Amazon Linux 2023 NSS Cryptographic Module

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Amazon Linux 2023 NSS Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>UnAuth<br/>Status Output<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>IKEV<br/>IPSEC</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Amazon Linux 2023 NSS Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>UnAuth<br/>Status Output<br/>Show Status</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>IKEV<br/>IPSEC</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Amazon Web Services, Inc. Amazon Linux 2023 NSS Cryptographic Module FIPS 140 -3 Non -Proprietary Security Policy Document Version 1. 2 Last update: 202 5-12 -08 Prepared by: atsec information security corporation

4516 Seton Center Pkwy, Suite 250

Austin, TX 78759 www.atsec.com

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table of Contents © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y List of Tables Ta b le 2 : Te s t e d Mo d u le Id e n t ific a t io n – So ft wa re , Firm wa re , Hyb rid (Exe c u t a b le Co d e Se t s ) 1 1 © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y List of Figures © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 5 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Amazon is a registered trademark of Amazon Web Services, Inc. or its affiliates. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 6 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

This document is the non -proprietary FIPS 140 -3 Security Policy for version 3.90.0 3e9a8358c972db98 of the Amazon Linux 2023 NSS Cryptographic Module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140 -3 (Federal Information Processing Standards Publication 140 -3) for an overall Security Level 1 module. This Non -Proprietary Security Policy may be reproduced and distributed, but only whole and intact and including this notice. Other documentation is proprietary to their authors.

This Security Policy describes the features and design of the module named Amazon Linux

2023 NSS Cryptographic Module using the terminology contained in the FIPS 140 -3

specification. The FIPS 140 -3 Security Requirements for Cryptographic Module specifies the security requirements that will be satisfied by a cryptogra phic module utilized within a security system protecting sensitive but unclassified information. The NIST/CCCS Cryptographic Module Validation Program (CMVP) validates cryptographic module to FIPS

140 -3. Validated products are accepted by the Federal agenc ies of both the USA and Canada

for the protection of sensitive or designated information. This Non -Proprietary Security Policy may be reproduced and distributed, but only whole and intact and including this notice. Other documentation is proprietary to their authors. The vendor has provided the non -proprietary Security Policy of the cryptographic module, which was further consolidated into this document by atsec information security together with other vendor -supplied documentation. In preparing the Security Policy doc ument, the laboratory formatted the vendor -supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 7 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y d o c u m e n t wa s c o n d u c t e d it e ra t ive ly t h ro u g h o u t t h e c o n fo rm a n c e t e s t in g , wh e re in t h e Se c u rit y Po lic y wa s s u b m it t e d t o t h e ve n d o r, wh o wo u ld t h e n e d it , m o d ify, a n d a d d t e c h n ic a l c o n t e n t s . Th e ve n d o r wo u ld a ls o s u p p ly a d d it io n a l d o c u m e n t a t io n , wh ic h t h e la b o ra t o ry fo rm a t t e d in t o t h e e xis t in g Se c u rit y Po lic y, a n d re s u b m it t e d t o t h e ve n d o r fo r t h e ir fin a l e d it in g . © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 8 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Purpose and Use: The Amazon Linux 2023 NSS Cryptographic Module (hereafter referred to as “the module”) provides a C language application program interface (API) designed to support cross platform development of security -enabled client and server applications. Applications built with NSS can support SSLv3, TLS, IKEv2, PKCS#5, PKCS#7, PKCS#11, PKCS#12, S/MIME, X.509 v3 certificates, and other security standards supporting FIPS 140 -3 validated cryptographic algorithms. It combines a vertical stack of Linux components intended to limit the external interface each separate component may provide. Module Type : Software Module Embodiment : MultiChipStand Module Characteristics : Cryptographic Boundary: Figure 1 shows a block diagram that represents the design of the module when the module is operational and providing services to other user space applications. In this diagram, the physical perimeter of the operational environment (a general -purpose comput er on which the module is installed) is indicated by a purple dashed line. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 9 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Figure 1: Block Diagram The cryptographic boundary is represented by the components painted in orange blocks, which consists of two software components:

1. The Softoken library, which provides a PKCS#11 token API (libsoftokn3.so), and its associated integrity check value (libsoftokn3.chk).
2. The Freebl cryptographic library, which implements most cryptographic algorithms used by Softoken (libfreeblpriv3.so), and its associated integrity check value (libfreeblpriv3.chk). Green lines indicate the flow of data between the cryptographic module and its operator application, through the logical interfaces defined in Section
3. Components in white are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module’s validation). For example, the kernel is responsible for managing system calls issue d by the module itself, as well as other applications using the module for cryptographic services. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general -purpose computer on which the module is installed. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 0 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): The module has been tested on the following platforms with the corresponding module variants and configuration options with and without PAA: Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor -Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module.

There are no components excluded from the requirements of the FIPS 140 -3 standard.

Modes List and Description: © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 1 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y 4.3 4.3 Table 4: Modes List and Description After passing all pre -operational self -tests and cryptographic algorithm self -tests executed on start -up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. Mode Change Instructions and Status: The module automatically switches between the approved and non -approved modes depending on the services requested by the operator. The status indicator of the mode of The module does not implement a degraded mode of operation.

Approved Algorithms: © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 2 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 3 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 5: Approved Algorithms Vendor -Affirmed Algorithms: Table 6: Vendor -Affirmed Algorithms Non -Approved, Allowed Algorithms: N/A for this module. Non -Approved, Allowed Algorithms with No Security Claimed: Table 7: Non -Approved, Allowed Algorithms with No Security Claimed Non -Approved, Not Allowed Algorithms: © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 4 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 8: Non -Approved, Not Allowed Algorithms

© 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 5 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 6 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 9: Security Function Implementations

The Crypto Officer shall consider the following requirements and restrictions when using the module. For TLS 1.2, the module offers the AES GCM implementation and uses the context of mechanism for IV generation is compliant with RFC 5288 and 8446. The module does not implement the TLS protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce _explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 7 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Alt e rn a t ive ly, t h e Cryp t

• Offic e r c a n u s e t h e m o d u le ’s API t o p e rfo rm AES GCM e n c ryp t io n u s in g in t e rn a l IV g e n e ra t io n . Th e s e IVs a re a lwa ys 9 6 b it s a n d g e n e ra t e d u s in g t h e a p p ro ve d DRBG in t e rn a l t o t h e m o d u le ’s b o u n d a ry, c o m p lia n t t
• Sc e n a rio 2 o f FIPS 1 4 0 -3 IG C.H. Fin a lly, fo r TLS 1 .3 , t h e AES GCM im p le m e n t a t io n u s e s t h e c o n t e xt o f Sc e n a rio 5 o f FIPS 1 4 0 -

3 IG C.H. Th e p ro t o c o l t h a t p ro vid e s t h is c o m p lia n c e is TLS 1 .3 , d e fin e d in RFC8 4 4 6 o f

Au g u s t 2 0 1 8 , u s in g t h e c ip h e r-s u it e s t h a t e xp lic it ly s e le c t AES GCM a s t h e e n c ryp t io n /d e c ryp t io n c ip h e r (Ap p e n d ix B.4 o f RFC8 4 4 6 ). Th e m o d u le s u p p o rt s a c c e p t a b le AES GCM c ip h e r s u it e s fro m Se c t io n 3 .3 .1 o f SP8 0 0 -5 2 r2 . TLS 1 .3 e m p lo ys s e p a ra t e 6 4 -b it s e q u e n c e n u m b e rs , o n e fo r p ro t o c o l re c o rd s t h a t a re re c e ive d , a n d o n e fo r p ro t o c o l re c o rd s t h a t a re s e n t t o a p e e r. Th e s e s e q u e n c e n u m b e rs a re s e t a t ze ro a t t h e b e g in n in g o f a TLS

1 .3 c o n n e c t io n a n d e a c h t im e wh e n t h e AES-GCM ke y is c h a n g e d . Aft e r re a d in g o r writ in g a

re c o rd , t h e re s p e c t ive s e q u e n c e n u m b e r is in c re m e n t e d b y o n e . Th e p ro t o c o l s p e c ific a t io n d e t e rm in e s t h a t t h e s e q u e n c e n u m b e r s h o u ld n o t wra p , a n d if t h is c o n d it io n is o b s e rve d , t h e n t h e p ro t o c o l im p le m e n t a t io n m u s t e it h e r t rig g e r a re -ke y o f t h e s e s s io n (i.e ., a n e w ke y fo r AES-GCM) o r t e rm in a t e t h e c o n n e c t io n .

The module provides password -based key derivation (PBKDF2), compliant with SP 800 -132. The module supports option 1a from Section 5.4 of SP 800 -132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accor dance to SP 800 -132 and FIPS 140 -3 IG D.N, the following requirements shall be met:

• De rive d ke ys s h a ll o n ly b e u s e d in s t o ra g e a p p lic a t io n s . Th e MK s h a ll n o t b e u s e d fo r o t h e r p u rp o s e s . Th e le n g t h o f t h e MK o r DPK s h a ll b e o f 1 1 2 b it s o r m o re .
• Pa s s wo rd s o r p a s s p h ra s e s , u s e d a s a n in p u t fo r t h e PBKDF2 , s h a ll n o t b e u s e d a s c ryp t o g ra p h ic ke ys .
• Th e le n g t h o f t h e p a s s wo rd o r p a s s p h ra s e s h a ll b e a t le a s t 8 c h a ra c t e rs , a n d s h a ll c o n s is t o f lo we rc a s e , u p p e rc a s e , a n d n u m e ric c h a ra c t e rs . Th e p ro b a b ilit y o f g u e s s in g t h e va lu e is e s t im a t e d t o b e a t m o s t 1 /6 2 8 = 4 x 1 0 -1 5 , wh e n t h e p a s s wo rd is a c o m b in a t io n o f lo we rc a s e , u p p e rc a s e , a n d n u m e ric c h a ra c t e rs . If t h e p a s s wo rd s o le ly c o n s is t s o f d ig it s , t h e p ro b a b ilit y o f g u e s s in g t h e va lu e is e s t im a t e d t o b e 1 0 -8 . Co m b in e d wit h t h e m in im u m it e ra t io n c o u n t a s d e s c rib e d b e lo w, t h is p ro vid e s a n a c c e p t a b le t ra d e -o ff b e t we e n u s e r e xp e rie n c e a n d s e c u rit y a g a in s t b ru t e -fo rc e a t t a c ks .
• A p o rt io n o f t h e s a lt , wit h a le n g t h o f a t le a s t 1 2 8 b it s , s h a ll b e g e n e ra t e d ra n d o m ly u s in g t h e SP 8 0 0 -9 0 Ar1 DRBG p ro vid e d b y t h e m o d u le .
• Th e it e ra t io n c o u n t s h a ll b e s e le c t e d a s la rg e a s p o s s ib le , a s lo n g a s t h e t im e re q u ire d t o g e n e ra t e t h e ke y u s in g t h e e n t e re d p a s s wo rd is a c c e p t a b le fo r t h e u s e rs . Th e m in im u m va lu e is 1 0 0 0 . Th e c a llin g a p p lic a t io n m u s t o b s e rve t h e re s t o f t h e re q u ire m e n t s a n d re c o m m e n d a t io n s s p e c ifie d in [SP8 0 0 -1 3 2 ]. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 8 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

To comply with the assurances found in Section 5.6.2 of SP 800 -56Ar3, the operator must use the module together with an application that implements the TLS protocol. Additionally, the module’s approved Key Pair Generation service (see the Approved Services table) must be used to generate ephemeral Diffie -Hellman or EC Diffie -Hel lman key pairs, or the key pairs must be obtained from another FIPS -validated module. As part of this service, the module will internally perform the full public key validation of the generated public key. The module’s shared secret computation service will internally perform the full public key validation of the peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 800 56Ar3.

The module does not establish SSPs using an approved key agreement scheme (KAS). However, it does offer some or all of the underlying KAS cryptographic functionality to be used by an external operator/application as part of an approved KAS.

Algorithms designated as “Legacy” can only be used on data that was generated prior to the Legacy Date specified in FIPS 140 -3 IG C.M .

Table 10 : Entropy Certificates Table 11 : Entropy Sources The module employs a Deterministic Random Bit Generator (DRBG) implementation based on SP 800 -90Ar1. This DRBG is used internally by the module (e.g. to generate symmetric keys, seeds for asymmetric key pairs, and random numbers for security functions). It can also be accessed using the specified API functions. The DRBG implemented is a SHA -256 Hash_DRBG, seeded by the entropy source described in the Entropy Sources table. It does not employ prediction resistance. The DRBG is seeded with 440 bits of entropy and reseeded with 440 bits. The entropy source is located within the module’s physical perimeter, but outside of the module’s cryptographic boundary.

The module implements the key generation methods as specified in the Vendor -Affirmed Cryptographic Algorithms table and the Security Function Implementations table. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 1 9 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

The module implements the SSP establishment methods as specified in the Security Function Implementations table.

GCM with internal IV generation in the approved mode is compliant with versions 1.2 and 1.3 of the TLS protocol (RFC 5288 and 8446) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements the TLS 1.0/1.1 and 1.2 key derivation functions for use in the TLS protocol. The module implements the IKEv2 key derivation function for use in the IPSec protocol (RFC 5996). For Diffie -Hellman, the module supports the use of the following safe primes: • IKE (RFC 3 5 2 6 ): MODP-2 0 4 8 (ID = 1 4 ), MODP-3 0 7 2 (ID = 1 5 ), MODP-4 0 9 6 (ID =

• TLS (RFC 7 9 1 9 ): ffd h e 2 0 4 8 (ID = 2 5 6 ), ffd h e 3 0 7 2 (ID = 2 5 7 ), ffd h e 4 0 9 6 (ID =

No o t h e r p a rt s o f t h e TLS o r IPSe c p ro t o c o ls , o t h e r t h a n t h e KDFs m e n t io n e d a b o ve , h a ve b e e n t e s t e d b y t h e CAVP a n d CMVP. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 0 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Table 12 : Ports and Interfaces The module does not have a control output interface. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 1 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Table 13 : Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module. No support is provided for multiple concurrent operators.

W,E W,E © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 2 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y W,E W,E G G,E G,W,E © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 3 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y G © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 4 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Z Z Z Z © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 5 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Z Z Z G G G Table 14 : Approved Services The following convention is used to specify access rights to SSPs:

• Generate (G): Th e m o d u le g e n e ra t e s o r d e rive s t h e SSP.
• Read (R): Th e SSP is re a d fro m t h e m o d u le (e .g . t h e SSP is o u t p u t ).
• Write (W): Th e SSP is u p d a t e d , im p o rt e d , o r writ t e n t o t h e m o d u le .
• Execute (E): Th e m o d u le u s e s t h e SSP in p e rfo rm in g a c ryp t o g ra p h ic o p e ra t io n .
• Zeroize (Z): Th e m o d u le ze ro ize s t h e SSP.
• N/A: Th e m o d u le d o e s n o t a c c e s s a n y SSP o r ke y d u rin g it s o p e ra t io n . To in t e ra c t wit h t h e m o d u le , a c a llin g a p p lic a t io n m u s t u s e t h e FIPS t o ke n APIs p ro vid e d b y So ft o ke n . Th e FIPS t o ke n API la ye r c a n b e u s e d t o re t rie ve t h e a p p ro ve d s e rvic e in d ic a t o r fo r t h e m o d u le . Th is in d ic a t o r c o n s is t s o f fo u r in d e p e n d e n t s e rvic e in d ic a t o rs :

1 . Th e s e s s io n in d ic a t o r, wh ic h m u s t b e u s e d fo r a ll c ryp t o g ra p h ic s e rvic e s e xc e p t

t h e Ke y De riva t io n s e rvic e . It c a n b e a c c e s s e d b y in vo kin g t h e © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 6 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y NSC_NSSGe t FIPSSt a t u s fu n c t io n wit h t h e CKT_NSS_SESSION_LAST_CHECK p a ra m e t e r. If t h e o u t p u t p a ra m e t e r is s e t t o CKS_NSS_FIPS_OK (1 ), t h e s e rvic e wa s a p p ro ve d .

2 . Th e o b je c t in d ic a t o r, wh ic h m u s t b e u s e d fo r t h e Ke y De riva t io n s e rvic e . It c a n b e

a c c e s s e d b y in vo kin g t h e NSC_NSSGe t FIPSSt a t u s fu n c t io n wit h t h e CKT_NSS_OBJECT_CHECK p a ra m e t e r a n d t h e o u t p u t d e rive d ke y. If t h e o u t p u t p a ra m e t e r is s e t t o CKS_NSS_FIPS_OK (1 ), t h e s e rvic e wa s a p p ro ve d .

3 . Th e Ra n d o m Nu m b e r Ge n e ra t io n s e rvic e in d ic a t o r, wh ic h m u s t b e u s e d fo r t h e

Ra n d o m Nu m b e r Ge n e ra t io n s e rvic e . It c a n b e a c c e s s e d b y in vo kin g t h e C_Se e d Ra n d o m o r C_Ge n e ra t e Ra n d o m fu n c t io n s . If a n y o f t h e s e fu n c t io n s re t u rn s CKR_OK, t h e s e rvic e wa s a p p ro ve d .

4 . Th e DSA Sig n a t u re Ve rific a t io n in d ic a t o r, wh ic h m u s t b e u s e d fo r t h e DSA

Sig n a t u re Ve rific a t io n s e rvic e . It c a n b e a c c e s s e d b y in vo kin g t h e C_Ve rifyIn it fu n c t io n wit h a n y CKM_DSA_* m e c h a n is m p a ra m e t e r. If t h is fu n c t io n re t u rn s CKR_OK, t h e s e rvic e wa s a p p ro ve d .

© 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 7 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 15 : Non -Approved Services The indicator value for the non -approved services specified in the Non -Approved Services table is CKS_NSS_FIPS_NOT_OK (0).

The module does not load external software or firmware. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 8 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

The integrity of the module is verified by performing DSA signature verification with a 2048 bit key and SHA -256. Each software component of the module has an associated integrity check value, which contains the DSA signature of the shared library.

Integrity tests are performed as part of the pre -operational self -tests, which are executed when the module is initialized. The integrity tests may be invoked on -demand by unloading and subsequently re -initializing the module, which will perform (among oth ers) the software integrity tests. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 2 9 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Type of Operational Environment: Modifiable How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms provided by the Linux kernel, and only the module has control over these SSPs.

The module shall be installed as stated in Section 11. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each proc ess has control over its own data and uncontrolled access to the data of other processes is prevented. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non -validated operational environment. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 0 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

The module is comprised of software only and therefore this section is not applicable. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 1 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

This module does not implement any non -invasive security mechanism and therefore this section is not applicable. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 2 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Table 16 : Storage Areas The module does not perform persistent storage of SSPs. SSPs are provided to the module (encrypted) unwrapping) Table 17 : SSP Input -Output Methods CSPs (with the exception of passwords) can only be imported to and exported from the module when they are wrapped (encrypted) using an approved security function (e.g. AES KW or KWP). PSPs can be imported and exported in plaintext. Import and export is per formed using API input and output parameters. The module only supports SSP entry and output to and from the calling application running on the same operational environment. Table 18 : SSP Zeroization Methods © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 3 o f 4 9

Name AES key HMAC key Key- derivation key Shared secret Password HKDF Derived key Entropy input DRBG seed Internal state (V, C) DH private key

Description AES key used for encryption, decryption, and computing MAC tags HMAC key used for computing MAC tags Symmetric key used to derive symmetric keys Shared secret generated by (EC) Diffie - Hellman Password used to derive symmetric keys Symmetric key derived from a shared secret Entropy input used to seed the DRBG DRBG seed derived from entropy input Internal state of the Hash_DRBG instance Private key used for Diffie - Hellman

Size - Strength 128, 192, 256 bits - 128, 192, 256 bits 112-524288 bits - 112-256 bits 112-4096 bits - 112- 256 bits 256-8192 bits - 112- 256 bits 8-128 characters - N/A 2048 bits - 112-256 bits 440 bits - 440 bits 440 bits - 256 bits 880 bits - 256 bits 2048-8192 bits - 112- 200 bits

Type - Category Symmetric key - CSP Symmetric key - CSP Symmetric key - CSP Shared secret - CSP Password - CSP Symmetric key - CSP Entropy input - CSP Seed - CSP Internal state - CSP Private key - CSP

Generated By Hash DRBG (symmetric key generation) Hash DRBG (symmetric key generation) Hash DRBG (symmetric key generation) HKDF Hash DRBG Hash DRBG Safe Primes Key Generation (key pair generation)

Established By KAS-FFC-SSC KAS-ECC- SSC

Used By AES (ECB, CBC, CBC-CS1, CTR) AES (KW, KWP) AES (GCM, encryption, internal IV) AES (CMAC) AES (GCM, decryption, external IV) AES-KW, AES- KWP, AES-GCM (KTS, key wrapping) AES-KW, AES- KWP, AES-GCM (KTS, key unwrapping) HMAC KBKDF TLS 1.0/1.1 KDF, TLS 1.2 KDF (CVL) HKDF IKEv2 KDF (CVL) PBKDF2 Hash DRBG Hash DRBG Hash DRBG KAS-FFC-SSC

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y All d a t a o u t p u t is in h ib it e d d u rin g ze ro iza t io n . Me m o ry is d e a llo c a t e d a ft e r ze ro iza t io n .

© 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 4 o f 4 9

Name DH public key EC private key EC public key DSA public key RSA private key RSA public key Intermediate key generation value KBKDF derived key TLS derived key IKEv2 derived key PBKDF derived key

Description Public key used for Diffie - Hellman Private key used for ECDH and ECDSA Public key used for ECDH and ECDSA Public key used for DSA signature verification Private key used for RSA signature generation Public key used for RSA signature verification Temporary value generated during symmetric key and key pair generation services Symmetric key derived from a key-derivation key Symmetric key derived from a shared secret Symmetric key derived from a shared secret Symmetric key derived from a password

Size - Strength 2048-8192 bits - 112- 200 bits P-256, P-384, P-521 - 128, 192, 256 bits P-256, P-384, P-521 - 128, 192, 256 bits (1024, 160), (2048, 224), (2048, 256), (3072, 256) - 80, 112, 128 bits 2048-4096 bits - 112- 150 bits Signature verification: 1024 - 4096 bits; Key pair generation: 2048 - 4096 bits - Signature verification: 80 - 150 bits; Key pair generation: 112 - 150 bits 112-8192 bits - 112- 256 bits 112-4096 bits - 112- 256 bits 112-256 bits - 112- 256 bits 112-256 bits - 112- 256 bits 128-2048 bits - 112- 256 bits

Type - Category Public key - PSP Private key - CSP Public key - PSP Public key - PSP Private key - CSP Public key - PSP Intermediate value - CSP Symmetric key - CSP Symmetric key - CSP Symmetric key - CSP Symmetric key - CSP

Generated By Safe Primes Key Generation (key pair generation) ECDSA KeyGen (key pair generation) ECDSA KeyGen (key pair generation) RSA KeyGen (key pair generation) RSA KeyGen (key pair generation) RSA KeyGen (key pair generation) ECDSA KeyGen (key pair generation) Safe Primes Key Generation (key pair generation) KBKDF TLS 1.0/1.1 KDF, TLS 1.2 KDF (CVL) IKEv2 KDF (CVL) PBKDF2

Established By

Used By KAS-FFC-SSC KAS-ECC-SSC ECDSA SigGen KAS-ECC-SSC ECDSA SigVer ECDSA SigVer (Legacy) DSA SigVer (Legacy) RSA SigGen RSA SigVer RSA SigVer (Legacy) RSA KeyGen (key pair generation) ECDSA KeyGen (key pair generation) Safe Primes Key Generation (key pair generation)

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 19 : SSP Table 1 © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 5 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 6 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 20 : SSP Table 2

The SHA -1 algorithm as implemented by the module will be non -approved for all purposes, starting January 1, 203 1. The ECDSA, and RSA algorithms as implemented by the module conform to FIPS 186 -4, which has been superseded by FIPS 186 -5. The transition started on July 25, 2023, and ended on February 4, 2024 . FIPS 186 -4 was withdrawn on February 3, 2024. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 7 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 8 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

Upon initialization, the module immediately performs all Freebl cryptographic algorithm self tests (CASTs) as specified in the Conditional Self -Tests table. When all those self -tests pass successfully, the module automatically performs the pre -operational integrity test on the libfreeblpriv3.so file using its associated check value. Then, the module performs the DSA CAST in the Softoken library, followed by the the pre operational integrity test on the libsoftokn3.so file using its associated check value. Finally, all remaining CASTs for the algorithms implemented in Softoken are exec uted (see the Conditional Self -Tests table). Only if all CASTs and pre -operational integrity tests passed successfully, the module transitions to the operational state. No operator intervention is required to reach this point. While the module is executing the self -tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. If any of the self -tests fail an error message is returned, and the module tr ansitions to an error state.

10.1 Pre -Operational Self -Tests

Table 21 : Pre -Operational Self -Tests Each software component of the module has an associated integrity check value, which contains the DSA signature of the shared library. The software integrity tests ensure that the module is not corrupted. The DSA and SHA -256 algorithms go through their res pective CASTs before the software integrity tests are performed.

© 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 3 9 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 0 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 1 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y 5.6.2.1.4 Table 22 : Conditional Self -Tests The module performs self -tests on all approved cryptographic algorithms as part of the approved services supported in the approved mode of operation, using the tests shown in the Conditional Self -Tests table. Upon generation of a key pair, the module will perform a pair -wise consistency test (PCT), as shown in the Conditional Self -Tests table, which provides some assurance that the generated key pair is well formed. For DH and EC key pairs, these tests consist of the PCT of a signature generation and a signature verification operation. Note that two PCTs are

Table 23 : Pre -Operational Periodic Information © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 2 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 24 : Conditional Periodic Information

© 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 3 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Table 25 : Error States In any error state, the output interface is inhibited, and the module accepts no more inputs or requests.

10.5 Operator Initiation of Self -Tests

The software integrity tests and CASTs can be invoked on demand by unloading and subsequently re -initializing the module. The PCTs can be invoked on demand by requesting the Key Pair Generation service. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 4 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

The module is distributed as a part of the Amazon Linux 2023 package in the form of the nss -softokn -3.90.0 -6.amzn2023.0. 1 and nss -softokn -freebl -3.90.0 -6.amzn2023.0. 1 RPM packages. The Netscape Portable Runtime (NSPR) package nspr -4.35.0 -6.amzn2023.0. 1 is a prerequisite for the module. Before the RPM packages are installed, the Amazon Linux 2023 system must operate in the FIPS validated configuration. To achieve this, the Crypto Officer must execute the fips -mode setup --enable command, then, restart the system. More information can be f ound at the vendor documentation . The Crypto Officer must verify the Amazon Linux 2023 system operates in the FIPS validated configuration by executing the fips -mode -setup --check command, which should output “FIPS mode is enabled.”

After installation of the RPM packages, the Crypto Officer must execute the “Show Version” service by accessing the CKA_NSS_VALIDATION_MODULE_ID attribute of the CKO_NSS_VALIDATION object in the default slot. The object attribute must contain the value Amazon Linux 2023 nss 3.90.0 -3e9a8358c972db98 Alternatively, the /usr/lib64/nss/unsupported -tools/validation tool is provided as a convenience by the nss -tools -3.90.0 -6.amzn2023.0. 1 RPM package. This tool performs the same steps, and outputs the FIPS module identifier as above. The cryptographic boundary consists only of the Softoken and Freebl libraries along with their associated integrity check values as listed in the Tested Module Identification table. If any other NSS API outside of these two libraries is invoked, the user i s not interacting with the module specified in this Security Policy.

There is no non -administrator guidance.

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, the nss softokn -3.90.0 -6.amzn2023.0. 1 and nss -softokn -freebl -3.90.0 -6.amzn2023.0. 1 RPM packages can be uninstalled from the Amazon Linux 2023 systems. © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 5 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y

• Tim in g a t t a c ks o n RSA
• Ca c h e -t im in g a t t a c ks o n t h e m o d u la r e xp o n e n t ia t io n o p e ra t io n u s e d in RSA
• Arit h m e t ic e rro rs in RSA s ig n a t u re s © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 6 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Appendix A. Glossary and Abbreviations

Amazon Linux 2023 NSS Cryptographic Module FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y Appendix B. References FIPS140 -3 FIPS PUB 140 -3 - Security Requirements for Cryptographic Modules March 2019 https://doi.org/10.6028/NIST.FIPS.140 -3 FIPS140 -3_IG Implementation Guidance for FIPS PUB 140 -3 and the Cryptographic Module Validation Program January 2024 https://csrc.nist.gov/Projects/cryptographic -module -validation program/fips -140 -3-ig -announcements FIPS180 -4 Secure Hash Standard (SHS) March 2012 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180 -4.pdf FIPS186 -4 Digital Signature Standard (DSS) July 2013 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186 -4.pdf FIPS186 -5 Digital Signature Standard (DSS) February 2023 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186 -5.pdf FIPS197 Advanced Encryption Standard November 2001 http://csrc.nist.gov/publications/fips/fips197/fips -197.pdf FIPS198 -1 The Keyed Hash Message Authentication Code (HMAC) July 2008 http://csrc.nist.gov/publications/fips/fips198 -1/FIPS-198 -1_final.pdf PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 http://www.ietf.org/rfc/rfc3447.txt SP800 -38A Special Publication 800 -38A - Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 http://csrc.nist.gov/publications/nistpubs/800 -38a/sp800 -38a.pdf SP800 -38B NIST Special Publication 800 -38B - Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 http://csrc.nist.gov/publications/nistpubs/800 -38B/SP_800 -38B.pdf SP800 -38D NIST Special Publication 800 -38D - Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 http://csrc.nist.gov/publications/nistpubs/800 -38D/SP -800 -38D.pdf SP800 -38F NIST Special Publication 800 -38F - Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800 -38F.pdf © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 8 o f 4 9

Amazon Linux 2023 NSS Cryptographic Module                                                                          FIPS 1 4 0 -3 No n -Pro p rie t a ry Se c u rit y Po lic y SP800 -56Ar3                   NIST Special Publication 800         -56A Revision 3      - Recommendation for Pair Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800            56Ar3.pdf SP800 -56Cr2                   NIST Special Publication 800         -56C Revision 2      - Recommendation for Key -Derivation Methods in Key           -Establishment Schemes August 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800            56Cr2.pdf SP800 -90Ar1                   NIST Special Publication 800         -90A - Revision 1 - Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800           90Ar1.pdf SP800 -90B                     NIST Special Publication 800         -90B - Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800            90B.pdf SP800 -108r1                   NIST Special Publication 800         -108 Revision 1      - Transitions: Recommendation for Key Derivation Using Pseudorandom Functions August 2022 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800            108r1.pdf SP800 -131Ar1                  NIST Special Publication 800         -131A Revision 1       - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths November 2015 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800           131Ar1.pdf SP800 -133r2                   NIST Special      Publication 800    -133rev2 - Recommendation for Cryptographic Key Generation June 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800            133r2.pdf SP800 -135r1                   NIST Special Publication 800         -135 Revision 1      - Recommendation for Existing Application       -Specific Key Derivation Functions December 2011 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800           135r1.pdf © 2 0 2 5 Am a zo n We b Se rvice s , In c ./a t s e c in fo rm a t io n s e c u rit y. Th is d o c u m e n t ca n b e re p ro d u ce d a n d d is t rib u t e d o n ly wh o le a n d in t a c t , in clu d in g t h is c o p yrig h t n o t ic e . Pa g e 4 9 o f 4 9