SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

Certificate

Approved Algorithms (67)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for SUSE Linux Enterprise OpenSSL 3 Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Symmetric Encryption with AES<br/>Symmetric Decryption with AES<br/>Show status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for SUSE Linux Enterprise OpenSSL 3 Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Symmetric Encryption with AES<br/>Symmetric Decryption with AES<br/>Show status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

SUSE LLC SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Prepared by: atsec information security corporation

Austin, TX 78759 www.atsec.com Document version: 1.2 Last update: 15-12-2025 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Table of Contents 1.1.1 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module List of Tables Table 3: Tested Module Identification

• Software/Firmware/Hybrid (Executable Code Sets) defined. not defined. Bookmark not defined. not defined. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module List of Figures © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

This document is the non-proprietary FIPS 140-3 Security Policy for version 1.0 of the SUSE Linux Enterprise OpenSSL 3 Cryptographic Module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for intact and including this notice. Other documentation is proprietary to their authors.

In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

N/A N/A © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Table 1: Security Levels © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

Purpose and Use: The SUSE Linux Enterprise OpenSSL 3 Cryptographic Module (hereafter referred to as “the module”) is defined as a software module in a multi-chip standalone embodiment. It provides a C language application program interface (API) for use by other applications that require cryptographic functionality. The module is a software library supporting FIPS 140-3 approved algorithms developed by SUSE LLC for its use by other applications that require cryptographic functionality and consists of one software component, the “FIPS provider”, which implements the FIPS requirements and the cryptographic functionality provided to the operator. Module Type: Software Module Embodiment: Multi-Chip Standalone Cryptographic Boundary: The cryptographic boundary of the module is defined as the fips.so shared library, which contains the compiled code implementing the FIPS provider. Tested Operational Environment’s Physical Perimeter (TOEPP): The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1 shows a block diagram that represents the design of the module when the module is operational and providing services to other user space applications. In this diagram, the physical perimeter of the operational environment (a general-purpose computer on which the module is installed) is indicated by a purple dashed line. The cryptographic boundary is represented by the components painted in orange blocks, which consists only of the shared library implementing the FIPS provider (fips.so). The “Data/Control Input” and “Data/Status Output” arrows indicate the flow of data between the cryptographic module and its operator application, through the logical interfaces defined in Section 3 Cryptographic Module Interfaces. Components in white are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module’s validation). For example, the kernel is responsible for managing system calls issued by the module itself, as well as other applications using the module for cryptographic services. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Figure 1: Block Diagram

Identification Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): 1.0 N/A 1.0 N/A 1.0 N/A © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module 1.0 N/A Table 2: Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: 825BTQCR1K23LPB and N/A 1.0 825BTQCR1K23LPB and N/A 1.0 GIGABYTE R152P30 Altra® Q8030 N/A 1.0 GIGABYTE R152P30 Altra® Q8030 N/A 1.0 N/A 1.0 N/A 1.0 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module N/A 1.0 N/A 1.0 Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid The module is considered to maintain compliance with the FIPS 140-3 validation for SUSE products when operating on any general-purpose platform/processor that supports the SUSE Linux Enterprise Server operating system per the vendor affirmation from SUSE based on the allowance FIPS 140-3 management manual [FIPS140-3_MM] section 7.9.1 bullet 1 a i). CMVP makes no statement as to the correct operation of the module or the security strengths of the generated keys when so ported if the specific operational environment is not listed on the validation certificate.

There are no components excluded from the requirements of the FIPS 140-3 standard.

Modes List and Description: © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Nonapproved NonApproved Table 5: Modes List and Description After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. No operator intervention is required to reach this point. The module operates in the approved mode of operation by default and can only transition into the non-approved mode by calling one of the non-approved services listed in the Non-Approved Services table of the Security Policy. In the operational state, the module accepts service requests from calling applications through its logical interfaces. At any point in the operational state, a calling application can end its process, causing the module to end its operation. Mode Change Instructions and Status: The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of

Approved Algorithms: © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2224 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2256 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2384 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 HMAC-SHA2512 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module HMAC-SHA2512 HMAC-SHA3224 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module HMAC-SHA3224 HMAC-SHA3256 HMAC-SHA3256 HMAC-SHA3384 HMAC-SHA3384 HMAC-SHA3512 HMAC-SHA3512 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module KDF SP800108 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Table 6: Approved Algorithms Vendor-Affirmed Algorithms: N/A Table 7: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. The module does not implement non-approved algorithms that are allowed in the approved mode of operation. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module The module does not implement non-approved algorithms that are allowed in the approved mode of operation with no security claimed. Non-Approved, Not Allowed Algorithms: Table 8: Non-Approved, Not Allowed Algorithms The table above lists all non-approved cryptographic algorithms of the module employed by the non-approved services of the Non-Approved Services table in Section 4.4 Non-Approved Services. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Passwordbased Key Passwordbased Key © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyGen 5.6.1.1.4) © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module AsymKeyPairKeyVer AsymKeyPairKeyVer 5.6.1.1.4) (1) © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module (1) Table 9: Security Function Implementations © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

For TLS 1.2, the module offers the AES GCM implementation and uses the context of Scenario 1 of FIPS 140-3 IG C.H. The module is compliant with SP 800-52 Rev. 2 Section

The module does not implement the TLS protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Alternatively, the Crypto Officer can use the module’s API to perform AES GCM encryption using internal IV generation. These IVs are always 96 bits and generated using the approved DRBG internal to the module’s boundary, compliant to Scenario 2 of FIPS 140-3 IG C.H. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. This service can be requested by invoking the EVP_EncryptInit_ex2 API function with a non-NULL IV value. When this is the case, the API will set a non-approved service indicator. Finally, for TLS 1.3, the AES GCM implementation uses the context of Scenario 5 of FIPS 1403 IG C.H. The protocol that provides this compliance is TLS 1.3, defined in RFC8446 of August 2018, using the cipher-suites that explicitly select AES GCM as the encryption/decryption cipher (Appendix B.4 of RFC8446). The module supports acceptable AES GCM cipher suites from Section 3.3.1 of SP 800-52 Rev. 2. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key.

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 2²⁰ AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. To meet the requirement stated in IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. As the module does not generate symmetric keys, the check is performed when keys are input the service APIs. Key_1 and Key_2 shall be generated and/or established independently according to the rules for component symmetric keys from NIST SP 800-133rev2, Sec. 6.3. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit.

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance to SP 800-132 and FIPS 140-3 IG D.N, the following requirements are met: © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

• Derived keys shall be used only for storage applications, and shall not be used for any other purposes. The length of the MK or DPK is 112 bits or more.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
• The minimum length of the password or passphrase accepted by the module is 8 characters. The probability of guessing the value, assuming a worst-case scenario of all digits, is estimated to be at most 10-8. Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks.
• A portion of the salt shall be generated randomly using the SP 800-90A Rev. 1 DRBG provided by the module. The minimum length required is 128 bits.
• The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users. The minimum value accepted by the module is 1000. If any of these requirements are not met, the requested service is non-approved (see NonApproved Services table in Section 4.4 Non-Approved Services).

To comply with the assurances found in Section 5.6.2 of SP 800-56A Rev. 3, the operator must use the module together with an application that implements the TLS protocol. Additionally, the module’s approved key pair generation service (see Approved Services table in Section 4.3 Approved Services) must be used to generate ephemeral Diffie-Hellman or EC Diffie-Hellman key pairs, or the key pairs must be obtained from another FIPSvalidated module. As part of this service, the module will internally perform the full public key validation of the generated public key. The module’s shared secret computation service will internally perform the full public key validation of the peer public key, complying with Sections 5.6.2.2.1 and 5.6.2.2.2 of SP 80056A Rev. 3.

The module implements the SHA-3 algorithms as both standalone and part of higher-level algorithms (in compliance with FIPS 140-3 IG C.C). As detailed in Section 2.6 Security Function Implementations with corresponding certificates, the cryptographic algorithms that use of SHA-3 include RSA signature generation and verification, ECDSA signature generation and verification, KBKDF, KDA HKDF, X9.63 KDF, X9.42 KDF, PBKDF, OneStep KDA, and HMAC. In addition, the implementation of the extendable output functions SHAKE128 and SHAKE256 were verified to have a standalone usage.

The module supports RSA Signature Verification for 1024, 1280, 1536 and 1792-bit keys. This is allowed by FIPS 140-3 IG C.F. Specifically, 1280 and 1792 cannot be CAVP tested but are approved for signature verification in IG C.F. The 1024-bit modulus has been CAVP tested for RSA signature verification in compliance with FIPS 186-4, while the 1536-bit modulus has been CAVP tested for RSA signature verification in compliance with FIPS 186-2. For all other approved moduli (namely 2048, 3072, and 4096 bit keys) supported by the module, RSA signature verification is approved and CAVP tested in compliance with FIPS 186-5. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

To comply with the assurances found in Section 6.4 of SP 800-56B Rev. 2, the module’s approved RSA key pair generation service (see Table 9) must be used to generate the RSA key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the key pair validity and the pairwise consistency according to Section 6.4.1.1 of SP 800-56B Rev. 2. Additionally, the entity requesting the shared secret computation service shall verify the validity of the peer’s public key using the public key validation service of the module (EVP_PKEY_check() API). This service will perform the full public key validation of the peer’s public key, complying with Section 6.4.2.1 of SP 800-56B Rev. 2.

To comply with the assurances found in Section 6.4 of SP 800-56Br2, the operator must use the module in the context of the TLS or SSH protocols. Additionally, the module’s approved key pair generation service (see Section 4.3) must be used to generate RSA key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the key pair validation of the generated public key. The operator must use the EVP_PKEY_public_check() API to perform partial public key validation of the peer public key, complying with Section 6.4.2.2 of SP 800-56Br2. The operator must also confirm the peer’s possession of private key by using any method specified in Section 6.4.2.3 of SP 800-56Br2.

The module does not establish SSPs using an approved key transport scheme (KTS). However, it does offer approved authenticated algorithms that can be used by an external operator/application as part of an approved KTS. The module does not establish SSPs using an approved key agreement scheme (KAS). However, it does offer some or all of the underlying KAS cryptographic functionality to be used by an external operator/application as part of an approved KAS.

SHA-1 is only approved when used in approved modes for message digest, HMAC, HKDF, KDA OneStep/TwoStep, PBKDF, SSH KDF, ANS x9.42 KDF, KBKDF, Hash DRBG, HMAC DRBG, RSA OAEP. The use of SHA-1 for digital signature generation (e.g., ECDSA, RSA, EdDSA) or verification is non-approved.

Table 10: Entropy Certificates © 2025 SUSE, LLC/atsec information security corporation.

NonPhysical Table 11: Entropy Sources As per the Public document of entropy certificate E177, the entropy source provides full In addition to the DRBG algorithms provided to the operator, the module internally uses two dedicated DRBG instances based on SP 800-90A Rev. 1 to generate seeds for asymmetric key pairs and random numbers for security functions. The following parameters are used:

1. Private DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate secret random values (e.g. during asymmetric key pair generation). It can be accessed using RAND_priv_bytes.
2. Public DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate general purpose random values that do not need to remain secret (e.g. initialization vectors). It can be accessed using RAND_bytes.

The module implements asymmetric key pair generation compliant with SP 800-133 Rev. 2 as listed in the Security Function Implementations table in 2.6 Security Function Implementations. When random values are required, they are obtained from the SP 800-90A Rev. 1 approved DRBG, compliant with Section 4 of SP 800-133 Rev. 2 (without XOR). Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service.

The module provides Diffie-Hellman (DH) and Elliptic Curve Diffie-Hellman (ECDH) shared secret computation compliant with SP 800-56A Rev. 3, in accordance with scenario 2 (1) of FIPS 140-3 IG D.F. For Diffie-Hellman, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919 (TLS). Note that the module only implements key pair generation, key pair verification, and shared secret computation. No other part of the IKE or TLS protocols is implemented (with the exception of the TLS 1.2 and 1.3 KDFs): © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module • IKE (RFC 3526): o o o o • MODP-2048 (ID =

14. MODP-3072 (ID =
15. MODP-4096 (ID =
16. MODP-6144 (ID = 17) o MODP-8192 (ID = 18) o ffdhe2048 (ID = 256) TLS (RFC 7919) o o o o ffdhe3072 (ID = 257) ffdhe4096 (ID = 258) ffdhe6144 (ID = 259) ffdhe8192 (ID = 260) For Elliptic Curve Diffie-Hellman, the module supports the NIST-defined P-224, P-256, P-384, and P-521 curve. According to FIPS 140-3 IG D.B, the key sizes of DH and ECDH shared secret computation provide respectively 112-200 and 112-256 bits of security strength in an approved mode of operation. In addition, the module provides RSA shared secret computation compliant with SP 800-56B Rev. 2, in accordance with scenario 1 (1) of FIPS 140-3 IG D.F. For RSA key generation, the module provides 2048-15360 bits keys. Therefore, according to FIPS 140-3 IG D.B, the key sizes of RSA shared secret computation provide 112-256 bits of security strength in the approved mode of operation.

The module implements the SSH key derivation function for use in the SSH protocol (RFC

GCM with internal IV generation in the approved mode is compliant with versions 1.2 and 1.3 of the TLS protocol (RFC 5288 and 8446) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements the TLS 1.2 and TLS 1.3 key derivation functions for use in the TLS protocol. No parts of the SSH, TLS, or IKE protocols, other than those mentioned above, have been tested by the CAVP and CMVP. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

N/A N/A N/A N/A Table 12: Ports and Interfaces The logical interfaces are the APIs through which the applications request services. These logical interfaces are logically separated from each other by the API design. The module does not implement a control output interface. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

N/A for this module. The module does not support authentication methods.

Table 13: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module when performing a service. The module does not support multiple concurrent operators.

y s t W,E W,E © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s W,E W,E e ea e W,E W,E ea E e e keyderivati Keyderivati W,E © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s G,R W,E G,R W,E G,R W,E G,R W,E G,R © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s p p p p W,E p G,R p p p p W,E p G,R W,E G,R W,E © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s G,R ea W,E W,E G,R ea W,E W,E G,R ea W,E W,E G,R © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s RSAbased 80056B W,E RSAbased 80056B , W,E e e, e W,E W,E e e, l e W,E W,E © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s G,R G,R G,R G,R G,R © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s G,R G,E,Z l W,E W,E l W,E W,E l W,E W,E © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s m y W,E (V C G,W,E (V G,W,E G,W,E N/A N/A N/A of selftests e © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s e e p © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s N/A © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s Z Z Z Z Z Z p © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y s Z p Z Z Z y Z (V C Z (V Z Table 14: Approved Services © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). The convention below applies when specifying the access permissions (types) that the service has for each SSP.

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP.
• N/A: The module does not access any SSP or key during its operation. To interact with the module, a calling application must use the EVP API layer provided by OpenSSL. This layer will delegate the request to the FIPS provider, which will in turn perform the requested service. Additionally, this EVP API layer can be used to retrieve the approved service indicator for the module. The suse_ossl_query_fipsindicator() function indicates whether an EVP API function is approved. After a cryptographic service was performed by the module, the API context (listed in the left column of the table below) associated with this request can contain a parameter (listed in the left right column of the table below) which represents the approved service indicator. The exact process to use this function and how to interpret its results is described in the fips_module_indicators manual page. Table 15 - Service Indicator Parameters

© 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module Table 16: Non-Approved Services The table above lists the non-approved services in this module, the algorithms involved and the roles that can request the service. In this table, CO specifies the Crypto Officer role.

The module does not load external software or firmware. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

The integrity of the module is verified by comparing a HMAC SHA-256 value calculated at run time with the HMAC SHA-256 value embedded in the fips.so file that was computed at build time. The module performs a KAT for the HMAC SHA-256 algorithm in order to test its proper operation before performing the checksum of the fips.so file.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity test may be invoked on-demand by unloading and subsequently re-initializing the module, or by calling the OSSL_PROVIDER_self_test function. This will perform (among others) the software integrity test. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

Type of Operational Environment: Modifiable How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms, and only the module has control over these SSPs.

The module shall be installed as stated in Section 11 Life-Cycle Assurance. If properly installed, the operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented. Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

The module is comprised of software only and therefore this Section is Not Applicable (N/A). © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

This module does not implement any non-invasive security mechanism, and therefore this Section is not applicable. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

Table 17: Storage Areas The module does not perform persistent storage of SSPs. The SSPs are temporarily stored in the RAM in plaintext form.

s t c s t c m Table 18: SSP Input-Output Methods on the same operational environment. This corresponds to manual distribution, electronic entry/output (“CM Software to/from App via TOEPP Path”) per FIPS 140-3 IG 9.5.A Table 1. There is no entry or output of cryptographically protected SSPs.

© 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module N/A Table 19: SSP Zeroization Methods The application that uses the module is responsible for the appropriate zeroization of SSPs. The module provides key allocation and destruction functions, which overwrites the memory Memory allocation of SSPs is performed by the OPENSSL_malloc() API call and the application in use of the module is responsible for the calling of the appropriate zeroization functions from the OpenSSL API. The zeroization functions then overwrite the memory OPENSSL_cleanse() should be used to overwrite sensitive data such as private keys. All data output is inhibited during zeroization. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

y 112524288 bits - 112256 bits Modulegenerate 204815360 bits - 112256 bits Modulegenerate 204815360 n: 112256 bits 204816384 bits - 112256 bits c © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y n: 102416384 204816384 Modulegenerate

c © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y Modulegenerate P-224, P256, P384, P521 bits 112, 128, Modulegenerate P-224, P256, P384, P521 bits 112, 128, P-224, P256, P384, P521 bits 112, 128, P-224, P256, P384, P521 bits 112, 128, bits - 112256 bits bits - 112256 bits © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits s - N/A bits - 112256 bits n Passwordbased Key bits - 112256 bits bits - 112256 bits Passwordbased Key © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y bits - 112256 bits n bits - 112256 bits bits - 128256 bits © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module y 11215360 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module bits - 112256 bits y Table 20: SSP Table 1 n s t s t Modulegenerated s t Modulegenerated s t © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module n s t s t Modulegenerated s t Modulegenerated s t s t s t Modulegenerated s t © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module n Modulegenerated s t s t s t s t s t s t s t © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module n s t s t s t s t s t s t s t © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module n s s t t t © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module n t t t Table 21: SSP Table 2

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031. © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module

HMACSHA2-256 HMACSHA2-256 HMACSHA2-256 HMACSHA2-256 © 2025 SUSE, LLC/atsec information security corporation.

SUSE Linux Enterprise OpenSSL 3 Cryptographic Module HMACSHA2-256 HMACSHA2-256 HMACSHA2-256 © 2025 SUSE, LLC/atsec information security corporation.