OpenSSL Cryptographic Module

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for OpenSSL Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery<br/>upgrade</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>status output<br/>UnAuth</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for OpenSSL Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery<br/>upgrade</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>status output<br/>UnAuth</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

F5, Inc. OpenSSL Cryptographic Module Prepared by: atsec information security corporation

4516 Seton Center Parkway, Suite 250

Austin, TX 78759 www.atsec.com

F5® is Registered trademarks of F5, Inc. Intel® Xeon® and Intel® Atom® processors are Registered trademarks of Intel Corporation. ____________________________________________________________________________________________________________________

This document is the non-proprietary FIPS 140-3 Security Policy that contains the security rules under which the OpenSSL Cryptographic Module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an Overall

Table 1: Security Levels ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Purpose and Use: The OpenSSL Cryptographic Module (hereafter referred to as “the module”) is a cryptographic library offering various cryptographic mechanisms to be used by OpenSSL application running on F5 VELOS system controller and blade. The module provides cryptographic services to applications through an Application Program Interface (API). The module also interacts with the underlying operating system via system calls. Module Type: Software Module Embodiment: MultiChipStand Cryptographic Boundary: The software block diagram Figure 1 shows the module, its interfaces with the operational environment and the delimitation of its cryptographic boundary with bold black perimeter. The software components of the cryptographic module are listed in Table - Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets). Figure 1: Block Diagram ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Tested Operational Environment’s Physical Perimeter (TOEPP): The module is aimed to run on a generalpurpose computer; the physical perimeter is the surface of the case of the target platform, as shown with orange dotted lines in the diagram Figure 1. The components of the TOEPP are listed in Table - Tested Operational Environments - Software, Firmware, Hybrid. The entropy source located within the module’s physical perimeter is outside of the module’s cryptographic boundary (see Figure 1).

Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Operational Environments - Software, Firmware, Hybrid: Table 3: Tested Operational Environments - Software, Firmware, Hybrid

Modes List and Description: ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 4: Modes List and Description Mode Change Instructions and Status: The module enters the approved mode after pre-operational self-tests succeed. The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of operation is equivalent to the indicator of the service that was requested.

Table 5: Approved Algorithms There are algorithms, modes, and key/moduli sizes that have been CAVP-tested but are not used by any approved service of the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by an approved service of the module. Vendor-Affirmed Algorithms: Table 6: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement any Non-Approved Allowed algorithms in the Approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: Table 7: Non-Approved, Allowed Algorithms with No Security Claimed Non-Approved, Not Allowed Algorithms: ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 8: Non-Approved, Not Allowed Algorithms ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 9: Security Function Implementations ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

AES GCM Use: The IV for AES-GCM is constructed in compliance with IG C.H scenario 1a (TLS 1.2) and scenario 1d (SSHv2).

SHA-1 Use: SHA-1 from Message Digest is only approved for non-digital-signature uses (see Table 8 of SP 800-131A rev2). Legacy Use

• RSA Digital signature verification using SHA-1 is allowed for legacy use only.
• Algorithms designated as “Legacy” can only be used on data that was generated prior to the Legacy Date specified in FIPS 140-3 IG C.M.

Table 10: Entropy Certificates ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 11: Entropy Sources The module entropy source specified in Table Entropy Sources uses jitter variations caused by executing instructions and memory accessed. The operator does not have the ability to modify the F5 entropy source (ES) configuration settings (see details in Public Use Document referenced in section 11.2). The module employs a Deterministic Random Bit Generator (DRBG) based on [SP800-90ARev1] for the generation of random value used in asymmetric keys, and for providing a RNG service to calling applications. The approved DRBG provided by the module is the CTR_DRBG with AES-256. The output of entropy sources provides 256-bits of entropy to seed and reseed SP800-90ARev1 DRBG during initialization (seed) and reseeding (reseed).

The module implements asymmetric key generation methods according to SP 800-133r2 section 5. The key generation methods are specified in the Security Function Implementations table. The module does not implement symmetric key generation.

The module implements SSP agreement, compliant with IG D.F scenario 2 (path 1). Additionally, the module implements SSP transport, compliant with IG D.G. The Key Establishment methods are specified in the Security Function Implementations table.

GCM with internal IV generation in the approved mode is compliant with version 1.2 of the TLS protocol (RFC 5288) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements the TLS 1.2 and SSH key derivation functions for use in the TLS protocol and SSH protocol (RFC 4253 and RFC 6668) respectively. The strength of the derived session key is based on the shared secret and the SHA function used as follows: For deriving session key with 192 bit strength, the TLS/SSH key derivation functions with shared secret based on P-384 curve using SHA-384 should be used. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

For deriving session key with 128 bit strength, • TLS key derivation functions with shared secret based on P-256 curve using SHA-256, SHA-384 or P-

• SSH key derivation functions with shared secret based on P-256 curve using SHA-1, SHA-256, SHA-

The TLS v1.0 / 1.1 / 1.2 and SSHv2 protocols have not been reviewed or tested by the CAVP or CMVP. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 12: Ports and Interfaces ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the module does not implement an authentication mechanism for Crypto Officer. The Crypto Officer role is implicitly assumed when accessing all services provided by the module (see Table - Approved Services and Table - Non-Approved Services below).

Table 14: Approved Services ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

For the above table, the convention below applies when specifying the access permissions (types) that the service has for each SSP. G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

Table 15: Non-Approved Services

The integrity of the module is verified by comparing a HMAC value calculated at run time on the libcrypto.so.1.0.2zc file, with the HMAC-SHA2-256 value stored in the module file .libcrypto.so.1.0.2zc.hmac that was computed at build time. The HMAC key used for integrity verification is 256 bits in length and is stored as part of the module binary. Integrity tests are performed as part of the Pre-Operational Self-Tests.

The on-demand integrity test is performed as part of the Pre-Operational Self-Tests by reloading the module. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

F5OS-C consists of a Linux based operating system customized for performance that runs directly on the hardware. Type of Operational Environment: Modifiable How Requirements are Satisfied: The module shall be installed as stated in Section 11.1. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data, and uncontrolled access to the data of other processes is prevented.

The module runs on a F5OS-C 1.6.0 operating system executing on the hardware and hypervisor specified in Table OEs. The module should be installed as stated in section 11. The operator should confirm that the module is installed correctly by section 11.2. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

The module is a software and therefore this section is Not Applicable (N/A). ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Per IG 12.A: Until requirements of SP 800-140F are defined, non-invasive mechanisms fall under ISO / IEC 19790:2012 Section 7.12 Mitigation of other attacks. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 17: SSP Input-Output Methods The module does not support manual SSP entry or intermediate key generation output. The SSPs are provided same operational environment. This is allowed by [FIPS 140-3_IG] IG 9.5.A Table 1, according to the “CM

Table 18: SSP Zeroization Methods ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Name

Description for SSH compliant with RFC5647

Size - Strength

Type - Category

Generated By Deterministic generation

Established By

Used By with AES GCM Authenticated decryption with AES GCM

Table 19: SSP Table 1 ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 20: SSP Table 2 ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Pre-operational self-tests are performed automatically when the module is loaded into memory. While the module is executing the pre-operational self-tests, services are not available, and input and output are inhibited. The module does not return control to the calling application until the tests are completed. On services are available.

Table 22: Conditional Self-Tests Table 23: Pre-Operational Periodic Information ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Table 24: Conditional Periodic Information

Table 25: Error States ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

The on demand self-tests can be invoked by unloading and subsequently reloading the module. This service performs the same cryptographic algorithm tests executed during pre-operational self-test and module loading. During the execution of the on demand self-tests, crypto services are not available, and no data output or input is possible. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Startup Procedures: Before the Crypto Officer can configure and use the F5OS-C software on VELOS platforms, the Crypto Officer must license the VELOS system. For automatic VELOS system licensing, the system needs to be able to connect to the F5 licensing server either through the internet or another means of networking. You need to have the Base Registration Key (five sets of characters separated by hyphens) provided by F5, and any add-on keys (two sets of 7 characters separated by a hyphen) that you have purchased. The Base Registration Key with associated add-on keys are pre-installed on a new VELOS system. The activation of the VELOS system license is described in License the system automatically from the CLI (https://techdocs.f5.com/en-us/velos-16-0/velos-systems-installation-upgrade/title-install-before-install-upgrade.html#license-chassis-cli). Installation Process: The Crypto Officer downloads the F5OS-C software image files (ie the module i.e. 1.0.2zc-fips binary and its integrity check file) and deploy it. The VELOS systems (controller or blade platforms) run F5OS-C software packages. After the FIPS validated module license is installed, the command prompt will change to ‘REBOOT REQUIRED’. The Crypto Officer must reboot the BIG-IP for all FIPS-compliant changes to take effect.

The FIPS validated module activation requires installation of the license referred as ‘FIPS license’. The Crypto Officer should call the show license service (with command "show system licensing"), then verify that the list of license flags includes "FIPS 140 License”. On the BIG-IP product the Crypto Officer should call the dedicated Show version API, fips_get_f5fips_module_version, to ensure that the module identifier and version are shown as: Cryptographic Module and OpenSSL 1.0.2zc-fips. The ESV Public Use Document (PUD) reference for non-physical entropy source is as follows: https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/85

The Crypto Officer shall consider the following requirements and restrictions when using the module. The IV for AES-GCM is constructed in compliance with IG C.H scenario 1a (TLS 1.2) and scenario 1d (SSHv2) in section 2.7.

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

The module does not implement security mechanisms to mitigate other attacks. ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

Appendix A. Glossary and Abbreviations AES             Advanced Encryption Standard AES-NI          Advanced Encryption Standard New Instructions CAVP            Cryptographic Algorithm Validation Program CBC             Cipher Block Chaining CCM             Counter with Cipher Block Chaining-Message Authentication Code CFB             Cipher Feedback CMAC            Cipher-based Message Authentication Code CMVP            Cryptographic Module Validation Program CSP             Critical Security Parameter CTR             Counter Mode DES             Data Encryption Standard DF              Derivation Function DSA             Digital Signature Algorithm DRBG            Deterministic Random Bit Generator ECB             Electronic Code Book ECC             Elliptic Curve Cryptography ESV             Entropy Source Validation FFC             Finite Field Cryptography FIPS            Federal Information Processing Standards Publication GCM             Galois Counter Mode HMAC            Hash Message Authentication Code KAS             Key Agreement Schema KAT             Known Answer Test KW              AES Key Wrap MAC             Message Authentication Code NDF             No Derivation Function NIST            National Institute of Science and Technology OFB             Output Feedback PAA             Processor Algorithm Acceleration PCT             Pairwise Consistency Test ____________________________________________________________________________________________________________________ © 2025 F5, Inc.

PR              Prediction Resistance PSS             Probabilistic Signature Scheme RNG             Random Number Generator RSA             Rivest, Shamir, Addleman SHA             Secure Hash Algorithm SHS             Secure Hash Standard SSH             Secure Shell TDES            Triple-DES XTS             XEX-based Tweaked-codebook mode with cipher text Stealing ____________________________________________________________________________________________________________________ © 2025 F5, Inc.