Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1]

Certificate

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1]
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Unauthenticated<br/>UnAuth</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>IKEV<br/>IPSEC<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>kernel<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1]
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Unauthenticated<br/>UnAuth</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>IKEV<br/>IPSEC<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>kernel<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Apple Inc. Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1] Prepared for: Apple Inc. One Apple Park Way Cupertino, CA 95014 Prepared by: atsec information security corporation

4516 Seton Center Parkway, Suite 250

Austin, TX 78759 www.atsec.com

This document may be reproduced and distributed only in its original entirely without revision.

List of Figures This document may be reproduced and distributed only in its original entirely without revision.

Trademarks Apple’s trademarks applicable to this document are listed in https://www.apple.com/legal/intellectual-property/trademark/appletmlist.html. Other company, product, and service names may be trademarks or service marks of others. This document may be reproduced and distributed only in its original entirely without revision.

This document is the non-proprietary FIPS 140-3 Security Policy for Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1] cryptographic module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for This document provides all tables and diagrams (when applicable) required by NIST SP 800140Br1.

Overall Level 1 Table 1: Security Levels This document may be reproduced and distributed only in its original entirely without revision.

Purpose and Use: The Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1] cryptographic module (hereafter referred to as “the module”) provides implementations of lowlevel cryptographic primitives to the Device OS’s kernels (iOS 16, iPadOS 16, watchOS 9, tvOS 16) Security Framework and Common Crypto. The module provides services intended to protect data in transit and at rest. The module is optimized for library use within the Device OS kernel space and does not contain any terminating assertions or exceptions. It is implemented as a Device OS dynamically loadable library. The library is loaded into the Device OS kernel and its cryptographic functions are made available to Device OS kernel services only. Any internal error detected by the module is returned to the caller with an appropriate return code. The calling Device OS kernel service must examine the return code and act accordingly. The module communicates any error status synchronously through the use of its documented return codes, thus indicating the module’s status. Caller-induced or internal errors do not reveal any sensitive material to callers. Module Type: Software Module Embodiment: MultiChipStand Cryptographic Boundary: The module cryptographic boundary is delineated by the dotted green rectangle in the Figure 1 where the Kernel Extension (KEXT) is a bundle that performs low-level tasks. KEXTs run in kernel space, which gives them elevated privileges and the ability to perform tasks that user-space apps can’t. This document may be reproduced and distributed only in its original entirely without revision.

Tested Module Identific Package or File Name

at Version

ion – Software, Firmw Software/ Firmware

a

re, Hybrid (Executable C Features

ode Sets): Integrity Test

Figure 1: Block Diagram Tested Operational Environment’s Physical Perimeter (TOEPP): The physical perimeter is represented by the most exterior black line in the block diagram Figure 1. The module executes within the kernel space of the computing platforms and operating systems listed in the Tested Operational Environments Table section 2.2.

xnu-10002.60.75.0.3 v13.0 N/A HMAC-SHA256 Fusion This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

V Operating System iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iPadOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 iOS 16 watchOS 9 macOS 13 Ventura macOS 13 Ventura macOS 13 Ventura

endor-Affirmed O

p

e Hardware Platform iPad Pro 12.9-inch iPad (6th generation) iPad Pro 12.9-inch (2nd generation) iPad Air (3rd generation) iPad (8th generation) iPad Pro 12.9-inch (3rd generation) iPad Pro 12.9-inch (4th generation) iPad Pro 12.9-inch (5th generation) iPad Pro 12.9-inch (6th generation) iPhone 8 iPhone 8 Plus iPhone XS iPhone XR iPhone 11 iPhone 11 Pro Max iPhone SE (2nd generation) iPhone 12 mini iPhone 12 Pro iPhone 12 Pro Max iPhone 13 mini iPhone 13 iPhone 13 Pro iPhone 14 Pro Apple Watch SE Mac mini iMac (24-inch) MacBook Pro (14-inch, 2021)

rational Environments - Software, Fi

r

Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: This document may be reproduced and distributed only in its original entirely without revision.

Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

None for this module Modes List and Description: This document may be reproduced and distributed only in its original entirely without revision.

Table 7: Approved Algorithms - AES-CCM Table 8: Approved Algorithms - AES-CFB128 Table 9: Approved Algorithms - AES-CFB8 Table 10: Approved Algorithms - AES-CTR Table 11: Approved Algorithms - AES-ECB This document may be reproduced and distributed only in its original entirely without revision.

Table 12: Approved Algorithms - AES-GCM Table 13: Approved Algorithms - AES-KW Table 14: Approved Algorithms - AES-OFB Table 15: Approved Algorithms - AES-XTS CTR_DRBG Table 16: Approved Algorithms - CTR_DRBG Candidates Table 17: Approved Algorithms - ECDSA-KEYGEN Table 18: Approved Algorithms - ECDSA-KEYVER This document may be reproduced and distributed only in its original entirely without revision.

Table 19: Approved Algorithms - ECDSA-SIGGEN Table 20: Approved Algorithms - ECDSA-SIGVER

1 8

Table 21: Approved Algorithms - HMAC-SHA1 Table 22: Approved Algorithms - HMAC-SHA224 Table 23: Approved Algorithms - HMAC-SHA256 Table 24: Approved Algorithms - HMAC-SHA384 This document may be reproduced and distributed only in its original entirely without revision.

Table 25: Approved Algorithms - HMAC-SHA512 Table 26: Approved Algorithms - HMAC-SHA512/256 Modulo - 2048, 3072, 4096 Table 27: Approved Algorithms - RSA-SIGGEN Modulo - 1024, 2048, 3072, 4096 Table 28: Approved Algorithms - RSA-SIGVER SHA1 Table 29: Approved Algorithms - SHA1 SHA224

224 Increment 8

Table 30: Approved Algorithms - SHA224 This document may be reproduced and distributed only in its original entirely without revision.

SHA256 Table 31: Approved Algorithms - SHA256 SHA384 Table 32: Approved Algorithms - SHA384 SHA512 Table 33: Approved Algorithms - SHA512 SHA512/256 Table 34: Approved Algorithms - SHA512/256 The FIPS 186-4 CAVP tests in the listed ACVP certificates above are mathematically identical to the FIPS 186-5 CAVP tests. Per FIPS 140-3 C.K Additional Comments 2, the module claims compliance with FIPS 186-5 tests. Vendor-Affirmed Algorithms: CKG Key Type:Asymmetric N/A SP800-133rev2 section 4 example 1 Table 35: Vendor-Affirmed Algorithms This document may be reproduced and distributed only in its original entirely without revision.

Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: RFC 6637 Key Derivation SHA-256, SHA-512, AES-128, AES-256 Table 36: Non-Approved, Not Allowed Algorithms

This document may be reproduced and distributed only in its original entirely without revision.

(PKV) This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

Table 37: Security Function Implementations

AES-GCM AES-GCM IV is constructed in compliance with IG C.H scenario

1. The GCM IV generation follows RFC 4106 and shall only be used for the IPsec protocol version
2. When the IV in RFC 4106 exhausts the maximum number of possible values for a given security association, either party to the security association that encounters this condition triggers a rekeying with IKEv2 to establish a new encryption key for the security association. The module uses RFC 7296 compliant IKEv2 to establish the shared secret SKEYSEED from which the AESGCM encryption keys are derived. In case the module’s power is lost and then restored, the key used for the AES GCM encryption/decryption shall be re-distributed. This condition is not enforced by the module. AES-XTS AES-XTS mode is only approved for hardware storage applications. The length of the AES-XTS data unit does not exceed 220 blocks. The module checks explicitly that Key_1 ≠ Key_2 before using the keys in the XTS-Algorithm to process data with them compliant with IG C.I.

E15 apple Table 38: Entropy Certificates This document may be reproduced and distributed only in its original entirely without revision.

Table 39: Entropy Sources Entropy sources: Two entropy sources (one non-physical entropy source and one physical entropy source) residing within the TOEPP provide the random bits. The entropy sources are located within the physical perimeter of the module (TOEPP) but outside the cryptographic boundary of the module. RBGs: The NIST [SP 800-90ARev1] approved deterministic random bit generators (DRBG) used for random number generation is a CTR_DRBG using AES-256 with derivation function and without prediction resistance. The module performs DRBG health tests according to [SP800-90ARev1 section 11.3]. The deterministic random bit generators are seeded by “read_random”. The read_random is the Kernel Space interface. RBG Output: The output of entropy sources provides 256-bits of entropy to seed and reseed SP800-90ARev1 DRBG during initialization (seed) and reseeding (reseed).

See vendor affirmed algorithms (CKG) in section 2.5. The module does not implement symmetric key generation.

No parts of the IPSec, other than those mentioned above, have been tested by the CAVP and CMVP. This document may be reproduced and distributed only in its original entirely without revision.

Table 40: Ports and Interfaces This document may be reproduced and distributed only in its original entirely without revision.

Name

Type

Operator Type

Authentication Methods

N/A for this module. FIPS 140-3 does not require an authentication mechanism for level 1 modules. Therefore, the module does not support an authentication mechanism for Crypto Officer. The Crypto Officer role is authorized to access all services provided by the module (see Table - Approved Services and Table - Non-Approved Services).

Crypto Officer Role CO None Table 41: Roles

This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

G,R,E This document may be reproduced and distributed only in its original entirely without revision.

n when the - AES This document may be reproduced and distributed only in its original entirely without revision.

Name Triple-DES encryption /

Description Execute Triple-DES mode

Algorithms Triple-DES [SP 800-

Role CO

Table 42: Approved Services The abbreviations of the access rights to SSPs have the following interpretation: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. N/A = The service does not access any SSP during its operation

decryption encrypt or decrypt operation. 67r2] This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

Table 43: Non-Approved Services

N/A This document may be reproduced and distributed only in its original entirely without revision.

A software integrity test is performed on the runtime image of the module. The HMAC-SHA256 implemented in the module is used as the approved algorithm for the integrity test. If the test fails, the module enters an error state where no cryptographic services are provided, and data output is prohibited i.e. the module is not operational.

The module’s integrity test can be performed on demand by power-cycling the computing platform. Integrity test on demand is performed as part of the Pre-Operational Self-Tests, automatically executed at power-on. This document may be reproduced and distributed only in its original entirely without revision.

Type of Operational Environment: Modifiable

The module is supplied as part of Device OS, a commercially available general-purpose operating system executing on the computing platforms specified in section 2.2. This document may be reproduced and distributed only in its original entirely without revision.

The FIPS 140-3 physical security requirements do not apply to the Apple corecrypto Module v13.0 [Apple silicon, Kernel, Software, SL1] since it is a software module. This document may be reproduced and distributed only in its original entirely without revision.

Per IG 12.A, until the requirements of NIST SP 800-140F are defined, non-invasive mechanisms fall under ISO/IEC 19790:2012 Section 7.12 Mitigation of other attacks. The requirements of this area are not applicable to the module. This document may be reproduced and distributed only in its original entirely without revision.

Table 45: SSP Input-Output Methods

This document may be reproduced and distributed only in its original entirely without revision.

Table 46: SSP Zeroization Methods Data output interfaces are inhibited while zeroisation is performed.

h This document may be reproduced and distributed only in its original entirely without revision.

h Table 47: SSP Table 1 This document may be reproduced and distributed only in its original entirely without revision.

Table 48: SSP Table 2 This document may be reproduced and distributed only in its original entirely without revision.

While the module is executing the self-tests, services are not available, and input and output are inhibited.

The module performs a pre-operational software integrity automatically when the module is loaded into memory (i.e., at power on) before the module transitions to the operational state. A used to perform the approved integrity technique. Prior to using HMAC-SHA-256, a Conditional Cryptographic Algorithm Self-Tests (CAST) is performed. compilation time. Table 49: Pre-Operational Self-Tests

This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

Table 50: Conditional Self-Tests

powered on Table 51: Pre-Operational Periodic Information This document may be reproduced and distributed only in its original entirely without revision.

This document may be reproduced and distributed only in its original entirely without revision.

prohibited Table 53: Error States

The module permits operators to initiate the pre-operational or conditional self-tests on demand for periodic testing of the module by rebooting the system (i.e., power-cycling). This document may be reproduced and distributed only in its original entirely without revision.

Startup Procedures: The module is built into Device OS defined in section 2 and delivered/ installed with the respective Device OS. There is no standalone delivery of the module as a software library. Installation Process and Authentication Mechanisms: The vendor’s internal development process guarantees that the correct version of module goes with its intended Device OS version. For additional assurance, the module is digitally signed by vendor, and it is verified during the integration into Host Device OS. This digital signature-based integrity protection during the delivery/integration process is not to be confused with the HMAC-256 based integrity check performed by the module itself as part of its pre-operational self- tests.

The Approved mode of operation is configured in the system by default and can only be transitioned into the non-Approved mode by calling one of the non-Approved services listed in Table - Non-Approved Services. If the device starts up successfully, then the module has passed all self-tests and is operating in the Approved mode. The ESV Public Use Document (PUD) reference for physical entropy source is: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validationprogram/documents/entropy/E14_PublicUse.pdf The ESV Public Use Document (PUD) reference for non-physical entropy source is: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validationprogram/documents/entropy/E15_PublicUse.pdf Apple Platform Certifications guide [platform certifications] and Apple Platform Security guide [SEC] are provided by Apple which offers IT System Administrators with the necessary technical information to ensure FIPS 140-3 Compliance of the deployed systems. This guide walks the reader through the system’s assertion of cryptographic module integrity and the steps necessary if module integrity requires remediation.

The Crypto Officer shall consider the following requirements and restrictions when using the module.

• AES-GCM see section 2.7.
• AES-XTS see section 2.7. This document may be reproduced and distributed only in its original entirely without revision.

The module secure sanitization is accomplished through the Lost Mode, remote wipe, and remote lock sections of the provided vendor document [platform certifications]. This document may be reproduced and distributed only in its original entirely without revision.

The module does not claim mitigation of other attacks. This document may be reproduced and distributed only in its original entirely without revision.

Appendix A.                   Glossary and Abbreviations AES                    Advanced Encryption Standard CAVP                   Cryptographic Algorithm Validation Program CAST                   Cryptographic Algorithm Self-Test CAST5                  A symmetric-key 64-bit block cipher with 128-bit key CBC                    Cipher Block Chaining CCM                    Counter with Cipher Block Chaining-Message Authentication Code CFB                    Cipher Feedback CMVP                   Cryptographic Module Validation Program CSP                    Critical Security Parameter CTR                    Counter Mode DRBG                   Deterministic Random Bit Generator ECB                    Electronic Code Book ESVP                   Entropy Source Validation Program FIPS                   Federal Information Processing Standards Publication GCM                    Galois Counter Mode HMAC                   Hash Message Authentication Code KAT                    Known Answer Test KDF                    Key Derivation Function KEXT                   Kernel Extension KW                     AES Key Wrap MAC                    Message Authentication Code KPI                    Kernel Programming Interface NIST                   National Institute of Science and Technology OFB                    Output Feedback PAA                    Processor Algorithm Acceleration PKG                    Key-Pair Generation PKV                    Public Key Validation PSS                    Probabilistic Signature Scheme PUD                    Public Use Document (ESVP) RSA                    Rivest, Shamir, Addleman SHA                    Secure Hash Algorithm SHS                    Secure Hash Standard TOEPP                  Tested Operational Environment Physical Perimeter XTS                    XEX-based Tweaked-codebook mode with cipher text Stealing This document may be reproduced and distributed only in its original entirely without revision.