Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]

Certificate

Approved Algorithms (103)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Firmware Load</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Self-test<br/>Show status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>IKEV<br/>IPSEC<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>kernel<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Firmware Load</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Self-test<br/>Show status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>IKEV<br/>IPSEC<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>kernel<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

Apple Inc. Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Document Version 2.0 December 2024 Prepared by: Lightship Security Inc. 1101-150 Isabella Street, Ottawa, ON, K1S 1V7 www.lightshipsec.com This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Trademarks Apple's trademarks applicable to this document are listed in https://www.apple.com/legal/intellectualproperty/trademark/appletmlist.html. Other company, product, and service names may be trademarks or service marks of others. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Contents 1. 2. 3. 4. 5. 6. 4.1 4.2 5.1 5.2 6.1 7. 8. 9. 9.1 9.2 9.3 9.4 9.5 9.6 10.1 10.2 10.3 11.1 11.2 This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Tables This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]

1. This document is the non-proprietary FIPS 140-3 Security Policy for Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] cryptographic module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for a Security Level 1 module. This document provides all tables and diagrams (when applicable) required by NIST SP 800-140B. The column names of the tables follow the template tables provided in NIST SP 800-140B. Table 1 describes the individual security areas of FIPS 140-3, as well as the Security Levels of those individual areas. N/A N/A N/A Table 1 – Security levels The Module has an overall security level of
2. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 2. Cryptographic Module Specification The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] cryptographic module (hereafter referred to as "the Module") is a software module running on a multi-chip standalone general-purpose computing platform. The version of module is 13 written as v13.0. The module provides implementations of low-level cryptographic primitives to the Host OS's (macOS Ventura v13) Security Framework and CommonCrypto. The module has been tested by Lightship Security, Inc. CST lab on the following platforms with and without PAA: # Table 2

• Tested operational environments. In addition to the platforms listed above, Apple Inc. has also tested the module on the following platforms and claims vendor affirmation on them: # This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Table 3

• Affirmed operational environments. The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate. The table below lists all Approved or Vendor-affirmed security functions of the module, including specific key size(s) employed for approved services, and implemented modes of operation. The module is in the Approved mode of operation when the module utilizes the services that use the security functions listed in the table below. The Approved mode of operation is configured in the system by default and can only be transitioned into the non-Approved mode by calling one of the non-Approved services listed in Table 9
• Non-approved services. If the device starts up successfully, then the module has passed all self-tests and is operating in the Approved mode. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] KBKDF: Supported Lengths: 8 to 4096 in increments of 8. Fixed Data Order: Before Fixed Data. When using HMAC as the PRF. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Table 4

• Approved algorithms The module does not have non-Approved algorithms used in the Approved mode of operation (with or without security claimed). The table below lists non-Approved security functions that are not Allowed in the Approved Mode of Operation: Table 5
• Non-approved algorithms Not Allowed in the Approved Mode of Operation Triple-DES encryption/decryption was tested as part of CAVP algorithm testing, but is not utilized for any services implemented/supp orted by the module in Approved mode of operation. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] executes within the kernel space of the computing platforms and operating systems listed in Table 2

• Tested operational environments. Figure 1 below shows the logical block diagram3 representing the following information:
• The location of the logical object of the module with respect to the operating system, other supporting applications and the cryptographic boundary so that all the logical and physical layers between the logical object and the cryptographic boundary are clearly defined; and
• The interactions of the logical object of the module with the operating system and other supporting applications resident within the cryptographic boundary. Figure 1
• Logical block diagram Kernel extension (KEXT) is a bundle that performs low-level tasks. KEXTs run in kernel space, which gives them elevated privileges and the ability to perform tasks that user-space apps cannot. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 3. Cryptographic Module Interfaces As a software-only module, the module does not have physical ports. For the purpose of the FIPS 140-3 validation, the physical ports are interpreted to be the physical ports of the hardware platform on which it runs. interfaces are described in the table below. N/A N/A N/A N/A N/A Table 6

• Ports and interfaces The module is optimized for library use within the macOS kernel space and does not contain any terminating assertions or exceptions. It is implemented as a macOS dynamically loadable library. The dynamically loadable library is loaded into the macOS kernel and its cryptographic functions are made available to macOS kernel services only. Any internal error detected by the module is reflected back to the caller with an appropriate return code. The calling macOS kernel service must examine the return code and act accordingly. The module communicates any error status synchronously through the use of its documented return codes, thus indicating the module’s status. It is the responsibility of the caller to handle exceptional conditions in a FIPS 140-3 appropriate manner. Caller-induced or internal errors do not reveal any sensitive material to callers. Cryptographic bypass This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 4. Roles, Services and Authentication The Module supports a single instance of one authorized role, designated as the Crypto-Officer. No support is provided for multiple concurrent operators or a Maintenance Operator. The table below lists the services available to the Crypto-Officer: Table 7

• Roles, Services, Input and Output 4.1 FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the module does not implement an authentication mechanism for Crypto Officer. The Crypto Officer role is authorized to access all services provided by the module (see Table 8
• Approved services and Table 9
• Non-approved services below). This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 4.2 Services The module implements a dedicated KPI function to indicate if a requested service utilizes an approved security function. For services listed in Table 8 – Approved services, the indicator function returns

1. For services listed in Table 9 – Non-approved services, the indicator function returns
2. The table below lists all approved services that can be used in the approved mode of operation. The abbreviations of the access rights to keys and SSPs have the following interpretation: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. N/A= The service does not access any SSP during its operation N/A N/A In accordance with Section 4 and 5.1 of NIST [SP 800-133r2] (CKG), the module uses its approved DRBG to generate random bits and seeds used to generate asymmetric keys. Each generated seed is an unmodified output from the DRBG. In accordance with Section 4 and 5.1 of NIST [SP 800-133r2] (CKG), the module uses its approved DRBG to generate random bits and seeds used to generate asymmetric keys. Each generated seed is an unmodified output from the DRBG. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A Z N/A Z N/A Z Table 8

• Approved services The table below lists all non-Approved services that can only be used in the non-Approved mode of operation. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Table 9

• Non-approved services This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 5. Software/Firmware Security 5.1 Integrity Techniques The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1], which is made up of a single component, is provided in the form of binary executable code. A software integrity test is performed on the runtime image of the module. The HMAC-SHA2-256 implemented in the module is used as an approved algorithm for the integrity test. If the test fails, the module enters an error state where no cryptographic services are provided and data output is prohibited. In this state the module is not operational. 5.2 On Demand Integrity Test Integrity tests are performed as part of the Pre-Operational Self-Tests. The software integrity test is automatically executed at power-on. It can also be invoked by self-test service or powering-off and reloading the module. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]

6. Operational Environment 6.1 Applicability The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] operates in a modifiable operational environment per FIPS 140-3 level 1 specifications. The module is supplied as part of macOS, a commercially available general-purpose operating system executing on the computing platforms specified in section
7. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 7. Physical Security The FIPS 140-3 physical security requirements do not apply to the Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] since it is a software module. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 8. Non-invasive Security Currently, the ISO/IEC 19790:2012 non-invasive security area is not required by FIPS 140-3 (see NIST SP 800-140F). The requirements of this area are not applicable to the module. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 9. Sensitive Security Parameter Management The following table summarizes the keys and Sensitive Security Parameters (SSPs) that are used by the cryptographic services implemented in the module: N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] N/A N/A N/A N/A N/A N/A N/A Table 10

• SSPs 9.1 A NIST approved deterministic random bit generator based on a block cipher as specified in NIST [SP 80090Ar1] is used. The default Approved DRBG used for random number generation is a CTR_DRBG using AES256 with derivation function and without prediction resistance. The random numbers used for key early boot time of macOS kernel for memory randomization. The output of HMAC_DRBG is not used for key deterministic random bit generators are seeded by “read_random”. The read_random is the Kernel Space For both Apple Entropy sources tested in the OEs listed in Table 2, the customer does not have the ability to modify the ES configuration settings (see details in Public Use Document referenced in 3 and 4). The module also performs DRBG health tests according to section 11.3 of [SP 800-90Ar1]. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] cryptographic boundary of the module. Table 11

• Non-Deterministic Random Number Generation Specification 9.2 Key / SSP Generation The module generates Keys and SSPs in accordance with FIPS 140-3 IG D.H. The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per [SP 800-133r2] Section 4 (vendor affirmed), compliant with [FIPS186-4], and using DRBG compliant with [SP 800-90Ar1]. A seed (the random value) used in asymmetric key generation is obtained from [SP 800-90Ar1] DRBG. The key generation service for RSA, ECDSA, as well as the [SP 800-90Ar1] DRBG have been ACVTS tested with algorithm certificates found in Table 4
• Approved algorithms. The module also implements KBKDF key derivation according to [SP 800-108r1] to derive symmetric keys. The module supports both Counter and Feedback modes with HMAC-SHA-1, HMAC-SHA2-224, HMAC-SHA2256, HMAC-SHA2-384, or HMAC-SHA2-512 as the pseudo-random function (PRF). 9.3 Key / SSP Establishment The module provides the following key/SSP establishment related services in the Approved mode:
• AES Key Wrapping The module implements a Key Transport Scheme (KTS) using AES-KW compliant to [SP 800-38F], IG D.G. The SSP establishment methodology provides between 128 and 256 bits of encryption strength. 9.4 Key / SSP Import/Export All keys and SSPs that are entered from, or output to module, are entered from or output to the invoking application running on the same device. Keys/SSPs entered into the module are electronically entered in plain text form. Keys/SSPs are output from the module in plain text form if required by the calling application. The module allows the output of plaintext CSPs (for example: ECDSA or RSA Key Pairs). To prevent inadvertent output of sensitive information, the module performs the following two independent internal actions: 1. 2. The module will internally request the random number generation service to obtain the random numbers and verify that the service completed without errors. Once the keys are generated the module will perform the pairwise consistency test and verify that the test is completed without errors. Only after successful completion of both actions, are the generated CSPs output via the KPI output parameter in plaintext. 9.5 Key / SSP Storage The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] stores ephemeral keys/SSPs in memory only. They are received for use or generated by the module only at the command of the calling application. The module does not provide persistent keys/SSPs storage. The module protects all keys/SSPs through the memory separation and protection mechanisms provided by the operating system. No process other than the module itself can access the keys/SSPs in its process’ memory. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 9.6 Key / SSP Zeroisation Keys and SSPs are zeroised when the appropriate context object is destroyed or when the system is powered down. Input and output interfaces are inhibited while zeroisation is performed. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 10. Self-tests This section specifies the pre-operational and conditional self-tests performed by the module. The preoperational and conditional self-tests ensure that the module is not corrupted and that the cryptographic algorithms work as expected. The module does not implement a bypass mode nor security functions critical to the secure operation of the cryptographic module and thus, does not implement either a pre-operational bypass test or pre-operational critical functions test. While the module is executing the self-tests, services are not available and input and output are inhibited. If the module fails pre-operational or conditional self-tests fail, it will report an error message indicating the cause of the failure and enters the Error State (See section 10.3). The module permits operators to initiate the pre-operational or conditional self-tests on demand for periodic testing of the module by rebooting the system (i.e., power-cycling).

The module performs a pre-operational software integrity test automatically when the module is loaded into memory (i.e., at power on) before the module transitions to the operational state. A software integrity test is performed on the runtime image of the Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] with HMAC-SHA2-256 used to perform the approved integrity technique. Prior to using HMAC-SHA-256, Conditional Cryptographic Algorithm Self-Test (CAST) is performed. If the CAST on the HMAC-SHA-256 is successful, the HMAC value of the runtime image is recalculated and compared with the stored HMAC value pre-computed at compilation time.

Conditional self-tests are to be performed by a cryptographic module when the conditions specified for the following tests occur: Cryptographic Algorithm Self-Test, Pair-Wise Consistency Test. The module does not implement any functions requiring a Software/Firmware Load Test, Manual Entry Test, Conditional Bypass Test nor Conditional Critical Functions Test; therefore, these tests are not performed by The following sub-sections describe the conditional tests supported by the Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1]. 10.2.1. Conditional Cryptographic Algorithm Self-Tests In addition to the pre-operational software integrity test described in Section 10.1, the Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] also runs the Conditional Cryptographic Algorithm Self-Tests (CAST) for all cryptographic functions of each approved cryptographic algorithm implemented by the module during power-up as well. All CASTs are performed prior to the first operational use of the cryptographic algorithm. These tests are detailed in Table 12

• Conditional Cryptographic Algorithm Self-tests below. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] The Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] does generate RSA and ECDSA asymmetric keys and performs the required RSA and ECDSA pair-wise consistency tests on the newly generated key pairs.

If any of the self-tests described in Sections 10.1, 10.2.1 or 10.2.2 fail, the module reports the cause of the error and enters an error state. In the Error State, no cryptographic services are provided, and data output is prohibited. The only method to recover from the error state is to power cycle the device which results in the module being reloaded into memory and reperforming the pre-operational software integrity test and the Conditional CASTs. The module will only enter into the operational state after successfully passing the preoperational software integrity test and the CASTs. The table below shows the different causes that lead to the Error State and the status indicators reported. Table 13

• Error Indicators This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 11. Life-cycle Assurance

The module is built into macOS Ventura v13 and delivered with device. There is no standalone delivery of the module as a software library. The vendor's internal development process guarantees that the correct version of module goes with its intended macOS version. For additional assurance, the module is digitally signed by vendor and it is verified during the integration into macOS. This digital signature-based integrity protection during the delivery/integration process is not to be confused with the HMAC-SHA2-256 based integrity check performed by the module itself as part of its pre-operational self-tests.

The Approved mode of operation is configured in the system by default and can only be transitioned into the non-Approved mode by calling one of the non-Approved services listed in Table 9 – Non-approved services. If the device starts up successfully, then the module has passed all self-tests and is operating in the Approved mode. The ESV Public Use Document (PUD) reference for physical entropy source is: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validationprogram/documents/entropy/E14_PublicUse.pdf The ESV Public Use Document (PUD) reference for non-physical entropy source is: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validationprogram/documents/entropy/E110_PublicUse.pdf Apple Platform Certifications guide [platform certifications] and Apple Platform Security guide [SEC] are provided by Apple which offers IT System Administrators with the necessary technical information to ensure FIPS 140-3 Compliance of the deployed systems. This guide walks the reader through the system’s assertion of cryptographic module integrity and the steps necessary if module integrity requires remediation. The Crypto Officer shall consider the following requirements and restrictions when using the module: o AES-GCM IV is constructed in compliance with IG C.H scenario

1. The GCM IV generation follows RFC 4106 and shall only be used for the IPsec protocol version
2. When the IV in RFC 4106 exhausts the maximum number of possible values for a given security association, either party to the security association that encounters this condition triggers a rekeying with IKEv2 to establish a new encryption key for the security association. The module uses RFC 7296 compliant IKEv2 to establish the shared secret SKEYSEED from which the AES-GCM encryption keys are derived. In case the module’s power is lost and then restored, the key used for the AES GCM encryption/decryption shall be re-distributed. This condition is not enforced by the module. This protocol has not been reviewed or tested by the CAVP and CMVP. o AES-XTS mode is only approved for hardware storage applications. The length of the AES-XTS data unit does not exceed 220 blocks. The module checks explicitly that Key_1 ≠ Key_2 before using the keys in the XTS-Algorithm to process data with them compliant with IG C.I. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] 12. Mitigation of Attacks The module does not claim mitigation of other attacks. This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Appendix A. Glossary and Abbreviations AES Advanced Encryption Standard AES-NI Advanced Encryption Standard New Instructions CAVP Cryptographic Algorithm Validation Program CAST Cryptographic Algorithm Self-Test CAST5 A symmetric-key 64-bit block cipher with 128-bit key CBC Cipher Block Chaining CCM Counter with Cipher Block Chaining-Message Authentication Code CFB Cipher Feedback CMVP Cryptographic Module Validation Program CSP Critical Security Parameter CTR Counter Mode DRBG Deterministic Random Bit Generator ECB Electronic Code Book ECDSA Elliptic Curve Digital Signature Algorithm ESVP Entropy Source Validation Program FIPS Federal Information Processing Standards GCM Galois Counter Mode HMAC Hash Message Authentication Code KAT Known Answer Test KBKDF Key Based Key Derivation Function KDF Key Derivation Function KEXT Kernel Extension KW AES Key Wrap MAC Message Authentication Code KPI Kernel Programming Interface NIST National Institute of Standards and Technology OAEP Optimal Asymmetric Encryption Padding OFB Output Feedback PAA Processor Algorithm Acceleration PCT Pairwise Consistency Test PKG Key-Pair Generation PKV Public Key Validation PRF Pseudo-Random Function PSS Probabilistic Signature Scheme PUD Public Use Document (ESVP) RSA Rivest, Shamir, Adleman SHA Secure Hash Algorithm SHS Secure Hash Standard TOEPP Tested Operational Environment Physical Perimeter This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] XTS XEX Tweakable Block Ciphertext Stealing This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] Appendix B. References FIPS140-3 FIPS PUB 140-3 - Security Requirements for Cryptographic Modules March 2019 https://doi.org/10.6028/NIST.FIPS.140-3 SP 800-140x CMVP FIPS 140-3 Related Reference https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3standards FIPS140-3_IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-igannouncements FIPS140-3_MM CMVP FIPS 140-3 Draft Management Manual https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validationprogram/documents/fips%20140-3/Draft%20FIPS-140-3CMVP%20Management%20Manual%2009-18-2020.pdf SP 800-140 FIPS 140-3 Derived Test Requirements (DTR) https://csrc.nist.gov/publications/detail/sp/800-140/final SP 800-140A CMVP Documentation Requirements https://csrc.nist.gov/publications/detail/sp/800-140a/final SP 800-140B CMVP Security Policy Requirements https://csrc.nist.gov/publications/detail/sp/800-140b/final SP 800-140C CMVP Approved Security Functions https://csrc.nist.gov/publications/detail/sp/800-140c/final SP 800-140D CMVP Approved Sensitive Security Parameter Generation and Establishment Methods https://csrc.nist.gov/publications/detail/sp/800-140d/final SP 800-140E CMVP Approved Authentication Mechanisms https://csrc.nist.gov/publications/detail/sp/800-140e/final SP 800-140F CMVP Approved Non-Invasive Attack Mitigation Test Metrics https://csrc.nist.gov/publications/detail/sp/800-140f/final FIPS180-4 Secure Hash Standard (SHS) March 2012 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] FIPS186-4 Digital Signature Standard (DSS) July 2013 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf FIPS197 Advanced Encryption Standard November 2001 http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 http://www.ietf.org/rfc/rfc3447.txt RFC3394 Advanced Encryption Standard (AES) Key Wrap Algorithm September 2002 http://www.ietf.org/rfc/rfc3394.txt RFC5649 Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm September 2009 http://www.ietf.org/rfc/rfc5649.txt SP 800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP 800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality May 2004 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf SP 800-38D NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf SP 800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf SP 800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] SP 800-56Cr2 Recommendation for Key-Derivation Methods in Key-Establishment Schemes August 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf SP 800-57r5 NIST Special Publication 800-57 Part 1 Revision 5 - Recommendation for Key Management Part 1: General May 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf SP 800-67r1 NIST Special Publication 800-67 Revision 1 - Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher January 2012 http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf SP 800-90Ar1 NIST Special Publication 800-90A - Revision 1 - Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf SP 800-90B NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf SP 800-108 NIST Special Publication 800-108 - Recommendation for Key Derivation Using Pseudorandom Functions (Revised) October 2009 http://csrc.nist.gov/publications/nistpubs/800-108/sp800-108.pdf SP 800-131Ar2 NIST Special Publication 800-131A - Transitioning the Use of Cryptographic Algorithms and Key Lengths March 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf SP 800-132 NIST Special Publication 800-132 - Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf SP 800-133r2 Recommendation for Cryptographic Key Generation June 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf SP 800-135r1 NIST Special Publication 800-135 Revision 1 - Recommendation for Existing Application-Specific Key Derivation Functions December 2011 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf This document may be reproduced and distributed only in its original entirety without revision.

Apple corecrypto Module v13.0 [Intel, Kernel, Software, SL1] MACOS macOS Technical Overview https://developer.apple.com/macos/ SEC Apple Platform Security Guide https://support.apple.com/guide/security/welcome/web macOS Product security certifications for macOS https://support.apple.com/HT201159 This document may be reproduced and distributed only in its original entirety without revision.

Referenced URLs

• www.lightshipsec.com
• https://www.apple.com/legal/intellectual-
• https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-
• https://doi.org/10.6028/NIST.FIPS.140-3
• https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-
• https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-
• https://csrc.nist.gov/publications/detail/sp/800-140/final
• https://csrc.nist.gov/publications/detail/sp/800-140a/final
• https://csrc.nist.gov/publications/detail/sp/800-140b/final
• https://csrc.nist.gov/publications/detail/sp/800-140c/final
• https://csrc.nist.gov/publications/detail/sp/800-140d/final
• https://csrc.nist.gov/publications/detail/sp/800-140e/final
• https://csrc.nist.gov/publications/detail/sp/800-140f/final
• http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
• http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
• http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
• http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
• http://www.ietf.org/rfc/rfc3447.txt
• http://www.ietf.org/rfc/rfc3394.txt
• http://www.ietf.org/rfc/rfc5649.txt
• http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
• http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
• http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
• http://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf
• http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
• http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf
• http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
• http://csrc.nist.gov/publications/nistpubs/800-108/sp800-108.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
• http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf
• http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf
• https://developer.apple.com/macos/
• https://support.apple.com/guide/security/welcome/web
• https://support.apple.com/HT201159