Amazon Linux 2023 Libgcrypt Cryptographic Module

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Amazon Linux 2023 Libgcrypt Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>status output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Amazon Linux 2023 Libgcrypt Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>UnAuth<br/>status output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Amazon Web Services, Inc. Amazon Linux 2023 Libgcrypt Cryptographic Module Document Version 1.2 Last update: 2025-02-05 Prepared by: atsec information security corporation

4516 Seton Center Pkwy, Suite 250

www.atsec.com © 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

This document is the non-proprietary FIPS 140-3 Security Policy for version 1.10.2- 752a14d13e4ce9c0 of the Amazon Linux 2023 Libgcrypt Cryptographic Module. It has a one-to- one mapping to the SP 800-140Brev1 starting with Section B.2.1 named “General” that maps to Section 1 General in this document and ending with Section B.2.12 named “Mitigation of other attacks” that maps to Section 12 Mitigation of Other Attacks in this document.

Table 1: Security Levels © 2025 Amazon Web Services, Inc./atsec information security.

Purpose and Use: The Amazon Linux 2023 Libgcrypt Cryptographic Module (hereafter referred to as “the module”) is a Software multi-chip standalone cryptographic module. The module is a software library implementing general purpose cryptographic algorithms. The module provides cryptographic services to applications running in the user space of the underlying operating system through an application program interface (API). Module Type: Software Module Embodiment: MultiChipStand Cryptographic Boundary: The module is implemented as shared library / binary file; as shown in the diagram below, the shared library file constitutes the cryptographic boundary. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed on. © 2025 Amazon Web Services, Inc./atsec information security.

Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): © 2025 Amazon Web Services, Inc./atsec information security.

Table 2: Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

There are no components excluded from the module. © 2025 Amazon Web Services, Inc./atsec information security.

Modes List and Description: Table 4: Modes List and Description Mode Change Instructions and Status: When the module starts up successfully, after passing the pre-operational self-test and cryptographic algorithms self-tests, the module is operating in the approved mode of operation by default and can only be transitioned into the non-approved mode by calling one of the non-approved services listed in the table above. Refer to Section 4 Roles, Services, and Authentication for details on the service indicators provided by the module that identify when an approved service is called. The module does not implement a degraded mode of operation.

Approved Algorithms: © 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Table 5: Approved Algorithms Vendor-Affirmed Algorithms: © 2025 Amazon Web Services, Inc./atsec information security.

Table 6: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: © 2025 Amazon Web Services, Inc./atsec information security.

Table 7: Non-Approved, Not Allowed Algorithms

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Name Extendable Output Functions

Type XOF

Description Compute a message digest from XOFs

Properties

Algorithms SHA2-256 SHA2-256 SHA2-256 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-384 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512 SHA2-512/224 SHA2-512/224 SHA2-512/224 SHA2-512/224 SHA2-512/224 SHA2-512/256 SHA2-512/256 SHA2-512/256 SHA2-512/256 SHA2-512/256 SHA3-224 SHA3-224 SHA3-224 SHA3-256 SHA3-256 SHA3-256 SHA3-384 SHA3-384 SHA3-384 SHA3-512 SHA3-512 SHA3-512 SHAKE-128 SHAKE-128 SHAKE-128 SHAKE-256 SHAKE-256 SHAKE-256

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Name

Type

Description

Properties

Algorithms PBKDF PBKDF

Table 8: Security Function Implementations

The AES algorithm in XTS mode can be only used for the cryptographic protection of data on storage devices, as specified in SP 800-38E. The length of a single data unit encrypted with the XTS-AES shall not exceed 2²⁰ AES blocks, that is 16MB of data. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. The AES-XTS mode shall only be used for the cryptographic protection of data on storage devices. The AESXTS shall not be used for other purposes, such as the encryption of data in transit.

The module provides password-based key derivation (PBKDF), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance with SP 800-132 and FIPS 140-3 IG D.N, the following requirements shall be met.

• Derived keys shall only be used in storage applications. The Master Key (MK) shall not be used for other purposes. The module accepts length of the MK or DPK of 112 bits or more.
• A portion of the salt, with a length of at least 128 bits, shall be generated randomly using the SP 80090Arev1 DRBG,
• The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The minimum value accepted by the module is 1000.
• Passwords or passphrases, used as an input for the PBKDF, shall not be used as cryptographic keys.
• The length of the password or passphrase shall be of at least 8 characters, and shall consist of lowercase, upper-case, and numeric characters. Assuming the worst-case scenario of all digits, the probability is estimated to be at most 10-8. Combined with the minimum iteration count as described above, this provides an acceptable trade-off between user experience and security against brute-force attacks. The calling application shall also observe the rest of the requirements and recommendations specified in SP 800-132. © 2025 Amazon Web Services, Inc./atsec information security.

Table 9: Entropy Certificates Table 10: Entropy Sources The module provides an SP 800-90Arev1-compliant Deterministic Random Bit Generator (DRBG) for creation of key components of asymmetric keys, and random number generation. This entropy source is located within the module’s physical perimeter but outside of the module’s cryptographic boundary. The module obtains 384 bits to seed the DRBG, and 256 bits to reseed it. The seeding (and automatic reseeding) of the DRBG is done with getrandom(). The DRBG supports the Hash_DRBG, HMAC_DRBG and CTR_DRBG mechanisms. The DRBG is initialized during module initialization; the module loads by default the DRBG using the HMAC_DRBG mechanism with SHA-256 and without prediction resistance. A different DRBG mechanism can be chosen by invoking the gcry_control(GCRYCTL_DRBG_REINIT) function. The module performs the DRBG health tests as defined in Section 11.3 of SP 800-90Arev1.

The module provides an SP 800-90Arev1-compliant Deterministic Random Bit Generator (DRBG) for the creation of key components of asymmetric keys, and random number generation. The Cryptographic Key Generation (CKG) methods implemented in the module for Approved services in the approved mode are compliant with Section 5.1 of SP 800-133rev2. For generating RSA and ECDSA keys the module implements asymmetric key generation services compliant with FIPS 186-4. A seed (i.e., the random value) used in asymmetric key generation is directly obtained from the SP 800-90Arev1 DRBG. © 2025 Amazon Web Services, Inc./atsec information security.

Additionally, the module implements key derivation with PBKDF2 using option 1a, compliant with SP800-132.

The module implements the SSP transport methods as specified in the Security Function Implementations table.

The module does not support any industry protocols listed within the publication of SP 800-135rev1. Therefore, this section is not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

Table 11: Ports and Interfaces All data output via data output interface is inhibited when the module is performing the pre-operational selftest, conditional self-tests, zeroization, or when the module enters an error state. The module does not © 2025 Amazon Web Services, Inc./atsec information security.

N/A for this module. The module does not implement authentication methods.

Table 12: Roles The module supports the Crypto Officer role only. This sole role is implicitly assumed by the operator of the module when performing a service.

W,E W,E © 2025 Amazon Web Services, Inc./atsec information security.

G,R G,R G,R W,E © 2025 Amazon Web Services, Inc./atsec information security.

W,E W,E W,E W,E W,E G,E © 2025 Amazon Web Services, Inc./atsec information security.

(V W,E (V C W,E W,E W,E © 2025 Amazon Web Services, Inc./atsec information security.

G,R W,E © 2025 Amazon Web Services, Inc./atsec information security.

Z y Z (V (V C Z © 2025 Amazon Web Services, Inc./atsec information security.

Table 13: Approved Services The table above lists the approved services. For each service, the table lists the associated cryptographic algorithm(s), the role to perform the service, the cryptographic keys or CSPs involved, and their access type(s). The following convention is used to specify access rights to a CSP: • G = Generate: The module generates or derives the SSP. • R = Read: The SSP is read from the module (e.g., the SSP is output). • W = Write: The SSP is updated, imported, or written to the module. • E = Execute: The module uses the SSP in performing a cryptographic operation. • N/A: the calling application does not access any CSP or key during its operation. The details of the approved cryptographic algorithms including the CAVP certificate numbers can be found in the Approved Algorithms table in Section 2.5 Algorithms. In order to check whether it utilizes an approved security function or not, the operator is responsible to invoke the gcry_control() API along with dedicated controls in the form of API input parameters. The module implements the following controls depending on the requested service:

1. GCRYCTL_FIPS_SERVICE_INDICATOR_CIPHER - For symmetric algorithms and the related modes.
2. GCRYCTL_FIPS_SERVICE_INDICATOR_KDF - For KDF operations.
3. GCRYCTL_FIPS_SERVICE_INDICATOR_PK_FLAGS - For asymmetric operations. 1
4. GCRYCTL_FIPS_SERVICE_INDICATOR_MD - For digest operations.
5. GCRYCTL_FIPS_SERVICE_INDICATOR_MAC - For MAC operations. 1The list of public key flags allowed in approved mode of operation is described in Appendix A. Approved Public Key Flags. © 2025 Amazon Web Services, Inc./atsec information security.

In addition to that, for the below-mentioned services, the approved service indicator corresponds to the GPG_ERR_NO_ERROR returned from listed functions in the indicator column below. They don’t use gcry_control() API:

1. Random number generation service: gcry_randomize(), gcry_random_bytes(), gcry_random_bytes_secure().
2. Public key validation service: gcry_mpi_ec_curve_point(). For all approved services, GPG_ERR_NO_ERROR (i.e., “0”) return code indicates the service is approved. In case the above-mentioned controls are used in conjunction, the operator is responsible to check that all the called functions return GPG_ERR_NO_ERROR (i.e., “0”). For all non-approved services, "non-zero" return code indicates the service is not approved. © 2025 Amazon Web Services, Inc./atsec information security.

Table 14: Non-Approved Services The table above lists the non-approved services. The details of the non-approved cryptographic algorithms not available in non-approved mode can be found in the Not Allowed, Non-Approved Algorithms table. For the services listed above, the module implements an additional service indicator in the form of a control named GCRYCTL_FIPS_SERVICE_INDICATOR_FUNCTION. The operator is responsible to invoke the gcry_control() API along with the following input parameters: GCRYCTL_FIPS_SERVICE_INDICATOR_FUNCTION control; the name of the API 2 representing the service.

The module does not load any external software/firmware.

2 The list of APIs supported by the module can be found in the documentation included in the optional

libgcrypt-devel package. © 2025 Amazon Web Services, Inc./atsec information security.

The integrity of the module is verified by comparing the HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the module’s ELF header that was computed at build time for each software component of the module. If the HMAC values do not match, the test fails, and the module enters the Error state.

Integrity test is performed as part of the Pre-Operational Self-Test. The module provides the Self-Test service to perform self-tests on demand which includes the pre-operational self-test (i.e., integrity test) and cryptographic algorithm self-tests (CASTs). This service can be invoked relying on the gcry_control(GCRYCTL_SELFTEST) API function call or by powering-off and reloading the module. During the execution of the on-demand self-tests, services are not available, and no data output or input is possible. In order to verify whether the self-tests have succeeded and the module is in the Operational state, the calling application may invoke the gcry_control(GCRYCTL_OPERATIONAL_P). The function will return TRUE if the module is in the Operational state and FALSE if the module is in the Error state. © 2025 Amazon Web Services, Inc./atsec information security.

Type of Operational Environment: Modifiable How Requirements are Satisfied: The module shall be installed as stated in Section 11 Life-Cycle Assurance. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

The module shall be installed as stated in Section 11 Life-Cycle Assurance. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2025 Amazon Web Services, Inc./atsec information security.

The module is comprised of software only, and therefore this section is not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

The module does not implement any non-invasive security mechanism, and therefore this section is not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

Table 15: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in plaintext form. SSPs are provided to the module by the calling process and are destroyed when released by the appropriate zeroization function calls.

Table 16: SSP Input-Output Methods The module does not support manual SSP input or intermediate SSP generation output. The SSPs are provided form within the physical perimeter of the operational environment. This is allowed by FIPS 140-3 IG 9.5.A, according to the “CM Software to/from App via TOEPP Path” entry in the table above. © 2025 Amazon Web Services, Inc./atsec information security.

Table 17: SSP Zeroization Methods The memory occupied by SSPs is allocated by regular memory allocation operating system calls. The application API and listed in the table above. Calling gcry_free() will zeroize the SSPs and also invoke the corresponding API functions listed in table to zeroize SSPs. The zeroization functions overwrite the memory occupied by SSPs with “zeros” and deallocate the memory with the regular memory deallocation operating system call. In case of abnormal termination, or swap in/out of a physical memory page of a process, the keys in physical memory are overwritten by the Linux kernel before the physical memory is allocated to another process. Data output via the The user must not call malloc/free to create/release space for keys, and must let libgcrypt manage space for keys, needs to be called before the process is terminated. © 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Table 18: SSP Table 1 © 2025 Amazon Web Services, Inc./atsec information security.

Table 19: SSP Table 2 © 2025 Amazon Web Services, Inc./atsec information security.

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031. The RSA and ECDSA algorithms as implemented by the module conform to FIPS 186-4, which has been superseded by FIPS 186-5. FIPS 186-4 has been withdrawn since February 3, 2024. © 2025 Amazon Web Services, Inc./atsec information security.

Table 20: Pre-Operational Self-Tests The details of integrity test are provided in Section 5.1 Integrity Techniques. Data output via the data output interface is inhibited during the execution of the pre-operational self-test.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Table 21: Conditional Self-Tests The CASTs are run prior to performing the integrity test. Data output via the data output interface is inhibited during the execution of the conditional self-tests. © 2025 Amazon Web Services, Inc./atsec information security.

Table 22: Pre-Operational Periodic Information © 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

© 2025 Amazon Web Services, Inc./atsec information security.

Table 23: Conditional Periodic Information

Table 24: Error States © 2025 Amazon Web Services, Inc./atsec information security.

The table above shows the error states and the corresponding condition. The calling application can obtain the module state by calling the gcry_control(GCRYCTL_OPERATIONAL_P) API function. The function returns FALSE if the module is in the Error state, TRUE if the module is in the Operational state. When the module fails any pre-operational self-test or conditional self-tests, the module will return an error code to indicate the error and enter the Error state. If random numbers are requested in the Error state or cipher operations are requested on a deallocated handle, the module will enter the Fatal Error state. Any further cryptographic operation and all data output via the data output interface are inhibited in both error states. Recovering from the Error state includes performing self-tests and restarting the module. The only way to transition from the Fatal Error state to the Operational state is to restart the cryptographic module.

The module provides the Self-Test service to perform self-tests as stated in Section 5.2 Initiate on Demand. During the execution of the on-demand self-tests, services are not available, and data output is not possible. Additionally, the PCTs can be invoked on demand by requesting the asymmetric key generation services. © 2025 Amazon Web Services, Inc./atsec information security.

The Crypto Officer can install the RPM package of the module as listed in Section 11.2 Administrator Guidance using standard tools recommended for the installation of RPM packages on an Amazon Linux 2023 or SnowOS

1.0 system (for example, dnf, rpm, and the RHN remote management tool). The integrity of the RPM package is

automatically verified during the installation, and the Crypto Officer shall not install the RPM package if there is any integrity error. Before the RPM package of the module is installed, the Amazon Linux 2023 and SnowOS 1.0 systems must operate in the FIPS validated configuration. This can be achieved by executing the fips-mode-setup --enable command and then restarting the system. More information can be found at the vendor documentation. The Crypto Officer must verify the Amazon Linux 2023 and SnowOS 1.0 system operates in the FIPS validated configuration by executing the fips-mode-setup --check command, which should output “FIPS mode is enabled.”

The binaries of the module are contained in the RPM packages for delivery. The Crypto Officer shall follow Section 11.1 Installation, Initialization, and Startup Procedures to configure the operational environment and install the module to be operated as a FIPS 140-3 validated module. The following RPM packages contain the FIPS validated module:

• libgcrypt-1.10.2-1.amzn2023.0.2.x86_64.rpm for Intel 64-bit
• libgcrypt-1.10.2-1.amzn2023.0.2.aarch64.rpm for ARM 64-bit After installation of the RPM package of the module, the operator must check the output of the gcry_get_config() API, which should include the following name and version: Amazon Linux 2023 libgcrypt 1.10.2-e4ddf5ed7abe8d45 Once libgcrypt has been put into the FIPS validated configuration, it is not possible to switch back to standard mode without terminating the process first. If the logging verbosity level of libgcrypt has been set to at least 2, the state transitions and self-tests are logged. The approved and non-approved security functions offered by the module are listed in Table 8, Security Function Implementations. The list of interfaces is provided in section 3. The Users responsibility on approved mode of operation is mentioned in section 2.4 that include description on mode of operation, section 2.7 that has algorithm specific information and in section 4.3 that lists approved services as well as service indicator mechanism. The module does not implement authentication methods. © 2025 Amazon Web Services, Inc./atsec information security.

There is no non-administrator guidance. The administrator guidance is specified in section 11.2

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, the libgcrypt-1.10.2-1.amzn2023.0.2 RPM package can be uninstalled from the Amazon Linux 2023 and SnowOS 1.0 systems. © 2025 Amazon Web Services, Inc./atsec information security.

RSA is vulnerable to timing attacks. In a setup where attackers can measure the time of RSA decryption or signature operations, blinding must be used to protect the RSA operation from that attack.

The module implements blinding against RSA Timing Attacks. By default, the module uses the following blinding technique: instead of using the RSA decryption directly, a blinded value y = x re mod n is decrypted and the unblinded value x' = y' r−1 mod n returned. The blinding value r is a random value with the size of the modulus n.

Not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

Below are listed the approved public key flags for an input s-expression: © 2025 Amazon Web Services, Inc./atsec information security.

Appendix B. Glossary and Abbreviations AES                     Advanced Encryption Standard AES-NI                  Advanced Encryption Standard New Instructions CAVP                    Cryptographic Algorithm Validation Program CBC                     Cipher Block Chaining CCM                     Counter with Cipher Block Chaining-Message Authentication Code CFB                     Cipher Feedback CMAC                    Cipher-based Message Authentication Code CMVP                    Cryptographic Module Validation Program CSP                     Critical Security Parameter CTR                     Counter Mode DF                      Derivation Function DRBG                    Deterministic Random Bit Generator ECB                     Electronic Code Book FIPS                    Federal Information Processing Standards Publication GCM                     Galois Counter Mode HMAC                    Hash Message Authentication Code KAT                     Known Answer Test KW                      AES Key Wrap MAC                     Message Authentication Code NIST                    National Institute of Science and Technology OFB                     Output Feedback PAA                     Processor Algorithm Acceleration PAI                     Processor Algorithm Implementation PR                      Prediction Resistance PSP                     Public Security Parameter PSS                     Probabilistic Signature Scheme RNG                     Random Number Generator RSA                     Rivest, Shamir, Adleman SHA                     Secure Hash Algorithm © 2025 Amazon Web Services, Inc./atsec information security.

SSP Sensitive Security Parameter XTS XEX-based Tweaked-codebook mode with cipher text Stealing © 2025 Amazon Web Services, Inc./atsec information security.

Appendix C. References FIPS140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules March 2019 https://doi.org/10.6028/NIST.FIPS.140-3 FIPS140-3_IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program January 2024 https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validationprogram/documents/fips%20140-3/FIPS%20140-3%20IG.pdf FIPS180-4 Secure Hash Standard (SHS) March 2012 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf FIPS186-4 Digital Signature Standard (DSS) July 2013 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf FIPS186-5 Digital Signature Standard (DSS) February 2023 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf FIPS197 Advanced Encryption Standard November 2001 https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf FIPS202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions August 2015 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 https://csrc.nist.gov/publications/detail/sp/800-38b/final © 2025 Amazon Web Services, Inc./atsec information security.

SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality May 2004 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf SP800-38E NIST Special Publication 800-38E - Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf SP800-90Arev1 NIST Special Publication 800-90A

• Revision 1 - Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf SP800-90B NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf SP800-132 NIST Special Publication 800-132 - Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf SP800-133rev2 NIST Special Publication 800-133
• Revision 2 - Recommendation for Cryptographic Key Generation June 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf SP800-135rev1 NIST Special Publication 800-135
• Revision 1
• Recommendation for Existing Application-Specific Key Derivation Functions December 2011 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-135r1.pdf SP800-140Br1 NIST Special Publication 800-140B
• Revision 1 - CMVP Security Policy Requirements November 2023 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Br1.pdf © 2025 Amazon Web Services, Inc./atsec information security.