Amazon Linux 2023 OpenSSL FIPS Provider

Certificate

Approved Algorithms (202)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Amazon Linux 2023 OpenSSL FIPS Provider
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[high] Firmware update / recovery<br/>/ rollback services<br/><i>Error</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Encryption with AES<br/>Decryption with AES<br/>Show status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Trusted code is reachable<br/>through update and<br/>recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Amazon Linux 2023 OpenSSL FIPS Provider
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[high] Firmware update / recovery / rollback services<br/><i>Error</i><br/>src: securityPolicy.services"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Encryption with AES<br/>Decryption with AES<br/>Show status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3 clueHigh;
  class C5,C6 clueLow;

Security Policy, page by page

Amazon Web Services, Inc. Amazon Linux 2023 OpenSSL FIPS Provider Document Version 1.2 Last update: 2025-05-14 Prepared by: atsec information security corporation

Austin, TX 78759 www.atsec.com

Amazon Linux 2023 OpenSSL FIPS Provider Table of Contents © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider List of Tables © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider List of Figures © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

This document is the non-proprietary FIPS 140-3 Security Policy for version 3.0.8- d694bfa693b76001 of the Amazon Linux 2023 OpenSSL FIPS Provider. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 including this notice. Other documentation is proprietary to their authors.

further consolidated into this document by atsec information security together with other vendorsupplied documentation. In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

Table 1: Security Levels N/A N/A © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Purpose and Use: The Amazon Linux 2023 OpenSSL FIPS Provider (hereafter referred to as “the module”) is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) for use by other applications that require cryptographic functionality. The module consists of one software component, the “FIPS provider”, which implements the FIPS requirements and the cryptographic functionality provided to the operator. Module Type: Software Module Embodiment: MultiChipStand Cryptographic Boundary: The cryptographic boundary of the module is defined as the fips.so shared library, which contains the compiled code implementing the FIPS provider. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1 shows a block diagram that represents the design of the module when the module is operational and providing services to other user space applications. In this diagram, the physical perimeter of the operational environment (a general-purpose computer on which the module is installed) is indicated by a purple dashed line. The cryptographic boundary is represented by the components painted in orange blocks, which consists only of the shared library implementing the FIPS provider (fips.so). Green lines indicate the flow of data between the cryptographic module and its operator application, through the logical interfaces defined in Section 3 Cryptographic Module Interfaces. Components in white are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module’s validation). For example, the kernel is responsible for managing system calls issued by the module itself, as well as other applications using the module for cryptographic services. © 2025 Amazon Web Services, Inc./atsec information security.

Identification Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Operational Environments - Software, Firmware, Hybrid: N/A 3.0.8d694bfa693b76001 N/A 3.0.8d694bfa693b76001 N/A 3.0.8d694bfa693b76001 N/A 3.0.8d694bfa693b76001 © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider N/A 3.0.8c6i.metal N/A 3.0.8Snowball Table 3: Tested Operational Environments - Software, Firmware, Hybrid

There are no components excluded from the requirements of the FIPS 140-3 standard.

Modes List and Description: Table 4: Modes List and Description Nonapproved After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. In the operational state, the module accepts service requests from calling applications through its logical interfaces. At any point in the operational state, a calling application can end its process, causing the module to end its operation. Mode Change Instructions and Status: The module automatically switches between the approved and non-approved modes depending on the

Approved Algorithms: © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider HMAC-SHA2224 HMAC-SHA2256 HMAC-SHA2384 HMAC-SHA2512 HMAC-SHA3224 HMAC-SHA3256 HMAC-SHA3384 HMAC-SHA3512 © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 5: Approved Algorithms The table above lists all approved cryptographic algorithms of the module, including specific key lengths employed for approved services (see Approved Services table in Section 4.3 Approved Services), and implemented modes or methods of operation of the algorithms. Vendor-Affirmed Algorithms: N/A Table 6: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 7: Non-Approved, Not Allowed Algorithms The table above lists all non-approved cryptographic algorithms of the module employed by the nonapproved services of the Non-Approved Services table in Section 4.4 Non-Approved Services.

© 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyVer © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider AsymKeyPairKeyGen AsymKeyPairKeyVer 5.6.1.1.4) 5.6.1.1.4) © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 8: Security Function Implementations

For TLS 1.2, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. OpenSSL 3 is compliant with SP 800-52r2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288 and 8446. The module does not implement the TLS protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. If the counter exhaustion condition is observed, the module returns an error indication to the calling application, which will then need to either abort the connection, or trigger a handshake to establish a new encryption key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Alternatively, the Crypto Officer can use the module’s API to perform AES GCM encryption using internal IV generation. These IVs are always 96 bits and generated using the approved DRBG internal to the module’s boundary, compliant to Scenario 2 of FIPS 140-3 IG C.H. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the EVP_EncryptInit_ex2 API function with a non-NULL iv value. When this is the case, the API will set a non-approved service indicator. Finally, for TLS 1.3, the AES GCM implementation uses the context of Scenario 5 of FIPS 140-3 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC8446 of August 2018, using the cipher-suites that explicitly select AES GCM as the encryption/decryption cipher (Appendix B.4 of RFC8446). The module supports acceptable AES GCM cipher suites from Section 3.3.1 of SP800-52r2. TLS 1.3 employs separate 64-bit sequence numbers, one for protocol records that are received, and one for protocol records that are sent to a peer. These sequence numbers are set at zero at the beginning of a TLS 1.3 connection and each time when the AES-GCM key is changed. After reading or writing a record, the respective sequence number is incremented by one. The protocol specification determines that the sequence number should not wrap, and if this condition is observed, then the protocol implementation must either trigger a re-key of the session (i.e., a new key for AES-GCM), or terminate the connection.

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 2²⁰ AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit.

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following requirements are met: © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

• Derived keys shall be used only for storage applications, and shall not be used for any other purposes. The length of the MK or DPK is 112 bits or more (this is verified by the module). Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys. The length of the password or passphrase is at least 8 characters (this is verified by the module), and may consist of lowercase, uppercase, and numeric characters. Assuming the worst-case scenario of all digits, the probability is estimated to be at most 10-8. Combined with the minimum iteration count as described in the fifth bullet point, this provides an acceptable trade-off between user experience and security against brute-force attacks. A portion of the salt shall be generated randomly using the SP 800-90Ar1 DRBG provided by the module. The minimum length required is 128 bits (this is verified by the module). The iteration count is selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The minimum value is 1000 (this is verified by the module). If any of these requirements are not met, the requested service is non-approved (see Non-Approved Services table in Section 4.4 Non-Approved Services).

To comply with the assurances found in Section 5.6.2 of SP 800-56Ar3, the operator must use the module together with an application that implements the TLS protocol. Additionally, the module’s approved key pair generation service (see Approved Services table in Section 4.3 Approved Services) must be used to generate ephemeral Diffie-Hellman or EC Diffie-Hellman key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the full public key validation of the generated public key. The module’s shared secret computation service will internally perform the full public key validation of the peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 800-56Ar3.

To meet the requirement stated in IG C.C, the module implements the SHA-3 algorithms as both standalone and part of higher-level algorithms. As detailed in Section 2.6 Security Function Implementations with corresponding certificates, the cryptographic algorithms that use of SHA-3 include RSA signature generation and verification, ECDSA signature generation and verification, KBKDF, HKDF, X9.63 KDF, X9.42 KDF, PBKDF, OneStep KDA, TwoStep KDA, and HMAC. In addition, the implementation of the extendable output functions SHAKE128 and SHAKE256 were verified to have a standalone usage.

To meet the requirement stated in IG C.F, the module implements only the approved modulus sizes of 2048, 3072, and 4096 bits for signature generation. For signature verification, the module implements only the approved module sizes of 1024, 2048, 3072, and 4096 bits. Each algorithm was tested, and corresponding certificates can be found detailed in Section 2.6 Security Function Implementations.

To meet the requirement stated in IG D.G, the module implements AES KW, KWP, GCM, and CCM as approved key wrapping algorithms. In addition, AES KW and AES KWP meets the requirements of SP 800-38F. Each approve key wrapping algorithm was tested, and corresponding certificates can be found detailed in Section 2.6 Security Function Implementations.

Table 9: Entropy Certificates © 2025 Amazon Web Services, Inc./atsec information security.

Table 10: Entropy Sources The module employs two Deterministic Random Bit Generator (DRBG) implementations based on SP 800-90Ar1. These DRBGs are used internally by the module (e.g. to generate seeds for asymmetric key pairs and random numbers for security functions). They can also be accessed using the specified API functions. The following parameters are used: 1. 2. Private DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate secret random values (e.g. during asymmetric key pair generation). It can be accessed using RAND_priv_bytes . Public DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate general purpose random values that do not need to remain secret (e.g. initialization vectors). It can be accessed using RAND_bytes . These DRBGs will always employ prediction resistance. More information regarding the configuration and design of these DRBGs can be found in the module’s manual pages.

The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800133r2. When random values are required, they are obtained from the SP 800-90Ar1 approved DRBG, compliant with Section 4 of SP 800-133r2 (without XOR). Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service.

The module implements SSP transport methods as listed in the table above. Additionally, the module implements the following key derivation methods:

• KBKDF: compliant with SP 800-108r1. This implementation can be used to generate secret keys from a pre-existing key-derivation-key. KDA OneStep, KDA TwoStep, HKDF: compliant with SP 800-56Cr1 (HKDF) and SP 800-56Cr2 (KDA OneStep, KDA TwoStep). These implementations shall only be used to generate secret keys in the context of an SP 800-56Ar3 key agreement scheme. ANS X9.42 KDF, ANS X9.63 KDF: compliant with SP 800-135r1. These implementations shall only be used to generate secret keys in the context of an ANS X9.42-2001 resp. ANS X9.632001 key agreement scheme. SSH KDF, TLS 1.2 KDF, TLS 1.3 KDF: compliant with SP 800-135r1. These implementations shall only be used to generate secret keys in the context of the SSH, TLS 1.2, or TLS 1.3 protocols, respectively. PBKDF2: compliant with option 1a of SP 800-132. This implementation shall only be used to derive keys for use in storage applications.

The module implements the SSH key derivation function for use in the SSH protocol (RFC 4253 and RFC 6668). GCM with internal IV generation in the approved mode is compliant with versions 1.2 and 1.3 of the TLS protocol (RFC 5288 and 8446) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements the TLS 1.2 and TLS 1.3 key derivation functions for use in the TLS protocol. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider For Diffie-Hellman, the module supports the use of the following safe primes:

• IKE (RFC 3526):
• MODP-2048 (ID = 14)
• MODP-3072 (ID = 15)
• MODP-4096 (ID = 16)
• MODP-6144 (ID = 17)
• MODP-8192 (ID = 18)
• TLS (RFC 7919)
• ffdhe2048 (ID = 256)
• ffdhe3072 (ID = 257)
• ffdhe4096 (ID = 258)
• ffdhe6144 (ID = 259)
• ffdhe8192 (ID = 260) No parts of the SSH, TLS, or IKE protocols, other than those mentioned above, have been tested by the CAVP and CMVP. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

N/A N/A N/A N/A Table 11: Ports and Interfaces The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module does not implement © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

The module does not support authentication methods.

Table 12: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module when performing a service. The module does not support multiple concurrent operators.

a n a s s e e, W,E n a t W,E n W,E t © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s n W,E W,E a keyon key key - KeyKBKDF © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s p p W,E d n G,W,E W,E © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s n e e, n e n G,R G,E,Z n n W,E N/A © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s N/A N/A DiffieHellman EC DiffieHellman © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider n s s Z - Keyderivation Z Z Z © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider s s Table 13: Approved Services Z The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). The convention below applies when specifying the access permissions (types) that the service has for each SSP.

• Generate (G): The module generates or derives the SSP. Read (R): The SSP is read from the module (e.g. the SSP is output). Write (W): The SSP is updated, imported, or written to the module. Execute (E): The module uses the SSP in performing a cryptographic operation. Zeroize (Z): The module zeroizes the SSP. N/A: The module does not access any SSP or key during its operation. To interact with the module, a calling application must use the EVP API layer provided by OpenSSL. This layer will delegate the request to the FIPS provider, which will in turn perform the requested service. Additionally, this EVP API layer can be used to retrieve the approved service indicator for the module. The redhat_ossl_query_fipsindicator() function indicates whether an EVP API function is approved. After a cryptographic service was performed by the module, the API context (listed in the left column of the bullets below) associated with this request can contain a parameter (listed in the right column of the bullets below) which represents the approved service indicator:
• EVP_CIPHER_CTX: OSSL_CIPHER_PARAM_REDHAT_FIPS_INDICATOR EVP_MAC_CTX: OSSL_MAC_PARAM_REDHAT_FIPS_INDICATOR EVP_KDF_CTX: OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR EVP_PKEY_CTX: OSSL_KEM_PARAM_REDHAT_FIPS_INDICATOR EVP_PKEY_CTX: OSSL_SIGNATURE_PARAM_REDHAT_FIPS_INDICATOR EVP_PKEY_CTX: OSSL_ASYM_CIPHER_PARAM_REDHAT_FIPS_INDICATOR The exact process to use these functions and parameters are described in the module’s manual pages.

© 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 14: Non-Approved Services The table above lists the non-approved services in this module, the algorithms involved, the roles that can request the service. In this table, CO specifies the Crypto Officer role. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

The integrity of the module is verified by comparing a HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity test may be invoked on-demand by unloading and subsequently reinitializing the module, or by calling the OSSL_PROVIDER_self_test function. This will perform (among others) the software integrity test. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Type of Operational Environment: Modifiable How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms provided by the Linux kernel, and only the module has control over these SSPs.

The module shall be installed as stated in Section 11 Life-Cycle Assurance. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

The module is comprised of software only, and therefore this section is not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

This module does not implement any non-invasive security mechanism, and therefore this section is not applicable. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Table 15: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in plaintext form. Table 16: SSP Input-Output Methods © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 17: SSP Zeroization Methods All data output is inhibited during zeroization. (EC) DiffieHellman using DiffieHellman DiffieHellman using DiffieHellman © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Keyderivation from a keyderivation © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider DiffieHellman DiffieHellman using DiffieHellman using DiffieHellman © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 18: SSP Table 1 © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider (V, C) © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 19: SSP Table 2

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Table 20: Pre-Operational Self-Tests The pre-operational software integrity tests are performed automatically when the module is initialized, before the module transitions into the operational state. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module transitions to the operational state only after the pre-operational self-tests are passed successfully.

© 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider N/A N/A N/A N/A © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 21: Conditional Self-Tests The module performs self-tests on all approved cryptographic algorithms as part of the approved services supported in the approved mode of operation, using the tests shown in the table above. Upon generation of a DH, RSA, or EC key pair, the module will perform a pair-wise consistency test (PCT) as shown in the Conditional Self-tests table in Section 10.2 Conditional Self-Tests, which provides some assurance that the generated key pair is well formed. For DH key pairs, this test consists of the PCT described in Section 5.6.2.1.4 of SP 800-56Ar3. For RSA and EC key pairs, this test consists of a signature generation and a signature verification operation. Data output through the data output interface is inhibited during the conditional self-tests. The module does not return control to the calling application until the tests are completed. If any of these tests fails, the module transitions to the error state (Section 10.4 Error States).

© 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 22: Pre-Operational Periodic Information © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Table 23: Conditional Periodic Information © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Table 24: Error States If the module fails any of the self-tests, the module enters the error state. In the error state, the module immediately stops functioning and ends the application process. Consequently, the data output interface is inhibited, and the module no longer accepts inputs or requests (as the module is no longer running).

The software integrity tests and cryptographic algorithm self-tests can be invoked on demand by unloading and subsequently re-initializing the module. The pair-wise consistency tests can be invoked on demand by requesting the key pair generation service. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

The module is distributed as a part of the Amazon Linux 2023 packages in the form of the openssl3.0.8-1.amzn2023.0.17 RPM package. Before the openssl-3.0.8-1.amzn2023.0.17 RPM package is installed, the Amazon Linux 2023 systems must operate in the FIPS validated configuration. This can be achieved by switching the system into the FIPS validated configuration after the installation. Execute the openssl list -providers command. Restart the system. More information can be found at the vendor documentation. The Crypto Officer must verify the Amazon Linux 2023 systems operates in the FIPS validated configuration by executing the fips-mode-setup –check command, which should output “FIPS mode is enabled.”

After installation of the openssl-3.0.8-1.amzn2023.0.17 RPM package, the Crypto Officer must verify the module name and version by executing the openssl list -providers command. The Crypto Officer must ensure that the f i p s provider is listed in the output as follows: fips name: Amazon Linux 2023 - OpenSSL FIPS Provider version: 3.0.8-d694bfa693b76001 status: active The cryptographic boundary consists only of the FIPS provider as listed. If any other OpenSSL or thirdparty provider is invoked, the user is not interacting with the module specified in this Security Policy.

There is no administrator guidance.

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. Then, if desired, the openssl-3.0.81.amzn2023.0.9 RPM package can be uninstalled from the Amazon Linux 2023 systems. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider

Certain cryptographic subroutines and algorithms are vulnerable to timing analysis. The module mitigates this vulnerability by using constant-time implementations. This includes, but is not limited to:

• Big number operations: computing GCDs, modular inversion, multiplication, division, and modular exponentiation (using Montgomery multiplication) Elliptic curve point arithmetic: addition and multiplication (using the Montgomery ladder) Vector-based AES implementations RSA, ECDSA, ECDH, and DH employ blinding techniques to further impede timing and power analysis. © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Appendix A. Glossary and Abbreviations AES Advanced Encryption Standard AES-NI Advanced Encryption Standard New Instructions API Application Programming Interface CAST Cryptographic Algorithm Self-Test CAVP Cryptographic Algorithm Validation Program CBC Cipher Block Chaining CCM Counter with Cipher Block Chaining-Message Authentication Code CE Cryptography Extensions CFB Cipher Feedback CKG Cryptographic Key Generation CMAC Cipher-based Message Authentication Code CMVP Cryptographic Module Validation Program CPACF CP Assist for Cryptographic Functions CSP Critical Security Parameter CTR Counter CTS Ciphertext Stealing DH Diffie-Hellman DRBG Deterministic Random Bit Generator ECB Electronic Code Book ECC Elliptic Curve Cryptography ECDH Elliptic Curve Diffie-Hellman ECDSA Elliptic Curve Digital Signature Algorithm EVP Envelope FFC Finite Field Cryptography FIPS Federal Information Processing Standards GCM Galois Counter Mode GMAC Galois Counter Mode Message Authentication Code HKDF HMAC-based Key Derivation Function HMAC Keyed-Hash Message Authentication Code IKE Internet Key Exchange KAS Key Agreement Scheme KAT Known Answer Test KBKDF Key-based Key Derivation Function KW Key Wrap KWP Key Wrap with Padding MAC Message Authentication Code NIST National Institute of Science and Technology OFB Output Feedback © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider PAA Processor Algorithm Acceleration PCT Pair-wise Consistency Test PBKDF2 Password-based Key Derivation Function v2 PSS Probabilistic Signature Scheme RSA Rivest, Shamir, Adleman SHA Secure Hash Algorithm SSC Shared Secret Computation SSH Secure Shell SSP Sensitive Security Parameter TLS Transport Layer Security XOF Extendable Output Function XTS XEX-based Tweaked-codebook mode with cipher text Stealing © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider Appendix B. References ANS X9.42-2001 Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography 2001 https://webstore.ansi.org/standards/ascx9/ansix9422001 ANS X9.63-2001 Public Key Cryptography for the Financial Services Industry, Key Agreement and Key Transport Using Elliptic Curve Cryptography 2001 https://webstore.ansi.org/standards/ascx9/ansix9632001 FIPS 140-3 FIPS PUB 140-3 - Security Requirements for Cryptographic Modules March 2019 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program January 2024 https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips140-3-ig-announcements FIPS 180-4 Secure Hash Standard (SHS) March 2012 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf FIPS 186-4 Digital Signature Standard (DSS) July 2013 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf FIPS 186-5 Digital Signature Standard (DSS) February 2023 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf FIPS 197 Advanced Encryption Standard November 2001 https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions August 2015 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf RFC 3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE) May 2003 https://www.ietf.org/rfc/rfc3526.txt RFC 5288 AES Galois Counter Mode (GCM) Cipher Suites for TLS August 2008 https://www.ietf.org/rfc/rfc5288.txt RFC 7919 Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS) August 2016 https://www.ietf.org/rfc/rfc7919.txt RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3 August 2018 https://www.ietf.org/rfc/rfc8446.txt © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider SP 800-38A Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP 800-38A Addendum Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode October 2010 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38aadd.pdf SP 800-38B Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf SP 800-38C Recommendation for Block Cipher Modes of Operation: the CCM Mode for Authentication and Confidentiality May 2004 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf SP 800-38D Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC November 2007 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication80038d.pdf SP 800-38E Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf SP 800-38F Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping December 2012 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf SP 800-52r2 Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations August 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf SP 800-56Ar3 Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography April 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf SP 800-56Cr1 Recommendation for Key-Derivation Methods in Key-Establishment Schemes April 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr1.pdf SP 800-56Cr2 Recommendation for Key-Derivation Methods in Key-Establishment Schemes August 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf SP 800-90Ar1 Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf © 2025 Amazon Web Services, Inc./atsec information security.

Amazon Linux 2023 OpenSSL FIPS Provider SP 800-108r1 NIST Special Publication 800-108 - Recommendation for Key Derivation Using Pseudorandom Functions August 2022 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf SP 800-132 Recommendation for Password-Based Key Derivation - Part 1: Storage Applications December 2010 https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf SP 800-133r2 Recommendation for Cryptographic Key Generation June 2020 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf SP 800-135r1 Recommendation for Existing Application-Specific Key Derivation Functions December 2011 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800135r1.pdf © 2025 Amazon Web Services, Inc./atsec information security.

Referenced URLs

• www.atsec.com
• https://webstore.ansi.org/standards/ascx9/ansix9422001
• https://webstore.ansi.org/standards/ascx9/ansix9632001
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf
• https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf
• https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
• https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
• https://www.ietf.org/rfc/rfc3526.txt
• https://www.ietf.org/rfc/rfc5288.txt
• https://www.ietf.org/rfc/rfc7919.txt
• https://www.ietf.org/rfc/rfc8446.txt
• https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
• https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a-
• https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf
• https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf
• https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-
• https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar3.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr1.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
• https://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf
• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-133r2.pdf