 4096, ECDSA P-256, P-384, or P-521) Cert. #A2137 Public RSA key used to RSA SigVer TLS or SSH SSH Client Public HDD/RAM
112 - 150 bits (FIPS 186-4) N/A Session Key N/A Zeroize Service
Key plaintext (RSA 2048, 3072, and Cert. #A2137 Encrypted
Used in all SSH connections to the AES-CBC, security module’s SSH Session AES-CTR, or KDF SSH SSH, KAS SP Zeroize at session
128 - 256 bits N/A RAM - plaintext command line interface.
Encryption Keys AES-GCM (CVL) 800-56A Rev. 3 termination (128, 192, or 256 bits: Cert. #A2137 CBC or CTR) (128 or 256 bits: GCM) Authentication keys used in all SSH connections to the HMAC-SHA-1 SSH Session security module’s HMAC-SHA2-256 KDF SSH SSH, KAS SP Zeroize at session Authentication 160 - 256 bits N/A RAM - plaintext command line interface HMAC-SHA2-512 (CVL) 800-56A Rev. 3 termination Keys (HMAC-SHA-1, Cert. #A2137 HMAC-SHA2-256, HMAC-SHA2-512) (160, 256, 512 bits) Used to check the integrity of all software HMAC-SHA2-256, Firmware Import only, TLS code ECDSA SigVer Factory HDD integrity 128 bits or SSH Session N/A N/A (HMAC-SHA-256 and (FIPS 186-4) preload plaintext verification key Key Encrypted ECDSA P-256) (Note: Cert. #A2137 This is not considered an SSP) Used to authenticate Public Key for RSA SigVer Import only, TLS firmware and content to Factory HDD Firmware Load 112 bits (FIPS 186-4) or SSH Session N/A N/A be installed on the preload plaintext Test Cert. #A2137 Key Encrypted appliance (RSA 2048 with SHA-256) TLS or SSH Authentication string CO, User SHA2-256 HDD - a password Zeroize N/A External Session Key N/A with a minimum length Password Cert. #A2137 hash (SHA2-256) Service Encrypted of eight (8) characters. TLS or SSH HDD/RAM
194 bits per N/A N/A RAM - plaintext Power cycle
String DRBG entropy source SP 800-90B © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 40
Cert. #A2137 Input length = 384 bits DRBG seed and input string coming from the CKG (vendor entropy source and AES affirmed), Counter 256 CTR DRBG state (V Entropy as DRBG and Key) used in the DRBG Seed 194 bits per N/A N/A RAM - plaintext Power cycle generation of a random SP 800-90B Cert. #A2137 values Input length = 128 bits Seed length = 384 bits CKG (vendor affirmed), Counter AES 256 CTR DRBG Entropy as DRBG state Key used in the DRBG Key 256 bits per N/A N/A RAM - plaintext Power cycle generation of a random SP 800-90B Cert. #A2137 values CKG (vendor affirmed), Counter AES 256 CTR DRBG Entropy as DRBG state V used in the DRBG V 128 bits per N/A N/A RAM - plaintext Power cycle generation of a random SP 800-90B Cert. #A2137 values SNMPv3 TLS or SSH Used to support Authentication KDF SNMP (CVL) HDD/RAM
Key Cert. #A2137 (CVL) Plaintext Service (AES 128/192/256 CFB) Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. Table 16
RDSEED Entropy Source bits of entropy before generating keys. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy Palo Alto Networks RTC Entropy ESV Cert. #130
Source © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 41
The entropy source provides at least 0.506 bits of entropy per bit of output. The DRBG is seeded with 384-bits of output from the entropy source. Therefore the DRBG is seeded with at least 194 bits of entropy before generating keys. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy 10. Self-Tests The cryptographic module performs the following tests below. The operator can command the module to perform the pre-operational and cryptographic algorithm self-tests by cycling power of the module; these tests do not require any additional operator action. Pre-operational Self-Tests Pre-operational Firmware Integrity Test
Palo Alto Network provides an Administrator Guide for additional information noted in the “References” section of this Security Policy. Module Enforced Security Rules The module design corresponds to the module security rules. This section documents the security rules enforced by the cryptographic module to implement the security requirements of this FIPS 140-3 Level 2 module. 1. The cryptographic module shall provide distinct operator roles. When the module has not been placed in a valid role, the operator shall not have access to any cryptographic services. 2. The cryptographic module provides identity-based authentication 3. The cryptographic module shall clear previous authentications on power cycle. 4. The module shall support the generation of key material with the approved DRBG. The entropy provided must be greater than or equal to the strength of the key being generated. 1. Data output shall be inhibited during power-up self-tests and error states. 2. Processes performing key generation and zeroization processes shall be logically isolated from the logical data output paths. 3. The module does not output intermediate key generation values. 4. Status information output from the module shall not contain CSPs or sensitive data that if misused could lead to a compromise of the module. 5. There are no restrictions on which keys or CSPs are zeroized by the zeroization service. 6. The module maintains separation between concurrent operators. 7. The module does not support a maintenance interface or role. 8. The module does not have any external input/output devices used for entry/output of data. 9. The module does not enter or output plaintext CSPs. Vendor imposed security rules In FIPS-CC mode, the following rules shall apply: 1. The operator shall not enable TLSv1.0 or use RSA for key wrapping; it is disabled by default. a. Checked via CLI using “show shared” command 2. When FIPS-CC mode is enabled, the operator shall not install plugins. a. Checked via CLI using “show plugins installed” 3. When FIPS-CC mode is enabled, the operator shall not use TACACS+. RADIUS may be used but must be protected by TLS protocol. a. Checked via CLI using “show deviceconfig” command Failure to follow these Security Rules will cause the module to operate in a non-compliant state. Key to Entity The cryptographic module associates all keys (secret, private, or public) stored within, entered into or output from the module with authenticated operators of the module. Keys stored within the module are only made available to authenticated operators via TLS or SSH. Keys are only input or output from the module by the authenticated operator via a SSH or TLS protected communication. Any attempt to intervene in the key to entity relationship would require defeating the module TLS or SSH encryption and authentication/integrity mechanism. © 2025 Palo Alto Networks, Inc. Panorama HW 10.1 Security Policy 44