AWS Key Management Service HSM

Certificate

Approved Algorithms (30)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for AWS Key Management Service HSM
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>firmware load</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C6 clue;
  class I2,I3,I6 infer;
  class R2,R3,R6 risk;
  class E2,E3,E6 evidence;

flowchart LR
  %% Deterministic clue tier for AWS Key Management Service HSM
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>firmware load</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C6 clueLow;

Security Policy, page by page

AWS Key Management Service HSM Hardware version 3.0, firmware version 1.8.104 Document Version 0.35 October 25, 2024

Amazon Web Services, Inc. The module meets the FIPS 140-3 overall Level 3 requirements. Table 1 lists the security level of for each area in the FIPS 140-3 validation: Table 1 – Security Levels

2. Cryptographic Module Specification The AWS Key Management Service HSM is used exclusively by AWS as a component of the AWS Key Management Service (KMS). The module is not directly accessible to customers of KMS. The cryptographic functions of the module are used to fulfill requests under specific public AWS KMS APIs. The module runs firmware versions 1.8.104 on hardware version 3.0 and is classified as a Hardware module with a multi-chip standalone embodiment. The cryptographic boundary is defined as the module case, and the module runs on a non-modifiable operating environment. The module follows the initialization/installation requirements found in Section
3. Table 2 - Cryptographic Module Tested Configuration The AWS Key Management Service HSM operates only in an Approved mode of operation. The module does not support any non-approved algorithms not allowed in the Approved mode of operation. The module’s cryptographic algorithm implementations have received the following certificate numbers from the Cryptographic Algorithm Validation Program (CAVP). Although additional modes and key lengths were included in the CAVP algorithm testing, the table below represents the actual modes and key lengths used by the services of the module. Standard Strength(s) There are algorithms, modes, and key/moduli sizes that have been CAVP-tested but are not used by any approved service of the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by an approved service of the module. Per IG C.H (Scenario 2), IVs are internally generated using an approved DRBG, with length of 96 bits (per SP 800-38D). The IV generation is internal to the module, but external to the algorithm boundary

6.1] 6.2] Table 3 –Approved Algorithms Table 4 – Non-Approved Algorithms Allowed in the Approved Mode of Operation

Table 5 - Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed

The cryptographic boundary consists of the entire module as shown in Figures 1 and 2. Figure 1 – Cryptographic Module Boundary (Front) Figure 2 - Cryptographic Module Boundary (Back)

3. Cryptographic Module Interfaces The module provides a number of physical and logical interfaces to the device, and the physical interfaces provided by the module are mapped to four FIPS 140-3 defined logical interfaces: data input, data output, control input, and status output. The control output interface is not applicable. The logical interfaces and their mapping are provided in the following table: Table 6 – Ports and Interfaces

4. Roles, Services, and Authentication Operators of the module may assume the following three roles implicitly: KMS Front End Role (KMS-FE) - The KMS front end hosts perform actions on behalf of customers of AWS KMS. KMS Coordinator Role (KMS-C) - Non-public facing KMS hosts perform actions on behalf of KMS administrators in Administrator Role (Admin) - Employees of AWS who are authorized to manage the module. For FIPS 140-3 purposes, the KMS Coordinator and Administrator roles serve as the Cryptographic Officer role per FIPS 140-3 requirements. The KMS-Front End role serves as the User role per FIPS 140-3 requirements. The module supports only identity-based authentication and requires RSA or ECDSA signatures using RSA with 2048bit, 3072-bit, or 4096-bit keys, or ECDSA with P-384. Operators of the module are identified by unique Operator Signature Public Key (QOS). The list of operator keys and the role of each operator are configured using either the Initialize or InitializeAndCreateDomain service. Operators interact with the module by submitting digitally signed commands to the module. The module authenticates operators by verifying the digitally signed commands submitted to the module. Table 7 – Roles and Authentication The list of services supported by the module are listed in Table
5. Unless otherwise specified, access to services can be configured to require one or more members of one or more roles listed in Table
6. These services are used only by components of KMS to fulfill requests under specific public AWS KMS APIs and cannot be used directly by KMS customers. See http://docs.aws.amazon.com/kms/latest/APIReference/Welcome.html for a list of the current public AWS KMS APIs. Authentication to the module requires RSA (2048 or 4096-bit) or ECDSA (P-384) signature verification. These authentication methods are cryptographically strong and provide between 112 to 192 bits of security. The possibility of a single random authentication attempt succeeding is 2-112 which is far less than the required minimum of less than 1/1,000,000.

Assuming an upper bound of 232 authentication requests per second, the possibility of a random authentication succeeding within a one-minute period is (60*232)/2112 = 15/278 which is significantly less than 1/100,000. The cryptographic strengths of the digital signatures used for authentication create such difficulty in achieving a successful random authentication attempt that even the theoretical maximum bandwidth of the 25 Gb/second Ethernet port is not significant enough to allow enough attempts in a one-minute period.

Table 8 – Roles, Service Commands, Input and Output Each approved service provides an indicator when the service utilizes an approved cryptographic algorithm, security function, or process in an approved manner. Per IG 2.4.C, the module implements a global indicator via the “Approved” service which is a persistent indicator that only returns healthy if the module is running in its approved mode of operation where approved services are executing. Approved Services Approved services supported by the module are listed in Table 9. Access rights Description Approved Functions Indicator Service Security SSPs Roles and/or SSPs

Access rights Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                   SSPs                                       Roles         and/or SSPs

Access rights Keys and/or Description               Approved              Functions                                                                                 Indicator to Keys Service                                                        Security                   SSPs                                        Roles         and/or SSPs (DKn or DKn-1) (DKn or DKn-1)

Access rights Description               Approved              Functions                                                                              Indicator Service                                                        Security                   SSPs                                     Roles         and/or SSPs

Access rights Description               Approved              Functions                                                                              Indicator Service                                                        Security                   SSPs                                     Roles         and/or SSPs

Access rights Description               Approved              Functions                                                                                Indicator Service                                                        Security                   SSPs                                       Roles         and/or SSPs (DKn or DKn-1)

Access rights Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                   SSPs                                       Roles         and/or SSPs (dRAK1, QRAK1) or dRSKn-1)

Access rights Description               Approved              Functions                                                                                 Indicator to Keys Service                                                        Security                    SSPs                                       Roles         and/or SSPs ECDSA                              QRAK2)

Access rights Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                   SSPs                                       Roles         and/or SSPs (dRAK1 and QRAK2) Key (DKn) (QRSKn or QRSKn-1)

Access rights Description               Approved              Functions                                                                                Indicator Service                                                        Security                   SSPs                                       Roles         and/or SSPs Key (dRSK0)

Access rights Keys and/or Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                   SSPs                                       Roles         and/or SSPs Key (dRSKn) Key (dRSKn)

Access rights Description               Approved              Functions                                                                                Indicator Service                                                        Security                    SSPs                                      Roles         and/or SSPs Key (dRSKn) (QRSKm, …, QRSKn) (optional)

Access rights Description               Approved              Functions                                                                                      Indicator Service                                                        Security                   SSPs                                       Roles               and/or SSPs

Access rights Description               Approved              Functions                                                                                      Indicator Service                                                        Security                   SSPs                                       Roles               and/or SSPs

Access rights Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                   SSPs                                       Roles         and/or SSPs

Access rights Keys and/or Description               Approved              Functions                                                                                  Indicator to Keys Service                                                        Security                     SSPs                                 Roles               and/or SSPs

Access rights Keys and/or Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                     SSPs                               Roles               and/or SSPs

Access rights Description               Approved              Functions                                                                                      Indicator Service                                                        Security                    SSPs                                        Roles             and/or SSPs

Access rights Keys and/or Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                     SSPs                               Roles               and/or SSPs

Access rights Keys and/or Description               Approved              Functions                                                                                Indicator to Keys Service                                                        Security                     SSPs                               Roles               and/or SSPs Table 9 – Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output).

W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

5. Software/Firmware Security The module performs integrity check on all firmware components using a 256-bit error detection code (EDC) on all module components. The integrity check is performed upon the initialization of the module and does not require operator intervention to run. If the check fails, the module will enter into an error state. The module does not support firmware loading. The operator can run the integrity test on demand by rebooting the module using the DeactivateAndReboot API.

6. Operational Environment The module has a non-modifiable operational environment and does not allow loading of any additional firmware while the module is operating in Approved mode.

The module is a hardware module with a multiple-chip standalone embodiment and conforms to the Level 3 requirements for physical security. The module’s production-grade enclosure is made of hard metal, and the enclosure does not provide a removable cover. The baffles installed by AWS satisfy FIPS 140-3 requirements for module opacity and probing. The module supports environments failure protection and shuts down if the temperature or voltage is outside of the values described in Table 11. Table 11

• EFP/EFT Table 12
• Hardness Testing Temperature Ranges

8. Non-invasive Security This section is not applicable. The module does not implement non-invasive attack mitigation techniques.

9.            Sensitive Security Parameters Management Table 13 provides a complete list of Critical Security Parameters used within the module. All keys and SSPs are zeroized by powering off the module. Establishment Security FuncUse & related Key/SSP Generation                                                                        Zeroisation tion and Cert. Strength Import / Name/Type                                   Number                                      Export                                     Storage                           keys

Customer Data Key (CDK) CSP/PSP

For symmetric keys, random bits length spec- ified by customer (in the range of 8 bits to 65536 bits) 112

• 128 bits (RSA 2048, 3072 or 4096 bits) 128
• 256 bits (ECDSA P-256, P-384, P-521, or secp256k1)

AES RSA ECDSA (A1908) CKG

Internally using DRBG or im- ported from another mem- ber of a Domain

Input: En- crypted using AES GCM with the DEK derived from an HBK or CSK (electroni- cally) Output: En- crypted in 2 forms by the GenerateAndEn- cryptRandomBy tes and Gener- ateDataKeyPair APIs:

1. Encrypted with the DEK derived from an HBK or CSK; and
2. Encrypted with the HOSK to provide se- cure transport to the request- ing service operator/role EncryptRan- domBytes and Generate- DataKeyPairWit houtPlaintext APIs export the CDK encrypted with the DEK from an HBK or CSK (electroni- cally)

N/A

Volatile memory

Overwriting with all zeros

Used outside of the module

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

HSM-Operator Session Key (HOSK) CSP

AES GCM (A1908)

Internally using DRBG, or im- ported from an HSM that is a member of the same domain

Input: The HOSK is input en- crypted with the domain key (DKn) (electroni- cally) Output: The HOSK is en- crypted in two forms to be out- put The first form is encrypted with either the Do- main Key (DKn) or the HSM Ses- sion Key Encryption Key (HSKEK) using AES GCM (elec- tronically) The second form is en- crypted using AES GCM with a 256-bit key de- rived from the shared secret established us- ing elliptic curve Diffie-Hellman key exchange (NIST-P384) us- ing the HSM Ephemeral Agreement Key Pair (dE,QE) and the Operator Ephemeral Agreement Pub- lic Key (dOEAK,

KAS (SP 800- 56Arev3) (Cofactor) One- Pass Diffie-Hell- man (ECC CDH) scheme with key confirma- tion KTS (SP 800- 38F)

Volatile memory

Overwriting with all zeros

The HOSK is used to encrypt communications between a user and HSMs in the same Domain

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Import / Name/Type Number Export Storage keys Output: QRAKk plaintext; dRAKk (DKn) (electroni-

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys (QRAKk)

Establishment Security FuncUse & related Key/SSP Generation Zeroisation Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Import / Name/Type Number Export Storage keys

Establishment Security FuncUse & related Key/SSP Generation Zeroisation tion and Cert. Strength Import / Name/Type Number Export Storage keys Table 13 – SSPs

Table 14 – Non-Deterministic Random Number Generator Specification

10. Self-Tests FIPS 140-3 requires the module to perform self-tests to ensure the integrity of the module and the correctness of the cryptographic functionality at start up. Some functions require conditional tests during normal operation of the module. All of these tests are listed and described in this section. In the event of a self-test error, the module will log the error and enter the error state. Once in the error state, all SSPs are zeroized and the module becomes unusable. Pre-Operational Self-Tests Pre-operational self-tests are run upon the initialization of the module and do not require operator intervention to run. If any of the tests fail, the module will not initialize. The module will enter an error state and no services can be accessed by the operator. The module implements the following pre-operational self-tests: Integrity Check 256-bit error detection code (EDC) on all module components The module performs all pre-operational self-tests automatically when the module is initialized. All pre-operational self-tests must be passed before a Crypto Officer can perform services. The pre-operational self-tests can be run on demand by rebooting the module. Conditional Self-Tests The module performs all conditional self-tests automatically when the module is initialized. All conditional self-tests must be passed before a Crypto Officer can perform services.. If any of these tests fail, the module will enter an error state, where no services can be accessed by the operators. The module can be re-initialized to clear the error and resume Approved mode of operation. Each module performs the following conditional self-tests: Cryptographic Algorithm Self Tests

• AES (Encryption in ECB mode with 128 bit key) KAT
• AES (Decryption in ECB mode with 128 bit key) KAT
• AES GCM (Generation with 128 bit key) KAT
• AES GCM (Verification with 128 bit key) KAT
• ECC KAS (ECDH) (Primitive Z test with EC P-256 parameter set) KAT
• ECDSA (Signature generation with P-256 curve) KAT
• ECDSA (signature verification with P-256 curve) KAT
• RSA (Signature generation, key transport SP800-56B per IG D.G with 2048 bit key) KAT
• RSA (Signature verification, key transport SP800-56B per IG D.G with 2048 bit key) KAT
• HMAC (Generation with SHA2-256, SHA2-512) KAT
• HMAC (Verification with SHA2-256, SHA2-512) KAT
• SHS (SHA-1, SHA2-256, SHA2-512) KAT
• SP 800-90 CTR_DRBG KAT

• DRBG Health Tests Performed on DRBG, per SP 800-90A Section 11.3
• SP 800-108 KBKDF (HMAC-SHA2-256) KAT
• KDA (OneStep KDF) (SHA2-256) KAT Pair-wise Consistency Tests
• RSA key pair generation
• ECDSA / ECDH key pair generation SP 800-56A Assurances
• Performed per SP 800-56Arev3 Sections 5.5.2 and 5.6.2 SP 800-90B Health Tests (Critical function test)
• NIST SP 800-90B ENT Health Tests, per SP 800-90B Section 4.5 The module does not perform a firmware load test because no additional firmware can be loaded in the module while operating in the Approved mode. Please see Section 3 for guidance on configuring and maintaining Approved mode. On-demand Self-Tests On-demand self-tests can be performed by rebooting the module which will perform the pre-operational self-tests. Periodic Self-Tests All conditional self-tests are automatically run once a day. The specific time is randomly selected by the module between 23 to 24 hours since the last run. The tests are executed in the background.

11. Life-cycle Assurance Delivery and Operation The AWS Key Management Service HSM is designed to be mounted in a rack only. Before mounting onto a rack, the module should be inspected for signs of physical tampering. Connect the power interface to the power connector in the rack. Power up the module. The module will start up in the approved mode of operation. No other configuration is necessary. End of Life To prepare a module for disposal:
12. Remove all domain information on the module using the ForgetDomain API
13. Delete the HSM Signature Key and HSM Agreement Key from the HSM using the Wipe API
14. Return the HSM to the factory state using the DeactivateAndReboot API. This step also zeroizes volatile memory as part of the reboot process
15. Power down the module by disconnecting the module from the power source To securely destroy a module:
16. To open the chassis, drill though all fasteners that secure the cover to the chassis and remove the cover.
17. Remove and destroy the solid state drive and memory modules in accordance with NIST SP 800-88rev1.

12. Mitigation of Other Attacks Not Applicable.

AES

Advanced Encryption Standard

Appendix A - Acronyms ANSI         American National Standards Institute API          Application Programming Interface AWS          Amazon Web Services CBC          Cipher Block Chaining CDK          Customer Data Key CMK          Customer Managed Key CMVP         Cryptographic Module Validation Program CO           Crypto Officer CSE          Communications Security Establishment Canada CSK          Customer Supplied Key CSP          Critical Security Parameter CTR          Counter DH           Diffie-Hellman DKn          Domain Key DKEK         Domain Key Encryption Key DRBG         Deterministic Random Bit Generator ECB          Electronic Codebook EC           Elliptic Curve ECDSA        Elliptic Curve Digital Signature Algorithm EMC          Electromagnetic Compatibility EMI          Electromagnetic Interference FCC          Federal Communications Commission FIPS         Federal Information Processing Standard GCM          Galois/Counter Mode HBK          HSM Backing Key HMAC         (Keyed-) Hash Message Authentication Code HOSK         HSM-to-Operator Session Key HSK          HSM Signature Key Pair HSKEK        HSM Session Key Encryption Key HSM          Hardware Security Module IPMI         Intelligent Platform Management Interface KAS          Key Agreement Scheme KAT          Known Answer Test KBKDF        Key Based Key Derivation Function KDF          Key Derivation Function KMS          Key Management Service KTS          Key Transport Scheme

MAC   Message Authentication Code MD    Message Digest NIST  National Institute of Standards and Technology NMI   Non-Maskable Interrupt OAEP  Optimal Asymmetric Encryption Padding PKCS  Public-Key Cryptography Standards PSS   Probabilistic Signature Scheme QOEAK Operator Ephemeral Agreement Public Key QOS   Operator Signature Public Key RNG   Random Number Generator RSA   Rivest, Shamir, and Adleman SHA   Secure Hash Algorithm SP    Special Publication SSP   Sensitive Security Parameter