Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C, PTP 850E

Certificate

Approved Algorithms (35)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C, PTP 850E
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update<br/>firmware load</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C, PTP 850E
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update<br/>firmware load</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>status output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C, PTP 850E Firmware: 12.0.1 Hardware: PTP 820N and PTP 820A, with TEL P/N: BS-0341-2 and with components:

• PTP820 TCC-B2-XG-MC: N000082H003
• PTP820 TCC-U: N000082H005
• PTP820 RMC-B: N000082H004 PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 850C and PTP 850E (Rev. 6) Prepared by: Acumen Security

Rockville, MD 20850 www.acumensecurity.net

Cambium Networks Ltd. assumes no liability resulting from any inaccuracies or omissions in this document, or from use of the information obtained herein. Cambium reserves the right to make changes to any products described herein to improve reliability, function, or design, and reserves the right to revise this document and to make changes from time to time in content hereof with no obligation to notify any person of revisions or changes. Cambium does not assume any liability arising out of the application or use of any product, software, or circuit described herein; neither does it convey license under its patent rights or the rights of others. It is possible that this publication may contain references to, or information about Cambium products (machines and programs), programming, or services that are not announced in your country. Such references or information must not be construed to mean that Cambium intends to announce such Cambium products, programming, or services in your country. This document, Cambium products, and 3rd Party software products described in this document may include or memories or other media. Laws in the United States and other countries preserve for Cambium, its licensors, and Cambium products described in this document may not be copied, reproduced, reverse engineered, distributed, merged or modified in any manner without the express written permission of Cambium. Furthermore, the purchase of Cambium products shall not be deemed to grant either directly or by implication, estoppel, or supplied software, except for the normal non-exclusive, royalty free license to use that arises by operation of law in the sale of a product. Restrictions of the software or documentation may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, without prior written permission of Cambium. License Agreements The software described in this document is the property of Cambium and its licensors. It is furnished by express license agreement only and may be used only in accordance with the terms of such an agreement. High Risk Materials Cambium and its supplier(s) specifically disclaim any express or implied warranty of fitness for any high-risk activities or uses of its products including, but not limited to, the operation of nuclear facilities, aircraft navigation or aircraft communication systems, air traffic control, life support, or weapons systems (“High Risk Use”). Any High Risk is unauthorized, is made at your own risk and you shall be responsible for any and all losses, damage or claims arising out of any High-Risk Use. Public Material

• May be reproduced only in its original entirety (without revision).

List of Figures Public Material

• May be reproduced only in its original entirety (without revision).

Introduction This is a non-proprietary FIPS 140-3 Security Policy for Cambium Networks Ltd. and the following Cambium Networks products: PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C, and PTP 850E. Below are the details of the certified products: Hardware Version #:

• PTP 820N and PTP 820A, with TEL P/N: BS-0341-2 and with components:
• PTP820 TCC-B2-XG-MC: N000082H003
• PTP820 TCC-U: N000082H005
• PTP820 RMC-B: N000082H004
• PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 850C, and PTP 850E (Rev. 6) Firmware Version #: 12.0.1 FIPS 140-3 Security Level: 2 Purpose This document was prepared as part of the Federal Information Processing Standard (FIPS) 140-3 validation process. The document describes how the Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C and PTP 850E meet the security requirements of FIPS 1403. It also provides instructions to individuals and organizations on how to deploy the product in a secure Approved mode of operation. The target audience of this document is anyone who wishes to use or integrate any of these products into a solution that is meant to comply with FIPS 140-3 requirements. Document Organization The Security Policy document is one document in a FIPS 140-3 Submission Package. In addition to this document, the Submission Package contains: Vendor Evidence document Finite State Machine Other supporting documentation as additional references This Security Policy and the other validation submission documentation were produced by Acumen Security, LLC. under contract to Cambium Networks. With the exception of this Non-Proprietary Security Policy, the FIPS 140-3 Submission Package is proprietary to Cambium Networks and is releasable only under appropriate non-disclosure agreements. Public Material
• May be reproduced only in its original entirety (without revision).

1. General The Cambium Networks PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 820N, PTP 820A, PTP 850C and PTP 850E (the module) are multi-chip standalone hardware modules validated at FIPS 140-3 Security Level
2. Specifically, the modules meet that following security levels for individual sections in FIPS 140-3 standard: Section FIPS 140-3 Section Title Security Level

Table 1 - Security Levels 2. Cryptographic Module Specification The PTP 820 and PTP 850 series radios provide a service-centric microwave platform for HetNet1 hauling. The platform includes a full complement of wireless products that provide backhaul and fronthaul solutions. Powered by a software-defined engine and sharing a common operating system, PTP 820 and PTP 850 Release 12.0.1, the PTP 820 and PTP 850 platforms deliver ultra-high capacities while supporting any radio transmission technology, any network topology, and any deployment configuration.

The cryptographic boundary for the modules is defined as encompassing the "top," "front," "left," "right," and "bottom" surfaces of the case and all portions of the "backplane" of the case. The following figures provide a physical depiction of the cryptographic modules: Heterogenous Network Public Material

• May be reproduced only in its original entirety (without revision).

Figure 1

• PTP 820G Figure 2
• PTP 820C Figure 3
• PTP 820S Public Material
• May be reproduced only in its original entirety (without revision).

Figure 4

• PTP 820C-HP Figure 5
• PTP 820N and PTP 820A Figure 6
• PTP 850C Public Material
• May be reproduced only in its original entirety (without revision).

Figure 7

• PTP 850E (Rev. 6) The PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 850C and PTP 850E are fixed configuration. The PTP 820N and PTP 820A are modular configuration, and have slots to insert the following cards:
• Traffic and Control Card (TCC): The Traffic Control Card (TCC) provides the control functionality for the PTP 820N and PTP 820A units. It also provides Ethernet management and traffic interfaces. There are two variants of this card:
• PTP820 TCC-B2-XG-MC: N000082H003: Required for Multi-Carrier ABC configurations. Provides 2 x FE Ethernet management interfaces, 2 x GbE optical interfaces, 2 x GbE electrical interfaces, and 2 x dual mode electrical or cascading interfaces.
• PTP820 TCC-U: N000082H005: Provides 6 x 1/10GE optical interfaces and 2 x RFU or 1/2.5 GbE electrical PoE interfaces. Two of the optical interfaces (1 and 2) can be configured as cascading interfaces. Supports up to two Multi-Carrier ABC groups, with capacity of 2.5 Gbps (non-configurable). Supports multiple high-capacity configurations with Link Bonding.
• Radio Modem Card-B (PTP820 RMC-B: N000082H004): The Radio Modem Card (RMC) provides the modem interface between the Indoor Unit (IDU) and the Radio Frequency Unit (RFU). The models included in this validation have been tested in the following configurations: Model Hardware Firmware Distinguishing Version Features PTP 820G PTP 820G 12.0.1 Fixed configuration IDU2. See Table 5 PTP 820C PTP 820C 12.0.1 Fixed configuration ODU3. See Table 6 PTP 820S PTP 820S 12.0.1 Fixed configuration ODU. See Table 7 PTP 820C-HP PTP 820C-HP 12.0.1 Fixed configuration ODU. See Table 8 Indoor unit Outdoor unit Public Material
• May be reproduced only in its original entirety (without revision).

Model Hardware Firmware Distinguishing Version Features PTP 820N PTP 820N with TEL P/N: BS-0341-2 12.0.1 Modular IDU. and with components:

• Single or dual TCC
• PTP820 TCC-B2-XG-MC:
• Dual RMC-B N000082H003
• Dual Power supplies See Table 9, Table 10
• PTP820 TCC-U: and Table 11 N000082H005
• PTP820 RMC-B: N000082H004 PTP 820A PTP 820A with TEL P/N: BS-0341-2 12.0.1 Modular IDU. and with components:
• Single or dual TCC
• PTP820 TCC-B2-XG-MC:
• Dual RMC-B N000082H003
• Dual Power supplies See Table 9, Table 10
• PTP820 TCC-U: and Table 11 N000082H005
• PTP820 RMC-B: N000082H004 PTP 850C PTP 850C 12.0.1 Fixed configuration ODU. See Table 12 PTP 850E PTP 850E (Rev. 6) 12.0.1 Fixed configuration ODU. See Table 13 Table 2 - Cryptographic Module Tested Configuration Additionally, the following cards can be configured on PTP 820N and PTP 820A modules. These cards provide port density, but do not contain any security-relevant functionality:
• Ethernet/Optical Line Interface Card (E/XLIC)
• STM-1/OC3
• STM-1 RST
• TDM E1/T1
• 10Gb Ethernet/Optical Line Interface Card (LIC-X-E10)
• Radio Interface Card (RIC-D)

The module operates in the Approved mode of operation (when configured as per the instructions in Section 11 of this document). Any usage of the non-Approved services described in Table 17 would result in a non-Approved mode of operation. Public Material

• May be reproduced only in its original entirety (without revision).

The following table lists the Approved algorithms supported by the modules: CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Management Security Algorithms Implementation (Firmware) A2758 AES CBC Direction: Decrypt, Encrypt Used for control/ (FIPS Key Length: 128, 256 management plane 197) ECB Direction: Decrypt, Encrypt encryption/ Key Length: 128, 256 decryption CTR Direction: Decrypt, Encrypt Key Length: 128, 192, 256 Payload Length: 8-128 Increment 8 Incremental Counter Counter Tests Performed CFB128 Direction: Decrypt, Encrypt Key Length: 128 GCM4 Direction: Decrypt, Encrypt IV Generation: Internal IV Generation Mode: 8.2.1 Key Length: 128, 256 Tag Length: 32, 64, 96, 104, 112, 120, 128 IV Length: 96-1024 Increment 8 Payload Length: 8-65536 Increment 8 AAD Length: 0-65536 Increment 8 KW Direction: Decrypt, Encrypt Cipher: Cipher, Inverse Key Length: 256 Payload Length: 128-524288 Increment SHS SHA-1 Message Length: 0-65536 Increment 8 Used for control/ (FIPS SHA2-256 management plane 180-4) SHA2-384 message digests. SHA2-512 SHA-1 is permitted within SSH, TLS and IPSec protocols, and legacy GCM IV generation tested in accordance with IG C.H, scenario 1 TLSv1.2 following RFCs 5516, 5246, 5288, and

5289 as well as SSH following RFCs 4251, 4252, 4253, 4254 and 5647. The IV is generated only for use with GCM

encryption within the protocol being used. The TLS cipher suites supported by the module are identified in section

11.4.2 of this document which are included in SP 800-52 Rev2 section 3.3.1. The module also internally generates

IVs for TLS 1.3 (RFC 8446) in accordance with scenario 5 in IG C.H. In the case the module’s power is lost and then restored, a new key for use with AES-GCM encryption/decryption is established. Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d signature verification only. HMAC HMAC- MAC: 32-160 Increment 8 Key Length: 8- Used for control/ (FIPS SHA1 524288 Increment 8 management plane 198-1) HMAC- MAC: 32-256 Increment 8 Key Length: 8- message SHA2-256 524288 Increment 8 authentication HMAC- MAC: 32-384 Increment 8 Key Length: 8SHA2-384 524288 Increment 8 HMAC- MAC: 32-512 Increment 8 Key Length: 8SHA2-512 524288 Increment 8 DRBG CTR_DRBG Capabilities: Used for control/ (SP800- Mode: AES-256 management plane 90Arev1) Derivation Function Enabled: Yes random bit Additional Input: 0-256 Increment 256 generation Entropy Input: 2048 Increment 128 Nonce: 128 Personalization String Length: 0-256 Increment 256 Returned Bits: 256 ECDSA KeyGen, Capabilities: Curve: P-256 Hash Algorithm: Used for control/ (FIPS KeyVer, SHA2-256, SHA2-384, SHA2-512 management plane 186-4) SigGen, Secret Generation Mode: Testing key generation, SigVer Candidates signature generation, and signature verification DSA KeyGen Capabilities: Used for control/ (FIPS L: 2048 management plane 186-4) N: 224 FCC key generation L: 2048 N: 256 L: 3072 N: 256 RSA KeyGen Capabilities: Used for control/ (FIPS Key Generation Mode: B.3.3 management plane 186-4) Properties: key generation, Modulo: 2048 signature Primality Tests: Table C.2 generation, and Properties: signature Modulo: 3072 verification Primality Tests: Table C.2 Properties: Modulo: 4096 Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Primality Tests: Table C.2 Info Generated By Server Public Exponent Mode: Random Private Key Format: Standard SigGen Capabilities: Signature Type: PKCS 1.5 Properties: Modulo: 2048 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 4096 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Capabilities: Signature Type: PKCSPSS Properties: Modulo: 2048 Salt Length: 28 Hash Pair: Hash Algorithm: SHA2-256 Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Salt Length: 64 Properties: Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Salt Length: 64 Properties: Modulo: 4096 Hash Pair: Hash Algorithm: SHA2-256 Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Salt Length: 64 Capabilities: Signature Type: ANSI X9.31 Properties: Modulo: 2048 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 4096 Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 SigVer Capabilities: Signature Type: PKCS 1.5 Properties: Modulo: 2048 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 4096 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Capabilities: Signature Type: ANSI X9.31 Properties: Modulo: 2048 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Properties: Modulo: 4096 Hash Pair: Hash Algorithm: SHA2-256 Hash Pair: Hash Algorithm: SHA2-384 Hash Pair: Hash Algorithm: SHA2-512 Capabilities: Signature Type: PKCSPSS Properties: Modulo: 2048 Hash Pair: Hash Algorithm: SHA2-256 Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Salt Length: 64 Properties: Modulo: 3072 Hash Pair: Hash Algorithm: SHA2-256 Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Salt Length: 64 Properties: Moduli: 4096 Hash Pair: Hash Algorithm: SHA2-256 Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d Salt Length: 32 Hash Pair: Hash Algorithm: SHA2-384 Salt Length: 48 Hash Pair: Hash Algorithm: SHA2-512 Salt Length: 64 Public Exponent Mode: Random KTS-1 AES AES-256 in KW mode Used for key transport on the data plane; key establishment methodology provides 256 bits of encryption strength KTS-2 AES AES-128 and AES-256 in GCM mode Used for key transport on the management plane within TLS and SSH; key establishment methodology provides 128 or

encryption strength KTS-3 AES AES-128, AES-192 and AES-256 in CTR Used for key HMAC mode with HMAC SHA-1 transport on the management plane within SSH; key establishment methodology provides between

encryption strength KTS-5 AES AES-128 and AES-256 in CBC mode with Used for key HMAC HMAC-SHA-1 or HMAC SHA-256 transport on the management plane within TLS; key establishment methodology provides 128 or Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d

encryption strength KAS-FFC- Diffie- Domain Parameter Generation Methods: Used for key SSC Hellman FB, FC, ffdhe2048, ffdhe3072 transport on the (SP800- Scheme: management plane 56arev3) dhEphem: using DiffieKAS Role: initiator, responder Hellman; key establishment methodology provides 112 and

encryption strength KAS-ECC- Ephemeral Domain Parameter Generation Methods: Used for key SSC Unified P-256 transport on the (SP800- Scheme: management plane 56arev3) ephemeralUnified: using Elliptic Curve KAS Role: initiator, responder Diffie-Hellman; key establishment methodology provides 128 bits of encryption strength CVL KDF Hash Algorithm: SHA2-256, SHA2-384, Used for key RFC 7627 TLSv1.2 SHA2-512 derivation within CVL KDF HMAC Algorithm: SHA2-256, SHA2-384 management RFC 8446 TLSv1.3 KDF Running Modes: DHE, PSK, PSK-DHE protocols CVL5 KDF SSHv2 AES-128, AES-192, AES-256 (SP800- SHA-1, SHA2-256, SHA2-384, SHA2-512 135-r1) Vendor- CKG6 SP800- §4: Using the Output of a Random Bit Symmetric key and affirmed 133rev2 Generator asymmetric seed §5: Generation of Key Pairs for generation Asymmetric-Key Algorithms Note that no parts of the SSH, SNMPv3, IKEv1 and TLS protocols, other than the approved cryptographic algorithms and the KDFs, have been tested by the CAVP and CMVP. In accordance with FIPS 140-3 IG D.H, the cryptographic module performs Cryptographic Key Generation (CKG) as per SP 800-133r2 (vendor affirmed). The resulting generated symmetric keys and the seed used in the asymmetric key generation are the unmodified output from an NIST SP 800-90A DRBG. Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d §6.1: The “Direct Generation” of Symmetric Keys §6.2: Derivation of Symmetric Keys A2758 KAS-1 KAS-FFC-SSC Cert. #A2758 with CVL Certs. Diffie-Hellman key A2756 #A2758 and #A2756 establishment ffdhe2048, ffdhe3072 providing 112 and using KAS-FFC-SSC

SSHv2 KDF, IKEv1 KDF, RFC 7627 TLSv1.2 KDF and RFC 8446 TLSv1.3 KDF A2758 KAS-2 KAS-ECC-SSC Cert. #A2758 with CVL Certs. Elliptic Curve DiffieA2756 #A2758, #A2756 and #A2757 Hellman key P-256 providing 128 bits of encryption establishment strength using KAS-ECC-SSC with SP 800-135 SSHv2 KDF, IKEv1 KDF, RFC 7627 TLSv1.2 KDF and RFC 8446 TLSv1.3 KDF IKE KDF Implementation (Firmware) A2756 KDF KDF IKEv1 Capabilities: Authentication Method: Pre- Used for key IKEv1 shared Key Initiator Nonce Length: 64- derivation within CVL 2048 Increment 8 Responder Nonce IPsec (SP800- Length: 64-2048 Increment 8 Preshared Not implemented 135-r1) Key Length: 8-8192 Increment 8 Diffie- on Freescale P1021 Hellman Shared Secret Length: 3072 Hash or ARM based Algorithm: SHA2-256 platforms SNMP KDF Implementation (Firmware) A2757 CVL KDF Password Length: 64, 256 Used for key (SP800- SNMPv3 Engine ID: derivation within 135-r1) 3078313130663331626636303532333062 management 64, protocols 3078333964653663643936303437353165 Linux Kernel Crypto Implementation (Firmware) A2755 AES CBC Direction: Decrypt, Encrypt Key Length: Used for data (FIPS 256; tested but not used on Freescale encryption/ 197) P1012 or ARM based platforms decryption within IPsec Public Material

• May be reproduced only in its original entirety (without revision).

CAVP Algorith Mode/Me Description / Key Size(s) / Key Use / Function Cert m and thod Strength(s) Standar d HMAC HMAC- MAC: 128; Key Length: 256; tested but not Used for message (FIPS SHA2-256 used on Freescale P1012 or ARM based authentication 198-1) platforms within IPSec SHS SHA2-256 Message Length: 0-51200 Increment 8; Used for message (FIPS not used on Freescale P1012 or ARM digests within IPsec 180-4) based platforms KTS-4 AES AES-256 in CBC mode with HMAC SHA-256 Used for key HMAC transport on the management plane within IPsec; key establishment methodology provides 256 bits of encryption strength AES Core Implementation (Hardware) AES 4014 AES OFB Direction: Decrypt, Encrypt Used for data plane (FIPS Key Length: 256 encryption/ 197) decryption (PTP 820C, 820S, 820CHP) A680 AES CTR Direction: Decrypt, Encrypt Used for data plane (FIPS Key Length: 256 encryption/ 197) Payload Length: 128 decryption (PTP Incremental Counter 850C, 850E, 820G, Counter Tests Performed 820A, 820N) Entropy Source ENT (P) Ring-oscillator noise source with no conditioning function Conformant to SP 800-90B and IG D.J and D.K. Minentropy: 1.9 bits per byte Table 3

• Approved Algorithms *Note that there are algorithms, modes, and key/moduli sizes that have been CAVP-tested but are not used by any approved service of the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by an approved service of the module. Algorithm/Function Use/Function MD5 RADIUS TACACS+ Table 4
• Non-Approved Algorithms Not Allowed in the Approved Mode of Operation Public Material
• May be reproduced only in its original entirety (without revision).

3. Cryptographic Module Interfaces The modules provide a number of physical ports/logical interfaces to the device, and the physical ports provided by the module are mapped to four FIPS 140-3 defined logical interfaces: data input, data output, control input, and status output. The physical ports/logical interfaces and their mapping are described in the following diagrams/tables: Figure 8

• PTP 820G Physical Ports Physical port Logical interface Data that passes over port/interface (1x) FE Management Interfaces7 Data Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (2x) GbE Electrical Interfaces (FE) (2x) Dual Mode GbE Electrical or Data traffic (TNC, GbE, E1/DS1) Cascading (2x) GbE Optical Interfaces (16x) E1/DS1s (2x) TNC Radio Interfaces (1x) FE Management Interfaces Data Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (2x) GbE Electrical Interfaces (FE) (2x) Dual Mode GbE Electrical or Data traffic (TNC, GbE, E1/DS1) Cascading (2x) GbE Optical Interfaces (16x) E1/DS1s (2x) TNC Radio Interfaces (1x) Sync In/Out RJ-45 Interface Control Input Clock signaling (Sync) TLS v1.2/1.3, SSH, IPSec, and (1x) RJ-45 Terminal Interface SNMPv3 management traffic (1x) FE Management Interfaces (FE) Note that only one FE interface appears in the figure. With the addition of a Y-connector, the single port can be used to provide two FE interfaces. Public Material
• May be reproduced only in its original entirety (without revision).

Serial console (Terminal) (1x) RJ-45 Terminal Interface Status Output Alarm signaling (DB9) TLS v1.2/1.3, SSH, IPSec, and (1x) FE Management Interfaces SNMPv3 management traffic (1x) DB9 External Alarms (FE) LEDs Serial console (Terminal) Activity (LED) (1x) -48V DC Power Interface Power Input N/A Table 5

• PTP 820G Ports and Interfaces Figure 9
• PTP 820C Physical Ports Public Material
• May be reproduced only in its original entirety (without revision).

Physical port Logical interface Data that passes over port/interface (1x) RJ-45 Data Port (PoE) Data Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Data traffic (Data Port, Antenna (2x) Data port (Electrical or Ports) Optical) (2x) Antenna Ports (1x) RJ-45 Data Port (PoE) Data Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Data traffic (Data Port, Antenna (2x) Data port (Electrical or Ports) Optical) (2x) Antenna Ports (1x) Source Sharing Control Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Signaling (Source Sharing) (1x) RSL Indication Status Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface RSL signaling (RSL) (1x) -48V DC Power Interface Power Input N/A (1x) RJ-45 Data Port (PoE) Table 6

• PTP 820C Ports and Interfaces Public Material
• May be reproduced only in its original entirety (without revision).

Figure 10

• PTP 820S Physical Ports Physical port Logical interface Data that passes over port/interface (1x) RJ-45 Data Port (PoE) Data Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Data traffic (Data Port, Antenna (2x) Data port (Electrical or Ports) Optical) (1x) Antenna Ports (1x) RJ-45 Data Port (PoE) Data Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Data traffic (Data Port, Antenna (2x) Data port (Electrical or Ports) Optical) (1x) Antenna Ports (1x) RJ-45 Management Control Input TLS v1.2/1.3, SSH, IPSec, and Interface SNMPv3 management traffic (RJ-45) (1x) RSL Indication Status Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface RSL signaling (RSL) (1x) -48V DC Power Interface Power Input N/A (1x) RJ-45 Data Port (PoE) Table 7
• PTP 820S Ports and Interfaces Public Material
• May be reproduced only in its original entirety (without revision).

Figure 11

• PTP 820C-HP Physical Ports Physical port Logical interface Data that passes over port/interface (1x) RJ-45 Data Port Data Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45 Management) Interface Data traffic (Data Ports, (2x) Data port (Electrical or Antenna Ports) Optical) (2x) Antenna Ports (1x) RJ-45 Data Port Data Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45 Management) Interface Public Material
• May be reproduced only in its original entirety (without revision).

Physical port Logical interface Data that passes over port/interface (2x) Data port (Electrical or Data traffic (Data Ports, Optical) Antenna Ports) (2x) Antenna Ports (1x) Source Sharing Control Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface Signaling (Source Sharing) (1x) RSL Indication Status Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (1x) RJ-45 Management (RJ-45) Interface RSL signaling (RSL) (1x) -48V DC Power Interface Power Input N/A Table 8

• PTP 820C-HP Ports and Interfaces Figure 12
• PTP820 TCC-U: N000082H005 (PTP 820N and PTP 820A) Physical Ports Physical port Logical interface Data that passes over port/interface (6x) GbE Optical Interfaces Data Input TLS v1.2/1.3, SSH, and SNMPv3 (2x) Gbe Electrical Interfaces management traffic (FE) (2x) FE Management Interfaces Data traffic (GbE) (6x) GbE Optical Interfaces Data Output TLS v1.2/1.3, SSH, and SNMPv3 (2x) Gbe Electrical Interfaces management traffic (FE) (2x) FE Management Interfaces Data traffic (GbE) (1x) Synchronization Interface Control Input Clock signaling (Sync) TLS v1.2/1.3, SSH, and SNMPv3 (1x) RJ-45 Terminal Interface management traffic (FE) (2x) FE Management Interfaces Serial console (Terminal) Signaling (Synchronization) (1x) RJ-45 Terminal Interface Status Output Alarm signaling (DB9) TLS v1.2/1.3, SSH, and SNMPv3 (2x) FE Management Interfaces management traffic (FE) Public Material
• May be reproduced only in its original entirety (without revision).

Physical port Logical interface Data that passes over port/interface (1x) ACT LED Serial console (Terminal) (1x) RJ45 External Alarms Activity (LED) Alarm signaling (RJ45) Table 9

• PTP820 TCC-U: N000082H005 (PTP 820N and PTP 820A) Ports and Interfaces Figure 13
• PTP820 TCC-B2-XG-MC: N000082H003 (PTP 820N and PTP 820A) Physical Ports Physical port Logical interface Data that passes over port/interface (2x) GbE Optical Interfaces Data Input TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (2x) FE Management Interfaces8 (FE) (2x) Dual Mode GbE Electrical or Data traffic (GbE) Cascading (2x) GbE Electrical Interfaces (2x) GbE Optical Interfaces Data Output TLS v1.2/1.3, SSH, IPSec, and SNMPv3 management traffic (2x) Dual Mode GbE Electrical or (FE) Cascading Data traffic (GbE) (2x) GbE Electrical Interfaces (1x) Synchronization Interface Control Input Clock signaling (Sync) TLS v1.2/1.3, SSH, IPSec, and (1x) RJ-45 Terminal Interface SNMPv3 management traffic (2x) FE Management Interfaces (FE) Serial console (Terminal) Signaling (Synchronization) (1x) RJ-45 Terminal Interface Status Output Alarm signaling (DB9) TLS v1.2/1.3, SSH, IPSec, and (2x) FE Management Interfaces SNMPv3 management traffic (1x) ACT LED (FE) (1x) DB9 External Alarms Serial console (Terminal) Activity (LED) Alarm signaling (DB9) Note that only one FE interface appears in the figure. With the addition of a Y-connector, the single port can be used to provide two FE interfaces. Public Material
• May be reproduced only in its original entirety (without revision).

Table 10 –PTP820 TCC-B2-XG-MC: N000082H003 (PTP 820N and PTP 820A) Ports and Interfaces Figure 14

• PTP820 RMC-B: N000082H004 (PTP 820N and PTP 820A) Physical Ports Physical port Logical interface Data that passes over port/interface (1x) TNC RFU Interface Data Input Data traffic (1x) TNC RFU Interface Data Output Data traffic (1x) TNC RFU Interface Control Input Data plane control signaling (1x) ACT LED Status Output Activity (1x) Link LED (1x) RFU LED Table 11
• PTP820 RMC-B: N000082H004 (PTP 820N and PTP 820A) Ports and Interfaces Public Material
• May be reproduced only in its original entirety (without revision).

Figure 15 - PTP 850C Physical Ports9 Physical port Logical interface Data that passes over port/interface (1x) 1/2.5/10GbE Electrical Data Input TLS v1.2/1.3, SSH, and SNMPv3 Interface management traffic (RJ-45) (1x) 1/2.5 GbE Electrical or Data traffic (Antenna ports, Optical Interface GbE) (2x) 1/10GbE Electrical or Optical Interface (1x) RJ-45 GbE Management Interface (2x) Antenna Ports (1x) 1/2.5/10GbE Electrical Data Output TLS v1.2/1.3, SSH, and SNMPv3 Interface management traffic (RJ-45) (1x) 1/2.5 GbE Electrical or Data traffic (Antenna ports, Optical Interface GbE) (2x) 1/10GbE Electrical or Optical Interface (1x) RJ-45 GbE Management Interface (2x) Antenna Ports (1x) RJ-45 GbE Management Control Input TLS v1.2/1.3, SSH, and SNMPv3 Interface management traffic (RJ-45) The WiFi port is disabled. Public Material

• May be reproduced only in its original entirety (without revision).

Physical port Logical interface Data that passes over port/interface (1x) Source Sharing Signaling (Source Sharing) (1x) RJ-45 GbE Management Status Output TLS v1.2/1.3, SSH, and SNMPv3 Interface management traffic (RJ-45) (1x) RSL Indication RSL signaling (RSL) (1x) -48V DC Power Interface Power Input N/A Table 12

• PTP 850C Ports and Interfaces Public Material
• May be reproduced only in its original entirety (without revision).

Figure 16 - PTP 850E Physical Ports Physical port Logical interface Data that passes over port/interface (1x) 1/2.5GbE Multiband Data Input TLS v1.2/1.3, SSH, IPSec, and Interface SNMPv3 management traffic (1x) 4x1/10GbE or 1x40GbE (RJ-45) Electrical or Optical Interface XPIC data (XPIC/IPsec) (1x) 1/10GbE Electrical Interface Data traffic (Antenna ports, (1x) RJ-45 GbE Management GbE) Interface (2x) Antenna Ports (1x) 1/2.5GbE Multiband Data Output TLS v1.2/1.3, SSH, IPSec, and Interface SNMPv3 management traffic (1x) 4x1/10GbE or 1x40GbE (RJ-45) Electrical or Optical Interface XPIC data (XPIC/IPsec) (1x) 1/10GbE Electrical Interface Data traffic (Antenna ports, (1x) RJ-45 GbE Management GbE) Interface (2x) Antenna Ports (1x) RJ-45 GbE Management Control Input TLS v1.2/1.3, SSH, IPSec, and Interface SNMPv3 management traffic (1x) Source Sharing (RJ-45) (1x) Protection/XPIC XPIC data (XPIC/IPsec) Signaling (Source Sharing) Public Material

• May be reproduced only in its original entirety (without revision).

Physical port Logical interface Data that passes over port/interface (1x) RJ-45 GbE Management Status Output TLS v1.2/1.3, SSH, IPSec, and Interface SNMPv3 management traffic (1x) RSL Indication (RJ-45) XPIC data (XPIC/IPsec) RSL signaling (RSL) (1x) -48V DC Power Interface Power Input N/A (1x) RJ-45 GbE Management Interface (PoE) WIFI Port N/A This port is disabled Table 13

• PTP 850E Ports and Interfaces 4. Roles, services, and authentication The following sections provide details about roles supported by the module, how these roles are authenticated, and the services the roles are authorized to access.

The module supports several different roles, including multiple Cryptographic Officer roles and a User role. Configuration of the module can occur over several interfaces and at different levels depending upon the role assigned. There are multiple levels of access for a Cryptographic Officer as follows:

• Security Officer, admin, SNMP User: Entities assigned this privilege level have complete access to configure and manage the module.
• Tech, Operator, Viewer: These entities have more limited access to manage the module. For example, they can only manage the configuration of the data traffic interface. The Users of the module are the remote peers to and from which backhaul traffic is transmitted. The Users are connected over a secure session protected using the Session keys. The Session keys are established from the remote peer using the Master Key to encrypt them. Successful decryption of the Session keys by the module, authenticates the User to the module. The CO is responsible for configuring the Master Key and the User role to pass encrypted data. Once the User is authenticated to the module, encrypted data can be transferred to and from the remote peer. If the CO does not configure the data-path for encryption, the User can still send un-encrypted data (bypass mode). The following table specifies roles, with corresponding service with input and output: Role Service Input Output Crypto Officer Show Status Web GUI forms, CLI Web GUI status, CLI return commands messages Public Material
• May be reproduced only in its original entirety (without revision).

Role Service Input Output Crypto Officer Perform Self- Web GUI forms, CLI Web GUI status, CLI return Tests commands messages Crypto Officer Change Web GUI forms, CLI Web GUI status, CLI return Password commands messages User Transmit/Receive Data plane packets Data plane packets Data Crypto Officer Administrative Web GUI forms, CLI Web GUI status, CLI return access over SSH commands messages Crypto Officer Administrative Web GUI forms, CLI Web GUI status, CLI return access over Web commands messages EMS Crypto Officer SNMPv3 Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer Key Entry Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer IPSEC Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer Zeroize Web GUI forms, CLI Web GUI status, CLI return commands messages N/A Cycle Power N/A N/A N/A Status LED N/A LED Status Output Crypto Officer View Summaries Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer Platform Web GUI forms, CLI Web GUI status, CLI return Management commands messages Public Material

• May be reproduced only in its original entirety (without revision).

Role Service Input Output Crypto Officer Fault Web GUI forms, CLI Web GUI status, CLI return Management commands messages Crypto Officer Radio Web GUI forms, CLI Web GUI status, CLI return Configuration commands messages Crypto Officer Ethernet Web GUI forms, CLI Web GUI status, CLI return Configuration commands messages Crypto Officer Sync Settings Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer Utilities Web GUI forms, CLI Web GUI status, CLI return commands messages Crypto Officer RBN Web GUI forms, CLI Web GUI status, CLI return commands messages Table 14

• Roles, Service Commands, Input and Output

The module supports role-based authentication. Module operators must authenticate to the module before being allowed access to services, which requires the assumption of an authorized role. The module employs the authentication methods described in the table below to authenticate Crypto-Officers and Users. Unauthenticated users are only able to access the module LEDs and power cycle the module. Role Authentication Method Authentication Strength CO Password/Username All passwords must be at least 8 characters and must include letters, numbers, and special characters. If (8) integers are used for an eight-digit password, the probability of randomly guessing the correct sequence is less than one (1) in 1,000,000 (this calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 integer digits, 33 special characters, and 52 letter characters. The calculation should be 958 = 6,634,204,312,890,625). Therefore, the associated probability of a successful random attempt is less than 1 in 1,000,000. In order to successfully guess the sequence in one minute would require the ability to make over 110,570,071,881,510 guesses per second, which far exceeds the operational capabilities of the module. Users AES-256 Master Key When using AES key-based authentication, the key has a size of 256-bits. Therefore, an attacker would have a 1 in Public Material

• May be reproduced only in its original entirety (without revision).

Role Authentication Method Authentication Strength 2^256 chance of randomly obtaining the key, which is much stronger than the one in a million chance. For AES based authentication, to exceed a 1 in 100,000 probability of a successful random key guess in one minute, an attacker would have to be capable of approximately 3.25X10^32 attempts per minute, which far exceeds the operational capabilities of the modules to support. Table 15

• Roles and Authentication

The services (approved and non-approved) that require operators to assume an authorized role (CryptoOfficer or User) as well as unauthenticated services are listed in the tables below. The module supports a global indicator of “enabled” when the module is in the Approved mode and an indicator of “disabled” when the module is in the non-Approved mode. Please note that the keys and Sensitive Security Parameters (SSPs) listed below use the following indicators to show the type of access required:

• G = Generate: The module generates or derives the SSP.
• R = Read: The SSP is read from the module (e.g. the SSP is output).
• W = Write: The SSP is updated, imported, or written to the module.
• E = Execute: The module uses the SSP in performing a cryptographic operation.
• Z = Zeroise: The module zeroises the SSP. Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions Show Status Provides N/A N/A CO N/A N/A status of the module and module versioning Perform Self- Used to N/A N/A CO N/A N/A Tests initiate ondemand self-tests (via powercycle) Change Update N/A Crypto Officer CO Crypto Officer Password N/A Password password Password (R/W) with a new CO Password CO Password Hash (E) value Hash Transmit/Receiv Encrypt/Dec AES-OFB Session Key Tx User Session Key Tx (R/W/Z) Admin e Data rypt data AES-ECB Session Key Rx Session Key Rx (R/W/Z) status passing AES-CTR Master Key Master Key (R) (enabled) through the AES-KW module Public Material
• May be reproduced only in its original entirety (without revision).

Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions (Bypass KTS (AESmode when KW) feature is not enabled) Administrative Secure AES-CTR DRBG entropy CO DRBG entropy input (R) Admin access over SSH remote HMAC input DRBG Seed (R) status command KAS-ECC- DRBG Seed DRBG V (R/W/Z) (enabled) line SSC DRBG V DRBG Key (R/W/Z) and appliance KAS-FFC- DRBG Key Diffie-Hellman / EC session administrati SSC Diffie-Hellman Diffie Hellman Shared logs on over an KTS / EC Diffie Secret (R/W/Z) SSH tunnel. RSA Hellman Diffie Hellman / EC Diffie SHS Shared Secret Hellman private key SSH KDF Diffie Hellman (R/W/Z) DRBG / EC Diffie Diffie Hellman / EC Diffie CKG Hellman Hellman public key DSA private key (R/W/Z) ECDSA Diffie Hellman SSH Private Key (R/W) / EC Diffie SSH Public Key (R/W) Hellman public SSH Session Key (R/W/Z) key SSH Integrity Key SSH Private Key (R/W/Z) SSH Public Key SSH Session Key SSH Integrity Key Administrative Secure AES-CBC DRBG entropy CO DRBG entropy input (R) Admin access over remote GUI AES-GCM input DRBG Seed (R) status Web EMS appliance HMAC DRBG Seed DRBG V (R/W/Z) (enabled) administrati KAS-ECC- DRBG V DRBG Key (R/W/Z) and on over a SSC DRBG Key Diffie-Hellman / EC session TLS tunnel. KAS-FFC- Diffie-Hellman Diffie Hellman Shared logs SSC / EC Diffie Secret (R/W/Z) KTS Hellman Diffie Hellman / EC Diffie SHS Shared Secret Hellman private key RSA Diffie Hellman (R/W/Z) TLSv 1.2 / EC Diffie Diffie Hellman / EC Diffie KDF Hellman Hellman public key TLS v1.3 private key (R/W/Z) KDF Diffie Hellman TLS Private Key (R/W) DRBG / EC Diffie TLS Public Key (R/W) CKG Public Material

• May be reproduced only in its original entirety (without revision).

Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions DSA Hellman public TLS Pre-Master Secret ECDSA key (G/E/Z) TLS Private Key TLS Master Secret TLS Public Key (G/E/Z) TLS Pre-Master TLS Session Encryption Secret Key (G/E/Z) TLS Master TLS Session Integrity Key Secret (G/E/Z) TLS Session Encryption Key TLS Session Integrity Key SNMPv3 Secure AES- SNMP Session CO SNMP Session Key Admin remote CFB128 Key (R/W/Z) status SNMPv3- HMAC SNMP Session SNMP Session (enabled) based SHS Authentication Authentication Key and system SNMP KDF Key (R/W/Z) session monitoring. SNMPv3 SNMPv3 password logs password (R/W/Z) Key Entry Enter key KTS Master Key CO Master Key (R/W) Admin over status managemen (enabled) t interfaces and session logs IPSec10 Control AES-CBC IKE session CO IKE session encrypt key Admin plane traffic HMAC encrypt key (R/W/Z) status encryption SHS IKE session IKE session (enabled) using IKEv1 KTS authentication authentication key for key KAS-FFC- key (R/W/Z) exchange SSC ISAKMP ISAKMP preshared key (Self- DSA preshared key (R/W) initiated IKEv1 KDF IPsec IPsec encryption key cryptograph encryption key (R/W/Z) ic output IPsec IPsec authentication key capability) authentication (R/W/Z) key Diffie Hellman Shared Diffie Hellman Secret (R/W/Z) Shared Secret Diffie Hellman private Diffie Hellman key (R/W/Z) private key Diffie Hellman public key (R/W/Z) Only available on MIPS CPU based models Public Material

• May be reproduced only in its original entirety (without revision).

Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions Diffie Hellman public key Zeroize Zeroize all N/A All CSPs CO All CSPs (Z) Admin CSPs status (enabled) Cycle Power Reboot of N/A DRBG entropy N/A DRBG entropy input (Z) Console module input DRBG Seed (Z) log DRBG Seed DRBG V (Z) DRBG V DRBG Key (Z) DRBG Key Diffie-Hellman / EC Diffie-Hellman Diffie Hellman Shared / EC Diffie Secret (Z) Hellman Diffie Hellman / EC Diffie Shared Secret Hellman private key (Z) Diffie Hellman Diffie Hellman / EC Diffie / EC Diffie Hellman public key (Z) Hellman SSH Session Key (Z) private key SSH Integrity Key (Z) Diffie Hellman SNMPv3 session key (Z) / EC Diffie SNMPv3 session Hellman public authentication key key TLS Pre-Master Secret SSH Session (Z) Key TLS Master Secret (Z) SSH Integrity TLS Session Encryption Key Key (Z) SNMPv3 TLS Session Integrity Key session key (Z) SNMPv3 IKE session encrypt key session (Z) authentication IKE session key authentication key (Z) TLS Pre-Master IPsec encryption key (Z) Secret IPsec authentication key TLS Master (Z) Secret Session Key Tx (Z) TLS Session Session Key Rx (Z) Encryption Key TLS Session Integrity Key IKE session encrypt key Public Material

• May be reproduced only in its original entirety (without revision).

Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions IKE session authentication key IPsec encryption key IPsec authentication key Session Key Tx Session Key Rx Status LED View status N/A N/A N/A N/A N/A Output via the modules’ LEDs View Summaries View unit N/A N/A CO N/A Admin summary status information (enabled) (Unit, Radio, Security) Platform Shelf N/A N/A CO N/A Admin Management managemen status t, unit (enabled) configuratio n, interfaces, firmware settings, activation key, and statistics Fault Alarm N/A N/A CO N/A Admin Management settings status (enabled) Radio Radio N/A N/A CO N/A Admin Configuration interface status settings (enabled) (includes Bypass setting and status) Ethernet Ethernet N/A N/A CO N/A Admin Configuration interface status settings (enabled) Public Material

• May be reproduced only in its original entirety (without revision).

Service Description Approved Keys and/or Role Access rights to Indicator Security SSPs s Keys/SSP’s Functions Sync Settings Manage N/A N/A CO N/A Admin synchroniza status tion (enabled) Utilities Generic N/A N/A CO N/A Admin utilities status (enabled) RBN Bandwidth N/A N/A CO N/A Admin notification status (enabled) Table 16

• Approved Services Service Description Algorithms Role Indicator Accessed SNMPv1/v2c Secure remote N/A CO Admin status (disabled) SNMPv1, v2cbased system monitoring. RADIUS RADIUS MD5 Admin status (disabled) authentication TACACS+ TACACS+ MD5 Admin status (disabled) authentication HTTP Plaintext HTTP N/A Admin status (disabled) Hot Standby Hot Standby N/A Admin status (disabled) Syslog Audit log N/A Admin status (disabled) forwarding NTP Network Time N/A Admin status Protocol servers (disabled) Telnet Plaintext CLI access N/A Admin status (disabled) Table 17
• Non-Approved Services 5. Software/Firmware Security The module performs a Firmware Integrity Test using a 160-bit error detection code (EDC) at power-on. If the EDC fails to compute properly, the module enters a hard error state where all cryptographic functions are disabled. Repeated failures of the integrity test will result in a reset to the factory default state. The integrity test may be performed on-demand by power-cycling the module. The module also performs a firmware load test (RSA 4096 with SHA2-256) covering the entire binary image, when a new FW is uploaded to the module. The signature is calculated and verified upon uploading of the new FW. If the test fails, the image will be discarded. Public Material
• May be reproduced only in its original entirety (without revision).

6. Operational Environment FIPS 140-3 Operational Environment requirements are not applicable since the module is a hardware module with a limited operational environment. The module runs Release 12.0.1 which includes Wind River Linux 4.1.0 or 4.14 depending on the CPU architecture.
7. Physical Security The appliances have a multi-chip standalone embodiment. The appliances are contained in a hard metal chassis, which is defined as the cryptographic boundary of the module. The appliances’ chassis is opaque within the visible spectrum. The enclosure of the appliances have been designed to satisfy Level 2 physical security requirements. Each of the appliances needs Tamper Evidence Labels (TELs) to meet Security Level 2 requirements. These labels are installed (as seen in the respective model images) at the factory before delivery to the customer, for the PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP, PTP 850C and PTP 850 E. For PTP 820N and PTP820A, the CO must place the twenty (20) TELs according to Figure 21-24 (below). The preparation instructions of the module prior to installation of the tamper seals are as follows: • Use caution to avoid touching the adhesive in such a way as to leave fingerprints and damage the labels. • The curing time (drying time) for the labels is at least sixty minutes. • The labels must be replaced whenever cards are added to or removed from the unit. Replacement labels can be ordered from Cambium Networks, part number BS-0341-2. • When replacing a label, gently cut the label, replace the module, and apply a new label in place of the previous label. The extra tamper seals shall be in possession of the CO at all times. The CO shall observe any changes to the module such as reconfigurations where the tamper evident seals are removed or installed to ensure the security of the module is maintained during such changes and the module is returned to an Approved mode of operation. The Crypto Officer shall periodically (defined by organizational security policy, recommendation is once a month) monitor the state of all applied TELs for evidence of tampering. If tamper is detected, the CO must take the device out of commission, inspect it and if deemed safe, return it to the Approved state. Physical Security Mechanism Recommended Frequency of Inspection/Test Guidance Inspection/Test Details Tamper Evidence Label During regular physical Inspect the labels for obvious maintenance operations. At signs of damage/removal. least every six months. Placement should be according to the figures below. Table 18 – Physical Security Inspection Guidelines Public Material – May be reproduced only in its original entirety (without revision).

Figure 17

• PTP 820G TEL Application Locations Public Material
• May be reproduced only in its original entirety (without revision).

Public Material

• May be reproduced only in its original entirety (without revision).

Figure 18

• PTP 820C TEL Application Locations Public Material
• May be reproduced only in its original entirety (without revision).

Figure 19

• PTP 820C-HP TEL Application Locations Public Material
• May be reproduced only in its original entirety (without revision).

Public Material

• May be reproduced only in its original entirety (without revision).

Public Material

• May be reproduced only in its original entirety (without revision).

Figure 20

• PTP820S TEL Application Locations Public Material
• May be reproduced only in its original entirety (without revision).

Figure 21 - PTP 820N and PTP 820A Bottom Figure 22

• PTP 820N and PTP 820A Front Public Material
• May be reproduced only in its original entirety (without revision).

Figure 23 - PTP 820N and PTP 820A Top Figure 24

• PTP 820N and PTP 820A Back Public Material
• May be reproduced only in its original entirety (without revision).

Figure 25

• PTP 850C/PTP 850E TEL Application Locations Public Material
• May be reproduced only in its original entirety (without revision).

8. Non-invasive Security FIPS 140-3 Non-invasive Security requirements are not applicable. Public Material

• May be reproduced only in its original entirety (without revision).

9. Sensitive security parameter management The following table identifies each of the Keys/SSPs associated with the modules: Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number DRBG entropy 256-bit DRBG Generated N/A N/A Plaintext Device power Used for control/ input (CSP) A2758 using temporarily cycle or management plane module in RAM cleared after random bit generation entropy use source DRBG Seed (CSP) 256-bit DRBG Generated N/A N/A Plaintext Device power Seed used for DRBG A2758 using SP temporarily cycle or instantiation and reseed 800-90Ar1 in RAM cleared after DRBG seed use construction DRBG V (CSP) 256-bit DRBG SP 800- N/A N/A Plaintext Device power Used for control/ A2758 90Ar1 DRBG temporarily cycle or management plane Internal in RAM cleared after random bit generation State use DRBG Key (CSP) 256-bit DRBG SP 800- N/A N/A Plaintext Device power Used for control/ A2758 90Ar1 DRBG temporarily cycle or management plane Internal in RAM cleared after random bit generation State use Diffie Hellman 112 and KAS-FFC-SSC N/A N/A Established Plaintext Device power Used for key transport on Shared Secret 128 bits 2048 bits using SP temporarily cycle or the management plane (CSP) and 3072 800- in RAM cleared after using Diffie-Hellman; key bits A2758 56Arev3 use establishment KAS-SSC methodology provides

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number Termination 112 and 128 bits of of protocol encryption strength session EC Diffie 128-bit KAS-ECC- N/A N/A Established Plaintext Device power Used for key transport on Hellman Shared SSC P-256 using SP temporarily cycle or the management plane Secret (CSP) A2758 800- in RAM cleared after using Elliptic Curve Diffie56Arev3 use Hellman; key KAS-SSC Termination establishment of protocol methodology provides session 128 bits of encryption strength Diffie Hellman 112 and KAS-FFC-SSC Generated N/A N/A Plaintext Device power Used for key transport on private key (CSP) 128 bits 2048 bits according to temporarily cycle or the management plane and 3072 SP 800- in RAM cleared after using Diffie-Hellman; key bits A2758; 56Arev3 use establishment DSA A2758 Termination methodology provides of protocol 112 and 128 bits of session encryption strength EC Diffie 128-bit KAS-ECC- Generated N/A N/A Plaintext Device power Used for key transport on Hellman private SSC P-256 according to temporarily cycle or the management plane key (CSP) A2758; SP 800- in RAM cleared after using Elliptic Curve DiffieECDSA 56Arev3 use Hellman; key A2758 Termination establishment of protocol methodology provides session 128 bits of encryption strength Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number Diffie Hellman 112 and KAS-FFC-SSC Generated Output in N/A Plaintext Device power Used for key transport on public key (PSP) 128 bits 2048 and according to plaintext temporarily cycle or the management plane

3072 bits SP 800- in RAM cleared after using Diffie-Hellman; key

A2758; 56Arev3 use establishment DSA A2758 Termination methodology provides of protocol 112 and 128 bits of session encryption strength EC Diffie 128-bit KAS-ECC- Generated Output N/A Plaintext Device power Used for key transport on Hellman public SSC P-256 according to electronically temporarily cycle or the management plane key (PSP) A2758; SP 800- in plaintext in RAM cleared after using Elliptic Curve DiffieECDSA 56Arev3 use Hellman; key A2758 Termination establishment of protocol methodology provides session 128 bits of encryption strength SSH Private Key 112-bit RSA 2048- Generated Entered N/A Plaintext Zeroization Used for control and (CSP) bit A2758 according to electronically persistently command management plane FIPS 186-4 in encrypted in Flash authentication form via approved KTS-2, KTS-3 or KTS-5 SSH Public Key 112-bit RSA 2048- Generated Output N/A Plaintext Zeroization Used for control and (PSP) bit according to electronically persistently command management plane A2758 FIPS 186-4 in plaintext in Flash authentication Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number SSH Session Key 128, 192 AES-CTR N/A N/A Derived Plaintext Device power Used for control and (CSP) or 256- (128, 192, using SP temporarily cycle or management plane bits 256), AES- 800- in RAM cleared after privacy GCM (128, 135rev1 use 256), SSH KDF Termination KDF A2758 of protocol session SSH Integrity Key 160, HMAC, SSH N/A N/A Derived Plaintext Device power Used for message integrity (CSP) 256 or KDF A2758 using SP temporarily cycle check in the control and 512-bits 800- in RAM Termination management plane 135rev1 of protocol KDF session SNMPv3 Shared SNMP KDF N/A Entered N/A Plaintext Zeroization Used for key derivation password (CSP) Secret, at A2757 electronically persistently command within management least eight in encrypted in Flash protocols characters form via approved KTS-2, KTS-3 or KTS-5 SNMPv3 session 128-bit SNMP KDF N/A N/A Derived Plaintext Device power Used for key (CSP) A2757, AES using SP temporarily cycle or encryption/decryption CFB128 800- in RAM cleared after within management A2758 135rev1 use protocols KDF Termination of protocol session Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number SNMPv3 session 160-bit SNMP KDF N/A N/A Derived Plaintext Device power Used for message integrity authentication A2757, using SP temporarily cycle or check within management key (CSP) HMAC 800- in RAM cleared after protocols A2758 135rev1 use KDF Termination of protocol session TLS Private Key 112-bit RSA 2048- Generated N/A N/A Plaintext Zeroization Used for authentication (CSP) bit according to persistently command within management A2758 FIPS 186-4 in Flash protocols TLS Public Key 112-bit RSA 2048- Generated Output N/A Plaintext Zeroization Used for authentication (PSP) bit according to electronically persistently command within management A2758 FIPS 186-4 in plaintext in Flash protocols TLS Pre-Master 384-bit KAS-FFC- N/A N/A Established Plaintext Device power Used for key derivation Secret (CSP) SSC, according to temporarily cycle or within the TLS KAS-ECC- SP 800- in RAM cleared after management protocol SSC A2758 56Arev3 use Termination of protocol session TLS Master 384-bit TLS 1.2 KDF N/A N/A Calculated Plaintext Device power Used for key derivation Secret (CSP) A2758 as an temporarily cycle or within the TLS element of in RAM cleared after management protocol. the TLS 1.2 use Derived from the TLS PreKDF Termination Master Secret of protocol session Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number TLS Session 128 or AES GCM, N/A N/A Derived Plaintext Device power Used for Encryption Key 256- bits AES CBC using SP temporarily cycle or encryption/decryption (CSP) A2758 800- in RAM cleared after within management TLS KDF 135rev1 use protocols A2758 KDF Termination of protocol session TLS Session 160, 256 HMAC SHA- N/A N/A Derived Plaintext Device power Used for message integrity Integrity Key or 384- 1, SHA2- using SP temporarily cycle or check in the control and (CSP) bits 256, SHA2- 800- in RAM cleared after management plane

384 135rev1 use

A2758 KDF Termination TLS KDF of protocol A2758 session IKE session 256-bit AES CBC N/A N/A Derived Plaintext Device power Used for encrypt key A2755, using SP temporarily cycle or encryption/decryption (CSP) IKEv1 KDF 800- in RAM cleared after within IPsec A2756 135rev1 use KDF Termination of protocol session IKE session 256-bit HMAC N/A N/A Derived Plaintext Device power Used for message authentication A2755, using SP temporarily cycle or authentication within key (CSP) IKEv1 KDF 800- in RAM cleared after IPsec A2756 135rev1 use KDF Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number Termination of protocol session ISAKMP Secret, IKEv1 KDF N/A Entered N/A Plaintext Zeroization Used for key derivation preshared (CSP) 32 A2756 electronically temporarily command within IPsec characters in encrypted in RAM form via approved KTS-2, KTS-3 or KTS-5 IPsec encryption 256-bit AES CBC N/A N/A Derived Plaintext Device power Used for key (CSP) 2755, using SP temporarily cycle or encryption/decryption IKEv1 KDF 800- in RAM cleared after within IPsec A2756 135rev1 use KDF Termination of protocol session IPsec 256-bit HMAC, N/A N/A Derived Plaintext Device power Used for message authentication SHA2-256 using SP temporarily cycle or authentication within key (CSP) A2755, 800- in RAM cleared after IPsec IKEv1 KDF 135rev1 use A2756 KDF Termination of protocol session Session key Tx 256-bit AES CTR Generated Electronically N/A Plaintext Device power Used for (CSP) A680 using DRBG entered and temporarily cycle or encryption/decryption or output in in RAM within data plane Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number AES OFB encrypted cleared after

4014 form via use

approved Data plane KTS-1 or KTS- rekey Session key Rx 256-bit AES CTR Generated Electronically N/A Plaintext Device power Used for (CSP) A680 using DRBG entered and temporarily cycle encryption/decryption Or AES OFB output in in RAM Data plane within data plane

4014 encrypted rekey

form via approved KTS-1 or KTSMaster key (CSP) 256-bit AES KW N/A Electronically N/A Plaintext Zeroization Used for session key AES ECB entered via persistently command encryption for session key A2758 KTS-2, KTS-3 in Flash exchange between local or KTS-5 and remote units Crypto Officer 958 N/A N/A Electronically N/A SHA2-512 Zeroization Used for Crypto Officer Password (CSP) entered in hash command login encrypted persistently form via in Flash approved KTS-2, KTS-3 or KTS-5 CO Password SHA2-512 SHA2-512 Generated N/A N/A Persistently Zeroization Used to verify Crypto Hash A2758 upon in Flash command Officer login Cambium Networks Ltd. © 2025 Version Public Material

• May be reproduced only in its original entirety (without revision).

Import/Export Establishment Use & related Security Key/SSP Strength Generation Storage Zeroisation Function and Name/Type keys Cert. Number password creation Table 19

• SSPs Cambium Networks Ltd. © 2025 Version Public Material
• May be reproduced only in its original entirety (without revision).

The module generates symmetric and asymmetric keys in compliance with the requirements of the FIPS 140-3 standard. Specifically, symmetric keys are generated using output of the Approved SP 800-90A DRBG and in compliance with IG D.H. Asymmetric keys are generated as part applicable key generation standards. See Table 19 for additional details.

All keys are entered into or output from the module in a secure manner. Specifically, the Session Keys are output from the module encrypted with an approved KTS using a Master Key with the AES-KW algorithm. Additionally, SSPs provisioned by an operator can be entered using an approved KTS employing AES-GCM or AES and HMAC within the SSH, TLS, or IPsec protocols. See Table 19 for additional details.

SSPs are stored in plaintext in non-volatile and volatile memory. See Table 19 for additional details.

SSPs stored in volatile memory are zeroized automatically when no longer needed. SSPs stored in nonvolatile memory are zeroized after repeated failure of the Pre-Operational Self-Tests or upon hardzeroization command issued. The zeroization will permanently erase SSPs stored in Flash by overwriting with zeroes. When zeroization occurs via power cycle or the zeroization command the module provides an indicator in the console log. When zeroization occurs via session termination the zeroization indicator is provided via session log. For CSPs that are zeroized after use, the indicator is that the service continues. If there is a zeroization error, the service in process will be terminated. See Table 19 for additional details. Entropy Sources Minimum number of bits of Details entropy ENT (P) The entropy source provides 2.79 Ring-oscillator noise source with bits of entropy per 8-bit sample. no conditioning function. To achieve a security strength of Conformant to SP 800-90B and IG

function will require a seed length of at least 138 samples. The DRBG is seeded with 2048 bits (256 samples) of data providing approximately 714 bits of entropy which is sufficient for generating the largest module SSPs of a maximum of 256 bits of security strength. Table 20

• Non-Deterministic Random Number Generation Specification

10. Self-tests Self-tests are health checks that ensure that the cryptographic algorithms within the module are operating correctly. The self-tests identified in FIPS 140-3 broadly fall within two categories:
11. Pre-Operational Self-Tests
12. Conditional Self-Tests When the module is powered on, its power-up self-tests are executed without any operator intervention. CASTs are performed prior to first usage of an algorithm. The operator may run periodic self-tests by power-cycling the module. Conditional tests are performed when a specific condition is met, such as usage of the entropy source or generation of key-pair.

The cryptographic module performs the following Pre-Operational Self-Tests on:

• Firmware Integrity Test: 160-bit Error detection code (EDC)
• Pre-operational Bypass Test

The HW-based entropy source is conditionally tested (when entropy is consumed by any of the FW components). Tests are APT and RCT (mentioned in the SP 800-90B document). The cryptographic module performs the following conditional self-tests:

• Conditional Cryptographic Algorithm Self-Tests:
• Management Security Algorithms Implementation (Firmware) (Cert. #A2758):
• HMAC-SHA2-256 CAST
• SHA-1 CAST
• SHA2-512 CAST
• AES-128 ECB Decrypt CAST
• AES KeyWrap Encrypt CAST
• AES KeyWrap Decrypt CAST
• AES-256 GCM Encrypt CAST
• RSA PKCS#1 Sign/Verify CASTs
• ECDSA Sign/Verify CASTs
• DH Shared Secret Computation CAST
• ECDH Shared Secret Computation CAST
• TLS 1.2 KDF CAST
• TLS 1.3 KDF CAST
• SSH KDF CAST
• DRBG CAST
• IKE KDF Implementation (Firmware) (Cert. #A2756):
• IKE KDF CAST
• SNMP KDF Implementation (Firmware) (Cert. #A2757): Public Material
• May be reproduced only in its original entirety (without revision).

• SNMP KDF CAST
• Linux Kernel Crypto Implementation (Firmware) (Cert. #A2755):
• AES-256 CBC Encrypt CAST
• AES-256 CBC Decrypt CAST
• HMAC-SHA2-256 CAST
• SHA2-256 CAST
• AES Core Implementation (Hardware):
• AES-256 OFB Encrypt CAST (Cert. #AES 4014)
• AES-256 OFB Decrypt CAST (Cert. #AES 4014)
• AES-256 CTR Encrypt CAST (Cert. #A680)
• AES-256 CTR Decrypt CAST (Cert. #A680)
• Entropy Self-tests
• SP 800-90B Repetition Count Test
• SP 800-90B Adaptive Proportion Test
• SP 800-90A Health Tests
• Conditional Pair-wise Consistency Self-Tests:
• Pairwise Consistency Test (PWCT) for RSA
• Pairwise Consistency Test (PWCT) for ECDSA
• Pairwise Consistency Test (PWCT) for DSA
• Conditional software/firmware load test
• Firmware Load Test (RSA 4096/SHA2-256 Signature Verification)
• Conditional Bypass Test

If any of the identified POSTs fail, the module will not enter an operational state and will instead provide an error message “Failed powerOnSelfTest”. If the failure persists after power-cycle, the module will then be placed in a Default State (where all keys/CSPs are zeroized) and the Approved mode enabled flag is reset to disabled. The module will enter the non-approved mode. Event logs will be updated accordingly. If either of the SP 800-90B self-tests fail, the repeated random numbers are discarded, and an error is reported. If the PWCT fails, the key pair is discarded, and an error is reported. If the Firmware Load Test fails, the new firmware is not loaded. If the conditional Bypass self-test fails, the error is reported, and the module does not transition into or out of bypass. During execution of the self-tests, firmware loading, zeroization, and while in an error state, data output is inhibited. 11. Life-cycle assurance This section describes the configuration and administration of the cryptographic module. Public Material

• May be reproduced only in its original entirety (without revision).

When configured as per this section of the Security Policy, the module only runs in the Approved mode of operation, with the exception of the non-Approved Services identified in Table 17. The non-Approved services described may make use of non-compliant cryptographic algorithms or plaintext data transfers. Use of these services is prohibited in an Approved mode of operation. The Crypto Officer is responsible for ensuring that any of the non-Approved Services (Table 17) in Section 4.3 are not used. Once the module is properly configured as outlined below, the non-Approved Services will not be available for use.

The module hardware is shipped in sealed boxes to indicate tamper. Upon delivery, the recipient should inspect the package to verify that there has been no tampering. PTP 820G, PTP 820C, PTP 820S, PTP 820CHP, PTP 850C, and PTP 850E have a fixed configuration with TELs applied at factory. The Crypto Officer must verify at installation time that the TELs are affixed and intact. PTP 820N, and PTP 820A have variable configurations and the CO must verify that they are configured as per one of the approved configurations identified in Section 2.1, Table 2. Moreover, the Crypto Officer must verify at installation time that the TELs are affixed and intact. The tamper evident seals installed as indicated in Section 7 is required for the module to be operated in the Approved mode of operation. Please refer to the figures in Section 7 of this document for the proper placement of TELs.

The CO must follow these steps to place the module in an Approved mode of operation. For the exact CLI command syntax or GUI instructions, please refer to the below referenced sections of the FIPS Security Configuration Guide for precise details. 1. Enable Password Enforcement to enforce password strength.

- Select Quick Configuration > Security > Access Control. - In the Password change for first login field, select Yes. - In the Enforce password strength field, select Yes. 2. Configure failure login attempts for wrong passwords to 3 attempts (default value).

- In the Failure login attempts to block user field, select the number of failed login attempts (3) that will trigger blocking. 3. For radio encryption mode, configure Master Key and enable Payload Encryption.

Public Material

• May be reproduced only in its original entirety (without revision).

4. Enable SNMP v3 (default) and disable SNMPv1 and v2. Add SNMP users as appropriate following the password complexity requirements specified for CO operators in Section 4 above. Ensure that “AES” and “SHA” are selected for the privacy and authentication ciphers, respectively.

- Select Quick Configuration > Security > Protocols. The Quick Configuration Security Protocols page opens (Figure 41). - In the SNMP Admin field, select Enable to enable SNMP - In the V1V2 Blocked field, select Yes to block SNMPv1 and SNMPv2 access so that only SNMPv3 access will be enabled. 5. Disable Telnet

- Select Quick Configuration > Security > Protocols. - In the Telnet Admin field, select Disable. - Click Apply. 6. Disable HTTP and enable HTTPS

- Select Quick Configuration > Security > Protocols. - In the HTTP protocol field, select HTTPS 7. [Optional step] in case of External Protection configuration (relevant for PTP 820G, PTP 820C, PTP 820S, PTP 820C-HP), enable Protection Admin and supply a pre-shared key. - 8.1 Encrypting the Protection Link 8. [Optional step] In case of TCC Redundancy (relevant for PTP 820N, PTP 820A), enable Protection Admin, and make sure TCC Protection switch mode is set to Cold Switch Over Note: Hot Switch Over (HSO) shall not be used in the Approved Mode - Web GUI: Platform > Shelf Management > Main Card Redundancy (In the TCC Protection switch mode field, select Cold Switch Over)

9. Change the default CO password - 3.4 Changing Your Password
10. Enable Approved Admin configuration, i.e., set operation mode to ‘Approved mode’. Public Material – May be reproduced only in its original entirety (without revision).

- 7.1 Enabling ‘Approved Mode’ Once the final step is performed the module will prompt the CO to reboot. Upon successful reboot the module will enter the Approved mode of operation. Once the module has been configured, the Approved mode status can be verified by selecting the Security Summary from the Web EMS main menu. The field for “FIPS Mode Admin” shows “enabled”. - 6 Viewing the Security Parameters

Protocols such as Telnet, RADIUS, TACACS+, HTTP, SNMPv1, and SNMPv2, Syslog, Hot Standby, NTP are not approved for use in the Approved mode and shall remain disabled. When in FIPS 140-3 compliant mode, only the following algorithms are used for SSH and TLS communications.

When in the Approved mode, the module supports only the following symmetric encryption algorithm:

• aes128-ctr
• aes192-ctr
• aes256-ctr
• aes128-gcm@openssh.com
• aes256-gcm@openssh.com The following Message Authentication Code (MAC) algorithm is supported in the Approved mode:
• hmac-sha1 The following key exchange algorithms are supported in the Approved mode:
• ecdh-sha2-nistp256
• ecdh-sha2-nistp384
• ecdh-sha2-nistp521
• diffie-hellman-group14-sha256
• diffie-hellman-group16-sha512
• diffie-hellman-group18-sha512

When in the Approved mode, only the following cipher suites are available for TLSv1.2 communications:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA Public Material
• May be reproduced only in its original entirety (without revision).

When in the Approved mode, only the following cipher suites are available for TLSv1.3 communications:

• TLS_AKE_WITH_AES_256_GCM_SHA384
• TLS_AKE_WITH_AES_128_GCM_SHA256

There are no specific maintenance actions required. 12. Mitigation of other attacks The module does not claim to mitigate any other attacks beyond those specified in FIPS 140-3. Public Material

• May be reproduced only in its original entirety (without revision).