Astro Subscriber Motorola Advanced Crypto Engine (MACE) - Security Level 3

Certificate

Approved Algorithms (19)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Astro Subscriber Motorola Advanced Crypto Engine (MACE) - Security Level 3
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Status Output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Astro Subscriber Motorola Advanced Crypto Engine (MACE) - Security Level 3
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Status Output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Astro Subscriber Motorola Advanced Crypto Engine (MACE)

• Security Level 3 Non-Proprietary FIPS 140-3 Security Policy Document Version: 1.3 Date: October 4, 2024 The MACE is used in multiple Motorola Solutions, Inc. subscribers. Visit the Motorola Solutions, Inc. website to verify your subscriber has this module by viewing the subscriber specifications sheet. Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

This document defines the Security Policy for the Astro Subscriber Motorola Advanced Crypto Engine (MACE)

• Security Level 3, hereafter denoted the MACE. The MACE is implemented as a single-chip cryptographic module to meet FIPS 140-3 level 3 physical security requirements as defined by FIPS 140-3 and embedded in the Motorola Solutions subscribers. The MACE provides secure key management, Overthe-Air-Rekeying (OTAR), and voice and data encryption for multiple Motorola Solutions subscribers. Visit the Motorola Solutions website to verify your subscriber has this cryptographic module by viewing the subscriber specifications sheet. The FIPS 140-3 security levels for the MACE are as follows: Table 1
• Security Levels Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE cryptographic module is a single chip hardware cryptographic module. The MACE is used in multiple Motorola Solutions, Inc. subscribers. The MACE cryptographic module is intended for use by US Federal agencies or other markets that require FIPS 140-3 validated overall security level 3.

The MACE cryptographic module is tested on the following operational environment. Table 2

• Cryptographic Module Tested Configuration The MACE cryptographic module supports the following approved algorithms which may be installed separately from the MACE base firmware using the program update service. While the installation of AES may be done separately, for the purposes of this validation the MACE includes this firmware. Table 3
• Approved Mode Drop-in Algorithms

The physical form of the MACE cryptographic module is depicted in Figure 1 and Figure

2. The MACE is a single chip embodiment. The cryptographic boundary is drawn around the perimeter of the MACE IC as shown in Figure
3. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Figure 1: MACE Chip (Top)                                   Figure 2: MACE Chip (Interfaces) The MACE IC has an SSI port, a KVL port when connected to the Motorola Key Variable Loader (KVL), SelfTest Indicator Interface, and Power Connections. Status Indicator              Status                                   KVL Port               KYLD Cryptographic                                   The MACE Boundary SSI RX 1.8V             Power                                     SSI Port SSI TX CPLD Audio                                                                                         OMAP CODECs Figure 3: Cryptographic Boundary

The MACE is originally non-compliant and must be configured to operate in an approved mode of operation. The MACE must be installed, initialized, and configured, including a required change of the factory-default password, in order to be in an approved mode. Documented below are the additional configuration settings that are required for the MACE to be used in an Approved Mode of operation at overall security level

3. At any given time, the module status service can be used to determine whether the MACE is operating at overall security level
4. There is no non-approved mode. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The Module status service can be used to verify the firmware version matches an approved version listed on NIST’s website: https://csrc.nist.gov/projects/cryptographic-module-validationprogram/validated-modules Also, the module status service will output the AES-256 DIA version installed with a display of 52 (ASCII "R") 01 00 00 -> R01.00.00 - AES256 DIA or 52 (ASCII "R") 01 00 01 -> R01.00.01 - AES256 DIA.

In order to configure the MACE into an approved mode, the Module configuration service must be used to ensure the following parameters are disabled.

1. Motorola Data Communication Over The Air Rekeying (MDC OTAR)
2. Key Loss Key (KLK) generation
3. Red Keyloading
4. Infinite UKEK Retention The operator shall configure the periodic self-tests timer as part of the Module configuration, refer to Section 11 for further details. Additionally, the MACE supports “drop-in algorithms” via the program update service. Drop-in algorithms may be added or removed from the MACE independent of the base FW. In order to remain in the Approved mode, only Approved and Allowed algorithms are loaded into the MACE during initialization; in particular AES-256 (Cert #A2261 and #A2262). The loading and unloading of any firmware within the validated cryptographic module invalidates the Module’s validation and zeroizes all SSPs except those entered at manufacturing. The Module is then in a non-compliant state. The MACE implements the Approved Mode and Non-Approved but Allowed cryptographic functions listed in the tables below. Note: The brackets [] reference the corresponding documents that can be found in the References section - Table 21 Table 5 – Approved Algorithms Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Per IG C.H Scenario 2, the MACE generates GCM IVs randomly as specified in SP800-38D section 8.2.2 using approved DRBG (Cert #A2265) and the IV length is 96 bits. The entropy for seeding the SP 800-90A DRBG is determined by the operator of the MACE which is outside of the module’s physical and logical boundary. The operator shall use entropy sources that meet the security strength required for the random number generation mechanism as shown in [SP 800-90A] Table 3 (CTR_DRBG) and set required bits into the module by using Load Entropy service listed in Section 4.3. Since entropy is loaded passively into the module, there is no assurance of the minimum strength of generated keys. The MACE will not operate in an approved mode if the module is not seeded by the external entropy. RSA SigVer [FIPS 186-2] is approved for legacy use only: verifying signatures that were performed starting September 1, 2020 and onwards is a not a FIPS 140-3 compliant use of this algorithm/service and cannot claim security. Verifying signatures generated before September 1, 2020 is the approved legacy use of RSA SigVer [FIPS Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Table 6

• Non-Approved but Allowed Cryptographic Functions Table 7
• Non-Approved but Allowed Cryptographic Functions with No Security Claimed Note: The module does not implement any Non-Approved Algorithms and Not Allowed Cryptographic Functions in the Approved Mode of Operation.

1. The MACE provides two distinct operator roles: User and Cryptographic Officer.
2. The MACE provides identity-based authentication.
3. The MACE clears previous authentications on power cycle.
4. An operator does not have access to any cryptographic services prior to assuming an authorized role.
5. The MACE allows the operator to initiate power-up self-tests by power cycling power or resetting the MACE.
6. Power up self-tests do not require any operator action.
7. Data output is inhibited during key generation, self-tests, zeroization, and error states.
8. Status information does not contain CSPs or sensitive data that if misused could lead to a compromise
9. There are no restrictions on which keys or SSPs are zeroized by the zeroization service.
10. The MACE does not support concurrent operators.
11. The MACE does not support a maintenance interface or role.
12. The MACE does not support manual SSP establishment method.
13. The MACE does not have any proprietary external input/output devices used for entry/output of data.
14. The MACE does not enter or output plaintext CSPs.
15. The MACE does not output intermediate key values.
16. The MACE does not provide bypass services on ports/interfaces. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE shall be installed in the Motorola Solutions subscriber products. After authentication with the default password, the operator shall change the default password for the User role. The MACE is not usable until the factory default password is changed for the User role. Note that this makes it very important that physical access to the MACE is strictly controlled. The MACE shall be operated such that only approved Drop-in algorithms listed in the Table 3 are installed including section 11 secure installation, initialization, startup and operation of the MACE. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE’s ports and associated FIPS defined logical interface categories are listed in Table 8. Table 8

• Ports and Interfaces Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE supports two distinct operator roles, User and Cryptographic Officer (CO). Table 9 lists all operator roles supported by the MACE and their related services. In addition, the MACE supports services which does not require to be authenticated, listed UA in Table 9. The MACE does not support a maintenance role and/or bypass capability. Table 9

• Roles, Service Commands, Input and Output Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE supports one distinct operator role (Crypto-Officer). The MACE uses a 10-digit password to authenticate the Crypto-Officer. The module ensures that there is no visible display of the authentication data.

All services implemented by the MACE are listed in Table

11. The MACE does not allow any non-approved service while operating in FIPS 140-3 level 3 mode and indicated use is based on the Module being in Approved mode per Table
12. The SSPs modes of access shown in Table 11 are defined as: • G = Generate: The MACE generates or derives the SSP. • R = Read: The SSP is read from the MACE (e.g., the SSP is output). • W = Write: The SSP is updated, imported, or written to the MACE. • E = Execute: The MACE uses the SSP in performing a cryptographic operation. • Z = Zeroize: The MACE zeroizes the SSP Table 11 – Approved Services Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Note: The module does not implement any Non-Approved Services and only provides an Approved mode of operation. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE is composed of base firmware version identified in Table

2. On top of that customer shall load at least one of the Drop-in algorithms listed in Table
3. The firmware components are protected with the approved firmware integrity technique described in Table
4. The Module includes a firmware verification and load service to support necessary updates for the base firmware. The operator can initiate the firmware integrity test on demand by power cycling the MACE. The Module is composed of the following firmware component(s): • non-modifiable operating system - binary Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE has a non-modifiable operational environment under the FIPS 140-3 definitions with a Physical Security at Level 3 therefore this section in not applicable. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE is a production grade, single-chip cryptographic module as defined by FIPS 140-3 and is designed to meet level 3 physical security requirements. The information below is applicable to cryptographic module hardware kit numbers 5185912Y03, 5185912Y05, and 5185912T05, which have identical physical security characteristics. ambient temperature (-40 to 85 degrees Celsius) only. No assurance of the epoxy hardness is claimed for this physical security mechanism outside of this range. The MACE does not contain any doors, removable covers, or ventilation holes or slits. No maintenance access interface is available. No special procedures are required to maintain physical security of the MACE while delivering to operators. There are two (2) voltage powers that power the MACE. VDDCORE voltage powers all MACE chip functions while VDDBU voltage powers the MACE chip battery. VDDCORE and VDDBU voltages enter the cryptographic boundary of the module separately; and therefore, were tested separately to verify that they both cause the MACE chip to zeroize SSPs Table 12

• Physical Security Inspection Guidelines Table 13
• EFP/EFT Table 14
• Hardness testing temperature range Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE does not implement any mitigation method against non-invasive attack. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The SSPs access methods are described in Table 15 below: Table 15

• SSP Management Methods Note: For zeroization methods with an asterisk, once zeroization is complete the Module will reboot, indicating successful zeroization. The output status of all other methods of success of zeroization are implicit and any attempt to use previous keys/CSPs will trigger an error. Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

MACE is described in the services detailed in 4.3. Table 16

• SSPs Management Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Table 17

• Non-Deterministic Random Number Generation Specification Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE performs self-tests to ensure the proper operation of the MACE. Per FIPS 140-3 these are categorized as either pre-operational self-tests or conditional self-tests. Both pre-operational and conditional self-tests are executed automatically by the Self-test service when the module is initiated by module reset or transitions from power off state to power on state. All KATs (including the integrity test) tests, services are not available, and data output (via the data output interface) is inhibited until all tests are successfully completed. No operator intervention is required. Pre-operational self-tests are available on demand by power cycling the MACE. Conditional self–tests are periodically performed by the MACE as configured by the operator during module configuration as shown in Section 11.1.1. The MACE will not accept any commands when a periodic self-test is required; the commands still in the I/O buffer will be processed by the MACE at the end of periodic self-test when the I/O buffer is emptied. The MACE will reset if any self-tests fail, otherwise it will continue to operate normally. The MACE logs the most recent self-test errors to the internal flash; the operator (UA) can extract the error logs using Extract Error Log service list in section 4.3. The self-tests error states and status indicator are described in table below: Table 18

• Error States and Indicators Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The MACE performs the conditional self-tests listed in the table below. All KATs are performed during boot up of the module and before the module transitions to an operational state. Table 20

• Conditional Self-Tests Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

The Module is originally a non-compliant module and must be initialized to be in approved mode. There is no non-approved mode. During initialization the operator shall configure the MACE from the instructions below:

1. Upon first access, the operator will use the default password provided by Motorola in a separate communication.
2. The operator will then change the default password based on the requirements in Table 10 – Roles and Authentication.
3. The operator will then configure the MACE using the Module configuration service as specified in the section 2.3.1.
4. Finally, the operator will set the periodic self-tests timer as part of the Module configuration in every X minutes, where X is a minimum value = 1 minute and maximum value = 712,800 minutes (495 days). Note: the default minimum = 0* but must be changed to a minimum of 1. * Periodic self-tests will not perform if minimum = 0

The MACE is embedded in multiple Motorola Solutions, Inc. radios (aka, subscribers). Motorola uses commercially available courier systems such as UPS, FedEx, and DHL with a tracking number and requires a signature at the end by an authorized client.

Use radio specific user guide available on the www.motorolasolutions.com website for secure operations.

Use radio specific user guide available on the www.motorolasolutions.com website for secure operations.

The MACE does not require any special maintenance.

After the end-of-life, the operator should zeroize all SSPs using the “Zeroize all keys and password” service listed in the Section 4.3 followed by shredding the MACE chip. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The MACE does not implement any mitigation method against other attacks. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

The following standards are referred to in this Security Policy. Table 21

• References Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

Table 22

• Acronyms and Definitions Motorola Solutions Public Material
• May be reproduced only in its original entirety (without revision).

Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).