Nuvoton Cryptographic Library 2.0 (reconstructed)

Nuvoton Technology Corporation Nuvoton Cryptographic Library 2.0 Hardware Version 2.1.4 Document Version 1.2 Last update: 2025-04-21 Prepared by: atsec information security corporation

Standard	FIPS 140-3
Overall level	1
Module type	Hardware
Embodiment	Single Chip
Status	Active
Sunset date	4/22/2030
Caveat	None
Vendor	Nuvoton Technology Corporation

Item	Page
Table 1: Security Levels	5
Table 2: Tested Module Identification – Hardware	7
Table 3: Modes List and Description	7
Table 4: Approved Algorithms	9
Table 5: Vendor-Affirmed Algorithms	9
Table 6: Security Function Implementations	12
Table 7: Entropy Certificates	12
Table 8: Entropy Sources	12
Table 9: Ports and Interfaces	14
Table 10: Roles	15
Table 11: Approved Services	20
Table 12: Mechanisms and Actions Required	23
Table 13: Storage Areas	25
Table 14: SSP Input-Output Methods	25
Table 15: SSP Zeroization Methods	25
Table 16: SSP Table 1	27
Table 17: SSP Table 2	28
Table 18: Conditional Self-Tests	30
Table 19: Conditional Periodic Information	32
Table 20: Error States	33
Figure 1: Block Diagram	6
Figure 2: Nuvoton NPCX998HB0BX	7

This document is the non-proprietary FIPS 140-3 Security Policy for Hardware version 2.1.4 of the Nuvoton Cryptographic Library 2.0. It has a one-to-one mapping to the [SP 800-140Br1] starting with section B.2.1 named “General” that maps to section 1 in this document and ending with section B.2.12 named “Mitigation of other attacks” that maps to section 12 in this document. This document also contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for a Security Level 1 module.

Table 1 describes the individual security areas of FIPS 140-3, as well as the Security Levels of those individual areas: Section Title Security Level

Purpose and Use: The Nuvoton Cryptographic Library 2.0 cryptographic module (hereafter referred to as “the module”) is a Hardware Single Chip cryptographic module. More specifically, the module is considered a sub-chip cryptographic subsystem as defined in IG 2.3.B. Module Type: Hardware Module Embodiment: SingleChip Cryptographic Boundary: The block diagram below shows the cryptographic boundary of the module, and its interfaces with the operational environment. The cryptographic boundary encompasses the entire physical chip. Figure 1: Block Diagram Tested Operational Environment’s Physical Perimeter (TOEPP): The red outline in Figure 1 above indicates the Tested Operational Environment’s Physical Perimeter (TOEPP). © 2025 Nuvoton Technology Corporation / atsec information security.

Figure 2: Nuvoton NPCX998HB0BX Figure 2 shows a picture of the NPCX998HB0BX (e.g., EC) in which the sub-chip module is embedded.

Tested Module Identification

Hardware: Model and/or Part Number Hardware Firmware Processors Features Version Version Notebook Embedded Controller (EC) 2.1.4 N/A Nuvoton NPCX998HB0BX N/A Table 2: Tested Module Identification

Hardware

There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.

Modes List and Description: The module supports approved services in the approved mode of operation. There are no non-approved services supported by the module. Mode Name Description Type Status Indicator Approved Mode Only approved algorithms are used Approved 1 Table 3: Modes List and Description

Approved Algorithms: The table below lists all security functions of the module, including specific key strengths employed for approved services, and implemented modes of operation. Algorithm CAVP Cert Properties Reference AES-CBC A2825 Direction - Decrypt, Encrypt SP 800-38A Key Length - 128, 192, 256 © 2025 Nuvoton Technology Corporation / atsec information security.

Algorithm CAVP Cert Properties Reference AES-CCM A2825 Key Length - 128, 192, 256 SP 800-38C AES-CFB128 A2825 Direction - Decrypt, Encrypt SP 800-38A Key Length - 128, 192, 256 AES-CMAC A2825 Direction - Generation, Verification SP 800-38B Key Length - 128, 192, 256 AES-CTR A2825 Direction - Decrypt, Encrypt SP 800-38A Key Length - 128, 192, 256 AES-ECB A2825 Direction - Decrypt, Encrypt SP 800-38A Key Length - 128, 192, 256 AES-GCM A2825 Direction - Decrypt, Encrypt SP 800-38D IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 192, 256 AES-GMAC A2825 Direction - Decrypt, Encrypt SP 800-38D IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 192, 256 AES-OFB A2825 Direction - Decrypt, Encrypt SP 800-38A Key Length - 128, 192, 256 ECDSA KeyGen A2825 Curve - P-256, P-384, P-521 FIPS 186-4 (FIPS186-4) ECDSA KeyVer A2825 Curve - P-256, P-384, P-521 FIPS 186-4 (FIPS186-4) ECDSA SigGen A2825 Component - No, Yes FIPS 186-4 (FIPS186-4) Curve - P-256, P-384, P-521 ECDSA SigVer (FIPS186- A2825 Component - No FIPS 186-4 4) Curve - P-256, P-384, P-521 Hash DRBG A2825 Prediction Resistance - No, Yes SP 800-90A Rev. Mode - SHA2-512 1 HMAC-SHA2-256 A2825 Key Length - Key Length: 256-512 Increment 8 FIPS 198-1 HMAC-SHA2-384 A2825 Key Length - Key Length: 256-512 Increment 8 FIPS 198-1 HMAC-SHA2-512 A2825 Key Length - Key Length: 256-512 Increment 8 FIPS 198-1 © 2025 Nuvoton Technology Corporation / atsec information security.

Algorithm CAVP Cert Properties Reference KAS-ECC-SSC Sp800- A2825 Domain Parameter Generation Methods - P-256, P- SP 800-56A Rev. 56Ar3 384, P-521 3 Scheme ephemeralUnified KAS Role - initiator, responder KTS-IFC A2825 Modulo - 2048, 3072 SP 800-56B Rev. Key Generation Methods - rsakpg2-basic 2 Scheme KTS-OAEP-basic KAS Role - initiator, responder Key Length - 1024 RSA SigGen (FIPS186-4) A2825 Signature Type - PKCS 1.5, PKCSPSS FIPS 186-4 Modulo - 2048, 3072 RSA SigVer (FIPS186-4) A2825 Signature Type - PKCS 1.5, PKCSPSS FIPS 186-4 Modulo - 2048, 3072 SHA2-256 A2825 - FIPS 180-4 SHA2-384 A2825 - FIPS 180-4 SHA2-512 A2825 - FIPS 180-4 Table 4: Approved Algorithms Vendor-Affirmed Algorithms Name Properties Implementation Reference CKG Type:Asymmetric N/A CKG for asymmetric keys as per SP 800-133Rev2 (ECDSA/ECDH) Curves:P-256, P-384, section 4 example 1 with no post processing on the U P-521 value Table 5: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: N/A for this module. © 2025 Nuvoton Technology Corporation / atsec information security.

Name Type Description Properties Algorithms AES-CBC BC-UnAuth AES Encryption and Key Size:128, 192, 256 AES-CBC AES Decryption bits Key Strength:128, 192,

AES-CCM BC-Auth Authenticated AES Key Size:128, 192, 256 AES-CCM Encryption and AES bits Decryption Key Strength:128, 192,

AES-CFB128 BC-UnAuth AES Encryption and Key Size:128, 192, 256 AES-CFB128 AES Decryption bits Key Strength:128, 192,

AES-CMAC MAC CMAC Message Key Size:128, 192, 256 AES-CMAC Authentication Code bits Generation and CMAC Message Authentication Code Verification AES-CTR BC-UnAuth AES Encryption and Key Size:128, 192, 256 AES-CTR AES Decryption bits Key Strength:128, 192,

AES-ECB BC-UnAuth AES Encryption and Key Size:128, 192, 256 AES-ECB AES Decryption bits Key Strength:128, 192,

AES-GCM BC-Auth Authenticated AES Key Size:128, 192, 256 AES-GCM Encryption and AES bits Decryption Key Strength:128, 192,

AES-GMAC MAC GMAC Message Key Size:128, 192, 256 AES-GMAC Authentication Code bits Generation and Key Strength:128, 192, GMAC Message 256 bits Authentication Code Verification AES-OFB BC-UnAuth AES Encryption and Key Size:128, 192, 256 AES-OFB AES Decryption bits Key Strength:128, 192,

Name Type Description Properties Algorithms HMAC MAC HMAC Message Key Size:256, 384, 512 HMAC-SHA2-256 Authentication Code bits HMAC-SHA2-384 Generation Key Strength:256, 384, HMAC-SHA2-512

RSA SigGen DigSig-SigGen RSA Signature Signature Types:PKCS#1 RSA SigGen Generation v1.5, RSA-PSS (FIPS186-4) Message Digest:SHA2256, SHA2-384, SHA2Modulus Size:2048, 3072 RSA SigVer DigSig-SigVer RSA Signature Signature Types:PKCS#1 RSA SigVer Verification v1.5, RSA-PSS (FIPS186-4) Message Digest:SHA2256, SHA2-384, SHA2Modulus Size:2048, 3072 KTS-IFC (Wrap) KTS-Wrap RSA Key Transport Scheme:KTS-OAEP-basic KTS-IFC (key wrapping) Modulus Size:2048, 3072 KTS-IFC (Unwrap) KTS-Wrap RSA Key Transport Scheme:KTS-OAEP-basic KTS-IFC (key unwrapping) Modulus Size:2048, 3072 ECDSA KeyGen AsymKeyPair- ECDSA Key Generation Method:B.4.2 ECDSA KeyGen KeyGen Generation Testing Candidates (FIPS186-4) Curves:P-256, P-384, PECDSA KeyVer AsymKeyPair- ECDSA Key Curves:P-256, P-384, P- ECDSA KeyVer KeyVer Verification 521 (FIPS186-4) ECDSA SigGen DigSig-SigGen ECDSA Signature Message Digest:SHA2- ECDSA SigGen Generation 256, SHA2-384, SHA2- (FIPS186-4) Curves:P-256, P-384, PECDSA SigVer DigSig-SigVer ECDSA Signature Message Digest:SHA2- ECDSA SigVer Verification 256, SHA2-384, SHA2- (FIPS186-4) Curves:P-256, P-384, PECDSA SigGen DigSig-SigGen ECDSA Signature Curves:P-256, P-384, P- ECDSA SigGen Component Generation 521 (FIPS186-4) Component © 2025 Nuvoton Technology Corporation / atsec information security.

Name Type Description Properties Algorithms SHS SHA Message Digest SHA2-256 Generation SHA2-384 SHA2-512 KAS-ECC-SSC KAS-SSC EC Diffie-Hellman Scheme:ephemeralUnified KAS-ECC-SSC Shared Secret Curves:P-256, P-384, P- Sp800-56Ar3 Computation 521 Hash_DRBG DRBG Random Number Mode:SHA2-512 Hash DRBG Generation Table 6: Security Function Implementations

The module’s AES-GCM implementation conforms to IG C.H scenario 2. The module uses the approved Hash_DRBG to generate the IV with a length of 96-bits. The entropy source producing the DRBG seed is located inside the module’s cryptographic boundary. Steps to comply with the SP800-56Brev2 assurances can be found in section 11.3 Non-Administrator Guidance. Compliance to FIPS 186-5 is met using FIPS 186-4 CAVP certs as allowed by additional comment 2 of IG C.K.

The module employs a Hash_DRBG using a SHA-512 PRF. Per section 10.1.1.1 of [SP800-90A], the internal state of the Hash_DRBG is the V, C, and reseed counter. The Hash_DRBG is seeded by the physical entropy source which provides 256-bits of entropy to seed and reseed the DRBG during initialization and reseeding. The estimated amount of entropy per entropy output bit is ~0.6/bit. The DRBG internal state is not accessible by non-DRBG functions. All random values used by approved security functions, SSP generation, or SSP establishment method are provided by the Hash_DRBG. Cert Vendor Number Name E114 Nuvoton Table 7: Entropy Certificates Name Type Operational Sample Entropy Conditioning Component Environment Size per Sample Nuvoton Physical NPCX998HB0BX 1 bit 0.6 bits The entropy pool is filled with random bits provided NTCES02 by an SP800-90B compliant entropy source whose noise source is from Ring Oscillators in hardware TRNG. Table 8: Entropy Sources © 2025 Nuvoton Technology Corporation / atsec information security.

The module generates Keys and SSPs in accordance with FIPS 140-3 IG D.H. The cryptographic module performs Cryptographic Key Generation (CKG) for asymmetric keys as per [SP800-133rev2] (vendor affirmed), compliant with [FIPS186-4] and using DRBG compliant with [SP800-90Arev1]. A seed (i.e., the random value) used in asymmetric key generation is obtained from [SP800-90Arev1] DRBG as described in Section 4 of [SP800-133rev2]. The key generation service for ECDSA, as well as the [SP 800-90Arev1] DRBG have been ACVT tested with algorithm certificates found in Table 3.

The module provides the following key/SSP establishment services:

The module implements KAS-ECC-SSC EC Diffie-Hellman Shared Secret Computation compliant to [SP80056Arev3] and IG D.F Scenario (2) path (1). o The shared secret computation provides between 128 and 256 bits of encryption strength.

Within the TOEPP, the module offers RSA key wrapping and unwrapping using KTS-OAEP-basic scheme. The implementation supports 2048 and 3072 modulus size, with both key encapsulation and un-encapsulation supported. The module does not implement key confirmation. See section 11.3 Non-Administrator Guidance. The SSP establishment methodology provides 112 or 128 bits of encryption strength.

The underlying logical interfaces of the module are the module’s C language Application Programming Interfaces (APIs). All data input and data output, status ports and control ports are directed through the interface of the module’s logical component, which are the APIs while the physical interface is considered the I/O ports of the sub-chip module through which the data input and data output, status output and control input traverse. Physical Logical Data That Passes Port Interface(s) I/O Ports Data Input Data inputs are provided in the variables passed in the API and callable service invocations, generally through caller-supplied buffers. I/O Ports Data Output Data outputs are provided in the variables passed in the API and callable service invocations, generally through caller-supplied buffers. I/O Ports Control Control inputs which control the operation of the module are provided through dedicated Input parameters. I/O Ports Status Status output is provided in return codes and through messages. Documentation for each Output API lists possible return codes. A complete list of all return codes returned by the C language APIs within the module is provided in the header files and the API documentation. Messages are documented also in the API documentation. Power Power Power interface is provided internally by TEOPP in which the cryptographic module is Port embedded. Table 9: Ports and Interfaces The module does not implement a Control Output Interface.

The module does not transmit unprotected SSPs over any of its interfaces. All authentication data is transmitted between the module and the other endpoints in protected manner on both the contact and contactless interfaces.

FIPS 140-3 does not require authentication mechanism for level 1 modules. Therefore, the module does not implement an authentication mechanism. N/A for this module.

The module supports two authorized roles: A Crypto Officer Role and a User Role. No support is provided for a Maintenance operator. The module does not implement a bypass mode nor concurrent operators. Name Type Operator Type Authentication Methods Crypto Officer Role CO None User Role User None Table 10: Roles When a device is delivered, the Crypto Officer is responsible for initializing the module i.e., configure the device by properly setting up key registers for storage of keys/CSPs. The Crypto Officer is implicitly assumed. The User can perform services from Table 5 and 5a only after the Crypto Officer takes possession by initializing it, thus creating data to be protected is generated. The Users of the module are software applications that implicitly assume the User Role when requesting any cryptographic services provided by the module.

The module only implements Approved security functions in an Approved mode. The Table 5 below lists services available. The module provides an approved service indicator by receiving a return code of “NCL_STATUS_OK to indicate that the service executed an approved security function. NOTE: The module does not implement any non-Approved Algorithms in the Approved Mode of Operation (neither with nor without security claim). The module does not implement any non-approved security functions. The abbreviations of the access rights to keys and SSPs have the following interpretation: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Name Description Indicator Inputs Outputs Security SSP Access Functions AES Encryption Data Encryption NCL AES key cipher text AES-CBC User STATUS and plain AES-CCM - AES key: W,E OK text AES-CFB128 AES-CTR © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Indicator Inputs Outputs Security SSP Access Functions AES-ECB AES-GCM AES-OFB AES Decryption AES Decryption NCL AES key plain text AES-CBC User STATUS and cipher AES-CCM - AES key: W,E OK text AES-CFB128 AES-CTR AES-ECB AES-GCM AES-OFB CMAC Message NCL AES key MAC AES-CMAC User Message Authentication STATUS and - AES key: W,E Authentication Code OK message Code Generation Generation CMAC Message NCL MAC and “VALID” or AES-CMAC User Message Authentication STATUS Message “INVALID” - AES key: W,E Authentication Code OK Code Verification Verification GMAC Message NCL AES key, authentication tag AES-GMAC User Message Authentication STATUS AAD - AES key: W,E Authentication Code OK Code Generation Generation GMAC Message NCL AES key, “PASS” or “FAIL” AES-GMAC User Message Authentication STATUS AAD, IV, tag - AES key: W,E Authentication Code OK Code Verification Verification HMAC Message NCL HMAC key MAC HMAC User Message Authentication STATUS and - HMAC Key: Authentication Code OK message W,E Code Generation Generation Message Digest SHS Message NCL message digest (hash SHS User Generation Digest STATUS value) Generation OK RSA Key Key Wrapping NCL RSA public encrypted key KTS-IFC User Transport (key using KTS- STATUS key and key (Wrap) - RSA KTS wrapping) OAEP-basic OK public key: W,E © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Indicator Inputs Outputs Security SSP Access Functions to be wrapped RSA Key Key Un- NCL RSA private plaintext key KTS-IFC User Transport (key wrapping using STATUS key and key (Unwrap) - RSA KTS unwrapping) KTS-OAEP- OK to be un- private key: basic wrapped W,E RSA Digital Digital Signature NCL RSA private signature RSA SigGen User Signature Generation STATUS key and Hash_DRBG - RSA Sig Generation OK message private key: W,E RSA Digital Digital Signature NCL RSA public True or False RSA SigGen User Signature Verification STATUS key and - RSA Sig Verification OK signature public key: W,E ECDSA Digital Digital Signature NCL ECDSA signature ECDSA User Signature Generation STATUS private key SigGen - ECDSA Generation OK and Hash_DRBG private key: message W,E ECDSA Digital Digital Signature NCL ECDSA signature ECDSA User Signature Generation STATUS private key SigGen - ECDSA Generation Component OK and Component private key: Component message Hash_DRBG W,E digest ECDSA Digital Digital Signature NCL ECDSA True or False ECDSA User Signature Verification STATUS public key SigVer - ECDSA public Verification OK and key: W,E signature ECDSA Key Asymmetric Key NCL Curve size generated private ECDSA User Generation Pair Generation STATUS and public key KeyGen - ECDSA OK pair Hash_DRBG private key: G,R - ECDSA public key: G,R ECDSA Key Asymmetric NCL Public Key True or False ECDSA User Verification Public Key STATUS KeyVer - ECDSA public Verification OK key: W,E - ECDH public key (including intermediate key generation values): W,E © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Indicator Inputs Outputs Security SSP Access Functions EC Diffie- Shared Secret NCL received shared secret KAS-ECC- User Hellman Shared Computation STATUS public key SSC - ECDH public Secret using Elliptic OK and key (including Computation Curve possessed intermediate Cryptography private key key generation values): W,E - ECDH private key (including intermediate key generation values): E - ECC Shared Secret: G,R Random Deterministic NCL Seed random numbers Hash_DRBG User Number Random STATUS - Entropy Input Generation Number OK String + Nonce: Generation W - DRBG internal state (i.e., Hash_DRB G V and C values), Seed: G Module Version Outputs Module N/A None Module Name + None User Info Name + Version Module Version Number Number SSP Zeroisation zeroizes crypto N/A handle of zeroized and None User function context crypto released memory - AES key: Z and releases function space - RSA KTS memory space context private key: Z - RSA KTS public key: Z - RSA Sig private key: Z - RSA Sig public key: Z - ECDSA private key: Z - ECDSA public key: Z - HMAC Key: Z - ECDH private key (including intermediate key generation © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Indicator Inputs Outputs Security SSP Access Functions values): Z - ECDH public key (including intermediate key generation values): Z - ECC Shared Secret: Z - Entropy Input String + Nonce: Z - DRBG internal state (i.e., Hash_DRB G V and C values), Seed: Z Show-Status Outputs N/A None Operational/Error None User Operational/ status Error status of the module Self-test Executes on- NCL None Pass/Fail status AES-CBC User demand self-test STATUS AES-CCM - HMAC Key: E and outputs OK HMAC - AES key: E Pass/Fail status RSA SigGen - RSA KTS RSA SigVer private key: E KTS-IFC - RSA KTS (Wrap) public key: E KTS-IFC - RSA Sig (Unwrap) private key: E ECDSA - RSA Sig SigGen public key: E ECDSA - ECDSA SigVer private key: E SHS - ECDSA public KAS-ECC- key: E SSC - ECDH private Hash_DRBG key (including intermediate key generation values): E - ECDH public key (including intermediate key generation values): E - DRBG © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Indicator Inputs Outputs Security SSP Access Functions internal state (i.e., Hash_DRB G V and C values), Seed: E Table 11: Approved Services

The module’s executable code is programmed in a masked ROM which is a type of Read-Only Memory (ROM) where content is programmed by the integrated circuit manufacturer during the silicon manufacturing (rather than by the Operator of the module). The memory technology is non reconfigurable memory as defined in IG 5.A, which will not have any change or degradation of data for a minimum of 10 years after manufactured date. As such, it is considered a hardware only module with a non-modifiable operational environment. The requirements of this area are not applicable to the module.

The Nuvoton Cryptographic Library 2.0 operates in a non-modifiable operational environment. The module is programmed by the manufacturer during the silicon manufacturing (rather than by the user). It maintains its own memory region which can only be accessed by the module. There is no additional application present within the operating environment. The module does not spawn any cryptographic processes. Type of Operational Environment: Non-Modifiable © 2025 Nuvoton Technology Corporation / atsec information security.

The Nuvoton Cryptographic Library 2.0 cryptographic module is a Hardware cryptographic module in a single chip embodiment. More specifically, the module is considered a sub-chip cryptographic subsystem. The module consists of production-grade components that include standard passivation techniques (e.g., a conformal coating applied over the module’s circuitry to protect against environmental or other physical damage). The module does not implement a maintenance role and has no maintenance access interface. Mechanism Inspection Frequency Inspection Guidance Hard tamper-evident Determined by the Observe the coating surrounding the chip for any signs of coating operator damage Table 12: Mechanisms and Actions Required © 2025 Nuvoton Technology Corporation / atsec information security.

Currently, the non-invasive security is not required by FIPS 140-3 (see NIST SP 800-140F). The requirements of this area are not applicable to the module. © 2025 Nuvoton Technology Corporation / atsec information security.

The module does not provide persistent storage for keys/SSPs. Keys/SSPs are stored in memory only and are received for use by the module only at the request of the User firmware. Storage Description Persistence Area Type Name RAM Stored in volatile memory Dynamic Table 13: Storage Areas

Keys/SSPs entered or output the module are electronically entered in plaintext form from the invoking User firmware running on the same device. No Keys/SSPs are entered or output from the module to outside the TOEPP. According to IG 2.3.B, Transferring SSPs including the entropy input between a sub-chip cryptographic subsystem and an intervening functional subsystem for Security Levels 1 and 2 on the same single chip is considered as not having Sensitive Security Parameter Establishment crossing the HMI of the sub-chip module per IG 9.5.A. Name From To Format Distribution Entry SFI or Type Type Type Algorithm API input Within the TOEPP RAM Plaintext Automated Electronic API output RAM Within the TOEPP Plaintext Automated Electronic Table 14: SSP Input-Output Methods

Keys and SSPs are explicitly zeroized automatically when structure associated with the cipher is deallocated or implicitly when the device is powered down thereby rendering the data irretrievable. Interface with the module is inhibited while zeroization is being performed. For Keys and SSPs explicitly zeroized automatically the successful completion of a requested service suffices as the implicit indicator that zeroisation has completed. Zeroization Description Rationale Operator Initiation Method Module Reset Power cycles the module All SSPs in RAM are cleared Initiated by operator after power reset Deallocate Automatic zeroization when structure Wipes the SSP's contents in Automatically by the Structure is deallocated memory module Table 15: SSP Zeroization Methods © 2025 Nuvoton Technology Corporation / atsec information security.

The following summarizes the keys and Sensitive Security Parameters (SSPs) that are used by the cryptographic services implemented in the module. Modification of PSPs by unauthorized operators is prohibited. Name Description Size - Type - Generated Established Used By Strength Category By By AES key AES Symmetric key 128, 192, Symmetric - AES-CBC used in Data 256 bits - CSP AES-CCM Encryption, Data 128, 192, AESDecryption and 256 bits CFB128 Message AES-CMAC Authentication Code AES-CTR Generation and AES-ECB verification AES-GCM AES-GMAC RSA KTS Key Wrapping and Un- 2048, 3072 Asymmetric KTS-IFC private key wrapping bits - 112 to key pair - (Wrap)

(Unwrap) RSA KTS public Key Wrapping and Un- 2048, 3072 Asymmetric KTS-IFC key wrapping bits - 112 to key pair - (Wrap)

(Unwrap) RSA Sig private Signature Generation 2048, 3072 Asymmetric RSA SigGen key and Verification bits - 112 key pair - RSA SigVer to 128 bits CSP RSA Sig public Signature Generation 2048, 3072 Asymmetric RSA SigGen key and Verification bits - 112 key pair - RSA SigVer to 128 bits PSP ECDSA private Key Verification, P-256, P- Asymmetric ECDSA ECDSA key Signature Generation 384, P-521 key pair - KeyGen SigGen and Verification curves - CSP Hash_DRBG ECDSA

bits ECDSA public Key Verification, P-256, P- Asymmetric ECDSA ECDSA key Signature Generation 384, P-521 key pair - KeyGen KeyVer and Verification curves - PSP Hash_DRBG ECDSA

Name Description Size - Type - Generated Established Used By Strength Category By By

greater ECDH private ECDH Shared Secret P-256, P- Asymmetric ECDSA KAS-ECCkey (including Computation 384, P-521 key pair - KeyGen SSC intermediate curves - CSP Hash_DRBG key generation 112 to 256values) bits ECDH public ECDH Shared Secret P-256, P- Asymmetric ECDSA ECDSA key (including Computation 384, P-521 key pair - KeyGen KeyVer intermediate curves - PSP Hash_DRBG KAS-ECCkey generation 112 to 256- SSC values) bits ECC Shared ECDH Shared Secret 112 to 256- Asymmetric KAS-ECCSecret Computation bits - 112 to shared SSC 256-bits secret - CSP Entropy Input Seed DRBG 256-bits - DRBG - CSP Hash_DRBG String + Nonce 256-bits DRBG internal Maintaining DRBG 256-bits - DRBG - CSP Hash_DRBG state (i.e., internal state 256-bits Hash_DRB G V and C values), Seed Table 16: SSP Table 1 Name Input - Storage Storage Zeroization Related SSPs Output Duration AES key API RAM:Plaintext Until deallocated Module Reset input or on module Deallocate reset Structure RSA KTS private key API RAM:Plaintext Until deallocated Module Reset RSA KTS public key:Paired input or on module Deallocate With reset Structure RSA KTS public key API RAM:Plaintext Until deallocated Module Reset RSA KTS private key:Paired input or on module Deallocate With reset Structure RSA Sig private key API RAM:Plaintext Until deallocated Module Reset RSA Sig public key:Paired input or on module Deallocate With reset Structure © 2025 Nuvoton Technology Corporation / atsec information security.

Name Input - Storage Storage Zeroization Related SSPs Output Duration RSA Sig public key API RAM:Plaintext Until deallocated Module Reset RSA Sig private key:Paired input or on module Deallocate With reset Structure ECDSA private key API RAM:Plaintext Until deallocated Module Reset DRBG internal state (i.e., input or on module Deallocate Hash_DRB G V and C API reset Structure values), Seed:Derived From output ECDSA public key:Paired With ECDSA public key API RAM:Plaintext Until deallocated Module Reset DRBG internal state (i.e., input or on module Deallocate Hash_DRB G V and C API reset Structure values), Seed:Derived From output ECDSA private key:Paired With HMAC Key API RAM:Plaintext Until deallocated Module Reset input or on module Deallocate reset Structure ECDH private key API RAM:Plaintext Until deallocated Module Reset DRBG internal state (i.e., (including intermediate input or on module Deallocate Hash_DRB G V and C key generation values) API reset Structure values), Seed:Derived From output ECDH public key (including intermediate key generation values):Paired With ECDH public key API RAM:Plaintext Until deallocated Module Reset DRBG internal state (i.e., (including intermediate input or on module Deallocate Hash_DRB G V and C key generation values) API reset Structure values), Seed:Derived From output ECDH private key (including intermediate key generation values):Paired With ECC Shared Secret API RAM:Plaintext Until deallocated Module Reset output or on module Deallocate reset Structure Entropy Input String + RAM:Plaintext Until deallocated Module Reset Nonce or on module Deallocate reset Structure DRBG internal state RAM:Plaintext Until deallocated Module Reset Entropy Input String + (i.e., Hash_DRB G V or on module Deallocate Nonce:Derived From and C values), Seed reset Structure Table 17: SSP Table 2 © 2025 Nuvoton Technology Corporation / atsec information security.

Self-tests ensure that the module is not corrupted and that the cryptographic algorithms work as expected. While the module is executing the self-test, no services are not available, and input and output are inhibited. The module will boot only after successfully passing the HMAC-SHA2-512 and SHA2-256 CASTs. If an error is detected in any self-test, the module will enter the Error State. N/A for this module. The module is solely implemented in hardware (i.e., only contains executable code that is stored in non- reconfigurable masked ROM1). As such, the module does not perform any pre-operational software/firmware integrity test, but instead performs a Cryptographic Algorithm Self-Test on the HMAC-SHA2-512 and SHA2-256 algorithms when the module is powered on. The module does not implement a pre-operational bypass test nor pre-operational critical functions test.

The module conducts conditional cryptographic algorithm self-test prior to the first operational use of each cryptographic algorithm. The table below describe the conditional tests supported by the module. Algorithm or Test Properties Test Test Indicator Details Conditions Test Method Type HMAC-SHA2- HMAC-SHA2-512 MAC KAT CAST NCL MAC Generation Performed when

512 (A2825) Generation KAT STATUS the module is

OK powered on SHA2-256 SHA2-256 Message Digest KAT CAST NCL Message Digest Performed when (A2825) KAT STATUS the module is OK powered on AES-CCM AES-CCM Encryption KAT KAT CAST NCL AES Encryption Prior to the first (A2825) using 128-bit key STATUS operational use OK of the algorithm AES-CBC AES-CBC Decryption KAT KAT CAST NCL AES Decryption Prior to the first (A2825) using 128-bit key STATUS operational use OK of the algorithm RSA SigGen Signature Generation KAT KAT CAST NCL RSA Signature Prior to the first (FIPS186-4) with 2048-bit key and SHA2- STATUS Generation operational use (A2825) 256 OK of the algorithm

1 A masked ROM is a type of Read-Only Memory (ROM) where content is programmed by the integrated circuit manufacturer during the silicon

Algorithm or Test Properties Test Test Indicator Details Conditions Test Method Type RSA SigVer PKCS#1 v1.5 Signature KAT CAST NCL RSA Signature Prior to the first (FIPS186-4) Verification KAT with 2048 -bit STATUS Verification operational use (A2825) key and SHA2-256 PKCS#1 OK of the algorithm v1.5 KTS-IFC KTS-OAEP-basic KAT CAST NCL KTS-OAEP- Prior to the first (A2825) Encryption/Decryption KAT STATUS basic Encryption operational use with 2048 -bit key and SHA2- OK and Decryption of the algorithm ECDSA Pairwise consistency test PCT PCT NCL Pairwise Performed upon KeyGen STATUS consistency test generation of a (FIPS186-4) OK new ECDSA key (A2825) pair ECDSA ECDSA Signature Generation KAT CAST NCL ECDSA Prior to the first SigGen KAT with P-256 curve and STATUS Signature operational use (FIPS186-4) SHA2-256 OK Generation of the algorithm (A2825) ECDSA ECDSA Signature Verification KAT CAST NCL ECDSA Prior to the first SigVer KAT with P-256 curve and STATUS Signature operational use (FIPS186-4) SHA2-256 OK Verification of the algorithm (A2825) KAS-ECC- ECDH shared secret KAT CAST NCL ECDH shared Prior to the first SSC Sp800- computation KAT with P-256 STATUS secret operational use 56Ar3 curve OK computation of the algorithm (A2825) Hash DRBG Hash_DRBG random number KAT CAST NCL Hash_DRBG Prior to the first (A2825) generation KAT using STATUS random number operational use predefined data. OK generation of the algorithm ENT RCT (Repetition Count Test) RCT CAST NCL Continuous Performed when STATUS Health Test the module is OK powered on ENT APT (Adaptive Proportion APT CAST NCL Continuous Performed when Test) STATUS Health Test the module is OK powered on Table 18: Conditional Self-Tests The module does not implement a Software/Firmware Load Test, Manual Entry Test, Conditional Bypass Test nor Conditional Critical Functions Test. © 2025 Nuvoton Technology Corporation / atsec information security.

During runtime, operators can initiate the conditional self-tests on demand by calling NCL_MISC_SelfTest and passing the algorithm as an argument. The module’s entropy source is powered on only momentarily to seed the module’s SP800-90B DRBG. The module performs ENT health tests defined in Section 4 of SP800-90B on the generated output prior to seeding the SP800-90B DRBG. After completing its execution, the entropy source powers down. N/A for this module. Algorithm or Test Test Method Test Type Period Periodic Method HMAC-SHA2-512 KAT CAST On demand By calling (A2825) NCL_MISC_SelfTest and passing the algorithm as an argument SHA2-256 (A2825) KAT CAST On demand By calling NCL_MISC_SelfTest and passing the algorithm as an argument AES-CCM (A2825) KAT CAST On demand By calling NCL_MISC_SelfTest and passing the algorithm as an argument AES-CBC (A2825) KAT CAST On demand By calling NCL_MISC_SelfTest and passing the algorithm as an argument RSA SigGen KAT CAST On demand By calling (FIPS186-4) (A2825) NCL_MISC_SelfTest and passing the algorithm as an argument RSA SigVer KAT CAST On demand By calling (FIPS186-4) (A2825) NCL_MISC_SelfTest and passing the algorithm as an argument KTS-IFC (A2825) KAT CAST On demand By calling NCL_MISC_SelfTest and passing the © 2025 Nuvoton Technology Corporation / atsec information security.

Algorithm or Test Test Method Test Type Period Periodic Method algorithm as an argument ECDSA KeyGen PCT PCT N/A N/A (FIPS186-4) (A2825) ECDSA SigGen KAT CAST On demand By calling (FIPS186-4) (A2825) NCL_MISC_SelfTest and passing the algorithm as an argument ECDSA SigVer KAT CAST On demand By calling (FIPS186-4) (A2825) NCL_MISC_SelfTest and passing the algorithm as an argument KAS-ECC-SSC KAT CAST On demand By calling Sp800-56Ar3 NCL_MISC_SelfTest (A2825) and passing the algorithm as an argument Hash DRBG (A2825) KAT CAST On demand By calling NCL_MISC_SelfTest and passing the algorithm as an argument ENT RCT CAST On demand Powering the chip off and on ENT APT CAST On demand Powering the chip off and on Table 19: Conditional Periodic Information

For any of the conditional self-tests, the module enters an error state upon failing the self-test. A failure in the conditional CAST or conditional PCT results in “NCL_STATUS_FAIL”. Likewise, a failure of the ENT health tests will result in an “ENTROPY_SRC_ERROR” status returned to the user. When in the error state, no cryptographic services are provided, control and data output is prohibited. The only method to clear this error state is to power cycle the device and then successfully pass the conditional self-tests. Name Description Conditions Recovery Method Indicator NCL_STATUS_FAIL When in this error Failure in The only method to NCL_STATUS_FAIL state, no conditional self- clear this error state cryptographic test (conditional is to power cycle the © 2025 Nuvoton Technology Corporation / atsec information security.

Name Description Conditions Recovery Method Indicator services are CAST or device and then provided, control conditional successfully pass and data output is PCT) the conditional selfprohibited. tests. ENTROPY_SRC_ERROR When in this error Failure of the The only method to ENTROPY_SRC_ERROR state, no ENT health test clear this error state cryptographic is to power cycle the services are device and then provided, control successfully pass and data output is the conditional selfprohibited. tests. Table 20: Error States © 2025 Nuvoton Technology Corporation / atsec information security.

As explained in Section 10.1 Pre-Operational Self-Tests, the module is placed in a masked ROM by manufacturer during the silicon manufacturing. The module is delivered as part of the Nuvoton NPCX998HB0BX platform (listed in Table 2). During manufacturing

each chip is tested to make sure the masked ROM was manufactured correctly; this is done using CRC32 algorithm on the entire masked ROM code on each device before it is shipped out. During execution

As part of the device boot process, the code is verified by a dedicated hardware inside the chip that checks every byte of code compared to a known parity bit. If any byte fails, the parity test then an internal error is generated; the error is handled by the application (User) firmware.

The module is configured to be operational by default. If the device starts up successfully and has successfully passed the HMAC-SHA2-512 and SHA2-256 CAST, it is operating correctly and can begin servicing User requests.

The entity using the IUT must obtain required assurances listed in section 6.4 of SP 800-56BRev2 by performing the following steps: 1. The entity requesting the RSA key unwrapping (un-encapsulation) service from the module, shall only use an RSA private key that was generated by an active FIPS validated module that implements FIPS 186-5 compliant RSA key generation service and performs the key pair validity and the pairwise consistency as stated in section

6.4.1.1 of the SP 800-56BRev2. Additionally, the entity shall renew these assurances over time by using any

method described in section 6.4.1.5 of the SP 800-56BRev2. 2. For use of an RSA key wrapping (encapsulation) service in the context of key transport per IG D.G, the entity using the module, shall verify the validity of the peer's public key using any method specified in section 6.4.2.1 of the SP 800-56BRev2. The entity using the module, shall confirm the peer's possession of private key by using any method specified in section

Once the module reaches its end-of-life stage (End of Life (EOL) date for the Nuvoton device is 10 years from manufacturing date) or sanitation is initiated by the module’s Operator, it is the Operator’s responsibility to clear all existing SSPs from the module. This can be achieved by either performing a full device reset, or by explicitly invoking the following sequence of APIs to clear the data from all modules:

NCL_SHA_Clear - For each of existing SHA and HMAC contexts

NCL_DRBG_Clear - For each of existing DRBG contexts

NCL_AES_Clear - For each of existing AES contexts

NCL_RSA_Clear - For each of existing RSA contexts

Glossary and Abbreviations AES Advanced Encryption Standard ACVP Algorithm Certification Validation Program CBC Cipher Block Chaining CAST Cryptographic Algorithm Self-Test CCM Counter with Cipher Block Chaining-Message Authentication Code CFB Cipher Feedback CMAC Cipher-based Message Authentication Code CMVP Cryptographic Module Validation Program CSP Critical Security Parameter CTR Counter Mode DRBG Deterministic Random Bit Generator ECB Electronic Code Book ECC Elliptic Curve Cryptography ENT Entropy Source EOL End Of Life FIPS Federal Information Processing Standards Publication GCM Galois Counter Mode HMAC Hash Message Authentication Code KAS Key Agreement Scheme KAT Known Answer Test MAC Message Authentication Code NIST National Institute of Science and Technology OFB Output Feedback PSS Probabilistic Signature Scheme RSA Rivest, Shamir, Addleman SHA Secure Hash Algorithm SHS Secure Hash Standard SSC Shared Secret Computation TOEPP Tested Operational Environment’s Physical Perimeter © 2025 Nuvoton Technology Corporation / atsec information security.

References FIPS140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules March 2019 https://doi.org/10.6028/NIST.FIPS.140-3 FIPS140-3_IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program January 2024 https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validationprogram/documents/fips 140-3/FIPS 140-3 IG.pdf FIPS180-4 Secure Hash Standard (SHS) March 2012 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf FIPS186-5 Digital Signature Standard (DSS) February 2023 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf FIPS197 Advanced Encryption Standard November 2001 http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 http://www.ietf.org/rfc/rfc3447.txt RFC3394 Advanced Encryption Standard (AES) Key Wrap Algorithm September 2002 http://www.ietf.org/rfc/rfc3394.txt RFC5649 Advanced Encryption Standard (AES) Key Wrap with Padding Algorithm September 2009 http://www.ietf.org/rfc/rfc5649.txt SP800-38A NIST Special Publication 800-38A - Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP800-38B NIST Special Publication 800-38B - Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 http://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf © 2025 Nuvoton Technology Corporation / atsec information security.

SP800-38C NIST Special Publication 800-38C - Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality May 2004 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf SP800-38D NIST Special Publication 800-38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf SP800-38F NIST Special Publication 800-38F - Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf SP800-56Arev3 NIST Special Publication 800-56A Revision 3 - Recommendation for Pair Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf SP800-56Brev2 Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography March 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Br2.pdf SP800-90Ar1 NIST Special Publication 800-90A - Revision 1 - Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf SP800-90B NIST Special Publication 800-90B - Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf SP800-133rev2 NIST Special Publication 800-133 - Recommendation for Cryptographic Key Generation December 2012 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf SP800-140Br1 NIST Special Publication 800-140Br1 - CMVP Security Policy Requirements November 2023 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-140Br1.pdf © 2025 Nuvoton Technology Corporation / atsec information security.

Nuvoton Cryptographic Library 2.0

Certificate

Derived Review-Risk Graph (review prompts, not findings)

Security Policy, page by page