RIGFORT Pro Blockchain HSM

Certificate

Approved Algorithms (14)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for RIGFORT Pro Blockchain HSM
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C1["[high] Firmware / bootloader<br/>versions disclosed<br/>(identity, not provenance)<br/><i>1.4.0</i>"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>firmware load<br/>recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test</i>"]
    C4["[high] Physical/logical<br/>interfaces (some 'blocked<br/>in firmware')<br/><i>Serial Port (RS-232)</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>kernel<br/>bootloader<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I1["Component identity is<br/>disclosed, but provenance<br/>and patch lineage are not."]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I4["Interface reachability may<br/>vary by boot stage and<br/>lifecycle state."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R1["Do the vendor version<br/>strings obscure the<br/>upstream baseline, fork<br/>lineage, or known-CVE<br/>exposure?"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R4["Are interfaces blocked<br/>before the bootloader<br/>runs, or only after<br/>approved mode starts?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E1["SBOM / component baselines<br/>· patch and backport<br/>manifest · CVE disposition"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E4["lifecycle reachability<br/>matrix · boot-stage<br/>interface timing ·<br/>factory/recovery/error-state<br/>access controls"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C1 --> I1 --> R1 --> E1
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C4 --> I4 --> R4 --> E4
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C1,C2,C3,C4,C6 clue;
  class I1,I2,I3,I4,I6 infer;
  class R1,R2,R3,R4,R6 risk;
  class E1,E2,E3,E4,E6 evidence;

flowchart LR
  %% Deterministic clue tier for RIGFORT Pro Blockchain HSM
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C1["[high] Firmware / bootloader versions disclosed (identity, not provenance)<br/><i>1.4.0</i><br/>src: certificate.firmwareVersions"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>firmware load<br/>recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test</i><br/>src: text:keyword"]
    C4["[high] Physical/logical interfaces (some 'blocked in firmware')<br/><i>Serial Port (RS-232)</i><br/>src: securityPolicy.portsAndInterfaces"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>kernel<br/>bootloader<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C1,C4 clueHigh;
  class C2,C3,C6 clueLow;

Security Policy, page by page

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy RigSec Technology Limited RIGFORT Pro Blockchain HSM Non-Proprietary FIPS 140-3 Security Policy Version: 1.7 Date: January 14, 2026 Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table of Contents Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy List of Tables List of Figures Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy This document defines the Security Policy for the RIGFORT Pro Blockchain HSM, hereafter denoted the Module. The Module is a multiple-chip standalone cryptographic module. It is a security module that supports the encryption algorithm approved by FIPS 140-3 and with physical security protection measures, key management mechanisms, and security features to provide secured and applicable cryptographic services for customer systems. Specifically, the security features include key wrapping, message authentication code (MAC), message digest, data encryption and decryption, digital signature generation and verification, etc. The FIPS 140-3 security levels for the Module are as follows: N/A N/A N/A Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

Security Policy Cryptographic Module Specification The Module is a hardware cryptographic module. The Module is intended for use by US Federal agencies or other markets that require FIPS 140-3 validated Data Encryption Cryptographic implementation. The Module is intended to be used in customer systems requiring security features include key wrapping, message authentication code (MAC), message digest, data encryption and decryption, digital signature generation and verification, etc. 2.1 Operational Environment RigSec Data Encryption cryptographic module is tested on the following operational environment. Table 2

• Tested Operational Environment # 3.4.0 1.4.0 NOTE: No Components were excluded from the cryptographic boundary 2.2 Cryptographic Boundary The physical form of the Module is depicted in Figure 1. The Module is a multiple-chip standalone embodiment. The cryptographic boundary is defined as an entire hardware module, and its physical boundary is defined by the hard metal chassis that surrounds all hardware and firmware of the module. The physical dimensions of the module are 482mm*45.5mm*360mm (W*H*L). Figure 1
• Front of RIGFORT Pro Blockchain HSM Figure 2
• Back of RIGFORT Pro Blockchain HSM Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 3

• Right Side of RIGFORT Pro Blockchain HSM Figure 4
• Left Side of RIGFORT Pro Blockchain HSM Figure 5
• Manufacturer Label Sticker of the Module Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 6

• Cryptographic Boundary Block Diagram Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 2.3 Modes of Operation The Module supports both an Approved and non-Approved mode of operation. To verify that the Module is in the Approved mode of operation, the operation mode indicator can be seen on the left side of the management software or check the operation mode status via the menu: Tools → Display Module Status. Table 3

• Modes of Operation

The Approved mode of operation is configured at reception of the Module by the CO role who implements the instructions in Section 11.2 Cryptographic Officer Guidance. The operation mode can be selected at initialization through the management software and cannot be changed once selected unless restored to factory settings.

The non-Approved mode of operation is configured at reception of the Module by the CO role who implements the instructions in Section 11.2 Cryptographic Officer Guidance. The operation mode can be selected at initialization through the management software and cannot be changed once selected unless restored to factory settings. In order to switch modes, the CO must perform a reset of the module by selecting from Management Console menu: Tools → Reset HSM, which zeroizes all the SSPs. Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 7

• Management Console - Unknown Mode during Initialization Figure 8
• Management Console - Approved Mode Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 9

• Management Console - Non- Approved Mode 2.4 Security Functions The Module implements the Approved and Non-Approved but Allowed cryptographic functions listed in the table(s) below. Table 4
• Approved Algorithms Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table 5

• Vendor Affirmed Approved Algorithms Note: The module does not implement any Non-Approved Algorithms Allowed in the Approved Mode of Operation. Note: The module does not implement any Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed Table 6
• Non-Approved Algorithms Not Allowed in the Approved Mode of Operation Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table 7

• Security Function Implementations D.G 2.5 Entropy Sources The Module uses the following entropy sources: Table 9
• Entropy Sources Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 2.6 Overall Security Design

1. The Module provides two distinct operator roles: User (User Application external entity) and Cryptographic Officer (Manager).
2. The Module provides identity-based authentication.
3. The Module clears previous authentications on power cycle.
4. An operator does not have access to any cryptographic services prior to assuming an authorized role.
5. The Module allows the operator to initiate power-up self-tests by power cycling power or resetting the Module.
6. Pre-Operational self-tests do not require any operator action.
7. Data output are inhibited during key generation, self-tests, zeroization, and error states.
8. Status information does not contain CSPs or sensitive data that if misused could lead to a compromise of the Module.
9. There are restrictions on which SSPs are zeroized by the zeroization service. Factory reset will zeroize all SSPs of the module, tamper detection or EFP failure will zeroize all unprotected SSPs of the module.
10. The Module does not support concurrent operators.
11. The Module does not support a maintenance interface or role.
12. The Module does not support manual SSP establishment method.
13. The Module does not have any proprietary external input/output devices used for entry/output of data.
14. The Module enters or outputs plaintext CSPs using trusted channel and split knowledge.
15. The Module does not store any plaintext CSPs.
16. The Module does not output intermediate key values.
17. The Module does not provide bypass services or ports/interfaces. 2.7 Rules of Operation The Module shall be installed as described in Section 11 secure installation, initialization, startup and operation of the Module, and Section 7 Physical Security. The Module shall be operated such that only the approved mode is enabled. Version 1.7 Amber Group Public Material – May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table 10

• Ports and Interfaces Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Roles, Services and Authentication 4.1 Assumption of Roles and Related Services The Module supports two distinct operator roles, User (User Application external entity) and Cryptographic Officer (CO) (Manager). The cryptographic module enforces the separation of roles using identity-based authentication. Re-authentication is enforced when changing roles. If the CO logs in while the user is logged in, the user will be automatically logged out. Table 12 lists all operator roles supported by the Module and their related services. In addition, the Module supports services which does not require to be authenticated, listed UA in Table 12. The Module does not support a maintenance role and bypass capability. The Module does not support concurrent operators. Previous authentications will be cleared on power cycle. The physical security mechanisms employed by the module protect the SSPs from unauthorized disclosure, modification, and substitution via physical intrusions. Table 12

• Roles, Service Commands, Input and Output ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ periodic selftests) ✓ ✓ ✓ ✓ ✓ Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 4.2 Authentication Methods The module ensures that there is no visible display of the authentication data. Table 13

• Authentication Description Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 4.3 Services All services implemented by the Module are listed in Table 14 and Table 15 below. The SSPs modes of access shown in Table 14 are defined as:

• G = Generate: The Module generates or derives the SSP. R = Read: The SSP is read from the Module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the Module. E = Execute: The Module uses the SSP in performing a cryptographic operation. Z = Zeroize: The Module zeroizes the SSP Table 14
• Approved Services G, R, E W, E G R N/A Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision). N/A

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy G N/A Z W N/A R Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision). G Z

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy N/A R R, W, E N/A N/A R R N/A Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision). R

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy W E E E Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision). E

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy E E E N/A N/A E Amber Group Public Material

• May be reproduced only in its original entirety (without revision). R, W, E R, E

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy N/A N/A N/A N/A R, E Z R, E Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision). W, E

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table 15

• Non-Approved Services Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy NOTE: All non-approved services are only available in Non-Approved mode. If invoke any non-approved service in approved mode, the module will return error code ERROR_HSM_MODE. NOTE: All services in Table 14 and Approved SSPs in Table 20 and Table 21 are available in Non-Approved mode. These services are considered non-approved services. Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Software/Firmware Security The Module is a Level 3 multi-chip standalone hardware module. Firmware integrity verification uses an approved digital signature cryptographic mechanism, if the calculated result is not successfully verified, the test fails, and the module enters the error state. In the production process, the public key of the firmware integrity key pair is written into the flash of the AS578 in plaintext. Use the sha256 algorithm to calculate the message digest of the bootloader, kernel, and application of the IMX6 and the message digest of the executable code of the AS578, sign these message digests with the private key of the firmware integrity key pair, and write these signatures into the flash of the AS578. The firmware integrity check of IMX6 and AS578 is performed as follows: AS578:

• Read the digital signature of executable code message digest stored in the flash of AS578, verify the signature with the public key of the firmware integrity key pair, and get the message digest.
• Read executable code and use sha256 algorithm to calculate message digest.
• Compare the two message digests, if the digests are consistent, the firmware integrity check will pass, otherwise module enters the error state. imx6:
• Read the images of bootloader, kernel and application on EMMC respectively, use sha256 algorithm to calculate the message digest, and transfer the message digest to AS578.
• Read the digital signature of bootloader, kernel, and application stored in the flash of AS578, verify the signature with the public key of the firmware integrity key pair, and obtain the message digest.
• Compare the two message digests, if the digests are consistent, the firmware integrity check will pass, otherwise module enters the error state. The operator can initiate the integrity test on demand by rebooting the module. Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Operational Environment The Module has a non-modifiable operational environment under the FIPS 140-3 definitions. The tested operational environment is listed in Table 2. The Module does not include a firmware load service to support necessary updates. Any firmware not identified in this Security Policy does not constitute the Module defined by this Security Policy or covered by this validation. Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy The module is a multiple-chip standalone cryptographic module. Physical security is designed according to Level 3 standards. 7.1 The cryptographic module is contained within a strong enclosure with four (4) tamper-evident seals on the top, left side and bottom and right side and bottom as described in Table

17. Each tamper evident seal is individually identifiable. The cryptographic module will perform EFP. If the voltage falls outside the normal operating range of the module, the module will shut down immediately. The Voltage range is 68V280V. If the temperature falls outside the normal operating range of the module, the module will immediately zeroizes all unprotected SSPS. The temperature range is -2℃---46℃. Table 16 – Physical Security Inspection Guidelines The Module will be shipped from the manufacturer with tamper-evident seals pre-installed. To operate the Module in an Approved mode of operation, the CO role shall inspect the tamper-evident seals IB6127370XXX as shown in Figure 10 to Figure 13 on the reception of the Module. Detailed information is provided in Table
18. If the CO determines that the seals were tampered with, the module is to be removed from service and no longer allowed to be used and is not to be returned to the vendor. The CO will perform the factory reset to zeroize all SSPs. Version 1.7 Amber Group Public Material – May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Seal ID 1 and 2 Figure 10

• Module Seal Locations (Top) Seal ID 3 Seal ID 4 Figure 11
• Module Seal Locations (Bottom) Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 12

• Module Seal Location (Left side) Figure 13
• Module Seal Location (Right side) Table 17
• Tamper-Evident Seal Locations Guidance Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 7.2 Tamper Detection The cryptographic module includes a tamper detection feature that will immediately zeroize all SSPs when the module's cover is removed. This forces a factory reset and will put the module into the Invasive Error State. This will also close all external interfaces and stop providing all services. The tamper detection remains active at all times including when the module is powered off, which at that point, will operate with an internal battery. As the tamper-evident seals will need to be broken to remove the cover, there is no recovery from the error state as the module will no longer be in service. 7.3 Environmental Failure Protection (EFP) The cryptographic module includes Environmental Failure Protection (EFP). If the voltage falls outside the normal operating range of the module, the module will shut down immediately. If the temperature falls outside the normal operating range of the module, the module will immediately zeroizes all unprotected SSPS. See Table 18 for the temperature and voltage measurements Table 18

• Environmental Failure Protection -2.6℃ Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Non-Invasive Security The Module does not implement any mitigation method against non-invasive attack. Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Sensitive Security Parameter (SSP) Management The SSPs access methods are described in Table 19 below: Table 19

• SSP Management Methods NOTE: Zeroization is implicit and is considered complete either after boot sequence is complete or when User/CO initiates zeroization via Zeroize service and the module provides success/fail status. Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 9.1 Critical Security Parameters (CSP) All CSPs used by the Module are described in this section. All usage of these CSPs by the Module is described in the services detailed in 0. Table 20

• CSPs Management Import EstablishZeroizaStorage I, E N/A N/A N/A N/A N/A I HMACSHA256 N/A I N/A N/A Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Import EstablishZeroizaStorage and SP80090B) N/A N/A and SP80090B) N/A N/A N/A N/A N/A N/A N/A N/A N/A I Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy 9.2 Public Security Parameters (PSP) All PSPs used by the Module are described in this section. All usage of these PSPs by the Module is described in the services detailed in Table 15. Table 21

• PSPs Generation Import EstablishZeroizaStorage N/A N/A N/A N/A N/A User RSApub N/A N/A Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy categorized as either pre-operational self-tests or conditional self-tests. the module is powered on, without external input or control. The Module will not accept any commands when a periodic self-test is required; the commands still in the I/O buffer will be processed by The Module and the periodic self-test executed when the I/O buffer is emptied. The Module logs self-test errors in the system log, the CO can consult the error log by View system logs on management software. When HSM powers on, the operator can perform the on-demand self-test through power cycling. Table 22

• Self-Test Error States and Indicators Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy The Module performs the following conditional self-tests: Table 24

• Conditional Self-Tests SP 80090B HealthTest NOTE: Conditional KAT tests are run during the startup of the module as part of the Pre-Operational SelfTest phase the Firmware Integrity. Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy

The module will be securely delivered to the operators via UPS with tracking codes to ensure there is no tampering during delivery. Upon receipt of the module, the CO must check that the module's outer packaging is intact or that the packaging has been opened during transport. Upon delivery, the operator must initialize the module as follows:

1. The operator must ensure that the initial security configuration of the module is completed in a restricted environment using a direct cabled serial connection from the management console (standalone PC).
2. From the management program on the console, the operator must select the COM port by selecting “Connect” from the menu bar.
3. Next, the operator must create the Manager role (CO) by selecting from the Management program menu: Device → Add MNG. The operator then must insert the first of 3 USB tokens. A new PASSWORD (8 characters) will be required and stored on the USB token.
4. Repeat this process twice more with different USB Tokens. When the three Manager roles have been created, HSM can be initialized.
5. Next, the operator will create DMK for the HSM, and export DMK components to USB tokens. Select from the Management program menu: Device → Create DMK. With 3 different USB token, CO must sign in the HSM three (3) times, and store DMK component to each USB token. One DMK component, one USB token.
6. With one of 3 USB tokens, the operator selects from menu, choose: Device → Set Mode of Operation, and choose “FIPS Mode”. Once “OK” is selected, the module will reboot and perform the Pre-Operational and Conditional KAT Self-Tests.
7. Select from menu Tools → Reset HSM, which zeroizes all the SSPs, will remove the module from the Approved Mode of Operation

The serial port is used to connect the cryptographic module and the management computer. The CO implements management functions such as Add MNG, Restore DMK, user application management, and key management through the management computer. The following is the specific function description. Connect HSM Before use HSM, you have to connect to it first. Choose “Connect” from menu, then the dialog below will appear: Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 14

• Choose COM Port From pull-down control, select COM port which connects to HSM. If the port used are not listed, please input the device full path in the edit control. After selection, please click “OK” button。 Add MNG The first step to use HSM, is to create HSM manager. From menu: Device → Add MNG, Follow the instructions shown in the figure below to complete the process. Figure 15
• Add MNG Create DMK From menu: Device → Create DMK, Follow the instructions shown in the figure below, the manager can store DMK components to 3 USB Tokens. Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 16

• Create DMK Set Mode of Operation The next step sets the HSM operation mode. From menu, choose: Device→ Set Mode of Operation. The CO will have two choices, to select “FIPS Mode” or “Non-FIPS Mode” Once selected, the CO will follow the instructions shown in the figure below to complete the process. Figure 17
• Set Mode of Operation Restore DMK After initialization is complete, when the HSM restarts, the first step is to restore DMK. From menu, choose: Device→ Restore DMK, Follow the instructions below to complete the process. Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Figure 18

• Restore DMK Other functions can be selected on the menu of the management software and operated according to the instructions. COs is responsible for protecting USB tokens and passwords from theft. COs must periodically check that the tamper evidence seals are intact and located in the correct position on the chassis. If evidence of tampering is detected, the module shall be considered non-compliant, and shall be scrapped.

The Type-C Port is used to connect the cryptographic module and the communication computer. The communication computer is connected to the application server via Ethernet. When CO creates a user account, a default password is generated. The default password is emailed to the appropriate user. The user must change the password when logging in for the first time. Users can access the services of the cryptographic module only after their identity authentication is passed. The cryptographic module provides user applications with services such as user login/logout, data encryption and decryption, data signature and verification. Users are responsible for protecting their passwords from theft.

The Module does not implement any mitigation method against other attacks. Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy

The following standards are referred to in this Security Policy. Table 25

• References Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Table 26

• Acronyms and Definitions Version 1.7 Amber Group Public Material
• May be reproduced only in its original entirety (without revision).

RIGFORT Pro Blockchain HSM FIPS 140-3 Security Policy Version 1.7 Amber Group Public Material

• May be reproduced only in its original entirety (without revision).