AMD Pensando PenTrust Security Module

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for AMD Pensando PenTrust Security Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>status output</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C6 clue;
  class I2,I3,I6 infer;
  class R2,R3,R6 risk;
  class E2,E3,E6 evidence;

flowchart LR
  %% Deterministic clue tier for AMD Pensando PenTrust Security Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>status output</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C6 clueLow;

Security Policy, page by page

Advanced Micro Devices, Inc. (AMD) AMD Pensando PenTrust Security Module

Disclaimer AMD, the AMD Arrow logo, Pensando and combinations thereof are trademarks of Advanced Micro Devices, Inc. This Security Policy document may be reproduced only in its original entirety (without revision).

This document defines the Security Policy for AMD Pensando PenTrust Security Module, hereafter referred to as the Module. The Module meets FIPS 140-3 overall Level 1 requirements, with security levels as described in section 1.2 below.

Purpose and Use: The Module is a software-hybrid module intended for use by customers seeking to implement approved cryptography. Module Type: Software-hybrid Module Embodiment: SingleChip Module Characteristics: Module is not a Sub-chip and there are no special characteristics. Cryptographic Boundary: The Module is a software hybrid Module that comprises of software and hardware components. The software component of the Module can only support cryptographic algorithms by utilizing the Processor Algorithm Implementations (PAI), which are enabled by software and process

service requests from the consuming application (outside of the cryptographic boundary) via the Mailbox API. The cryptographic boundary of the Module is defined by the pentrustfw.img. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP is the physical perimeter of the AMD Pensando DPU 08-0010-01. The Module executes from the ARM Cortex M0 CPU, a single-threaded CPU, with no underlying OS. The consuming application (outside of the cryptographic boundary) executes from GPC Hardware outside of the boundary (e.g. A72 ARM Processor). Figure 1: Block Diagram

Tested Module Identification – Hardware:

N/A for this module. Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: Table 3: Tested Module Identification
• Hybrid Disjoint Hardware Tested Operational Environments - Software, Firmware, Hybrid: Table 4: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. CMVP makes no statement as to the correct operation of the Module or the security strengths of the keys when so ported if the specific operational environment is not listed on the validation certificate.

The Module does not support excluded components.

Modes List and Description:

Table 5: Modes List and Description The Module does not support degraded mode.

Approved Algorithms: Table 6: Approved Algorithms Vendor-Affirmed Algorithms: N/A for this module.

Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: N/A for this module.

Table 7: Security Function Implementations

There are no additional requirements for documentation of the algorithms supported by the Module.

N/A for this module. N/A for this module.

The Module does not support industry protocols.

Table 8: Ports and Interfaces

The Module does not support a Trusted Channel.

Table 9: Roles As per FIPS 140-3, the Module supports the Crypto Officer (CO) operator role implicitly. The role is implicitly assumed by the service requested. The Module does not support authentication. The Module does not support multiple concurrent operators, a maintenance role or bypass capability.

Please see below for the Approved Services supported by the Module. As per FIPS 140-3 IG, Section 2.4.C, a global indicator applies to this Module as it only supports Approved Services in an approved manner. An implicit indication via the successful completion of a service is the global indicator of the Module. Please note that columns for “Input” and “Output” below are documented from the standpoint of the API parameters. It is important to note that independent of the parameters, module supports a status indicator per service to indicate success or failure. All service inputs result in a service output. s

Name FIPS_GET_MO DULE_VERSIO N CMD_FIPS_ZE ROIZE BOOT_SUCCES S DIAG_GET_STA TUS DIAG_READPU BKEYBOOT

Description Algorithm SHA2- 384 Returns the module version information. This is the show module version service required by FIPS 140-3. Zeroises long lived SSPs Used for the A72 to signal to PenTrust that boot is successful Reads the boot status from PenTrust. Includes which PenTrust image (0 or 1) was loaded, and which A72 image (0 or 1) was loaded Used to read out the public key material for SM Public Key or CM Public Key

Indica tor

Inputs Message Size, Public Key, Message , Signature DMA pointer to store result

Outputs Data containin g the version informati on for the module FaultStat us, Boot status info Key (public key of system authentic ation algorithm type)

Security Function s

SSP Access W,E,Z - SM Public Key: E Crypto Officer Crypto Officer - CM Public Key: Z - SM Public Key: Z Crypto Officer Crypto Officer Crypto Officer - CM Public Key: R - SM Public Key: R

Name READ_CHIP_C ERT SHOW_STATU S SELF_TEST

Description Reads and outputs the X.509 chip certificate (binary blob) which is outside of the boundary and not an SSP. This is a helper function. This is the Show Status service required by FIPS 140-3. The service is provided by the module`s API and will automatically report status of the module during Self-Tests and the Error State. See Section 10 for more information. This is the Self- Tests service required by FIPS 140-3. The service is provided automatically by the module upon power-cycle, reset, or reboot. All Self-Tests are executed by the module during power-on.

Indica tor

Inputs context, Ciphertex t

Outputs Chip Certificat e See Section 10 for more informati on See Section 10 for more informati on

Security Function s

SSP Access Crypto Officer Crypto Officer Crypto Officer - CM Public Key: E - SW image authentic ation public key: E

The Module does not support a software load test. The Module is a hybrid software module and the loaded software image is a complete image replacement of the disjoint software component.

The Module does not support Bypass Actions.

The Module does not support self-initiated cryptographic output capability.

The Module uses ECDSA P-384 with SHA2-384 Signature Verification (ECDSA Cert. #A4453) as the approved integrity technique. The Module executes an ECDSA P-384 with SHA2-384 Signature Verification Known Answer Test (KAT) prior to the software integrity test.

To initiate the integrity test on demand the operator can power-cycle, reset, reboot the Module as per FIPS 140-3 IG 2.4.C.

The Module is not Open-Source.

Type of Operational Environment: Modifiable The Module supports a modifiable Operational Environment. How Requirements are Satisfied: The modifiable Operational Environment supports a single threaded CPU where the only process that can execute at any point in time is the AMD Pensando PenTrust Security Module.

Zeroization Method CMD_FIPS_ZEROIZE

Description Service available to the consuming application to Zeroise Long lived SSPs.

Rationale

Operator Initiation API

No other processes can run concurrently with the Module, and there can be only one instance of the Module. The modifiable Operational Environment does not support an operating system. Hence, the Module has control over its own SSPs, does not support uncontrolled access nor modifications to SSPs, and does not require restrictions or configurations of the operational environment for the Module to operate in an approved mode.

The Module does not support Non-Invasive Security. As per SP 800-140F, no additional requirements are applicable.

Table 11: Storage Areas Table 12: SSP Input-Output Methods

Table 13: SSP Zeroization Methods

Table 14: SSP Table 1 Table 15: SSP Table 2

Table 16: Pre-Operational Self-Tests

Table 17: Conditional Self-Tests

Table 18: Pre-Operational Periodic Information

Table 19: Conditional Periodic Information

To initiate the Self-Tests on demand the operator can power-cycle, reset, reboot the Module as per FIPS 140-3 IG 2.4.C. The Module executes all Self-Tests during power-on.

The Module is included inside the AMD DPU ASIC, which will be assembled together with other parts by manufacturing (AMD) into a larger product for the end user. There are no specific installation procedures or initialization procedures required for the end user.

The startup procedures of the module are:

1. Connect a console with terminal access.
2. Power on the Module.
3. Inspect the console output and confirm all Self-Tests Passed. See Section 10.1 and 10.2 above for successful indicators.
4. Issue the service FIPS_GET_MODULE_VERSION by issuing the following API: ./pentrust_test show_module_version Manufacturer: AMD Hardware name: Pensando DPU 08-0010-01 Software name: AMD Pensando PenTrust Security Module Hardware version: 1 Hardware build: 0 Software version: 5.0.0 Crypto version: 1.0.0
5. Crypto Officer shall confirm the output of the Module matches the information above. Module is now ready to accept services in the Approved Mode of operation.

The security parameters, physical ports, and logical interfaces for the Administrator (Crypto Officer) are defined via this Security Policy. Given the Module does not support authentication, the Crypto Officer role is implicitly assumed by invoking the services of the Module. The Crypto Officer is responsible for taking the following security rules into consideration:

1. The Module does not provide authentication.
2. If on-demand Self-Tests are needed, the Module must be power-cycled. All Self-Test are performed at power-up automatically.
3. Data output is inhibited during self-tests, zeroisation and error states.
4. Status information does not contain CSPs or sensitive information that if misused would lead to a compromise.
5. The Module performs both in-line zeroisation automatically for its APIs and offers the service CMD_FIPS_ZEROIZE for PSPs in SRAM.
6. The Module does not support concurrent operators. There are no other administrative functions or security events other than what is listed above. For any questions, please contact FIPS@amd.com.

The Module does not support a Non-Administrator.

Please see section 11.2 for security rules.

The Module does not support Maintenance.

If the Crypto Officer would like to render the Module as no longer operable (end of life), the Crypto Officer must securely sanitize the Module by issuing the CMD_FIPS_ZEROIZE service followed by a power-cycle. Any private and public key records stored outside of the cryptographic boundary shall also be destroyed by the Crypto Officer.