Thales Luna G7 Cryptographic Module

Certificate

Approved Algorithms (66)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Thales Luna G7 Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Firmware Load<br/>recovery<br/>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>kernel<br/>bootloader</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Thales Luna G7 Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Firmware Load<br/>recovery<br/>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>kernel<br/>bootloader</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Thales Luna G7 Cryptographic Module 002-000179-001 Rev. K January 10, 2025

Contents Document Information Document Part Number 002-000149-002 Release Date January 10, 2025 Revision Version K Thales and/or its subsidiaries and are registered in certain countries. All other trademarks and service marks, whether registered or not in specific countries, are the property of their respective owners. Disclaimer All information herein is either public information or is the property of and owned solely by Thales and/or its subsidiaries who shall have and keep the sole right to file patent applications or any other kind of intellectual property protection in connection with such information. Nothing herein shall be construed as implying or granting to you any rights, by license, grant or otherwise, under any intellectual and/or industrial property rights of or concerning any of Thales’s information. This document can be copied or distributed for informational, non-commercial, internal and personal use only provided that: appear in all copies.  This document shall not be posted on any network computer or broadcast in any media other than on the NIST CMVP validation list and no modification of any part of this document shall be made. Use for any other purpose is expressly prohibited and may result in severe civil and criminal liabilities. The information contained in this document is provided “AS IS” without any warranty of any kind. Unless otherwise expressly agreed in writing, Thales makes no warranty as to the value or accuracy of information contained herein. Thales hereby disclaims all warranties and conditions with regard to the information contained herein, including all implied warranties of merchantability, fitness for a particular purpose, title and noninfringement. In no event shall Thales be liable, whether in contract, tort or otherwise, for any indirect, special or consequential damages or any damages whatsoever including but not limited to damages resulting from loss of use, data, profits, revenues, or customers, arising out of or in connection with the use or performance of information contained in this document. Thales does not and shall not warrant that this product will be resistant to all possible attacks and shall not incur, and disclaims, any liability in this respect. Even if each product is compliant with current security standards in force on the date of their design, security mechanisms' resistance necessarily evolves according to the state of the art in security and notably under the emergence of new attacks. Under no circumstances, shall Thales be held liable for any third party actions and in particular in case of any successful attack against systems or equipment incorporating Thales products. Thales disclaims any liability with respect to security for direct, indirect, incidental or consequential damages that result from any use of its products. It is further stressed that independent testing and verification by the person using the product is particularly encouraged, especially in any application in which defective,

Contents incorrect or insecure functioning could result in damage to persons or property, denial of service or loss of privacy.

Term

Definition

Acronyms and Abbreviations ACRONYMS AND ABBREVIATIONS AES                          Advanced Encryption Standard AEK                          AccessID Encryption Key AEK-KW                       AEK-Key Wrapping ANSI                         American National Standards Institute AU                           Audit User API                          Application Programming Interface CBC                          Cipher Block Chaining CDH                          Cofactor Diffie-Hellman CID                          Client IDentity CITS                         Chrysalis ITS CKG                          Cryptographic Key Generation CFB                          Cipher FeedBack CMAC                         Cipher Block Chaining Message Authenticate Code CMVP                         Cryptographic Module Validation Program CO                           Crypto Officer CPV3                         Cloning Protocol Version 3 CSP                          Critical Security Parameter CTR                          CounTeR CU                           Crypto User CVL                          Component Validation List DEK                          Data Encryption Key DH                           Diffie-Hellman DMK                          Data MAC Key DPK                          Data Protection Key

Term

Definition

Acronyms and Abbreviations DSA                          Digital Signature Algorithm DRBG                         Deterministic Random Bit Generator ECB                          Electronic Code Book ECC                          Elliptic Curve Cryptography ECDH                         Elliptic Curve Diffie-Hellman ECDSA                        Elliptic Curve Digital Signature Algorithm EFP                          Environmental Failure Protection EFT                          Environmental Failure Testing EKA                          Ephemeral Key Agreement EMI                          ElectroMagnetic Interference FFC                          Finite Field Cryptography FIPS                         Federal Information Processing Standard GCM                          Galois Counter Mode GMAC                         Galois Message Authentication Code HMAC                         Keyed-Hash Message Authentication Code HA                           High Availability HOC                          Hardware Origin Certificate HOK                          Hardware Origin Key HSM                          Hardware Security Module / Host Security Module ICD                          Interface Control Design/Document IG                           Implementation Guidance ISO/IEC                      International Organization for Standardization / International Electrotechnical Commission IV                           Initialization Vector KAS                          Key Agreement Scheme KAT                          Known Answer Test KBKDF                        Key-Based Key Derivation Function

Term

Definition

Acronyms and Abbreviations KCV                          Key Cloning Vector KDF                          Key Derivation Function KDM                          Key Destruction Method KEV                          Key Encryption Vector KTS                          Key Transport Scheme KW                           Key Wrap KWP                          Key Wrap with Padding LCO                          Limited Crypto Officer LED                          Light Emitting Diode MAC                          Message Authentication Code MGF                          Mask Generation Function MIC                          Manufacturer’s Integrity Certificate MIK                          Manufacturer’s Integrity Key MK                           Master Key NIST                         National Institute of Science and Technology N/A                          Not Applicable OFB                          Output FeedBack PAC                          PED Authentication Certificate PAK                          PED Authentication Key PBKDF                        Password Based Key Derivation Function PCIe                         Peripheral Component Interconnect Express PCT                          Pair-wise Consistency Test PEC                          Password Encryption Certificate PED                          PIN Entry Device PEK                          Password Encryption Key PKCS                         Public-Key Cryptography Standards

Term

Definition

Acronyms and Abbreviations POST                         Power-on Self-Test PSK                          Partition Storage Key PSS                          Probabilistic Signature Scheme PST                          Periodic Self-Test RDK                          Role Domain Key RNG                          Random Number Generator RPV                          Remote PED Vector RSA                          Rivest Shamir Adleman RSASVE                       RSA Secret-Value Encapsulation SHA                          Secure Hash Algorithm SKA                          Static Key Agreement SMK                          SKS Master Key SKS                          Scalable Key Storage SO                           Security Officer SSC                          Shared Secret Computation SSP                          Sensitive Security Parameter STC                          Secure Trusted Channel STM                          Secure Transport Mode Triple-DES                   Triple Data Encryption Standard TUK                          Token or Module Unwrapping Key TWC                          Token or Module Wrapping Certificate USB                          Universal Serial Bus USK                          User’s Storage Key XTS                          XEX Tweakable block cipher ciphertext Stealing

Cryptographic Algorithms and Key Lengths, March 2019.

References [ISO/IEC 14888-3:2018] ISO/IEC 14888-3:2018, ‘IT Security techniques

• Digital Signatures with appendix
• Part 3: Discrete logarithm based mechanisms’, 2018-11. [ISO 19790:2012] ISO/IEC 19790:2012 (Corrected 2015-12-15, IDT) Information technology
• Security techniques
• Security requirements for cryptographic modules, 2015-12-15. [ISO 24759:2017] ISO/IEC 24759:2017 (Corrected 2017-03, IDT) Information technology
• Security techniques
• Test requirements for cryptographic modules, 2017-03.

NOTE: You require an account to access the Customer Support Portal. To create a new

account, go to the portal and click on the REGISTER link.

Preface PREFACE This document deals only with operations and capabilities of the Thales Luna G7 Cryptographic Module in the technical terms of [FIPS 140-3]. General information on Thales HSM alongside other Thales products is available from the following sources:

[ISO 24759:2017] Section 6 [Number Below]

FIPS 140-3 Section Title General Cryptographic Module Specification Cryptographic Module Interfaces Roles, Services, and Authentication Software/Firmware Security Operational Environment Physical Security Non-Invasive Security Sensitive Security Parameter Management Self-Tests Life-Cycle Assurance Mitigation of Other Attacks

Security Level

The Thales Luna G7 Cryptographic Module meets all level 3 security requirements for [FIPS 140-3] as summarized in the table below: Table 1-1: Security Levels

NOTE Thales Luna G7 Cryptographic Module does not support degraded operation as defined in [ISO 19790:2012].

NOTE The Thales Luna G7 Cryptographic Module can be used as follows:

 as a standalone device called the Thales Luna G7 USB HSM; or

 as a standalone device called the Thales Luna G7 Backup HSM.

device. The cryptographic module is contained in its own secure enclosure, which provides physical resistance. The cryptographic boundary of the module is defined to encompass all components inside the secure enclosure The module must be explicitly configured to operate in an Approved Mode of Operation using steps outlined in sections 13.3 and 13.4. Configuration steps outlined in these sections are performed during the secure initialization of the module. The module only supports a single approved mode of operation and any configuration changes to settings defining that mode will trigger a zeroization of all partition Sensitive Security Parameter (SSP) and require the full reset and re-initialization of the module. The module provides secure key generation and storage for symmetric keys and asymmetric key pairs along with support for a broad range of cryptographic services. Access to key material and cryptographic services for users and user application software is provided through the PKCS #11 programming API, which is implemented over the module’s proprietary command interface. The module may host multiple ‘user partitions’ which are cryptographically separated and are presented as ‘virtual tokens’ to user applications. A single ‘admin partition’ exists, which is dedicated to the HSM Security Officer (HSM SO) and Administrator roles. Each partition must be separately authenticated in order to make it available for use.

embodiment. The Tested Operational Environment’s Physical Perimeter (TOEPP) of the modules is shown in Figure 2-1 and Figure 2-2 below. The TOEPP is defined as the enclosure on the top and bottom sides of the USB device

Cryptographic Module Specification TOEPP Figure 2-1: Thales Luna G7 Cryptographic Module HW 808-000064-005 and 808-000064-006 TOEPP Figure 2-2: Thales Luna G7 Cryptographic Module HW 808-000080-001 and 808-000080-002 The module includes a CR2032, 3V, coin battery, which is excluded from the TOEPP boundary. This battery is used to power the modules real-time clock when not connected through the 5V power interface. The real-time clock is not used to support any approved security functions supported by the module.

NOTE As covered above, ‘firmware’ for the module includes the bootloader and main

firmware. To use the module in an approved mode of operation, all firmware, including the

bootloader and main firmware must be validated to [FIPS 140-3] to run on Thales Luna G7

Cryptographic Module.

The following figure highlights the cryptographic boundary of the module covered by this certification: Cryptographic boundary 1.x.x G7 Hardware Platform are ‘firmware’ within the scope of definitions in [ISO 19790:2012].

Model

Hardware [Part Number and Version] 808-000080-001 808-000080-002 808-000064-005 808-000064-006

Firmware Version Main firmware: 7.7.3 with Bootloader: 1.3.0, 1.5.0 or 1.6.0 Main firmware: 7.7.3 with Bootloader: 1.3.0, 1.5.0 or 1.6.0 Main firmware: 7.7.3 with Bootloader: 1.3.0, 1.5.0 or 1.6.0 Main firmware: 7.7.3 with Bootloader: 1.3.0, 1.5.0 or 1.6.0

Distinguishing Features

NOTE The security features described in this document apply to the Thales Luna G7

Cryptographic Module only and do not include any feature that may be enforced by the

client or Thales Luna PED.

NOTE As the module is a hardware module of ‘multi-chip standalone’ embodiment, this security policy is not required to list an operating system.

The following tested configurations are covered in this security policy: Table 2-1: Cryptographic module configuration. HSM or                                                 Bootloader: 1.3.0, 1.5.0 or 1.6.0   higher resolution. Backup HSM HSM or                                                 Bootloader: 1.3.0, 1.5.0 or 1.6.0   higher resolution. Functionally Backup HSM                                                                                 the difference limited to the supply choice for one of the non-security enforcing internal components. Backup HSM                                             Bootloader: 1.3.0, 1.5.0 or 1.6.0   resolution screen. Backup HSM                                             Bootloader: 1.3.0, 1.5.0 or 1.6.0   resolution screen. Functionally the difference limited to the supply choice for one of the non-security enforcing internal components.

NOTE The following certificates referenced above contain redundant listings not used by the

cryptographic module:

 Cert #C2020 includes listing for KAS-ECC, KAS-FFC, CVL (RSADP) and GMAC;;

 Cert #C2022 includes SHA1 and SHA2-256. The implementations for SHA1 and SHA2-256 are

present in the bootloader to verify firmware integrity but are redundant to other approved

security functions. Firmware authenticity is checked using RSA PKCS#1 v1.5 with SHA2-384.

Implementations for these algorithms are present in the software libraries or hardware integrated

circuits used by the module and have completed CAVP testing but where these functions are

either not called by the modules executable code or the target function is not used as a security

function to satisfy requirements from FIPS 140-3.

 SafeNet Cryptographic Library (Certs #C2020, #A674 and #A2125). The following entropy noise source and associated ESV certificate is used by the cryptographic module:  Thales G7 Hardware Platform TRNG (Cert #E97). together with algorithms use by service, are listed in the Table 2-2 below. Listings in the ‘Use / Function’ column map to services listed in Table 4-2 and Table 4-4.

Cryptographic Module Specification Table 2-2: Approved Algorithms #A2125           ECDSA SigGen                        Signature Generation                            B-233, B-283,                               Request HSM self-test, Generate signature or MAC SHA3-224, SHA3-256, SHA3-384, SHA3-512.         B-409, B-571, K-233,                        over user supplied data , Setup Remote PED Session. #A2125           ECDSA SigVer                        Signature Verification                          B-233, B-283,                               Request HSM self-test, Verify signature or MAC over B-409, B-571, K-233,                        user supplied data, Setup Remote PED Session. #A2125           HASH_DRBG                           SHA2-256                                        256-bits.                                   Clone SMK between partitions, Configure partition for Standard: [SP800-90Ar1].                                                                                                        high-available recovery / login, Create a user partition, Enable/disable STM, Export secret or private key using key wrapping, Extract entropy from DRBG, Generate domain parameters, Generate local symmetric or asymmetric key-pair, Generate signature or MAC over user supplied data, Initialize the HSM, Initialize Remote PED Vector (RPV), Initialize role, Perform encrypt operation on user supplied data object, Request HSM self-test, Setup Remote PED Session, Reseed partition DRBG, Rollover SMK for a given partition. K-409, K-571, P-224, P-256, P-384, P-521.   partition secret or private key object. Standard: [SP800-56Ar3]             dhOneFlow.                                                                                  partition secret or private key object. #A2125           KAS-IFC                             KAS1-basic                                      4096-bits.                                  Clone SMK between partitions, Configure partition for high-available recovery / login.

Cryptographic Module Specification Table 2-2: Approved Algorithms increment 1 byte. partition secret or private key object. increment 1 byte. partition secret or private key object, Clone SMK object. using key wrapping, Initialize the HSM, Initialize role, Change authentication data, Login as role. #A2125 PBKDF2 HMAC-SHA2-512 Derived Key Length: Initialize the HSM, Initialize Remote PED Vector (RPV), 256-bits Initialize role, Change authentication data, Login as Password Length: role, Request HSM self-test. Used internal to the cryptographic module to derive the storage encryption key used to encrypt the checkword used during password-based authentication. The derived key is separately used to encrypt for storage the USK which is independently also encrypted under the module generated KEK. The module uses method 1a from [SP800-132] where the derived Master Key (MK) is used directly as the Data Protection Key (DPK). Further information on use of PBKDF is provided in section 4.2.1.

Cryptographic Module Specification Table 2-2: Approved Algorithms #A674            RSA KeyGen                          Key Generation B.3.3 and B.3.6                 4096 bits.                                 Configure partition for high-available recovery / login, Generate local symmetric or asymmetric key-pair, Initialize the HSM, Initialize role, Request HSM self#A674            RSA SigGen                          Signature Generation                           4096-bit.                                  Clone SMK between partitions, Generate signature or Vendor Note: Key sizes up to modulus       MAC over user supplied data, Request HSM self-test. #A674            RSA SigVer                          Signature Verification                         4096-bit.                                  Load configuration update file, Clone SMK between partitions, Configure partition for high-available recovery / login, Generate local symmetric or asymmetric key-pair, Request HSM self-test, Update firmware, Verify signature or MAC over user supplied data. #C2020           AES-CBC                             CBC                                            128, 192, 256 bits.                        Perform encrypt operation on user supplied data object, Perform decrypt operation on user supplied data object, Import secret or private key using key wrapping, Insert key from external storage using SKS, , Request HSM self-test.

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020           AES-CFB128                          CFB128                                       128, 192, 256 bits.                          Perform encrypt operation on user supplied data object, Perform decrypt operation on user supplied data object, Request HSM self-test. #C2020           AES- CFB8                           CFB8                                         128, 192, 256 bits.                          Perform encrypt operation on user supplied data Standards: [FIPS 197] and                                                                                                     object, Perform decrypt operation on user supplied [SP800-38A].                                                                                                                  data object, Request HSM self-test. #C2020           AES-CMAC                            CMAC                                         128, 192, 256 bits.                          Generate signature or MAC over user supplied data, Standards: [FIPS 197],                                                                                                        Verify signature or MAC over user supplied data, [SP800-38D], [SP800-38E] and                                                                                                  Request HSM self-test. #C2020           AES-CTR                             CTR                                          128, 192, 256 bits.                          Send or receive data over PED tunnel (remote PED), Standards: [FIPS 197] and                                                                                                     Perform encrypt operation on user supplied data [SP800-38A].                                                                                                                  object, Perform decrypt operation on user supplied data object¸ Import secret or private key using key wrapping, Request HSM self-test. #C2020           AES-ECB                             ECB                                          128, 192, 256 bits.                          Perform encrypt operation on user supplied data Standards: [FIPS 197] and                                                                                                     object, Perform decrypt operation on user supplied [SP800-38A].                                                                                                                  data object, Import secret or private key using key wrapping, Request HSM self-test. #C2020           AES-GCM3                            GCM                                          128, 192, 256 bits.                          Extract key to external storage using SKS, Perform Standards: [FIPS 197] and                                                                                                     encrypt operation on user supplied data object, [SP800-38D].                                                                                                                  Perform decrypt operation on user supplied data object, Import secret or private key using key wrapping, Export secret or private key using key wrapping, Request HSM self-test. #C2020           AES-KW                              KW                                           128, 192, 256 bits.                          Perform encrypt operation on user supplied data Standards: [FIPS 197] and                                                                                                     object, Perform decrypt operation on user supplied [SP800-38F].                                                                                                                  data object, Import secret or private key using key wrapping, Export secret or private key using key wrapping, Request HSM self-test.

3 The module generates IVs internally using the approved DRBG where all IV used are 128-bits in length per [SP800-38D] and in accordance with FIPS 140-3 I.G. C.H, scenario 2.

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020 AES-KWP KWP 128, 192, 256 bits. Initialize the HSM, Create a user partition, Initialize Standards: [FIPS 197] and role, Export/import audit log secret key, Clone SMK [SP800-38F]. between partitions, Rollover SMK for a given partition, Change authentication data, Initialize role, Configure partition for high-available recovery / login, Login as role, Initialize Remote PED Vector (RPV), Send or receive data over PED tunnel (remote PED), Generate local symmetric or asymmetric key-pair, Generate domain parameters, Derive key from existing partition secret or private key object, Import secret or private key using key wrapping, Export secret or private key using key wrapping, Insert key from external storage using SKS, Extract key to external storage using SKS, Perform encrypt operation on user supplied data object, Perform decrypt operation on user supplied data object, Generate signature or MAC over user supplied data, Verify signature or MAC over user supplied data, Change authentication data , Request HSM self-test. #C2020 AES-OFB OFB 128, 256 bits. Perform encrypt operation on user supplied data Standards: [FIPS 197] and object, Perform decrypt operation on user supplied [SP800-38A]. data object, Request HSM self-test. #C2020 DSA KeyGen Key Generation 2048, 3072 bits. Generate local symmetric or asymmetric key-pair. #C2020 DSA SigGen Signature Generation 2048, 3072 bits. Generate signature or MAC over user supplied data, Request HSM self-test. #C2020 DSA SigVer Signature Verification 1024, 2048, 3072 bits. Verify signature or MAC over user supplied data, Request HSM self-test.

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020           ECDSA KeyGen                        Key Generation                              B-233, B-283, B-409, B-571, K-233, K-283,     Generate local symmetric or asymmetric key-pair, K-409, K-571, P-224, P-256, P-384, P-521.     Initialize Remote PED Vector (RPV), Setup Remote PED Session. #C2020           ECDSA SigGen                        Signature Generation                        B-233, B-283, B-409, B-571, K-233, K-283,     Generate signature or MAC over user supplied data, SHA2-224, SHA2-256, SHA2-384, SHA2-512.     K-409, K-571, P-224, P-256, P-384, P-521.     Request HSM self-test, Setup Remote PED Session,. #C2020           ECDSA SigVer                        Signature Verification                      B-163, B-233, B-283, B-409, B-571, K-163,     Request HSM self-test, Setup Remote PED Session, K-233, K-283, K-409, K-571, P-192, P-224,     Verify signature or MAC over user supplied data. #C2020           HMAC-SHA-1                          HMAC-SHA-1                                  Mac size: 80, 96, 128, 160.                   Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test, Verify signature or MAC over block size, key size > block size.            user supplied data. #C2020           HMAC-SHA2-224                       HMAC-SHA2-224                               Mac size: 112, 128, 160, 192, 224.            Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Verify signature or MAC over user supplied data, block size, key size > block size.            Request HSM self-test. #C2020           HMAC-SHA2-256                       HMAC-SHA2-256                               Mac size: 128, 192, 256.                      Send or receive data over PED tunnel (remote PED), Key size: key size < block size, key size =   Request HSM self-test, Generate signature or MAC block size, key size > block size.            over user supplied data, Verify signature or MAC over user supplied data, Generate secure log record. #C2020           HMAC-SHA2-384                       HMAC-SHA2-384                               Mac size: 192, 256, 320, 384.                 Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test, Verify signature or MAC over block size, key size > block size.            user supplied data. #C2020           HMAC-SHA2-512                       HMAC-SHA2-512                               Mac size: 256, 320, 384, 448, 512.            Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test, Verify signature or MAC over block size, key size > block size.            user supplied data. #C2020           HMAC-SHA3-224                       HMAC-SHA3-224                               Mac size: 112, 128, 160, 192, 224.            Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test, Verify signature or MAC over block size, key size > block size.            user supplied data. #C2020           HMAC-SHA3-256                       HMAC-SHA3-256                               Mac size: 128, 192, 256.                      Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test Verify signature or MAC over block size, key size > block size.            user supplied data. #C2020           HMAC-SHA3-384                       HMAC-SHA3-384                               Mac size: 192, 256, 320, 384.                 Generate signature or MAC over user supplied data, Key size: key size < block size, key size =   Request HSM self-test Verify signature or MAC over block size, key size > block size.            user supplied data.

Cryptographic Module Specification Table 2-2: Approved Algorithms Key size: key size < block size, key size =   Request HSM self-test Verify signature or MAC over existing partition secret or private key object, Change authentication data, Login as role, Request HSM selftest. #C2020           RSA KeyGen                          Key Generation B.3.3 and B.3.6                 2048 and 3072 bits.                           Request HSM self-test, Generate local symmetric or asymmetric key-pair. #C2020           RSA SigGen                          Signature Generation                           2048 and 3072 bits.                           Request HSM self-test, Generate signature or MAC over user supplied data.

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020           RSA SigVer                          Signature Verification                         1024, 2048 and 3072 bits.               Request HSM self-test, Verify signature or MAC over user supplied data. #C2020           SHA1                                SHA1                                           N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHA2-224                            SHA2-224                                       N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHA2-256                            SHA2-256                                       N/A                                     Request HSM self-test, Protect object integrity, Enable/disable STM, Initialize role, Configure partition for high-available recovery / login, Login as role, Import secret or private key using key wrapping, Insert key from external storage using SKS, Perform digest operation on user supplied data. #C2020           SHA2-384                            SHA2-384                                       N/A                                     Request HSM self-test, Update firmware, Load configuration update file, Configure partition for highavailable recovery / login, Import secret or private key using key wrapping, Perform digest operation on user supplied data.

4 Legacy usage only. These legacy algorithms can only be used on data that was generated prior to the Legacy Date specified in FIPS 140-3 IG C.M.

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020           SHA2-512                            SHA2-512                         N/A                                     Request HSM self-test, Clone SMK between partitions, Enable/disable STM, Initialize role, Configure partition for high-available recovery / login, Initialize Remote PED Vector (RPV), Generate local symmetric or asymmetric key-pair, Generate domain parameters, Derive key from existing partition secret or private key object, Import secret or private key using key wrapping, Export secret or private key using key wrapping, Perform digest operation on user supplied data, Perform encrypt operation on user supplied data object, Generate signature or MAC over user supplied data. #C2020           SHA3-224                            SHA3-224                         N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHA3-256                            SHA3-256                         N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHA3-384                            SHA3-384                         N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHA3-512                            SHA3-512                         N/A                                     Request HSM self-test, Import secret or private key using key wrapping, Perform digest operation on user supplied data. #C2020           SHAKE-128                           SHAKE-128                        N/A                                     Request HSM self-test, Perform digest operation on user supplied data. #C2020           SHAKE-256                           SHAKE-256                        N/A                                     Request HSM self-test, Perform digest operation on user supplied data. #C2020           Triple-DES-CBC                      CBC                              168-bits                                Request HSM self-test, Perform decrypt operation on Standards:. [SP800-67r2] and                                                                                 user supplied data object, Import secret or private key Legacy4 Decryption #C2020           Triple-DES-CFB64                    CFB64                            168-bits                                Request HSM self-test, Perform decrypt operation on Standards: [SP800-67r2] and                                                                                  user supplied data object. Legacy4 Decryption

Cryptographic Module Specification Table 2-2: Approved Algorithms #C2020           Triple-DES-CFB8                     CFB8                                         168-bits                                    Request HSM self-test, Perform decrypt operation on Standards: [SP800-67r2] and                                                                                                  user supplied data object. Legacy4 Decryption #C2020           Triple-DES-CMAC                     CMAC (MAC verify only)                       168-bits                                    Request HSM self-test. Verify signature or MAC over Standards: [SP800-67r2] and                                                                                                  user supplied data. Legacy4 Verification #C2020           Triple-DES-CTR                      CTR                                          168-bits                                    Request HSM self-test, Perform decrypt operation on Standards:. [SP800-67r2] and                                                                                                 user supplied data object, Import secret or private key Legacy4 Decryption #C2020           Triple-DES-ECB                      ECB                                          168-bits                                    Request HSM self-test, Perform decrypt operation on Standards:. [SP800-67r2] and                                                                                                 user supplied data object, Import secret or private key Legacy4 Decryption #C2020           Triple-DES-OFB                      OFB                                          168-bits                                    Request HSM self-test, Perform decrypt operation on Standards:. [SP800-67r2] and                                                                                                 user supplied data object. Legacy4 Decryption #C2022           SHA2-384                            SHA2-384 (Byte Only)                         N/A                                         Request authentication and execution of main firmware.

Cryptographic Module Specification Table 2-2: Approved Algorithms #E97 Physical Live noise source Full Entropy Initialize the HSM, Create a user partition, Clone SMK [SP800-90B], [FIPS 180-4] between partitions, Rollover SMK for a given partition, Enable/disable STM, Request HSM self-test, Initialize role, Configure partition for high-available recovery / login, Initialize Remote PED Vector (RPV), Setup Remote PED Session, Generate local symmetric or asymmetric key-pair, Generate domain parameters, Derive key from existing partition secret or private key object, Export secret or private key using key wrapping, Re-seed partition DRBG, Extract entropy from DRBG, Perform encrypt operation on user supplied data object, Generate signature or MAC over user supplied data.

Algorithm

Caveat Vendor Affirmed

Use / Function

Key Transport

Algorithm

Caveat N/A

Use / Function

Cryptographic Module Specification Table 2-3: Vendor Affirmed Approved Algorithms CKG6 Vendor Affirmed Initialize the HSM, Create a user partition, Clone SMK between partitions, Rollover SMK for a [SP800-133r2] given partition, Initialize role, Change authentication data, Initialize Remote PED Vector (RPV), Setup Remote PED Session, Generate local symmetric or asymmetric key-pair, Generate domain parameters. Table 2-4: Non-approved algorithms allowed in the approved mode of operation KAS-ECC-SSC ephemeralUnified, fullUnified, onePassDH Derive key from existing partition secret or private key object. (Cert #A2125) When using Non-NIST curves from Table 2-6 and allowances from [FIPS 140-3 IG] C.A, Use of Non-approved elliptic curves. KTS (AES Cert. Key unwrapping: key establishment methodology provides between 128 and 256 bits of Clone SMK between partitions, #C2020) encryption strength. Import secret or private key Uses allowances in [FIPS 140-3 IG] D.G, Key transport methods, for key unwrapping using using key wrapping. un-authenticated modes of encryption listed on Cert #C2020 without use of an additional approved hash function. Legacy4 Unwrapping KTS (Triple-DES Key unwrapping: key establishment methodology provides 112 bits of encryption Import secret or private key Cert #C2020) strength. using key wrapping. Uses allowances in [FIPS 140-3 IG] D.G, Key transport methods, for key unwrapping using un-authenticated modes of encryption listed on Cert #C2020 without use of an additional Legacy4 Unwrapping approved hash function. Table 2-5: Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed N/A N/A N/A

6 Symmetric keys and seed for asymmetric key generation are created based on the direct output of the module DRBG (#C2020)

based on [SP800-133r2] using example 1 from section 4 and 6.1 where V is a string of binary zeroes and as such B = V. Asymmetric Key pairs are generated based on [SP800-133r2], section 5.1 and 5.2 and using methods from [FIPS 186-4]. The module supports derivation of keys from other keys as per [SP800-133r2], section 6.2.2, and supports the derivation of keys from passwords using methods in 6.2.3 and [SP800-132] for storage encryption. Keys can also be recovered from key components entered into the module using methods from [SP800-133r2], section 6.3 and both concatenation of components (option 1) or Exclusive-Oring (option 2).

NOTE The module is capable of supporting a single mode of operation. Transition from an

approved to non-approved mode of operation automatically triggers HSM zeroize module

service.

Algorithm / Function Symmetric Encryption / Decryption

Use / Function

Cryptographic Module Specification Table 2-6: Supported non-NIST elliptic curve as per [FIPS 140-3] IG C.A Non-Approved security functions are not available for use when the module has been configured to operate in the approved mode (see section 13.3 and 13.4). The following table lists non-approved algorithms supported for use with certain user consumable services when the module is configured in the non-Approved mode of operation during secure initialization. Table 2-7: Non-approved algorithms not allowed in the approved mode of operation. ARIA Perform decrypt operation on user supplied data object, Perform encrypt operation on user CAST3 supplied data object, Derive key from existing CAST5 partition secret or private key object, Import secret or private key using key wrapping. DES RC2 RC4 RC5

Algorithm / Function

Use / Function

Cryptographic Module Specification RSA (non-compliant with less than 112 bits of encryption strength) RSA X.5097 SEED SM4 Triple-DES (non-compliant for encrypt operations) XOR8 Hashing HAS-160 Derive key from existing partition secret or private key object, Verify signature or MAC over KECCAK user supplied data, Perform digest operation on MD2 user supplied data. MD5 RIPEMD-160 SM3 Message Authentication Code AES-MAC Generate signature or MAC over user supplied data, Verify signature or MAC over user supplied ARIA-CMAC data. ARIA-MAC CAST3-MAC CAST5-MAC COMP128 DES-MAC HAS160-HMAC HMAC (non-compliant with less than 112 bits of encryption strength) MD5-HMAC MILENAGE RC2-MAC RC5-MAC RIPEMD160-HMAC SEED-CMAC SEED-MAC SM3-HMAC SSL3-MD5-MAC SSL3-SHA1-MAC

7 this algorithm allows RSA encryption of a supplied data object without the use of padding. Any required padding is added by the operator ahead

of supplying the data to this variant of the RSA encrypt/decrypt function. this algorithm allows the operator to XOR supplied data with either a supplied base key or key derived from a base key. This function is deprecated for use in any situation where security of the data or key is required .

Algorithm / Function

Use / Function

Cryptographic Module Specification Triple-DES-CMAC (non-compliant for MAC generation) Triple-DES-MAC Triple-DES-x9.19-MAC TUAK Asymmetric DSA (non-compliant with less than 112 bits of encryption strength) Generate signature or MAC over user supplied data, Verify signature or MAC over user supplied ECDSA (non-compliant with less than 112 bits of encryption strength) data. EdDSA EdDSA PH KCDSA RSA (non-compliant with less than 112 bits of encryption strength) SM2 SM3 Key Derivation AES9 Derive key from existing partition secret or private key object. ARIA BIP32 DES MD5 SHA10 SSL PRE-MASTER SSL3-MASTER SM3 Triple-DES XOR11 Key Agreement Diffie-Hellman (key agreement; key establishment methodology; non-compliant with Derive key from existing partition secret or less than 112 bits of encryption strength) private key object. ECC (non-compliant with less than 112 bits of encryption strength) Key Transport AES12 Import secret or private key using key wrapping, Export secret or private key using key wrapping. ARIA

9 AES is non-approved for key derivation when used to derive keys using methods other than as permitted by NIST standard such as [SP800-

56Cr2] and [SP800-108r1] in particular, use of AES in ECB or CBC mode directly to derive keys. SHA1, SHA2 and SHA3 are non-approved for key derivation when they are used to derive keys in a way that is non-compliant with NIST standards such as [SP800-56Cr2], [SP800-108r1], [SP800-132] and [SP800-135r1]. XOR is non-approved for key derivation when selected as a mechanism to combine supplied user data with an existing module stored key. AES is non-approved for key transport when used to encrypt keys using methods other than as permitted by NIST standards such as [SP80038F]. In particular, use of un-authenticated modes of AES for encryption without a separate authentication tag (e.g. signature or MAC) is nonapproved.

Algorithm / Function

Use / Function

Cryptographic Module Specification CAST3 CAST5 DES RC2 RSA (key wrapping; key establishment methodology; non-compliant with less than

RSA13 SEED SM4 TDES Asymmetric Key Generation Diffie-Hellman (non-compliant with less than 112 bits of encryption strength) Generate local symmetric or asymmetric keypair, Generate domain parameters. ECC (non-compliant with less than 112 bits of encryption strength) KCDSA RSA (non-compliant with less than 112 bits of encryption strength) SM2 X9.42 Domain Parameter Generation non-compliant when used for key transport using RSA variants that are [SP800-56Br2] non-compliant.

NOTE The USB port on the right side of the figure is only present on the 808-000080-001 and 808-000080-002 versions on the hardware.

The following figure identifies the physical interfaces to the cryptographic module: Power supply USB port Top side view Battery Excluded 7.7.2 Cryptographic Boundary Right side view Top view LCD touch screen SafeNet Luna Backup HSM Smart Card reader Bottom side view Figure 3-1: Thales Luna G7 Cryptographic Module physical interfaces. The cryptographic module is a multi-chip standalone hardware module in the small form factor device. The cryptographic boundary of the module is shown above. The cryptographic boundary is defined to encompass all components inside the enclosure, including the LCD touch screen panel. The following table maps the physical interface to logical interfaces and supported data:

Table 3-1: Ports and interfaces.

Trusted channel summary Where CSP and authentication are not separately encrypted, these are exclusively passed into or output from The following trusted channels are defined for Thales Luna G7 Cryptographic Module:  Physical Trusted Path (USB) – the local USB interface is considered a physical trusted path into the The following sections describe each trusted path in more detail.

Cryptographic Module Interfaces Physical Trusted Path (USB) If configured, the module can use an iKey as an external data input/output device for CSP and authentication data. The iKey connects to the module’s rightmost USB port and is used to pass authentication data and CSPs to and from the module via a physical trusted path. CSP’s and authentication data that are output to the iKey are written to the iKey itself. Authentication of the module by the iKey is done by physical means based on the direct physical connection of the iKey to the Thales Luna G7 Cryptographic Module. All authentication data from the user is entered via the module’s LCD screen. Messages exchanged from the iKey and the module are encrypted using AES with a 256-bit key in CTR mode alongside a MAC using HMAC-SHA2-256. Authentication Trusted Path (LCD) Authentication of the module is done using G7 UI via the liquid crystal display (LCD) of the Thales Luna G7 Cryptographic Module. This trusted channel is used as part of the identity based authorization scheme to present the authentication data and is not separately authenticated.

Roles

Principal Duties

Roles, Services, and Authentication

The Thales Luna G7 Cryptographic Module supports the following roles: Table 4-1: Thales Luna G7 Cryptographic Module Roles HSM Security Officer (HSM SO) The HSM SO is responsible for managing the HSM. As such, the HSM SO is authorized to install and configure the HSM and set and maintain global HSM security policies. He/she is also able to request [Admin Partition Role] the load of new HSM firmware update files (FUF) and new Configuration Update Files (CUF). The HSM SO is able to create and delete partitions, but is not authorized to generate, load or use keys stored on the user partitions that have been created. The HSM SO is able to create, manage and use keys created in the Admin Partition alongside is responsible for initializing the ‘Administrator role’. The HSM SO can reset the Administrator password (configuration dependent). The HSM SO is responsible for selecting the authentication method during the HSM initialization. The HSM can have only one HSM SO. Administrator The Administrator is authorized to create, use, transfer and destroy key objects contained in the Admin partition. This role has privileges that are a subset of the HSM SO role. [Admin Partition Role] Partition Security Officer (Partition The Partition SO creates the partition level Partition CO role, sets and changes partition-level SO) policies. This role also has an option to reset the Partition CO password (configuration dependent) following lockout. [User Partition Role] Partition Crypto Officer (Partition The Partition CO role is authorized to create, use, destroy and transfer key objects for a given CO) partition. The Partition CO can optionally create the Partition LCO and Partition CU, and perform initial assignment of key authorization data. [User Partition Role] Partition Limited Crypto Officer The Partition LCO is an optional partition role authorized to create and use key objects, and perform (Partition LCO) initial assignment of key authorization data. The role is only permitted to delete key objects where per-key authorization is used and the correct authorization data for a given key object can be [User Partition Role] presented to the cryptographic module. Partition Crypto User (Partition CU) The Partition CU is the partition role authorized to use the key objects within the partition (e.g. sign, encrypt/decrypt). [User Partition Role] Audit User (AU) The AU initializes the secret key used to generate Message Authentication Code (MAC) for secure audit messages alongside configuring logging levels for the HSM. [Admin Partition Role]

Roles

Principal Duties

Role HSM Management

Service

Input

Output

Public User Unauthenticated user with limited access to perform signature verification with public keys where CKA_PRIVATE = false, initialization of the module and roles and to read module status. The act of logging into the roles can be found in section 13.7. The mapping of the cryptographic module’s roles services can be found in the table below. In this table, ‘Any role’ in the ‘role’ column signifies that any role identified in Table 4-1: Thales Luna G7 Cryptographic Module Roles can access the corresponding service. This includes the ‘public user’ that is an implicit role and unauthenticated by the module. domain, authentication return code HSM SO (admin partition) Set partition policy partition policy number, return code Any role HSM zeroize session return code

Role Management

Roles, Services, and Authentication fingerprint (disabled), return code Any role Query role status session, role role status, return code initialize Administrator) authentication data (if return code AU, Partition SO, Partition CO, Partition LCO, Partition CU, Public User (required to initialize HSM SO, AU or Partition SO) Partition SO (required to initialize Partition LCO or Partition CU) change HSM SO) authentication data return code AU (required to change AU) HSM SO or Administrator Administrator) Partition SO (required to Partition CO) Partition CO or Partition LCO (required to change Partition LCO) Note: Roles are not

Luna PED Configuration

Key Management Activities

Roles, Services, and Authentication CO, Partition LCO, Partition CU CO, Partition LCO, Partition CU

Cryptographic Services

Bootloader Services

Partition CU Partition CU Partition SO, Partition CO, Partition LCO, Partition CU Partition LCO, Partition CU Partition LCO, Partition CU HSM SO, Administrator, Perform encrypt operation session, algorithm, encrypted data, return code HSM SO, Administrator, Perform decrypt operation session, algorithm, decrypted data, return code Authentication Mechanism Summary All users, except for the Public User, must authenticate to the module using identity-based authentication.

Roles, Services, and Authentication If configured with PED, all roles must authenticate using an iKey. The iKey can be connected directly to the device or to the Luna PED device. In case of Luna PED, the connection needs to be done over the Remote PED channel. When a role is initialized, a module generates the authentication data as a 48-byte random value and writes it to an iKey. Optionally, the Crypto-Officer, Limited Crypto Officer and Crypto-User roles can be configured to use two-factor authentication by also assigning a password to the role. If configured with Password, all roles must authenticate using a minimum of an 8-character password. When a role is initialized under this configuration, the operator enters the initial password for the role. Regardless of configuration (PED or Password), the password is delivered to the module encrypted with the public key from the Password Encryption Certificate (PEC) using KTS-OAEP-basic from [SP800-56Br2]. Table 4-3: Roles and Required Identification and Authentication HSM SO Memorized Multi-Factor Crypto Device iKey: 48-byte random authentication data generated when a Secret role is initialized and stored on iKey. The probability of guessing the authentication data in a single attempt is 1 in 2384. With a Auditor Memorized Multi-Factor Crypto Device maximum of 6000 failed login attempts per minute. User provided byte array (minimum 8 bytes): Memorized secret Partition SO Memorized Multi-Factor Crypto Device are limited to a character set of 86 characters14 presented to the Secret module as there ASCII byte representation. The strength of an 8 character password with character set size of 86 is log2(868). + optional Memorized This makes the probability of guessing the memorized secret in a single attempt 1 in 251 The module supports a maximum of

Partition LCO Memorized Multi-Factor Crypto Device count for a given role is disabled. Secret + optional Memorized Automatic lock-out: This feature, which is enabled by default, Secret can be used to limit the impact of brute force attacks on login Partition CU Memorized Multi-Factor Crypto Device and is covered in more detail in section 4.2.3. Public User Not Required N/A N/A When using the password authentication mechanism, the module encrypts a known check-word under a key derived using PBKDF from [SP800-132] and option 1a from section 5.4, ‘Using the Derived Master Key to Protect Data’. During a login attempt, the module generates a key from the supplied password, and attempts to decrypt a known checkword. Successful login is achieved if the decrypted checkword matches the expected value. If successful, the PBKDF derived key is used to remove a layer of encryption from the module stored User Storage Key (USK)15. The length of the password used as input to the PBKDF function is consistent with the password length selected by the authenticating user, which is required to be between 8 and 255 characters long. Where passwords are randomly generated, the probability of successfully guessing the password and deriving the storage key for a minimum password length of 8 characters is 1 in 251. This probability is significantly reduced if random passwords are not used.

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 !@#$%^*()-_=+[]{}/:',.~ When ‘decommission’ is enabled as a module capability, the USK is independently encrypted in storage under a 256-bit module generated AES key.

Roles, Services, and Authentication Guidance in Appendix A, ‘Security Considerations’ of [SP800-132] should be consulted when picking an appropriate password length in situations where encryption layers derived from the user password are required to protect the confidentiality of module protected user keys. The module uses an iteration count of 1000 when generating the key used to decrypt the checkword. This limit has been set to account for the fact that objects encrypted under the [SP800-132] derived key are never exported from the module and are exclusively stored inside its cryptographic boundary where they are physically protected. In addition, the module supports lock-out of all identities following a configurable number of failed login attempts where this is the primary mechanism offered by the module to protect against bruteforcing of memorized secret. Activation If PED authentication is configured, the Crypto-Officer, Limited Crypto Officer and Crypto-User roles can be configured to use a two-step authentication process. The first stage is termed “Activation” and is performed using an iKey. Once activated, access to key material and cryptographic services is not allowed until the second stage of authentication, ‘User Login’, has been performed using the role’s password. Once activated, a role stays activated until the role is explicitly deactivated, deleted or the module is reset16. Account lockout behaviours In addition to the cryptographic strength of the authentication mechanisms, all authenticating roles have the ability to maintain a failed authentication count that can be configured to stop attempts to brute force authentication data. The maximum supported failed authentication attempts can be set to between 3 and 10 for each role with the following lockout behaviours observed:

All services listed in the table below can be accessed in approved mode and when in this mode exclusively use the security functions listed in Table 2-2 and Table 2-6. When the module is operating in this mode, security functions in Table 2-7 are disabled and blocked from being used. As notes on the content of Table 4-4: Approved Services:  In the ‘Approved Security Functions’ column: • ‘Algorithms’ maps the target service to cryptography from standards referenced in [SP800-140Cr2] alongside corresponding CAVP certificates from Table 2-2 or ‘non-Approved but Allowed’ cryptography from Table 2-6.

16 A module is reset in response to a trigger signal being received on a request from a host application.

Roles, Services, and Authentication

• ‘Key Management technique’ maps the target service to cryptography from standards referenced in [SP800-140Dr2] alongside corresponding CAVP certificates from Table 2-2 or ‘non-Approved but Allowed’ cryptography from Table 2-6.
• ‘Authentication Technique’ lists the permitted authentication mechanism as specified in [SP800-140E];
• For RSA, ECDSA and AES-KW, where multiple algorithms may be used based on module settings as covered in Table 2-2 only the primary implementation is listed in the table.

Factory reset deletes all roles (including HSM SO), all users and objects and sets all HSM settings and policy to values defined in pre-loaded configuration update files.

Algorithms: N/A Key management technique: N/A Authentication technique: N/A

CITS-DAC, CITS-DAK, ECC DAC, Secure Audit AccessID- HMAC Key, PSK, USK, DRBG C, DRBG V, Entropy Input String, Entropy Seed, , KCV, SMK, HA HA RND, PUB, PK, Asymmetric Key Pairs (general partition or session keys), Symmetric Keys (general partition or session keys), SALKCWK CWK , HSM, PED, DEK DMK DEK HSM, HSM, PED, DMK AEK, AEK-EK, PED, , AccessID .

Any role

Z: (for ALL partition) CITS-DAC, CITS-DAK, ECC DAC, Secure Audit AccessID-HMAC Key, PSK, USK, DRBG C, DRBG V, KCV, SMK.HA HA RND, PUB, PK, Asymmetric Key Pairs (general partition or session keys), Symmetric Keys (general partition or session keys) In addition, the following HSM level keys are erased: SALKCWK CWK , HSM, PED, DEK DMK DEK HSM, HSM, PED, DMK PED E: AEK, AEK-EK, AccessID .

Table 4-4: Approved Services keys), SALK, CWKHSM, CWKPED, keys) DEKHSM, DMKHSM, DEKPED, SALK, CWKHSM, CWKPED, DEKHSM, DMKHSM, DEKPED, DMKPED

Role Management

This service returns status in relation to a target role (e.g. whether the role is initialized or not).

Algorithms: N/A Key management technique: N/A Authentication technique: N/A

AEK, AEK-EK, AccessID.

Any role

E: AEK, AEK-EK, AccessID.

Table 4-4: Approved Services login HAPUB, HAPK, DRBG C, DRBG V, AEK, AEK-EK, AccessID.

This service triggers creation of the module Remote PED Vector. As part of this service, keys used by the PED for remote PED setup are written to an orange iKey connected to Thales Luna PED during initiation of the service.

Algorithms: AES (Cert #C2020)

• KWP mode with 256-bit key Key management technique: ESV Cert #E97), CKG, SHA (Cert #C2020)
• SHA2-512, HASH_DRBG (Cert #A2125), ECDSA (Cert #C2020)
• Key Generation and Signature Generation over curve P-521 Authentication technique: Single- Factor Crypto Software, Multi- Factor Crypto Device

ECC HOK, PAK, DRBG C, DRBG V, Entropy Input String, Entropy Seed, HSM-SKA- C GSK, RPV, RPV-C, REMOTE, RPV-K, PED-SKA-C and PED- SKA-K, AEK, AEK-EK, AccessID.

HSM SO

E: ECC HOK, PAK, GSK, AEK, AEK-EK, AccessID. G: PED-SKA-C and PED-SKA- K. W: RPV, RPV-C, RPV-K. G/W: HSM-SKA-C REMOTE, DRBG C, DRBG V, Entropy Input String, Entropy Seed.

Table 4-4: Approved Services CWKPED, DEKHSM, DEKPED, #A2125) – Derivation: DEKHSM, DEKPED, DMKHSM, fullUnified using CWKHSM, CWKPED. W: DEKHSM, DEKPED, DMKHSM, CWKHSM, CWKPED.

Public users cannot generate any objects where either CKA_SENSITIVE or CKA_PRIVATE attributes are true.

Cryptographic Services

stores (excludes erase of operation.

Roles, Services, and Authentication

Non-approved services listed in the table below are not available when the module has been configured to operate in the approved mode (see section 13.3 and 13.4). As notes on the content of Table 4-5:  In the ‘Indicator Column’:

• IND_1:
• For USB HSM
• Partition Policy (43) Allow non-FIPS Algorithms is set to disabled AND HSM Policy (56), Allow User Defined ECC Curves is set to disabled AND return code is CKR_OK; or
• For Backup HSM
• HSM Policy (55), Enable Restricted Restore is set to enabled AND return code is CKR_OK.

RSA is non-compliant with less than 112 bits of encryption strength. Triple-DES is non-compliant with less than 112 bits of encryption strength. HMAC is non-compliant with less than 112-bits of encryption strength.

Service

Description This service is not possible for the Backup configuration. This service is used by a user to request validation of a signature or MAC over a block of user-supplied data using a module stored cryptographic key. The service returns whether the validation was successful. This service is not possible for the Backup configuration.

Non-Approved Algorithms Accessed Asymmetric Algorithms: DSA23, ECDSA24, EdDSA, EdDSA PH, KCDSA, RSA25, SM2, SM3. Symmetric Algorithms: ARIA-CMAC, SEED-CMAC, Triple-DES- CMAC26, HMAC27, HAS160-MAC, MD5-HMAC, SM3-HMAC, RIPEMD160-HMAC, AES-MAC, ARIA-MAC, CAST3-MAC, CAST5- MAC, DES-MAC, RC2-MAC, RC5-MAC, SEED-MAC, SSL3-MD5- MAC, SSL3-SHA1-MAC, Triple-DES-MAC, Triple-DES-x9.19-MAC, TUAK, MILENAGE, COMP128. Asymmetric Algorithms: DSA28, ECDSA29, EdDSA, EdDSA PH, KCDSA, RSA30, SM2, SM3.

Roles HSM SO, Administrator, Partition CO, Partition LCO, Partition CU.

Indicator

Key Management Activities

This service is used to derive keys based on other key material stored in the module or supplied to it on request of the end-user. Derived keys are stored in the cryptographic module for use with other user consumable cryptographic services or to export to other cryptographic modules or systems. This service is not possible for the Backup configuration.

AES31, ARIA, BIP32, DES, MD5, SHA, SSL PRE-MASTER, SSL3- MASTER, SM3, Triple-DES, XOR.

HSM SO, Administrator, Partition CO, Partition LCO.

Roles, Services, and Authentication DSA is non-compliant with less than 112 bits of encryption strength. ECDSA is non-compliant with less than 112 bits of encryption strength. RSA is non-compliant with less than 112 bits of encryption strength. Triple-DES-CMAC is non-compliant with less than 112-bits of encryption strength. HMAC is non-compliant with less than 112-bits of encryption strength. DSA is non-compliant with less than 112 bits of encryption strength. ECDSA is non-compliant with less than 112 bits of encryption strength. RSA is non-compliant with less than 112 bits of encryption strength. AES is non-approved for key derivation when use to derive keys using methods other than as permitted by NIST standard such as [SP800-56Cr2] and [SP800-108r1] in particular, use of AES in ECB or CBC

Service

Description This service is used to generate symmetric keys or asymmetric key pairs requested by the end-user and stored in the cryptographic module for use with other user consumable cryptographic services or to export to other cryptographic modules or systems. This service is not possible for the Backup configuration This service is used to import secret or private key from the admin or user partitions using key wrapping Unauthenticated symmetric encryption is permitted for key unwrapping under Uses allowances in [FIPS 140-3 IG] D.G, Key transport methods. This service is not possible for the Backup configuration. This service is used to export secret or private key from the admin or user partitions using key wrapping. This service is not possible for the Backup configuration. This service is used to generate domain parameters requested by the end-user and stored in the cryptographic module for use with other user consumable

Non-Approved Algorithms Accessed Diffie-Hellman32, ECC33, KCDSA, RSA34, SM2. ARIA, CAST3, CAST5, DES, RC2, RSA35, SEED, SM4. AES36, ARIA, CAST3, CAST5, DES, RC2, RSA, SEED, SM4, TDES. X9.42 Domain Parameter Generation

Roles HSM SO, Administrator, Partition CO, Partition LCO. HSM SO, Administrator, Partition CO, Partition LCO. HSM SO, Administrator, Partition CO, Partition LCO. Any role.

Indicator

Diffie-Hellman key generation mechanisms are non-compliant with less than 112-bits of encryption strength. ECC key generation mechanisms are non-compliant with less than 112-bits of encryption strength. RSA key generation mechanisms are non-compliant with less than 112-bits of encryption strength. RSA is non-approved for key transport when used with an encryption strength of 112-bits or when using PKCS#1, v1.5 padding for encryption. AES is non-approved for key transport when used to encrypt keys using methods other than as permitted by NIST standards such as [SP800-38F]. In particular, use of un-authenticated modes of AES for encryption without a separate authentication tag (e.g. signature or MAC) is non-approved. Public users cannot generate any objects where either CKA_SENSITIVE or CKA_PRIVATE attributes are true. As such, the service would not affect the security of the module or the security of the information being protected, as sought by 4.1.A.

Service

Description cryptographic services or to export to other cryptographic modules or systems.

Non-Approved Algorithms Accessed

Roles

Indicator

Roles, Services, and Authentication

The Thales Luna G7 Cryptographic Module’s firmware integrity is checked on startup as described in section 10.1. The two keys used for the software and firmware Approved integrity techniques are the Root Certificate and Firmware Signing Certificate. The bootloader runs the self-test functions to check the firmware integrity as well as the cryptographic algorithms used to check the bootloader and main firmware image authenticity. Any failures during these tests will result in a module halt in which an error message is output, the module halts all functions and data output is inhibited. The bootloader and main firmware are stored as signed binaries using RSA PKCS #1-v1.5 with a 4096-bit module and SHA2-384. The operator can trigger an on-demand check of the module firmware using the CA_SelfTest Cryptoki API command. An example of the CA_SelfTest Cryptoki API command in use can be found in section 13.5. Periodic Self Tests (PST) are performed every 24 hours and run the firmware integrity tests and a subset of the KAT tests. Failure of either of these self-tests during PST will trigger a module halt. Recovery from this state will require the module to be restarted and for the detected fault to have cleared. Otherwise, the module will re-halt during POST following restart. See section 10 for additional information about the PST.

When new firmware is to be loaded using the hsm updatefw LunaCM command a separate mechanism is used to authenticate the firmware than the pre-operational firmware self-test. An example of the hsm updatefw LunaCM command can be found in section 11.11. Once initiated the firmware load sequence uses a set series of ICD commands and all others are prohibited until the firmware update is completed. Updating the firmware is a two stage process. The first stage is to download the firmware to the module. The second stage involves subsequently re-authenticating and loading the firmware following a module restart, this occurs based on the bootloader during power-on ahead of the communications module being started. The firmware load test can be found in Table 10-2.

The following are the firmware components included on the module:  hsm - this component is compiled as a 32bit LSB executable for PowerPC. This is identified throughout this document as the ‘main firmware’.  bootloader - the bootloader is an Executable and Linkable Format (ELF) executable. This is identified throughout this document as the ‘bootloader’. No source code, object code or just-in-time compiled code are included in the module.

The module uses a limited modifiable operational environment.

Physical Security Mechanism

Recommended Frequency of Inspection/Test On receipt of HSM following transport At any point following any un-authorized access to the environment hosting the HSM Following any extended periods of unattended storage for the module

Inspection/Test Guidance Details

Module Construction The module is enclosed in a plastic enclosure that provides tamper-evidence. Any tampering that might compromise a module’s security is detectable by visual inspection of the physical integrity of a module. The HSM SO should perform a visual inspection of the module at regular intervals. Within the plastic enclosure, a hard opaque epoxy covers the circuitry of the cryptographic module. Attempts to remove this epoxy will cause sufficient damage to the cryptographic module so that it is rendered inoperable. The module’s enclosure is opaque to resist visual inspection of the device design, physical probing of the device and attempts to access sensitive data on individual components of the device. Environment Failure Protection The module supports an EFP mechanism that will trigger module shutdown if low or high temperature extremes and out-of-range voltage conditions are detected whilst the module is active. This is covered in more detail in section 7.3. The following routine inspections are recommended. surfaces for signs of tamper Following manufacture, both the front and rear covers of the Thales Luna G7 Cryptographic Module are permanently adhered to the PCB assembly using epoxy resin and with the lid assemblies having feet set into the epoxy. The polycarbonate case will show witness marks if any attempt is made to tamper with the plastic. Any attempts to remove the case and covers will result in significant physical damage to the card rendering it un-usable. In the event of any observed damage, contact Thales to confirm whether observed anomalies are to be expected or are confirmed signs of potential tampering.

The module’s hardware is designed to sense and respond to out-of-range temperature conditions as well as out-of-range voltage conditions. The temperature and voltage conditions are only monitored in the poweredon state. In the event that the module senses an out-of-range temperature or over voltage the module will reset itself, clear all working memory, and log the event. The module can be reset and placed back into operation when in-bound operating conditions have been restored. The module monitors the 5V voltage rails that can independently trigger an EFP event. The following table covers the limits enforced by the module:

The module PCB is potted using an epoxy-based compound inside the polycarbonate plastic case that makes up the identified cryptographic boundary in Figure 2-1 and Figure 2-2. The potting material has a Shore D hardness rating of 90 and an operating temperature from -65ºC to +200ºC over which it maintains its hardness. The following table lists the temperature range tested during the assessment of the module. Table 7-3: Hardness testing temperature ranges

N/A: [19790:2012] Section 6.8, Non-invasive security is non-applicable as there are currently no requirement in [SP800-140F].

NOTE A HSM wipe-out (KDM3) zeroizes all keys and CSPs on the module. This method

applies to every row in Table 9-1 and is explicitly called out in the table only if the SSP is not

covered by any other destruction method.

NOTE When an end-user triggers zeroization using a zeroization service and zeroization is successful, return code CKR_OK is displayed.

NOTE When an end-user triggers zeroization using a zeroization service and zeroization is successful, return code CKR_OK is displayed.

The following table lists Sensitive Security Parameters (SSP) used to perform approved security function The following notes should be observed when reading the table:

Table 9-1: Summary of SSPs manufacture as                                                            corresponding to the Root Key. It is selfRoot Certificate                                                N/A – part of the                                                               signed with its private key controlled by generated                                             managed            Management        signed by “Root Private” signing key used to 4096-bit public key                                               outside the                                           “Engineering”      Policies          certify HSM firmware updates. generated                                             managed            Management        signed by “Root Private” signing key used to 4096-bit public key                                               outside the                                           “Engineering”      Policies          certify HSM capability updates. Manufacturer’s                                                                                                                                             corresponding to the Manufacturing Integrity Integrity Certificate                                             N/A – Key (MIK) controlled by Thales. It is signed 4096-bit public key                                                                                                                                          material certified by Hardware Origin certificate                                                                                                                                              Certificates (HOCs). This key is a PSP. ECC Manufacturing Integrity Certificate                                             N/A –                                                                                      The X.509 public key certificate ECC public                          #C2020)                  outside the      in Plaintext                         plaintext          KDM3              Integrity Key (ECC MIK). It is self-signed. certificate for public                                            module.                                                                                    This key is a PSP. key on curve P-384 A 4096-bit RSA private key used to sign Hardware Origin Key                                                                                                     Flash memory                         certificates for other device key pairs, such as 4096-bit private key                                                                                                    GSK                                  the time the device is manufactured. This key is a CSP.

SSP Management The X.509 public key certificate Hardware Origin                                                                                                                                             corresponding to the HOK. It is signed by the 4096-bit public key                      (#A674)                  Appendix B.3.6   in Plaintext                         plaintext          KDM3              time the device is manufactured. Used in certificate                                                                                                                                              verifying all key material signed by the HOK. This key is a PSP. ECC Hardware Origin                                                                                                                                          ECC P-384 private key used to sign other Key                                                                                                                                                  device keys and used for a specific PKI #C2020)                  Appendix B.4.1   Output                                                  KDM3              key or a specific action originated within the hardware crypto module. curve P-384                                                                                                                                              This key is a CSP. The X.509 public key certificate ECC Hardware Origin                                                                                                                                          corresponding to the ECC HOK. It is signed Certificate                                                                                                                                             by the ECC Manufacturing Integrity Key (ECC ECC public                          #C2020)                  Appendix B.4.1   in Plaintext                         plaintext          KDM3              implementation requiring assurance that a certificate for public                                                                                                                                       key or a specific action originated within the key on curve P-384                                                                                                                                          hardware crypto module. This key is a PSP. Token or Module                                                                                                                                             A 4096-bit RSA private key used in the key Unwrapping Key                                                                                                                                              cloning protocol. It is generated each time (TUK4)                150-bits                                                                         N/A                                              the module initializes from power up or reset. 4096-bit private key                                                                                                                       or destructive This key is a CSP. Token or Module                                                                                                                           Power Cycle –     The X.509 public key certificate Wrapping Certificate                                                                                                                       KDM1.             corresponding to the TUK4. It is signed by (#A674)                  Appendix B.3.6   in Plaintext                         plaintext          zeroize request   as part of the handshake during the cloning 4096-bit public key                                                                                                                        or destructive    protocol. certificate                                                                                                                            policy change     This key is a PSP. Encryption Vector –                      KDA One-Step             [SP800-90Ar1]                                                            Zeroized          384-bit nonce used with the cloning protocol

384 bit nonce further details)

SSP Management 640-bit value that is the concatenation of the Entropy Input String (384-bits), Nonce (128Entropy Seed 640-bits N/A N/A bits) and 128-bit personalisation string. Used as to initialise the internal state of This key is a CSP. generated Part of the secret state of the approved from [SP800- This key is a CSP. Part of the secret state of the approved This key is a CSP. 256-bit AES key that is the same for all users Global Storage Key on a specific Luna cryptographic module. It is #C2020) Output KDM3 within the non-volatile memory area reserved for use by the module. This key is a CSP.

SSP Management For PED configurations, this is a 256-bit value, the first 32-bytes of which are used as an AES KW 256-bit key that is used to wrap/unwrap the SALK when it is exported / HASH_DRBG It is either generated by the module or with SHA2-256 imprinted onto the module at the time audit 256-bit key #A2125) to PED USK onto an iKey to enable initializing the Auditor N/A for role on additional modules into the same Password domain. For password configurations, this value is an

8 - 255 character data string supplied by the

user during configuration of the secure audit capability. This key is a CSP. Secure Audit Logging                                              [SP800-90Ar1]    encrypted under                      plaintext,                           and authentication of the log messages. mode                                 RDK                                  This key is a CSP. Secure Audit                                                                                                                                              AccessID to be used in the Secure Audit logs, (Cert #C2020)                             Output                               plaintext          KDM2              AccessID. A new key will be generated at every module power-on or firmware reset. This key is a CSP. the password                         User provided password input by the
8 - 255 character                                                                                                      encrypted with                       This key is a CSP.

SSP Management A 256-bit key generated by the Thales Luna client and submitted to the HSM for use to AccessID Encryption                                                                                                                                          wrap the HSM generated AEK for export to Key – Encryption Key                                                                                                                                         the Thales Luna Client to encrypt the A new key is generated for each AEK transfer event. This key is a CSP. #C2020).                                  the AEK-EK using                     plaintext.         KDM2              A new key will be generated at every module AES-KW.                                                                   power-on or firmware reset. This key is a CSP. AccessID                                                                                                                                                128-bit secret value used as an authorization 128-bit       N/A.                     N/A.                                      N/A.                                             token for sessions. This key is a CSP. Hashed user password with 256-bit random Stored User                                                                                                                                              salt. SSP is compared with salted hash of SHA2-256 (Cert                                                                             passwords supplied by the end-user as part 256-bit value                                                                                                                                             optional memorized secret. This key is a CSP.

SSP Management PED Authentication                                                                 to PED                                                                    A 256-bit random value that is generated by 48-byte random                                                  with SHA2-256    encrypted using                                                           Thales Luna PED. value                                                                       HSM CSP                                                                   This key is a CSP. if Password                                                                    path and                                                                  User provided password input by the configuration)                                                 N/A              encrypted under          N/A                           N/A                operator as authentication data. Flash memory                         This key is used to encrypt all sensitive Partition Storage                                                [SP800-90Ar1]                                                                              This key is unique per-partition and used to This key is a CSP. SKS Master Key                                                  [SP800-90Ar1]                                                                              A randomly generated 256-bit secret used as (SMK)                              AES-KWP (Cert            HASH_DRBG                                                                                  the master key for deriving all SKS key blob This key is a CSP. HA Login Public Key                                               [FIPS 186-4],                                                           Zeroized via ICD   A 4096-bit RSA public key used for the HA 4096-bit public key                                              B.4.1                                                                   KDM1               This key is a PSP. HA Login Private Key                                              [FIPS 186-4],                                         Flash memory      Zeroized via ICD   A 4096-bit RSA private key used for the HA 4096-bit private key                                              B.3.6                                                 USK               KDM1               This key is a CSP.

SSP Management (RND)                              #C2020)                                   secret from output                   plaintext                             primary HA Login instance. HA Login Ephemeral                                                                                                                         command -          A 256-bit encryption key used with AES to #C2020)                                   with peer TWC                        plaintext                             from the primary HA Login instance. 256-bit AES key                                                                                                                          Session closure    This key is a CSP. Value that controls a partition’s ability to participate in the cloning protocol. In the case of PED configurations, it is generated by the module or imprinted onto the module at partition initialization time. Vector (KCV)             32 to 2040-                                                                                                       Partition          For password configurations, this 8 - 255 bits                                                                                                          deletion - KDM1    character data string is supplied by the user during partition initialization. For PED configurations, the 48-byte random value is output from the original partition in the domain to an iKey to enable initializing additional modules into the domain. This key is a CSP. command -          A randomly generated 256-bit key, which KDM1               must be shared between a remote PED and a cryptographic module in order to establish a Erased on user     secure communication channel between or destructive     This key is a CSP.

SSP Management PED Authentication                                                                                                                        KDM1              An ECC public key certificate used to verify curve P-521                                                                                                                            or destructive    This key is a PSP. PED Authentication                                                                                                                        KDM1              An ECC private key used to sign certificates curve P-521                                                                                                                            or destructive    This key is a CSP. Agreement                                                                                                                                               Used by the Thales Luna PED to authenticate Certificate for                                                                                                                                          the remote HSM to connect to and to extract ECC public key on                                                                                                                                                     for remote connection with PED. curve P-521                                                                                                                                              This key is a PSP. Agreement Private                                                                                                                                           Used by the remote HSM as the static private Key for Remote                                                                                                                                            key for: agreement for remote connection curve P-521                                                                                                                                              This key is a CSP. HSM Ephemeral                                                                                                                                              Used by the Thales Luna PED to authenticate Key-Agreement                                                                                                                                             the remote HSM to connect to and to extract KAS-ECC (Cert            [FIPS 186-4],                                        Working SDRAM in   KDM1 -            the HSM’s ephemeral public key for C(2e,2s, curve P-521                                                                                                                                              This key is a PSP.

SSP Management HSM Ephemeral                                                                                                                                              Used by the Thales Luna PED to authenticate Key-Agreement                                                                                                                                              the remote HSM and to extract the HSM’s curve P-521                                                                                                                                              This key is a CSP. Certificate (RPV-C)                                                                Output via direct                                      via ICD           An ECC public key certificate used by the 256-bits                                                connection to a         N/A                            command           HSM device to verify PED-SKA-C, PED-EKA-C. Luna PED                                                                 This key is a PSP. An ECC private key used by the HSM to sign curve P-521                                                                                                                                              This key is a CSP.

SSP Management via ICD           Used by the HSM to authenticate and extract Certificate for                                                                  Output via direct                                                        the Luna PED’s ECC ephemeral public key for Erased on user    Uniquely generated for each use. ECC public key on                                                                                                                                          This key is a PSP. curve P-521                                                                                                                            zeroize request PED Static Key-                                                                                                                          in response to    Used by the Thales Luna PED for Remote Agreement Private                                                                                                                         erase request     connections. Act as An ECC static private key Luna PED                                                                 Key is not used by the HSM as a SP but is ECC private key on                                                                                                                        Erased on user    generated by it for use by the Luna PED. curve P-521                                                                                                                            zeroize request   This key is a CSP. Intermediate key value used during setup of the Remote PED channel. Key is the output of the ECDH function and PED Master Shared                        KDA One-Step                                                                                     Zeroized          used to generate HSM and PED CSP 256-bit key                          #A2125)                                                                                          KDM1              Encryption Key. Keys are generated using OneStep KDF from [SP800-56Cr2] with SHA2512. This key is a CSP.

SSP Management PED Channel       Derived during Remote PED Channel for Termination -     wrapping exchanged SSPs. HSM CSP Wrapping                                                                                                                             KDM1 Output                                  plaintext          Erased on user    depending on the cipher suite negotiated zeroize request   between the HSM and PED during remote policy change     This key is a CSP. PED Channel       Derived during Remote PED Channel for Termination -     wrapping exchanged SSPs. PED CSP Wrapping                                                                                                                             KDM1 Output                                  plaintext          Erased on user    depending on the cipher suite negotiated zeroize request   between the HSM and PED during remote policy change     This key is a CSP. Derived during Remote PED Channel for encrypting communication messages (from HSM Data                                                                                                                                  KDM1 PED setup. This key is a CSP. KDM1              Derived during Remote PED Channel for zeroize request   This key is a CSP.

SSP Management Derived during Remote PED Channel as the PED Channel       initialization vector for encrypting Termination -     communication messages (from HSM-tozeroize request   depending on the cipher suite negotiated or destructive    between the HSM and PED during remote This key is a CSP. Derived during Remote PED Channel for encrypting communication messages (from PED setup. This key is a CSP. KDM1              Derived during Remote PED Channel for zeroize request   This key is a CSP. PED Initialization                                               from [SP800-                        fullUnified with                                          initialization vector for encrypting

SSP Management KDM1               A 4096-bit RSA private key used to decrypt Password Encryption                                               [FIPS 186-4],                                                                              user passwords that are provided to the Key (PEK)             150-bits                               Appendix                                   N/A                          Erased on user     module. It is generated the first time it is
4096 bit private key                                              B.3.6                                                                   zeroize request    required.
or destructive     This key is a CSP. Password Encryption                                                                                                                       KDM1               The X.509 public key certificate 4096-bit public key                     #A674)                                    in Plaintext                          plaintext        Zeroized via ICD   signed by the HOK the first it is required. B.3.6 certificate                                                                                                                          command -          This key is a PSP. Password Encryption                                               [SP800-90Ar1]    Imported                                               Zeroized           Nonce used to provide replay protection with

SSP Management CVL (Cert #A2125)) This key is a PSP.

128, 192 or 256-bit for AES keys. 112-bit for Triple-DES.

Triple-DES-CBC Triple-DES-CFB64 Triple-DES-CFB8 Triple-DES-CMAC Triple-DES-CTR Triple-DES-ECB Triple-DES-OFB (Cert #C2020) HMAC-SHA-1 HMAC-SHA2-224 HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 HMAC-SHA3-224 HMAC-SHA3-256 HMAC-SHA3-384 HMAC-SHA3-512 (Cert #C2020) KDA (Cert #A2125) KBKDF (Cert #C2020) AES-CBC AES-CFB128 AES- CFB8 AES-CMAC AES-CTR AES-ECB AES-GCM AES-KW AES-KWP AES-OFB (Cert #C2020)

N/A (user imported) Or [SP800-90Ar1] HASH_DRBG with SHA2-256 (module generated)

Input or output encrypted using Symmetric Keys (general partition or session keys) using key wrap/unwrap ICD commands and [SP800-38F] encryption options Input or output encrypted using Asymmetric Keys (general partition or session keys) using key wrap/unwrap ICD commands and KTS-OAEP-basic from [SP800- 56Br2] Input using Symmetric Keys (general partition or session keys) using key unwrap ICD commands and approved symmetric algorithms as permitted by [FIPS 140-3 IG] D.G, Key transport methods When transferred between

Can be established as the output of supported [SP800- 56Ar3] compliant key establishment using other partition stored asymmetric key- pair

Flash memory encrypted with USK

Zeroized via ICD command - KDM1 Session closure – KDM1

SSP Management MAC, KDF partition stored

Key / SSP Name / Type

Strength

Security Function and Cert Number

Generation

Import/ Export partitions using SKS, encrypted under the SMK

Establishment

Storage

Zeroisation

Use and Related Keys

Specification The module includes a non-deterministic Random Number Generator (RNG) within the module boundary. The non-deterministic RNG is used exclusively to feed the DRBG (Cert #C2020). The Non-Deterministic RNG complies with [SP800-90B] and has been certified using [FIPS 140-3 IG] D.J with guidance set out in [FIPS 140-3 IG] D.K. Table 9-2: Non-Deterministic Random Number Generation Specification Non-deterministic jitter The noise source outputs [SP800-90B] compliant Non-Deterministic RNG using a hardware based noise from FRO. blocks of entropy in 384 internal to the module boundary (ESV #E97). Raw noise collection is performed autonomously by hardware as entropy is Following testing, the required to seed the on-chip DRBG (Cert #C2020). If the entropy register is not DRBG is seeded with a full when the DRBG accesses it, the read will stall until the entropy is generated. 256-bit seed and 128-bit During each entropy collection cycle, 2500 samples of raw noise are collected. All outputs from the noise source are subjected to statistical testing ahead of being fed to the DRBG.

321 bits of entropy. The output of the hardware noise source includes a total failure test to check

for bit-patterns consistent with hardware failures.

Depending on the configuration of the module, the following methods of key import and export for ‘Asymmetric Key Pairs (general partition keys)’ and ‘Symmetric Keys (general partition keys)’ are available as a service:  Manual Key Import/Export The manual import/export methods of the module are restricted to the G7 GUI and the iKey directly attached to the module via the USB port.

• For the G7 GUI the import methods include password authentication data. This includes whether the module is using Password authentication or is optionally selected with PED authentication.
• For the iKey the import/export methods include the PED authentication data, private/public keys and PED Key Agreement certificates.  Password Encryption Certificate (PEC) Import Protocol Prior to submitting a password for authentication, the client:
• requests a 24-byte nonce using the LUNA_REQUEST_CHALLENGE command;
• requests the cryptographic module PEC using the LUNA_GET_PEC command; and
• validates the received certificate against an embedded copy of the Thales root certificate stored in the client. Following completion of above
• the client concatenates the nonce (24 bytes) with their password (up to

248 bytes) and encrypts using RSA-OAEP with SHA512 for its MGF as defined in [SP800-56Br2] as

SSP Management

• KTS-OAEP-basic from [SP800-56Br2] and where the following options are supported: − Modulus lengths of 2048, 3072, 4096, 6144, or 8192 for export or 1024, 2048, 3072, 4096, 6144, or 8192 for import; and − Hash and MGF options must match and be consistent with one of the following algorithms: SHA1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3512. − Where this mechanism is used with public keys generated by the module these are generated using either rsakpg1-crt or rsakpg2-crt from section 6.3.1.3 of [SP800-56Br2] and where the module is the ‘owner’. All keys generated by the module are subject to a pairwise consistency check on generation and are separately validated as per either section 6.4.1.2 or 6.4.1.3 from [SP800-56Br2] depending on the generation method used. − Where this mechanism is used with a public key imported from outside the module, assurances as per section 6.4.2 of [SP800-56Br2] shall be sought ahead of use of the public key. In this scenario, the module is not providing any assurances for the generation methods of the public/private key pair and where the resulting encrypt operation is not considered part of a key transport scheme as defined in [FIPS 140-3 IG], D.G.
• [SP800-38F] compliant KTS using one of the following options for both key unwrapping and wrapping: − AES (128, 192 or 256-bit) in KW, KWP.
• [FIPS 140-3 IG] D.G, Key transport methods, compliant KTS for unwrap of key objects using one of the following options: − AES (128, 192 or 256-bit) in CBC, CTR or ECB modes; or − Triple-DES (112 and 168-bit) in CBC, ECB and CTR. The unwrap operation takes as input an encrypted symmetric key or asymmetric private key and a handle to the key required to successfully unwrap the object. It decrypts the key and returns the handle to the imported key.  Key Unwrap using historic versions of SKS The module supports key import for keys previously exported from another certified Thales HSM using versions of SKS supported by legacy firmware versions and where related certificates are now on NIST’s historical list. Import is supported for key migration. Objects imported using this method are either:
• encrypted using AES with 256-bit key in GCM mode with SHA2-256 for integrity protection; or
• encrypted using AES with 256-bit key in OFB mode and with SHA1 for integrity protection.

Test

Operations Performed Verify, Digest Verify, Digest

Indicator

NOTE Signature verification pre-operational self-tests will always be preceded by the

Conditional KAT on the bootloader implementations of RSA supporting a single mode of

operation. Transition from an approved to non-approved mode of operation automatically

triggers the HSM zeroize module service.

NOTE When conditional tests are run as part of the pre-operational self-test, the HSM will

test all possible implementations of a given algorithm independent of the HSM level

configuration and settings.

During PST, the module will exclusively test the implementation of a given algorithm in use

for a given configuration and settings of the HSM at the time of a given conditional test

executing.

The module performs the pre-operational self-tests upon power-up to confirm the firmware integrity, and to check the continued correct operation of the random number generator and each of the implemented cryptographic algorithms used in support of the integrity checks. While the module is running these self-tests, all interfaces are disabled until the successful completion of the self-tests. If any test fails an error message is output alongside being recorded in the error log, the module halts, and data output is inhibited. Boot loader performs an RSA PKCS #1-v1.5 signature with Verify, Digest Error output and module halt 4096-bit modulus and SHA2-384 signature verification of itself. Boot loader performs an RSA PKCS #1-v1.5 signature with Verify, Digest Error output and module halt 4096-bit modulus and SHA2-384 signature verification of the main firmware prior to firmware start. do not require operator input to initiate.

All KAT, alongside statistical testing of the noise source, is performed immediately following the pre-

Self-Tests Table 10-2: Conditional self-tests (#C2022) ([SP800-56Ar3]/[SP80056Br2] compliant implementation) validation ([SP800-56Ar3] for derive operation. compliant implementation)

Test

Cryptographic Mechanism Tested Pre-operational: HMAC-SHA1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2- 512, HMAC-SHA3-224, HMAC-SHA3-256, HMAC- SHA3-384, HMAC-SHA3-512 PST: HMAC-SHA1, HMAC-SHA2-224, HMAC-SHA2- 384, SHA3-256 Pre-operational: Signature Generation, Sig Verification for RSA X9.31 with SHA2-256, RSA PKCS #1-v1.5 with SHA2-256, RSA PKCS #1-v1.5 (no hash), RSA PKCS #1-v1.5 with SHA2-256 and SHA2-256 for MGF, RSA-OAEP-basic with 2048-bit modulus and SHA1, SHA2-256 and SHA2-384, SHA2-512 as MGF PST: Signature Generation, Signature Verification for: PKCS-PSS with modulus of 8192-bits and SHA2-256, PKCS-PSS with modulus of 2048-bit and SHA2-256, RSA-OAEP-basic with 2048-bit modulus and SHA2-256 as MGF Pre-operational: Signature Generation, Signature Verification for 2048-bit modulus with SHA2-224. Signature Verification with 1024-bit modulus and SHA1 PST: DSA with 2048-bit modulus and SHA2-224 Pre-operational: X9.42 Diffie-Hellman [SP800- 56Ar3] key derive with 2048-bit modulus PST: <as per pre-operational self-test> Pre-operational: ECB, CBC, OFB, CFB128, CFB8, KW, KWP, GCM and CMAC covering 128-bit,192- bit and 256-bit keys as supported by the different modes PST: CBC, GCM, KW, KWP – 256-bit key

Location Main firmware Main firmware Main firmware Main firmware Main firmware

When Performed Prior to first use., PST Prior to first use., PST Prior to first use., PST Prior to first use., PST Prior to first use., PST

Operations Performed Digest. Sign, Verify, Encrypt, and Decrypt. Sign and Verify. Derive (X9.42 Derive operation – no KDF). Encrypt, Decrypt.

Indicator

Test

Cryptographic Mechanism Tested Pre-operational: ECB, CBC, OFB, CFB64, CTR 168- bit keys. PST: ECB with 168-bit key Pre-operational: CMAC for 168-bit keys. PST: <as per pre-operational self-test> Pre-operational: KAS-ECC [SP800-56Ar3] shared secret calculation (only) using curves P-224, P- 384, P-521 and K-233 PST: KAS-ECC with P-384, OneStep KDF using SHA2-256 Pre-operational: Signature Generation, Signature Verification with ECDSA and both curves P-256 and K-233 (no hashing) PST: Signature Generation, Signature Verification using ECDSA and curves P-256, K-233 Pre-operational: KBKDF [SP800-108r1] with AES- CMAC, HMAC-SHA2-224, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 as PRF options PST: KBKDF [SP800-108r1] using AES-CMAC as the PRD with 128-bit key Pre-operational: OneStep KDF [SP800-56Cr2] with SHA1, SHA2-224, SHA2-256, SHA2-384, SHA2-512, SHA3-224, SHA3-256, SHA3-384, SHA3- 512. X9.42/X9.63 KDF using SHA1. PST: OneStep KDF [SP800-56Cr2] with SHA2-512. X9.42 and X9.63 KDF [SP800-135r1] using SHA1. Pre-operational: KAS1-basic [SP800-56Br2] with 4096-bit modulus PST: <as per pre-operational self-test>.

Location Main firmware Main firmware Main firmware Main firmware Main firmware Main firmware Main firmware

When Performed Prior to first use., PST Prior to first use., PST Pre-operational, PST Prior to first use., PST Prior to first use., PST Prior to first use., PST Prior to first use., PST

Operations Performed Decrypt. Verify. Derive (no KDF). Sign, Verify. Derive. Derive. Encrypt, Decrypt.

Indicator

Test

Cryptographic Mechanism Tested Pre-Operational PBKDF [SP800-132] using HMAC- SHA1, HMAC-SHA2-224, HMAC-SHA2-256, HMAC- SHA2-384, HMAC-SHA2-512 PST: PBKDF [SP800-132] using HMAC-SHA2-512

Location Main firmware

When Performed Prior to first use., PST

Operations Performed Derive.

Indicator

Pair-Wise Consistency Test (PCT)

Software/Firmware Load Test (SW/FW Load)

Continuous Test: RSA PKCS #1-v1.5, modulus 4096 signature and SHA2-384

Main firmware

On firmware update request

Verify.

Manual Entry Test

Bypass Test

Critical Function Test

Continuous Test: Total failure test on the output from the hardware noise source, Repetition Count Test and Adaptive Proportion Test statistical tests

Main firmware

Continuous

N/A.

Self-Tests for ECDSA and ECDH) N/A N/A

The module will perform periodic self-tests (PST) at set intervals of time for the pre-operational tests and a subset of the KAT tests. These tests will be performed every 24 hours, at which point the PSTs will be implemented as a single asynchronous command with multiple steps that make up all PSTs that must be executed. The command will be added to the HSM’s command scheduler run queue, alongside any other commands that have been sent to the HSM. Each time the PST command is given time to execute, it will perform a single step and then return priority to other commands in the queue. Each step will be consistent in size with other cryptographic commands so as not to impact overall performance of the HSM. Conditional tests performed periodically are identified in Table 10-2 above as tests with ‘PST’ in the ‘When Performed’ column.

NOTE Failing to follow the steps to configure the module into the Approved Mode will

result in the module operating in a Non-Compliant state, which is outside the scope of this

validation.

NOTE The module shall be received in a zeroised state. To check the status of the module

use the hsm showinfo LunaCM command as described in section 13.1.

The module is confirmed as being in the zeroised state when the partition status

for the administration slot reports zeroized.

Thales Luna G7 Cryptographic Module should be deployed in a secure environment that will protect the module from sophisticated attackers with direct access. This is standard practice for high-value assets such as HSMs and forms part of a defence-in-depth approach to security. Securing the environment of the HSM typically will include a combination of both:  securing its location using physical defences; and  procedures for monitoring and managing authorized access to the HSM. The exact measures put in place will vary and should be commensurate with the potential consequences or costs associated with the complete compromise of the HSM and cryptographic keys (or data objects) it protects. Common components of a physical security solution often include:

Before using the module it must be initialized, after which it should be immediately configured into its approved mode of operation. Prior to secure initialization of the module, access control relies on procedural controls only and the module should be received in the zeroised state with no initialized roles. Initialization creates the HSM SO role, names the module, defines the authentication mode and associates the admin partition with a key cloning domain.

NOTE As part of initialization when using PED based authentication, the end-user is asked if

they wish to duplicate your iKeys. It is strongly recommended that you do this and for

duplicate keys to be retained in secure storage for backup purposes. It is not possible to

copy iKeys at a later point.

Life-cycle Assurance Initialization is performed using the hsm init command from LunaCM or LunaSH, though LunaSH can only be used for the Thales Luna G7 Backup HSM. It should be noted that the hsm init command should only be run when an individual has been assigned to the HSM SO role and usually is run either by them or with them present. Following initialization of the module, it should immediately be configured into its approved mode of operation ahead of initialization of any further roles or creation of any stored key objects. Guidance on configuring the approved mode of operation is provided in section 13.3 and 13.4.

Security of the overall system, including the HSM, is only as strong as its weakest component. As such, the environment needs to take responsibility for securing artefacts relating to the HSM when outside its control. In particular, the following explicit requirements shall be met:

In addition to the above, to minimize risks to data being transferred in plaintext through the local environment of the HSM:  All sensitive data should be encrypted if stored outside the HSM as part of a strategy to keep sensitive data logically separate from other data managed by the IT environment.

Permitted devices at the time of writing this document include: iKeys.

The HSM maintains a host accessible log of events in PCIe accessible FRAM memory. This allows the log on the Thales Luna G7 Cryptographic Module to be read by the host driver even if the bootloader or main firmware has failed during power-on leaving the card in an un-responsive state.  The FRAM log can viewed using the lunadiag tool installed with the Thales LunaCM client:

• to view the FRAM log select option 18 Read Diagnostic Log then one of: − option 3 Tamper
• will output event in the log dedicated to tamper with recorded events. − option 1 card history
• records reset events that can be correlated with either when a card has been turned on or a soft or hard reset has had to occur. The following figures show example output from the logs: Tamper Log Entry 0, 0x25 bytes read, timestamp = 7630, reset count = 1: New FRAM LOG created. Entry 1, 0xc9 bytes read, timestamp = 17167, reset count = 4: LOG(TAMPER): ds3644_initialize - Warning: 10 L3 tamper settings do not match default! Registers re-configured. Actual values: 0x8f 0xff 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x5c 0xd2 0x7e Entry 2, 0x31 bytes read, timestamp = 17167, reset count = 4: ALM2008: Internal data corruption Card History Log Entry 0, 0x20 bytes read, timestamp = 303, reset count = 1965: reset reason 0x9154008 Date: 2019-05-30 (Thursday) Time: 1:09:09 Entry 1, 0x20 bytes read, timestamp = 304, reset count = 1966: reset reason 0x9154008 Date: 2019-05-30 (Thursday) Time: 1:09:38 Entry 2, 0x20 bytes read, timestamp = 3097, reset count = 1967: reset reason 0x41154008 Date: 2019-05-30 (Thursday) Time: 22:06:07 When reading the FRAM log messages:  timestamp
• is the elapsed time in milliseconds since the last time the card was reset; and  reset count
• identifies the reset event the offset is relevant to. This can be used with the card history log to calculate the time an event occurred by taking the data and time listed against the reset event and then adding the offset from the timestamp. In the scenario of a power-on or on-demand self-test failing, even if the triggered event causes the module to enter the halted state, the details can be accessed through the FRAM log. If the FRAM logs cannot be read following halt, this likely indicates the power-on self-tests detected an error during startup of the

CAUTION! Should the end user fail to comply with these requirements this could lead to subsequent compromise or malicious misuse of the HSM and its cryptographic keys.

CAUTION! In order to securely use the Thales Luna PED in its remote configuration, it is

important to check and acknowledge the serial number of the target HSM during setup of

the Remote PED tunnel.

If the displayed serial number does not match the expected target HSM serial number the

user must reject the displayed serial number at the PED, which will halt channel setup.

Life-cycle Assurance bootloader. If the main firmware experienced a halt during its power-on tests, then further error details will still be accessible through the FRAM logs. An example of the module failing the SHA2-224 self-test on startup is below: ---Entry 155, 0x40 bytes read, timestamp = 6495, reset count = 117: LOG(CRITICAL): SHA2_SelfTest failed, rc=0x30000a

In order to maintain the separation of user roles throughout the life of the HSM deployment and to avoid

User Authentication iKeys Should an end user lose an iKey or believe their iKey to have been compromised it is imperative for the security of the HSM deployment that immediate action is taken to: 1. minimize the chances of subsequent misuse of the lost or compromised iKey; and 2. check for evidence of misuse of the iKey to allow for wider compromise recovery actions to be considered. Following identification of a lost or compromised iKey, the following actions should be taken:  If a backup iKey was made and it includes a corresponding PIN, duplicate the iKey to allow re-issue (while retaining a backup) but ensure the PIN is changed on all residual copies of the duplicated iKey prior to re-deployment of the iKey.

NOTE role resetpw is a sister command to role changepw and when enabled as a

capability can enable a Security Officer to reset a lost or forgotten password on behalf of an

end user.

Life-cycle Assurance  If the iKey was originally issued with no PIN, the iKey should be considered compromised and will need to be recreated:

• Recreating an iKey requires all objects stored in the impacted partition or HSM to be backed up to allow for recovery following recreation of a new iKey. − Where supported, cloning and SKS should be used to back up the HSM contents to a secondary HSM. − If an HSM SO iKey has been lost, all partitions and objects on the HSM should be backed up if partitions are still available. − If a Partition CO, Partition LCO or Partition CU iKey is lost, the impacted partition should be backed up. − If the AU iKey is lost, a copy of the Audit Logging Secret should be made and transferred to a PED iKey. − For the loss of an HSM SO iKey, LunaCM command hsm factoryReset followed by hsm init should be run to re-create the iKey. This will result in a loss of all un-backed up objects on the HSM.
• In the event of loss of a Partition CO, Partition LCO or Partition CU iKey, the HSM SO must use the partition delete command to remove a partition before subsequently creating a new partition using partition create.
• For AU, the audit partition must be re-initialised using the LunaCM command role init –name audit to recreate a new AU iKey. The Audit Logging Secret can then be imported using the audit import command from LunaCM.

General Should a role believe their PIN or password to have been compromised (where used) but access to the corresponding iKey or to the HSM was not possible, the following action should be taken:  the PIN or password should be changed using: • role changepw LunaCM command for a compromised password or iKey PIN to issue a new password and the option to create a new iKey PIN where appropriate. At this time it is not possible to reset a password or PIN associated with the HSM SO role and as such, the only route to change this PIN is to back up and then to reinitialize the HSM. KCV The KCV is used to register an HSM with a domain allowing it to transfer keys with other modules. Loss of a domain key should be considered a security event. Backups of the KCV or print-outs (optional) of the HSM-or-Partition domain secret should be retained. If this has not been performed, it is not possible to recreate or replace the domain secret.

NOTE Use of the terase and tplease bootloader commands to perform a complete

erase of all Flash based storage is not intended to be performed by customers and is

included here for completeness only.

The Flash contains keys created during manufacture that cannot be replaced without

repeating the full manufacturing process for the card.

Following erase of the flash, only signed main firmware in a format not made publicly

available can be loaded onto the module.

Life-cycle Assurance In order to recover from complete loss of a domain secret, the objects in the HSM (where configuration permits) need to be exported and re-imported into an HSM registered with a new domain. Remote PED iKeys When a Remote iKey is considered to be compromised, a new iKey should be generated and distributed to all remote PED on the Orange iKey. In order to create a new Remote PED iKey: • run the ped vector init from LunaCM.

When an individual no longer has the requirement to hold the authorized role associated with the HSM, a hand-over of iKeys and corresponding PIN or password should be arranged. When an iKey has been lost for a role to be revoked, guidance on recovering from a lost end user authentication iKey in section 11.6 should be followed.

Keys can be deleted from a partition in one of a number of ways:

Resetting is the process of removing all sensitive information from the cryptographic module. Run the LunaCM hsm factoryreset command to reset the HSM to factory default settings. Care should be taken to observe that the command executes to a successful completion.

NOTE All updates of the firmware MUST be FIPS 140-3 validated before they can be loaded

for the module to remain in an approved mode of operation.

Life-cycle Assurance An example output from a successful factory reset is shown below: lunacm:>hsm factoryreset You are about to factory reset the HSM. All contents of the HSM will be destroyed. HSM policies will be reset and the remote PED vector will be erased. Are you sure you wish to continue? Type 'proceed' to continue, or 'quit' to quit now ->proceed Command Result : No Error Figure 11-1: Example successful factory reset console output from LunaCM

Updating the module’s firmware requires the HSM SO and the firmware update file to complete. Run the LunaCM hsm updatefw command to update the current firmware to a new version. If any failures are detected during the update, the command will fail and the module will continue running on the existing An example output from a successful firmware update is shown below: lunacm:>hsm updatefw -fuf fwupdateG7_testCert_7.0.1_RC327.fuf authcode fwupdateG7_testCert_7.0.1_RC327.fuf.txt You are about to update the firmware. The HSM will be reset. Are you sure you wish to continue? Type 'proceed' to continue, or 'quit' to quit now -> proceed Updating firmware. This may take several minutes. Firmware update passed. Resetting HSM Command Result : No Error Figure 11-2: Example successful FW update console output from LunaCM

The module does not require any periodic maintenance outside the routine inspection of tamper evidence as documented in Section 7.2.

Mitigation of Other Attacks

No assured mitigations to ‘other attacks’ are covered in this security policy.

NOTE Any module returning hardware, main firmware and bootloader versions not listed in this

security policy is out of the scope of this validation and requires a separate FIPS 140-3 certificate.

Both hardware part numbers in this security policy are correlated with the Thales Luna G7

Cryptographic Module.

Ahead of putting the module into its approved mode of operation, it is important to identify the hardware, main firmware and bootloader versions of the target module and to check these correspond to one of the tested modules listed in section Table 2-1. The following sections provide guidance on checking each element.  hsm showinfo when using LunaCM. The command returns status information on the target cryptographic module including the version numbers for both bootloader, main firmware and separately the hardware identity. Example output for the command for a valid module is shown in the figure below with relevant versions and the module’s name highlighted in red: lunacm:>hsm showinfo Slot Id -> 6 Partition Label -> g7_597068 Partition Serial Number -> 597068 Partition Model -> Luna G7 Partition Manufacturer -> Gemalto Partition Status -> L3 Device, OK39 Session State -> CKS_RW_PUBLIC_SESSION Role Status -> none logged in RPV Initialized -> No Partition SMK OUIDs: SMK-FW4: Not Initialized SMK-FW6: Not Initialized SMK-FW7-FM: Not Initialized SMK-FW7-Rollover: Not Initialized SMK-FW7-Primary: 3c000000170000124c1c0900 LunaCM maps to the Luna ICD logical interface at the cryptographic module boundary. The command will show “Zeroized” instead of “OK” if the module is in a zeroized state.

Guidance Partition Storage: Total Storage Space:                    655360 Used Storage Space:                     0 Free Storage Space:                     655360 Object Count:                           0 Overhead:                               24408 HSM Storage: Total Storage Space:                    33554432 Used Storage Space:                     679768 Free Storage Space:                     32874664 Allowed Partitions:                     1 Number of Partitions: 0 HSM Part Number -> 808-000080-001 Environmental: System Temperature :                    35 deg. C Firmware Version -> 7.7.3 Bootloader Version ->                    1.6.0 Rollback Firmware Version -> Not Available License Count: 1. 621000186-000 G7 Base CUF *** The HSM is in FIPS approved operation mode. *** Command Result : No Error 13-1: Example output of hsm showinfo command from LunaCM

The Thales Luna G7 Cryptographic Module comes in two configurations, the Thales Luna G7 USB HSM and the Thales Luna G7 Backup HSM. Check the configuration with:  slot list when using LunaCM. The command returns status information of the cryptographic module including the configurations. Example output for the command for a valid module is shown in the figure below with relevant configurations highlighted in red: Available HSMs: Slot Id -> 105 Label -> g7backup_596424

Guidance Serial Number ->                           596424 Model ->                                   Luna G7 Firmware Version ->                        7.7.3 Bootloader Version ->                      1.6.0 Configuration ->                           Luna HSM Admin Partition (PW) Backup Mode Slot Description ->                        Admin Token Slot HSM Status ->                              L3 Device, OK Slot Id ->                                 108 Label ->                                   g7_121212 Serial Number ->                           121212 Model ->                                   Luna G7 Firmware Version ->                        7.7.3 Bootloader Version ->                      1.6.0 Configuration ->                                 Luna HSM Admin Partition (PW) Key Export With Cloning Mode Slot Description ->                        Admin Token Slot HSM Status ->                              L3 Device, OK 13-2: Example output of slot list command from LunaCM

The module is configured to be in an Approved Mode of Operation on a per-partition basis. To place a partition into its approved mode of operation, the HSM SO (Admin Partition) or Partition SO (User Partition) must check and, if necessary, set the following partition level policy:  Partition Policy (43) Enable non-FIPS Algorithms - this policy is set to true by default if HSM Policy (12), Allow Non-FIPS Algorithms is separately set to true. If HSM Policy (12), Allow Non-FIPS Algorithms is set to false, the module will set this value to false (enforced by the module). This policy shall be set to false. Ahead of configuring the individual partitions, the HSM SO must set the following HSM level policies:  HSM Policy (56), Allow User Defined ECC Curves is enabled by default and shall be disabled. If the HSM SO attempts to enable or disable these policies, a warning is displayed and the HSM SO is prompted to confirm the selection. If this policy is left as enabled, the module will be operating in the nonapproved mode of operation. Following entry into an approved mode of operation, any changes to either policy will trigger an automatic zeroization of the HSM erasing all roles and partition stored key objects.

To place the Thales Luna G7 Backup HSM into its approved mode of operation, the HSM SO must check and, if necessary, set the following HSM level policy:  HSM Policy (55), Enable Restricted Restore – this is disabled by default and shall be enabled.

Guidance If the HSM SO attempts to disable these policies, a warning is displayed and the HSM SO is prompted to confirm the selection. If this policy is left as disabled, the module will be operating in the non-approved mode of operation. Following entry into an approved mode of operation, any changes to HSM Policy (55), Enable Restricted Restore will trigger an automatic zeroization of the HSM erasing all roles and partition stored key objects.

To make the module perform its cryptographic self-tests as described in section 10.2 you must use the following:  Self Test (Option #90) when using the client tool. This will give you 3 options of self-tests to run on the module:

Enter your choice : 90 Slots available: slot#5 - Admin Token Slot slot#6 - User Token Slot slot#9 - Admin Token Slot Select a slot (last selected slot = 6): 6 Test to perform: [0] To cancel [1] H/W Test [2] Crypto Test [3] RNG Test [4] Perf mode on (us) [5] Perf mode on (ns) [6] Perf mode off [7] Cryptographic Algorithm Self Tests [8] Sentry off [9] Sentry on [10] Inject error: exit() [11] Inject error: raise() [12] Inject error: kernel oops [13] Inject error: infinite loop [14] List all enabled Sentry PKA engines (0:5) [15] Disable a Sentry PKA engine (0:5) [16] Enable a Sentry PKA engine (0:5) > 2 Status: Doing great, no errors (CKR_OK)

Guidance (TITLE) menu titles, (99 or FULL) Full Help, (NONE) No help, (0 or EXIT) Quit Status: Doing great, no errors (CKR_OK) 13-3: Example output of the Self Test command from CKDemo

The nominal operating temperatures of the module are between 5 and 35°C. The module’s tamper thresholds can be found in section 7.3. The nominal operation voltage of the module is 5V DC. The module’s voltage thresholds can also be found in section 7.3.

To log into the module’s roles as described in section 4.1 you must first set the slot to the partition you wish to log into. To set the slot you must first use the slot list LunaCM command to view the available slots, as shown above in section 13.2. Once you have the chosen slot you wish to log into use the following:  set slot when using LunaCM. lunacm:> slot set -slot 4 Command Result : No Error 13-4: Example output of set slot command from LunaCM Once set you may now log into any of the available roles to the partition by using:  role login when using LunaCM. lunacm:> role list Roles (short) ============================ Partition SO po Crypto Officer co Limited Crypto Officer lco Crypto User cu Command Result : No Error lunacm:>role login -name po Please attend to the PED. Command Result : No Error 13-5: Example output of role list and role login commands from LunaCM

NOTE Some roles must first be initialized before they can be logged in. To do so you must use the role init command in LunaCM

NOTE When reviewing the manuals, you should refer to the latest version of each manual.

Should any conflict be identified between guidance in this security policy and statements in the

online product documentation, guidance in the security policy takes precedence.

In addition to the direct guidance provided in this Security Policy, both Thales Luna G7 USB HSM and Thales Luna G7 Backup HSM include extensive user guidance in their online free to access manual. The full manuals for these products can be accessed at www.thalesdocs.com where the target products can be found under ‘Luna HSMs’ and where the ‘read docs’ link will take you to the front page where the document portal for Thales Luna G7 USB HSM. Thales Luna G7 Backup HSM documentation is part of the Luna PCIe HSM and Luna Network HSM documentations.