Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module

Certificate

Approved Algorithms (482)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>IKEV<br/>IPSEC</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>Show Status</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>IKEV<br/>IPSEC</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Canonical Ltd. Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module Version 5.15.0-73-fips Version 1.2 Last update: 11-08-2024 Prepared by: atsec information security corporation

4516 Seton Center Pkwy, Suite 250

Austin, TX 78759 www.atsec.com © 2024 Canonical Ltd./ atsec information security.

© 2024 Canonical Ltd. / atsec information security.

3 of 103

This document is the non-proprietary FIPS 140-3 Security Policy for version 5.15.0-73-fips of the Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 module. intact and including this notice. Other documentation is proprietary to their authors.

1 1

2 1

3 1

4 1

5 1

6 1

7 N/A

8 N/A

9 1

which was further consolidated into this document by atsec information security together with other vendor-supplied documentation. In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing. © 2024 Canonical Ltd. / atsec information security.

6 of 103

Purpose and Use: The Canonical Ltd. Ubuntu 22.04 Kernel Crypto API Cryptographic Module (hereafter referred to as “the module”) provides a C language application program interface (API) for use by other (kernel space and user space) processes that require cryptographic functionality. The module operates on a general-purpose computer as part of the Linux kernel. Its cryptographic functionality can be accessed using the Linux Kernel Crypto API. Module Type: Software Module Embodiment: MultiChipStand Module Characteristics: Cryptographic Boundary: The cryptographic boundary of the module is defined as the kernel binary and the kernel crypto object files, the libkcapi library, and the sha512hmac binary, which is used to verify the integrity of the software components. In addition, the cryptographic boundary contains the .hmac files which store the expected integrity values for each of the software components. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1: Block Diagram © 2024 Canonical Ltd. / atsec information security.

7 of 103

Identification Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: The module makes use of hardware acceleration provided by the hardware platform. Namely, AES-NI and SHA extensions from the Intel based platform, NEON and Cryptography Extensions for the Graviton2 based platform, and CPACF for the z15 based platform, listed in the Tested Operational Environments - Software, Firmware, Hybrid table. CPACF is considered as PAI. AES-NI, SHA extensions, NEON, and Cryptography Extensions are considered as PAA. © 2024 Canonical Ltd. / atsec information security.

8 of 103

Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

Modes List and Description: 4.3 4.3 Table 4: Modes List and Description Mode Change Instructions and Status: After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. was requested. Not applicable. © 2024 Canonical Ltd. / atsec information security.

9 of 103

Approved Algorithms: © 2024 Canonical Ltd. / atsec information security.

10 of 103

© 2024 Canonical Ltd. / atsec information security.

11 of 103

© 2024 Canonical Ltd. / atsec information security.

12 of 103

© 2024 Canonical Ltd. / atsec information security.

13 of 103

© 2024 Canonical Ltd. / atsec information security.

14 of 103

Table 5: Approved Algorithms Vendor-Affirmed Algorithms: Table 6: Vendor-Affirmed Algorithms © 2024 Canonical Ltd. / atsec information security.

15 of 103

Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: Table 7: Non-Approved, Not Allowed Algorithms

© 2024 Canonical Ltd. / atsec information security.

16 of 103

© 2024 Canonical Ltd. / atsec information security.

17 of 103

Name DRBG or Counter DRBG

Type

Description

Properties 256 bits Hash DRBG:128, 256 bits

Algorithms Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG Counter DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG HMAC DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG Hash DRBG

© 2024 Canonical Ltd. / atsec information security.

18 of 103

© 2024 Canonical Ltd. / atsec information security.

19 of 103

Name

Type

Description

Properties keys:112-524288 bits with 112-256 bits of strength

Algorithms HMAC-SHA2-512 HMAC-SHA2-512 AES-CMAC AES-CMAC AES-CMAC AES-CMAC AES-CMAC AES-CMAC AES-CMAC AES-GMAC AES-GMAC AES-GMAC AES-GMAC AES-GMAC AES-GMAC HMAC-SHA3-224 HMAC-SHA3-224 HMAC-SHA3-256 HMAC-SHA3-256 HMAC-SHA3-384 HMAC-SHA3-384 HMAC-SHA3-512 HMAC-SHA3-512 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-224 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-384 SHA2-384 SHA2-384 SHA2-384

© 2024 Canonical Ltd. / atsec information security.

20 of 103

© 2024 Canonical Ltd. / atsec information security.

21 of 103

© 2024 Canonical Ltd. / atsec information security.

22 of 103

© 2024 Canonical Ltd. / atsec information security.

23 of 103

© 2024 Canonical Ltd. / atsec information security.

24 of 103

Name

Type

Description

Properties

Algorithms HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CBC AES-CBC AES-CBC AES-CBC AES-CBC AES-CBC AES-CBC AES-CBC AES-CBC AES-CTR AES-CTR AES-CTR AES-CTR AES-CTR AES-CTR AES-CTR AES-CTR AES-CTR SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA-1 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-256 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512

© 2024 Canonical Ltd. / atsec information security.

25 of 103

Table 8: Security Function Implementations

For IPsec, the module offers the AES GCM implementation and uses the context of Scenario 1 (b) of FIPS 140-3 IG C.H. The mechanism for IV generation is compliant with RFC 4106. IVs generated using this mechanism may only be used in the context of AES GCM encryption within the IPsec protocol. The module does not implement IPsec. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. This application must use RFC 7296 compliant IKEv2 to establish the shared secret SKEYSE ED from which the AES GCM encryption keys are derived. The design of the IPsec protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the crypto_aead_encrypt API function with an AES GCM handle. When this is the case, the API will not set an approved service indicator, as described in the Approved Services table.

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 220 AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit. To meet the requirement stated in IG C.I, the module implements a check to ensure that the two AES keys used in AES XTS mode are not identical.

The module offers DH and ECDH shared secret computation services compliant to the SP 80056Ar3 and meeting IG D.F scenario 2 path (1). In order to meet the required assurances listed in Section 5.6 of SP 800-56Ar3, the module shall be used together with an application that implements the IPSec protocol and the following steps shall be performed: 1. The entity using the module, must use the module's "Key pair generation" service: the set_secret and generate_public_key API functions, to generate DH/ECDH ephemeral key pairs. This meets the assurances required by key pair owner defined in the section

© 2024 Canonical Ltd. / atsec information security.

26 of 103

2. As part of the module's shared secret computation service, the module internally performs the public key validation on the peer's public key passed in as input to the API function. This meets the public key validity assurance required by the sections 5.6.2.2.1/5.6.2.2.2 of SP 800-56Ar3.
3. The module does not support static keys, therefore the "assurance of peer's possession of private key" is not applicable.

The module implements HMAC with SHA3-224, SHA3-256, SHA3-384, SHA3-512. The CAVP certificates have been obtained for the HMAC algorithm as well as for all the SHA3 implementations. The CAVP certificates are listed in the Approved Algorithms table.

The module implements FIPS 186-4 RSA SigVer. All RSA modulus lengths (i.e., 2048, 3072,

4096 bits) have been CAVP tested. The CAVP certificates are listed in the Approved Algorithms

Table 9: Entropy Certificates Table 10: Entropy Sources The module implements three different Deterministic Random Bit Generator (DRBG) implementations based on SP 800-90Ar1: Counter DRBG, Hash DRBG, and HMAC DRBG. Each of these DRBG implementations can be instantiated by the operator of the module, using the parameters listed specified in the Security Function Implementations table. When instantiated, these DRBGs can be used to generate random numbers for external usage. Additionally, the module employs a specific HMAC SHA-512 DRBG implementation for internal purposes (e.g. to generate asymmetric key pairs). This DRBG is initially seeded with © 2024 Canonical Ltd. / atsec information security.

27 of 103

448 output bits from the entropy source (416 bits of entropy) and reseeded with 320 output

bits from the entropy source (297 bits of entropy).

The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800-133r2. When random values are required, they are directly obtained as output from the SP 800-90Ar1 approved DRBG, compliant with Section 4 of SP 800-133r2 (without XOR). The following methods are implemented:

• Safe Primes key pair generation: compliant with SP 800-133r2, Section 5.2, which maps to SP 800-56Ar3. The method described in Section 5.6.1.1.4 of SP 800-56Ar3 (“Testing Candidates”) is used.
• ECDSA key pair generation: compliant with SP 800-133r2, Section 5.1 and 5.2. The method described in Appendix B.4.2 of FIPS 186-4 (“Testing Candidates”) is used. Note that this generation method is also used to generated ECDH key pairs. Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service.

The module implements SSP agreement and SSP transport methods as listed in the Security Function Implementations table. The module implements the following SSP establishment methods: Key agreement:

• KAS-FFC-SSC compliant with SP 800-56Ar3 and Scenario 2 (1) of FIPS 140-3 IG D.F; using ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 safe primes groups with 112-200 bits of security strength.
• KAS-ECC-SSC compliant with SP 800-56Ar3 and Scenario 2 (1) of FIPS 140-3 IG D.F; using P-256, P-384 curves with 128, 192 bits of security strength. Key transport:
• AES-KW according to IG D.G, using 128, 192, 256-bit keys with 128-256 bits of security strength.
• AES-CCM according to IG D.G, using 128, 192, 256-bit keys with 128-256 bits of security strength.
• AES-GCM according to IG D.G, using 128, 192, 256-bit keys with 128-256 bits of security strength.
• AES-CBC or AES-CTR with HMAC SHA-1, HMAC SHA-256, HMAC SHA-384, or HMAC SHA-512 according to IG D.G, using 128, 192, 256-bit AES keys with 128-256 bits of © 2024 Canonical Ltd. / atsec information security.

28 of 103

security strength, and 112-524288 bits HMAC keys with 112-256 bits of security strength.

AES-GCM with internal IV generation in the approved mode is compliant with RFC 4106 and shall only be used in conjunction with the IPsec protocol. For Diffie-Hellman, the module supports the use of the following safe primes: • TLS (RFC 7919): ffdhe2048 (ID = 256), ffdhe3072 (ID = 257), ffdhe4096 (ID = 258), ffdhe6144 (ID = 259), ffdhe8192 (ID = 260) No other parts of the TLS or IPSec protocols, other than those mentioned above, have been tested by the CAVP and CMVP. © 2024 Canonical Ltd. / atsec information security.

29 of 103

Table 11: Ports and Interfaces The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module does © 2024 Canonical Ltd. / atsec information security.

30 of 103

Table 12: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module. No support is provided for multiple concurrent operators.

© 2024 Canonical Ltd. / atsec information security.

31 of 103

D.L): G,W,E G,W,E © 2024 Canonical Ltd. / atsec information security.

32 of 103

© 2024 Canonical Ltd. / atsec information security.

33 of 103

n © 2024 Canonical Ltd. / atsec information security.

34 of 103

Z D.L): Z D.L): Z D.L): Z Z Table 13: Approved Services The following convention is used to specify access rights to SSPs:

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP.
• N/A: The module does not access any SSP or key during its operation. © 2024 Canonical Ltd. / atsec information security.

35 of 103

Table 14: Non-Approved Services

Not applicable. © 2024 Canonical Ltd. / atsec information security.

36 of 103

The Linux kernel binary is integrity tested using an HMAC SHA-512 calculation performed by the sha512hmac utility (which utilizes the module’s HMAC and SHA-512 implementations). The kernel crypto object files listed in the Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets) table are loaded on start-up by the module and verified using RSA signature verification with PKCS#1 v1.5 padding, SHA-512, and a 4096-bit key. The libkcapi and sha512hmac software components perform their own internal integrity test, respectively using the HMAC SHA-256 and HMAC SHA-512 implementations provided by the Linux kernel.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity tests can be invoked on demand by unloading and subsequently re-initializing the module, which will perform (among others) the software integrity tests. © 2024 Canonical Ltd. / atsec information security.

37 of 103

Type of Operational Environment: Modifiable How Requirements are Satisfied: the module executes as part of a general-purpose operating system (Canonical Ubuntu 22.04 and Canonical Ubuntu Core 22), which allows modification, loading, and execution of software that is not part of the validated module. The approved cryptographic algorithms of the module are part of the Linux kernel, which operates in Linux kernel space. This ensures that any SSPs contained within the module are protected by the process isolation and memory separation mechanisms provided by the Linux kernel, and only the module has control over these SSPs. The user space libkcapi and sha512hmac components, though not processing any SSPs, are similarly protected by the operating environment.

The module shall be installed as specified in Section 11.1. Instrumentation tools like the ptrace system call, gdb and strace, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2024 Canonical Ltd. / atsec information security.

38 of 103

The module is comprised of software only and therefore this section is not applicable. © 2024 Canonical Ltd. / atsec information security.

39 of 103

This module does not implement any non-invasive security mechanism and therefore this section is not applicable. © 2024 Canonical Ltd. / atsec information security.

40 of 103

Name API input parameters; AF_ALG_type sockets (input) API output parameters; AF_ALG type sockets (output)

From Operator calling application (TOEPP) Cryptographic module

To Cryptographic module Operator calling application (TOEPP)

Format Type Plaintext Plaintext

Distribution Type Manual Manual

Entry Type Electronic Electronic

SFI or Algorithm

Table 15: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in destroyed when released by the appropriate zeroization function calls. Table 16: SSP Input-Output Methods Table 17: SSP Zeroization Methods © 2024 Canonical Ltd. / atsec information security.

41 of 103

Name AES Key HMAC Key Shared Secret Entropy Input (IG D.L) DRBG Seed (IG D.L)

Description AES key used for Encryption; Decryption; Authenticated encryption; Authenticated decryption; Message authentication; HMAC key used for Message authentication code (MAC); Shared secret established during Shared Secret Computation Entropy input used to seed the DRBGs DRBG seed derived from Entropy Input

Size - Strength XTS: 128, 256 bits; ECB, CBC, CTR, CFB128, CBC-CTS-CS3, KW, OFB, CCM, GCM, CMAC, CMAC: 128, 192, 256 bits - XTS: 128, 256 bits; ECB, CBC, CTR, CFB128, CBC- CTS-CS3, KW, OFB, CCM, GCM, CMAC, CMAC: 128, 192, 256 bits 112-524288 bits - 112-256 bits KAS-FFC- SSC:ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192; KAS- ECC-SSC: P-256, P-384 bits - KAS-FFC-SSC: 112-200 bits; KAS-ECC-SSC: 128, 192 bits 128-448 bits - 128-256 bits Counter DRBG: 256, 320, 384 bits; Hash_DRBG: 440, 888 bits; HMAC DRBG: 160, 256, 512 bits - Counter DRBG: 128, 192,

Type - Category Symmetric key - CSP Symmetric key - CSP Shared secret - CSP Entropy input - CSP Seed - CSP

Generated By Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG

Established By Shared Secret Computation with KAS- FFC-SSC or KAS-ECC-SSC

Used By Encryption and Decryption with AES Message Authentication with AES or HMAC Message Authentication with AES or HMAC Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG

All data output is inhibited during zeroization.

© 2024 Canonical Ltd. / atsec information security.

42 of 103

Name DRBG Internal State (V, Key) (IG D.L) DRBG Internal State (V, C) (IG D.L) DH Public Key DH Private Key EC Public Key EC Private Key Intermediate Key Generation Value

Description Internal state of Counter DRBG and HMAC DRBG instances Internal state of Hash DRBG instance Public key used for KAS-FFC- SSC DH private key used for KAS- FFC-SSC Public key used for KAS-ECC- SSC EC private key used for KAS- ECC-SSC Intermediate value generated during Key Pair Generation

Size - Strength 256 bits; Hash DRBG: 128, 256 bits; HMAC DRBG: 128, 256 bits Counter DRBG: 256, 320, 348 bits; HMAC DRBG: 320, 512, 1024 bits - Counter DRBG: 128, 192, 256 bits; HMAC DRBG: 128, 256 bits 440, 888 bits - 128, 256 bits ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 - 112-200 bits ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192 - 112-200 bits P-256, P-384 - 128, 192 bits P-521, P-384 - 128, 192 bits 2048-8192 bits - 112-200 bits

Type - Category Internal state - CSP Internal state - CSP Public key - PSP Private key - CSP Public key - PSP Private key - CSP Intermediate value - CSP

Generated By Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG Key Pair Generation with ECDSA or Safe Primes Key Pair Generation with ECDSA or Safe Primes Key Pair Generation with ECDSA or Safe Primes Key Pair Generation with ECDSA or Safe Primes Key Pair Generation with ECDSA or Safe Primes

Established By

Used By Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG Random Number Generation with HMAC DRBG, Hash DRBG or Counter DRBG Shared Secret Computation with KAS-FFC- SSC or KAS- ECC-SSC Shared Secret Computation with KAS-FFC- SSC or KAS- ECC-SSC Shared Secret Computation with KAS-FFC- SSC or KAS- ECC-SSC Shared Secret Computation with KAS-FFC- SSC or KAS- ECC-SSC Key Pair Generation with ECDSA or Safe Primes

© 2024 Canonical Ltd. / atsec information security.

43 of 103

Table 18: SSP Table 1 © 2024 Canonical Ltd. / atsec information security.

44 of 103

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2030. The RSA algorithm as implemented by the module conforms to FIPS 186-4, which has been superseded by FIPS 186-5. FIPS 186-4 was withdrawn on February 3, 2024. © 2024 Canonical Ltd. / atsec information security.

45 of 103

© 2024 Canonical Ltd. / atsec information security.

46 of 103

Table 20: Pre-Operational Self-Tests The pre-operational software integrity tests are performed automatically when the module is powered on, before the module transitions into the operational state. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-tests are passed successfully. © 2024 Canonical Ltd. / atsec information security.

47 of 103

© 2024 Canonical Ltd. / atsec information security.

48 of 103

© 2024 Canonical Ltd. / atsec information security.

49 of 103

© 2024 Canonical Ltd. / atsec information security.

50 of 103

© 2024 Canonical Ltd. / atsec information security.

51 of 103

© 2024 Canonical Ltd. / atsec information security.

52 of 103

© 2024 Canonical Ltd. / atsec information security.

53 of 103

© 2024 Canonical Ltd. / atsec information security.

54 of 103

© 2024 Canonical Ltd. / atsec information security.

55 of 103

© 2024 Canonical Ltd. / atsec information security.

56 of 103

© 2024 Canonical Ltd. / atsec information security.

57 of 103

© 2024 Canonical Ltd. / atsec information security.

58 of 103

© 2024 Canonical Ltd. / atsec information security.

59 of 103

© 2024 Canonical Ltd. / atsec information security.

60 of 103

© 2024 Canonical Ltd. / atsec information security.

61 of 103

© 2024 Canonical Ltd. / atsec information security.

62 of 103

© 2024 Canonical Ltd. / atsec information security.

63 of 103

© 2024 Canonical Ltd. / atsec information security.

64 of 103

© 2024 Canonical Ltd. / atsec information security.

65 of 103

© 2024 Canonical Ltd. / atsec information security.

66 of 103