OpenSSL FIPS Provider for AlmaLinux 9

Certificate

Approved Algorithms (279)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for OpenSSL FIPS Provider for AlmaLinux 9
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Symmetric Encryption with AES<br/>Symmetric Decryption with AES<br/>Show status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for OpenSSL FIPS Provider for AlmaLinux 9
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Symmetric Encryption with AES<br/>Symmetric Decryption with AES<br/>Show status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

Cloudlinux Inc., TuxCare division OpenSSL FIPS Provider for AlmaLinux 9 Document Version 1.1 Last update: 2024-09-27 Prepared by: atsec information security corporation

Austin, TX 78759 www.atsec.com

OpenSSL FIPS Provider for AlmaLinux 9 Table of Contents © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 List of Tables Table 2: Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets) . 7 List of Figures © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

This document is the non-proprietary FIPS 140-3 Security Policy for version 3.0.71d2bd88ee26b3c90 of the OpenSSL FIPS Provider for AlmaLinux 9. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 module. intact and including this notice. Other documentation is proprietary to their authors.

N/A N/A Table 1: Security Levels © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

Purpose and Use: The OpenSSL FIPS Provider for AlmaLinux 9 (hereafter referred to as “the module”) is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) for use by other applications that require cryptographic functionality. The module is a software library supporting FIPS 140-3 approved algorithms developed by TuxCare for its use by other applications that require cryptographic functionality and consists of one software component, the “FIPS provider”, which implements the FIPS requirements and the cryptographic functionality provided to the operator. Module Type: Software Module Embodiment: MultiChipStand Module Characteristics: Cryptographic Boundary: The cryptographic boundary of the module is defined as the fips.so shared library, which contains the compiled code implementing the FIPS provider. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1 shows a block diagram that represents the design of the module when the module is operational and providing services to other user space applications. In this diagram, the physical perimeter of the operational environment (a general-purpose computer on which the module is installed) is indicated by a purple dashed line. The cryptographic boundary is represented by the components painted in orange blocks, which consists only of the shared library implementing the FIPS provider (fips.so). Green lines indicate the flow of data between the cryptographic module and its operator application, through the logical interfaces defined in Section 3 Cryptographic Module Interfaces. Components in white are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module’s validation). For example, the kernel is responsible for managing system calls issued by the module itself, as well as other applications using the module for cryptographic services. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Figure 1 - Block Diagram

Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): 3.0.71d2bd88ee26b3c90 N/A Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: 9.2 N/A 3.0.71d2bd88ee26b3c90 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 9.2 N/A 3.0.71d2bd88ee26b3c90 Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

There are no components excluded from the requirements of the FIPS 140-3 standard.

Modes List and Description: Nonapproved NonApproved After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. The module operates in the approved mode of operation by default and can only transition into the non-approved mode by calling one of In the operational state, the module accepts service requests from calling applications through its logical interfaces. At any point in the operational state, a calling application can end its process, causing the module to end its operation. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the service that was requested. Degraded Mode Description: The module does not implement a degraded mode of operation.

Approved Algorithms: © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 5: Approved Algorithms Vendor-Affirmed Algorithms: N/A © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 N/A C.C N/A C.C Table 6: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 7: Non-Approved, Not Allowed Algorithms The table above lists all non-approved cryptographic algorithms of the module employed by the non-approved services of the Non-Approved Services table in Section 4.4 Non-Approved Services.

© 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS1 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS2 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 AES-CBCCS3 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 SP80056Cr2 Sp80056Cr1 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 KDF SP800108 Passwordbased Key Passwordbased Key DigSigSigGen © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 HMAC-SHA3224 HMAC-SHA3256 HMAC-SHA3384 HMAC-SHA3512 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 SHA2512/224 SHA2512/224 SHA2512/224 SHA2512/224 SHA2512/224 SHA2512/256 SHA2512/256 SHA2512/256 SHA2512/256 SHA2512/256 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 AsymKeyPairKeyGen © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyVer AsymKeyPairKeyVer KAS-FFCSSC Sp80056Ar3 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 Table 8: Security Function Implementations

For TLS 1.2, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. The module is compliant with SP 800-52r2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288 and 8446. The module does not implement the TLS protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Alternatively, the Crypto Officer can use the module’s API to perform AES GCM encryption using internal IV generation. These IVs are always 96 bits and generated using the approved DRBG internal to the module’s boundary, compliant to Scenario 2 of FIPS 140-3 IG C.H. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 EVP_EncryptInit_ex2 API function with a non-NULL IV value. When this is the case, the API will set a non-approved service indicator. Finally, for TLS 1.3, the AES GCM implementation uses the context of Scenario 5 of FIPS 1403 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC8446 of August 2018, using the cipher-suites that explicitly select AES GCM as the encryption/decryption cipher (Appendix B.4 of RFC8446). The module supports acceptable AES GCM cipher suites from Section 3.3.1 of SP800-52r2. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key.

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 2²⁰ AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit.

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following requirements are met:

• Derived keys shall be used only for storage applications, and shall not be used for any other purposes. The length of the MK or DPK is 112 bits or more.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
• The minimum length of the password or passphrase accepted by the module is 8 characters. The probability of guessing the value, assuming a worst-case scenario of all digits, is estimated to be at most 10-8. Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks.
• A portion of the salt shall be generated randomly using the SP 800-90Ar1 DRBG provided by the module. The minimum length required is 128 bits.
• The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The minimum value accepted by the module is 1000. If any of these requirements are not met, the requested service is non-approved (see NonApproved Services table in Section 4.4 Non-Approved Services). © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

To comply with the assurances found in Section 5.6.2 of SP 800-56Ar3, the operator must use the module together with an application that implements the SSH/TLS protocol. Additionally, the module’s approved key pair generation service (see Approved Services table in Section 4.3 Approved Services) must be used to generate ephemeral Diffie-Hellman or EC Diffie-Hellman key pairs, or the key pairs must be obtained from another FIPSvalidated module. As part of this service, the module will internally perform the full public key validation of the generated public key. The module’s shared secret computation service will internally perform the full public key validation of the peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 80056Ar3.

The module implements the SHA-3 algorithms as both standalone and part of higher-level algorithms (in compliance with FIPS 140-3 IG C.C). As detailed in Section 2.6 Security Function Implementations with corresponding certificates, the cryptographic algorithms that use of SHA-3 include RSA signature generation and verification, ECDSA signature generation and verification, KBKDF, KDA HKDF, X9.63 KDF, X9.42 KDF, PBKDF, OneStep KDA and HMAC. In addition, the implementation of the extendable output functions SHAKE128 and SHAKE256 were verified to have a standalone usage.

The module implements only the approved modulus sizes of 2048, 3072, and 4096 bits for signature generation. For signature verification, the module implements the approved module sizes of 2048, 3072, and 4096 bits. Each algorithm was tested, and corresponding certificates can be found detailed in Section 2.6 Security Function Implementations. The module also supports RSA signature verification with 1024, 1280, 1536 and 1792 modulus bits. These modulus sizes are allowed only for legacy use, in compliance with FIPS 140-3 IG C.F.

Table 9: Entropy Certificates NonPhysical © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 10: Entropy Sources The module employs two Deterministic Random Bit Generator (DRBG) implementations based on SP 800-90Ar1. These DRBGs are used internally by the module (e.g. to generate seeds for asymmetric key pairs and random numbers for security functions). They can also be accessed using the specified API functions. The following parameters are used:

1. Private DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate secret random values (e.g. during asymmetric key pair generation). It can be accessed using RAND_priv_bytes.
2. Public DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate general purpose random values that do not need to remain secret (e.g. initialization vectors). It can be accessed using RAND_bytes. These DRBGs will always employ prediction resistance. More information regarding the configuration and design of these DRBGs can be found in the module’s manual pages.

The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800-133r2. When random values are required, they are obtained from the SP 80090Ar1 approved DRBG, compliant with Section 4 of SP 800-133r2 (without XOR):

• Safe primes key pair generation: compliant with SP 800-133r2, Section 5.2, which maps to SP 800-56Ar3. The method described in Section 5.6.1.1.4 of SP 800-56Ar3 (“Testing Candidates”) is used.
• RSA key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-4. The method described in Appendix B.3.6 of FIPS 186-4 (“Probable Primes with Conditions Based on Auxiliary Probable Primes”) is used.
• ECC (ECDH and ECDSA) key pair generation: compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-4. The method described in Appendix B.4.2 of FIPS 186-4 (“Testing Candidates”) is used. Additionally, the module implements the following key derivation methods:
• KBKDF: compliant with SP 800-108r1. This implementation can be used to generate secret keys from a pre-existing key-derivation-key.
• KDA OneStep, HKDF: compliant with SP 800-56Cr2. These implementations shall only be used to generate secret keys in the context of an SP 800-56Ar3 key agreement scheme. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

• ANS X9.42 KDF, ANS X9.63 KDF: compliant with SP 800-135r1. These implementations shall only be used to generate secret keys in the context of an ANS X9.42-2001 resp. ANS X9.63-2001 key agreement scheme.
• SSH KDF, TLS 1.2 KDF, TLS 1.3 KDF: compliant with SP 800-135r1. These implementations shall only be used to generate secret keys in the context of the SSH, TLS 1.2, or TLS 1.3 protocols, respectively.
• PBKDF2: compliant with option 1a of SP 800-132. This implementation shall only be used to derive keys for use in storage applications. Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service.

The module provides Diffie-Hellman (DH) and Elliptic Curve Diffie-Hellman (ECDH) shared secret computation compliant with SP800-56Ar3, in accordance with scenario 2 (1) of FIPS 140-3 IG D.F. For Diffie-Hellman, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919 (TLS). Note that the module only implements key pair generation, key pair verification, and shared secret computation. No other part of the IKE or TLS protocols is implemented (with the exception of the TLS 1.2 and 1.3 KDFs):

• IKE (RFC 3526):
• MODP-2048 (ID = 14)
• MODP-3072 (ID = 15)
• MODP-4096 (ID = 16)
• MODP-6144 (ID = 17)
• MODP-8192 (ID = 18) TLS (RFC 7919) o ffdhe2048 (ID = 256) o ffdhe3072 (ID = 257) o ffdhe4096 (ID = 258) o ffdhe6144 (ID = 259) o ffdhe8192 (ID = 260) For Elliptic Curve Diffie-Hellman, the module supports the NIST-defined P-224, P-256, P-384, and P-521 curve. According to FIPS 140-3 IG D.B, the key sizes of DH and ECDH shared secret computation provide 112-200 and 112-256 bits of respective bits of security strength in an approved mode of operation. The module implements AES KW, KWP, GCM, and CCM as approved key wrapping algorithms. These algorithms can be used to wrap SSPs providing 128, 192, 256-bit keys with key strength between 128-256 bits in compliance with IG D.G. In addition, AES KW and AES KWP meets the requirements of SP 800-38F. Each approved key wrapping algorithm was tested, and corresponding certificates can be found detailed in Section 2.6 Security Function Implementations. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

The module implements the SSH key derivation function for use in the SSH protocol (RFC

GCM with internal IV generation in the approved mode is compliant with versions 1.2 and 1.3 of the TLS protocol (RFC 5288 and 8446) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements the TLS 1.2 and TLS 1.3 key derivation functions for use in the TLS protocol. No parts of the SSH, TLS, or IKE protocols, other than those mentioned above, have been tested by the CAVP and CMVP. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

Table 11: Ports and Interfaces The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

N/A for this module. The module does not support authentication methods.

Table 12: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module when performing a service. The module does not support multiple concurrent operators.

W,E W,E with AESKW with AESKWP with AESGCM W,E © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 with AESCCM g with AESKW g with AESKWP g with AESGCM g with AESCCM W,E D.G) with AESKW with AESKWP with AESCCM with AESGCM W,E g D.G) g with AESKW with AESKWP with AESCCM W,E © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 with AESGCM W,E W,E W,E W,E from a keyderivation Keyderivation W,E G,R W,E G,R © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 W,E G,R W,E G,R W,E G,R W,E p G,R W,E G,R Passwordbased Key Passwordbased Key © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 W,E G,R n W,E W,E G,R W,E G,R W,E W,E W,E W,E © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 G,R G,E,Z W,E W,E W,E W,E G,E G,E,W © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 G,E,W G,E,W N/A N/A N/A © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Passwordbased Key N/A © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation. Z

OpenSSL FIPS Provider for AlmaLinux 9 p Z Z © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 13: Approved Services The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). The convention below applies when specifying the access permissions (types) that the service has for each SSP.

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP.
• N/A: The module does not access any SSP or key during its operation. To interact with the module, a calling application must use the EVP API layer provided by OpenSSL. This layer will delegate the request to the FIPS provider, which will in turn perform the requested service. Additionally, this EVP API layer can be used to retrieve the approved service indicator for the module. The redhat_ossl_query_fipsindicator() function indicates whether an EVP API function is approved. The exact process to use this function and how to interpret its results is described in the fips_module_indicators manual page.

© 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 14: Non-Approved Services The table above lists the non-approved services in this module, the algorithms involved and the roles that can request the service. In this table, CO specifies the Crypto Officer role.

The module does not load external software or firmware. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

The integrity of the module is verified by comparing a HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time. This operation is performed by the verify_integrity() function which performs a KAT for the HMAC SHA-256 algorithm in order to test its proper operation before performing the checksum of the module file.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity test may be invoked on-demand by unloading and subsequently re-initializing the module, or by calling the OSSL_PROVIDER_self_test function. This will perform (among others) the software integrity test. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

Type of Operational Environment: Modifiable How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms, and only the module has control over these SSPs.

The module shall be installed as stated in Section 11 Life-Cycle Assurance. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

The module is comprised of software only and therefore this section is Not Applicable (N/A).

Number: Not applicable. Placement: Not applicable. Surface Preparation: Not applicable. Operator Responsible for Securing Unused Seals: Not applicable. Part Numbers: Not applicable.

Not applicable. Table 15: EFP/EFT Information Not applicable. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

Table 16: Hardness Testing Temperatures Not applicable. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

This module does not implement any non-invasive security mechanism, and therefore this section is not applicable. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

Table 17: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in

Table 18: SSP Input-Output Methods

© 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 N/A Table 19: SSP Zeroization Methods The application that uses the module is responsible for the appropriate zeroization of SSPs. The module provides key allocation and destruction functions, which overwrites the memory occupied by the SSP´s information with zeros before its deallocation. Memory allocation of SSPs is performed by the OPENSSL_malloc() API call and the application in use of the module is responsible for the calling of the appropriate zeroization functions from the OpenSSL API. The zeroization functions then overwrite the memory OPENSSL_cleanse() should be used to overwrite sensitive data such as private keys. In case of abnormal termination, or swap in/out of a physical memory page of a process, the SSPs in physical memory are overwritten by the Linux kernel before the physical memory is allocated to another process. All data output is inhibited during zeroization. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 with AESKWP with AESGCM with AESCCM with AESKWP with AESGCM with AESCCM 112524288 bits - 112256 bits

© 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 bits - 112200 bits bits - 112200 bits bits - 112256 bits © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits e - N/A bits - 112256 bits n Passwordbased Key bits - 112256 bits bits - 112256 bits n bits - 112256 bits Passwordbased Key © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 bits - 128384 bits G, © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 20: SSP Table 1 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Table 21: SSP Table 2

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2030. © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9

HMACSHA2-256 Table 22: Pre-Operational Self-Tests The pre-operational software integrity tests are performed automatically when the module is initialized, before the module transitions into the operational state. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-tests are passed successfully. Prior the first use, a CAST is executed for the algorithms used in the Pre-operational SelfTests.

© 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 P-256, P384, and P521 P-256, P384, and P521 P-256, P384, and P521 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 P-256, P384, and P521 P-256, P384, and P521 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 KDF SP800108 SP80056Cr2 Sp80056Cr1 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 Passwordbased Key Passwordbased Key Passwordbased Key Passwordbased Key Passwordbased Key Passwordbased Key © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 SP 80090Arev1 HMAC-SHA1 SP 80090Arev1 KAS-FFCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 KAS-ECCSSC Sp80056Ar3 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.

OpenSSL FIPS Provider for AlmaLinux 9 KAS-ECCSSC Sp80056Ar3 N/A SP 80056Arev3 5.6.2.1.4 © 2024 Cloudlinux Inc., TuxCare division/atsec information security corporation.