Cryptographic Module for BIG-IP

Certificate

Approved Algorithms (33)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Cryptographic Module for BIG-IP
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[high] Firmware update / recovery<br/>/ rollback services<br/><i>Halt Error<br/>The data output is inhibited.</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Trusted code is reachable<br/>through update and<br/>recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Cryptographic Module for BIG-IP
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[high] Firmware update / recovery / rollback services<br/><i>Halt Error<br/>The data output is inhibited.</i><br/>src: securityPolicy.services"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Show Status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3 clueHigh;
  class C5,C6 clueLow;

Security Policy, page by page

F5, Inc. Cryptographic Module for BIG-IP version 1.0.2za-fips Last update: November 2024 Prepared by: atsec information security corporation

Austin, TX 78759 www.atsec.com

Cryptographic Module for BIG-IP Table of Contents 1.1 1.2 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 3.1 4.1 4.2 4.3 4.4 5.1 5.2 6.1 9.1 9.2 9.3 9.4 © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP F5® and BIG-IP® are registered trademarks of F5, Inc. VMware ESXi™ is a registered trademark of VMware®, Inc. Intel® Xeon® is a registered trademark of Intel® Corporation. Dell is a registered trademark of Dell, Inc. Azure and Hyper-V are registered trademarks of Microsoft AWS is a trademark of Amazon.com, Inc. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

This document is the non-proprietary FIPS 140-3 Security Policy that contains the security rules under which the Cryptographic Module for BIG-IP must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards

Table 1 - Security Levels © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

Purpose of Use: The Cryptographic Module for BIG-IP (hereafter referred to as “the module”) is a cryptographic library offering various cryptographic mechanisms to be used by OpenSSL application running on BIG-IP Virtual Edition. The module provides cryptographic services to applications through an Application Program Interface (API). The module also interacts with the underlying operating system via system calls. Module Type: software Module Embodiment: multiple-chip standalone Cryptographic boundary: The block diagram in Figure 1 shows the module, its interfaces with the operational environment and the delimitation of its cryptographic boundary with red lines. Figure 1 Block Diagram The cryptographic module boundary consists of two components:

• the shared library, the binary for cryptographic implementations (libcrypto.so.1.0.2za)
• the file that holds the pre-computed integrity check value (.libcrypto.so.1.0.2za.hmac) Tested Operational Environment’s Physical Perimeter (TOEPP): The module is aimed to run on a general-purpose computer; the physical perimeter is the surface of the case of the target platform, as shown with orange dotted lines in the diagram Figure 2. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Figure 2

• Cryptographic Module Tested Operational Environment’s Physical Perimeter (TOEPP)

Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets): The module version is 1.0.2za-fips. Tested Operational Environments - Software, Firmware, Hybrid: # Table 2 - Operational Environments -Software Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: # © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Table 3 - Vendor Affirmed Operational Environments Note: The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.

Modes List and Description: Table 4 - Modes of Operation The module becomes operational and enters the approved mode after pre-operational self-tests and conditional algorithm self-tests succeed. No operator intervention is required to reach this point. Once the module is operational, the mode of operation is implicitly assumed depending on the security function invoked and the security strength of the cryptographic keys. Using any nonapproved algorithms from Table 8 will put the module in non-approved mode implicitly.

1 There are algorithms, modes, and key/moduli sizes that have been CAVP-tested but are not used by any approved service

of the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by an © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP N/A N/A © 2024 F5, Inc. / atsec information security.

Table 5 - Approved Algorithms Vendor Affirmed Algorithms: Table 6 - Vendor Affirmed Algorithms Non-Approved, Allowed Algorithms: The module does not implement any Non-Approved Allowed algorithms in the Approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: Table 7 - Non-Approved, Allowed Algorithms with No Security Claimed Non-Approved, Not Allowed Algorithms © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Table 8 - Non-Approved, Not Allowed Algorithms © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

Table 9 - Security Function Implementations

AES-GCM IV: The Crypto Officer shall consider the following requirements and restrictions when using the module. The IV for AES-GCM is constructed in compliance with IG C.H scenario 1a (TLS 1.2). The module is compliant with SP800-52r2 section 3.3.1 and the mechanism for IV generation is compliant with RFC5288. The module does not implement the TLS protocol. The module’s implementation of AES-GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES-GCM key encryption or decryption under this scenario shall be established. generation services specified in section 9.2. For KAS-FFC-SSC the module generates keys using Safe Primes Key Generation with Safe Prime Groups: ffdhe2048, ffdhe3072, ffdhe4096. For KASECC-SSC, the module generates keys using ECDSA KeyGen, with curves P-384 and P-256. The module performs full public key validation on the generated public keys. Additionally, the module performs full public key validation on the received public keys. RSA modulus size (IG C.F): The module implements FIPS 186-4 RSA KeyGen, SigVer and RSA SigGen with modulus lengths of 2048, 3072, 4096 bits. All these modulus lengths have been CAVP tested.

The module entropy source specified in Table 10 uses jitter variations caused by executing instructions and memory accessed (see details in Public Use Document referenced in section 11.2). The CPU Jitter 3.4.0 entropy source with SHA-3 vetted conditioning component is located within the physical perimeter of the module but outside the cryptographic boundary of the module. © 2024 F5, Inc. / atsec information security.

NonPhysical The module employs a Deterministic Random Bit Generator (DRBG) based on [SP800-90Ar1] for the generation of random value used in asymmetric keys, and for providing a RNG service to calling applications. The approved DRBG provided by the module is the counter DRBG with AES256. The output of entropy sources provides 256-bits of entropy to seed and reseed SP800-90Ar1 DRBG during initialization (seed) and reseeding (reseed).

The module implements RSA, ECDSA, ECDH and DH asymmetric key generation services with the following methods:

• RSA and ECDSA key pairs are generated in accordance with [SP800-133r2] section 5.1 which maps to [FIPS186-4] Appendix B.3.3 (RSA) or Appendix B.4.2 (ECDSA). A seed (i.e. the random value) used in asymmetric key generation is directly obtained from the [SP80090Ar1] DRBG.
• Diffie-Hellman and EC Diffie-Hellman key pairs are generated in accordance with [SP800133r2] section 5.2 i.e. key generation method specified in [SP800-56Ar3] section 5.6.1.1.1 (DH) or section 5.6.1.2.1 (ECDH) used by approved key-establishment schemes which maps to [FIPS 186-4].

See Table 9, "KAS" row.

The TLS v1.0 / 1.1 / 1.2 protocol has not been reviewed or tested by the CAVP or CMVP. See section 2.7 for details. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

The logical interfaces are the API through which the applications request services. The following table summarizes the logical interfaces. Table 11 - Ports and Interfaces © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the module does not implement an authentication mechanism for Crypto Officer. The Crypto Officer role is implicitly assumed when accessing all services provided by the module (see Table Approved Services and Table - Non-Approved Services below).

The module supports the Crypto Officer role only. No support is provided for multiple concurrent operators. N/A Table 12 - Roles Table below describes the authorized role in which the service can be performed with specification © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP N/A N/A N/A

The status output from the FIPS_set_indicator_status service indicator's call is provided in Indicator column in Table 14. To read this indicator, the calling application must register a callback function using 'FIPS_register_indicator_callback'. The callback function shall take the input of the form "char *" which is the form of the indicator being output by the module. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP W, E DiffieCalculate a shared © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP 1.2 TLS-P-HASHW, E, G W, E N/A N/A N/A N/A Table 14 - Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

© 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Table 15 - Non-Approved Services © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

The integrity of the module is verified by comparing a HMAC value calculated at run time on the libcrypto.so.1.0.2za file, using HMAC key embedded in the same file, with the HMAC-SHA2-256 value stored in the module file .libcrypto.so.1.0.2za.hmac that was computed at build time. Integrity tests are performed as part of the Pre-Operational Self-Tests.

The on-demand integrity test is performed by power-cycling or reloading the module. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

Operational Environment Type: The module operates in a modifiable operational environment. BIG-IP consists of a Linux based operating system customized for performance that runs directly on the hardware or in virtual environment. Operational Environment Requirements: The module runs on a BIG-IP 17.1.0.1 operating system executing on the hardware and hypervisor specified in Table

2. Configuration Settings and Restrictions: The module should be installed as stated in section
3. The operator should confirm that the module is installed correctly by section following guidance in section 11.1 and section 11.2. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

The module is a software and therefore this section is Not Applicable (N/A). © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

Per IG 12.A: Until requirements of SP800-140F are defined, non-invasive mechanisms fall under ISO / IEC 19790:2012 Section 7.12 Mitigation of other attacks. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

The module does not support manual SSP entry or intermediate key generation output. The module does not support entry and output of SSPs beyond the physical perimeter of the operational environment (TOEPP). The SSPs can be provided to the module in plaintext form via API parameters, to and from the calling application running on the same operational environment. This is allowed by [FIPS 140-3_IG] IG 9.5.A Table 1, according to the “CM Software to/from App via TOEPP Path” entry which refers to keys communicated within the physical perimeter of the GPC.

The application is responsible for calling the appropriate destruction functions provided in the module's API. The destruction functions (listed in Table 17) overwrite the memory occupied by system call. N/A N/A N/A N/A N/A N/A HMACSHA-1, () N/A N/A © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP DiffieHellma n HMACSHA-384: HMACSHA-1 SP800133r2 e1 N/A e() SP800133r2 e1 N/A () KAS-ECCSSC Sp80056Ar3 SP800133r2 e1 N/A (); KAS-ECCSSC Sp80056Ar3: N/A () DiffieHellma n DiffieHellma n © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP DiffieHellma n DiffieHellma n DiffieHellma n preprimar y y KAS-FFCSSC Sp80056Ar3: SP800133r2 e1 N/A KAS-FFCSSC Sp80056Ar3: N/A 8, 2, ECDH: P256, P384/ 128 and 192bits N/A SP800135r1 N/A SP800135r1 N/A ECDH: P256, P384 / 128 N/A © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP and 192bits SP800135r1 D.L) D.L) D.L) [SP80090Ar1] [SP80090Ar1] N/A N/A N/A N/A © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

While the module is executing the pre-operational self-test, CASTs and PCTs, services are not available, and data/control input and data output are inhibited. The module does not return control to the calling application until the self-tests are completed. On successful completion of the CASTs cryptographic services are available. If the module fails any of the tests, it will return an error code and enter into the Error state to prohibit any further cryptographic operations.

Pre-operational self-tests are performed automatically when the module is loaded into memory; the pre-operational self-tests ensure that the module is not corrupted and that the cryptographic algorithms work as expected. HMAC-SHA256 Table 18 - Pre-Operational Self-Tests

© 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP KAS-ECCSSC KAS-FFCSSC [SP800TLS [SP800SSH Table 19 - Conditional Self-Tests The entropy source performs its required self-tests; those are not listed in Table 19, as the entropy source is not part of the cryptographic boundary of the module.

The periodic self-tests can be invoked by powering-off and reloading the module. This service performs Conditional Cryptographic Algorithm Self-Tests (CASTs) and integrity test. During the execution of the periodic self-tests, crypto services are not available and no data output or input is possible. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Table 20 - Error States The module must be re-loaded in order to clear the error condition.

The on demand self-tests is performed by powering-off and reloading the module. During the execution of the on demand self-tests, Conditional Cryptographic Algorithm Self-Tests (CASTs) and integrity test are performed. The crypto services are not available and no data output or input is possible. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

Startup Procedures: Before the Crypto Officer can configure and use the BIG-IP system, the Crypto Officer must activate a valid license on the system. The Crypto Officer chooses the license to buy by selecting the hypervisor from Table 2, and the throughput needed. The following procedures described in "K77552 Licensing the BIG-IP system" on my.F5.com (https://my.f5.com/manage/s/article/K7752#reg) are performed:

• Obtaining a registration key
• Obtaining a dossier
• Activating the license Installation Process: The Crypto Officer downloads the BIG-IP VE image (ie the module i.e. 1.0.2zafips binary and its integrity check file) and deploys it. After the FIPS validated module license is installed, the command prompt will change to ‘REBOOT REQUIRED’. The Crypto Officer must reboot the BIG-IP for all FIPS-compliant changes to take effect.

The Crypto Officer should verify the validity of the BIG-IP software license by running the command: ‘tmsh show sys license' which should output 'FIPS 140, BIG-IP VE-1G to 10G,’ under the ‘Active Modules’ list. On the BIG-IP product the Crypto Officer should call the dedicated Show version API, fips_get_f5fips_module_version, to ensure that the module identifier and version are shown as: Cryptographic Module for BIG-IP OpenSSL 1.0.2za-fips. If the module has passed all self-tests then it is operating in the Approved mode. The Approved mode of operation can only transition into the non-Approved mode by calling one of the nonApproved services listed in Table - Non-Approved Services. The ESV Public Use Document (PUD) reference for non-physical entropy source is as follows: https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropyvalidations/certificate/74

The Crypto Officer shall consider the following requirements and restrictions when using the module.

• AES GCM IV see Section 2.7
• SP800-56Ar3 assurances see Section 2.7
• RSA modulus size see Section 2.7 © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP

The module does not implement security mechanisms to mitigate other attacks. © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Appendix A. AES AES-NI CAST CAVP CBC CCM CFB CKG CMAC CMVP CPU CSP CTR DES DSA DRBG ECB ECC ECDSA ESV FFC FIPS GCM GMAC HMAC IV KAS KAT KDF KTS KW MAC NIST OFB PAA PCT PSP PSS RAM RNG RSA SHA SSH TDES TLS XTS Glossary and Abbreviations Advanced Encryption Standard Advanced Encryption Standard New Instructions Cryptographic Algorithm Self-Test Cryptographic Algorithm Validation Program Cipher Block Chaining Counter with Cipher Block Chaining-Message Authentication Code Cipher Feedback Cryptographic Key Generation Cipher-based Message Authentication Code Cryptographic Module Validation Program Central Processing Unit Critical Security Parameter Counter Mode Data Encryption Standard Digital Signature Algorithm Deterministic Random Bit Generator Electronic Code Book Elliptic Curve Cryptography Elliptic Curve Digital Signature Algorithm Entropy Source Validation Finite Field Cryptography Federal Information Processing Standards Publication Galois Counter Mode Galois Message Authentication Code Hash Message Authentication Code Initialization Vector Key Agreement Schema Known Answer Test Key Derivation Function Key Transport Scheme AES Key Wrap Message Authentication Code National Institute of Science and Technology Output Feedback Processor Algorithm Acceleration Pairwise Consistency Test Public Security Parameter Probabilistic Signature Scheme Random-Access Memory Random Number Generator Rivest, Shamir, Adleman Secure Hash Algorithm Secure Shell Triple-DES Transport Layer Security XEX-based Tweaked-codebook mode with cipher text Stealing © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP Appendix B. References FIPS140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules March 2019 https://doi.org/10.6028/NIST.FIPS.140-3 FIPS140-3_IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-igannouncements FIPS180-4 Secure Hash Standard (SHS) August 2015 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf FIPS186-4 Digital Signature Standard (DSS) July 2013 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf FIPS197 Advanced Encryption Standard November 2001 http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf FIPS202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions August 2015 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 http://www.ietf.org/rfc/rfc3447.txt RFC3394 Advanced Encryption Standard (AES) Key Wrap Algorithm September 2002 http://www.ietf.org/rfc/rfc3394.txt SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality May 2004 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf SP800-38D NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP SP800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf SP800-38G NIST Special Publication 800-38G - Recommendation for Block Cipher Modes of Operation: Methods for Format - Preserving Encryption March 2016 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf SP800-52r2 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations August 2019 https://doi.org/10.6028/NIST.SP.800-52r2 SP800-56Ar3 NIST Special Publication 800-56A Revision 3 - Recommendation for Pair Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://doi.org/10.6028/NIST.SP.800-56Ar3 SP800-56Cr2 Recommendation for Key Derivation through Extraction-then-Expansion August 2020 https://doi.org/10.6028/NIST.SP.800-56Cr2 SP800-57 NIST Special Publication 800-57 Part 1 Revision 4 - Recommendation for Key Management Part 1: General January 2016 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf SP800-90Ar1 NIST Special Publication 800-90A - Revision 1 - Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 http://dx.doi.org/10.6028/NIST.SP.800-90Ar1 SP800-90B (Second DRAFT) NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://doi.org/10.6028/NIST.SP.800-90B SP800-131Ar2 NIST Special Publication 800-131A Revision 2- Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths March 2019 https://doi.org/10.6028/NIST.SP.800-131Ar2 SP800-132 NIST Special Publication 800-132 - Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf SP800-133r2 NIST Special Publication 800-133 - Recommendation for Cryptographic Key Generation June 2020 https://doi.org/10.6028/NIST.SP.800-133r2 SP800-135r1 NIST Special Publication 800-135 Revision 1 - Recommendation for Existing Application-Specific Key Derivation Functions December 2011 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf © 2024 F5, Inc. / atsec information security.

Cryptographic Module for BIG-IP SP800-140B NIST Special Publication 800-140B - CMVP Security Policy Requirements March 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140B.pdf © 2024 F5, Inc. / atsec information security.

Referenced URLs

• www.atsec.com
• https://my.f5.com/manage/s/article/K7752#reg
• https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-
• https://doi.org/10.6028/NIST.FIPS.140-3
• https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-
• http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
• http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
• http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
• http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
• http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
• http://www.ietf.org/rfc/rfc3447.txt
• http://www.ietf.org/rfc/rfc3394.txt
• http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
• http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
• http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
• http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
• http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf
• http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
• http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38G.pdf
• https://doi.org/10.6028/NIST.SP.800-52r2
• https://doi.org/10.6028/NIST.SP.800-56Ar3
• https://doi.org/10.6028/NIST.SP.800-56Cr2
• http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
• http://dx.doi.org/10.6028/NIST.SP.800-90Ar1
• https://doi.org/10.6028/NIST.SP.800-90B
• https://doi.org/10.6028/NIST.SP.800-131Ar2
• http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf
• https://doi.org/10.6028/NIST.SP.800-133r2
• http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140B.pdf