Chainguard FIPS Provider for OpenSSL

Certificate

Approved Algorithms (73)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Chainguard FIPS Provider for OpenSSL
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update<br/>Recovery</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Encryption with AES<br/>Decryption with AES<br/>Show Status</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Chainguard FIPS Provider for OpenSSL
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update<br/>Recovery</i><br/>src: text:keyword"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Encryption with AES<br/>Decryption with AES<br/>Show Status</i><br/>src: securityPolicy.services"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>HTTPS</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C5,C6 clueLow;
  class C3 clueHigh;

Security Policy, page by page

Chainguard, Inc. Chainguard FIPS Provider for OpenSSL Document Version: 1.1 Last Update: 2025-12-27 Prepared by: atsec information security corporation

Austin, TX 78759 www.atsec.com © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table of Contents 1.1 © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL List of Tables © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL List of Figures © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL 1.1 Overview The present document is the non-proprietary FIPS 140-3 Security Policy for the Chainguard FIPS Provider for OpenSSL which will also be referred to as “the module” and “the cryptographic module” throughout this document. This Security Policy specifies the security rules under which the module must operate to meet the FIPS 140-3 Level 1 requirements.

In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

Purpose and Use: The Chainguard FIPS Provider for OpenSSL (hereafter referred to as “the module”) is defined as a software module in a multi-chip standalone embodiment. It is a software library that provides a C language application program interface (API) for use by other applications that require cryptographic functionality. Module Type: Software Module Embodiment: MultiChipStand Module Characteristics: Cryptographic Boundary: The module consists of one software component, the “FIPS provider” i.e., fips.so (depicted in orange color in Figure 1), that forms the module’s cryptographic boundary which implements the FIPS requirements, and the cryptographic functionality. Components depicted in white color in Figure 1 are only included in the diagram for informational purposes. They are not included in the cryptographic boundary (and therefore not part of the module’s validation). For example, the kernel is responsible for managing system calls issued by the module itself, as well as other applications using the module for cryptographic services. Tested Operational Environment’s Physical Perimeter (TOEPP): Figure 1 shows the physical perimeter of the operational environment (a general-purpose computer on which the module is installed) is indicated by a purple dashed line. Figure 1: Block Diagram

Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets): © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL N/A N/A Table 2: Tested Module Identification

• Software, Firmware, Hybrid (Executable Code Sets) Tested Operational Environments - Software, Firmware, Hybrid: m7i.metal24xl N/A N/A m7i.metal24xl N/A N/A Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 4: Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid Note: The CMVP makes no statement as to the correct operation of the module or the security strengths of the generated SSPs when the module is ported if the specific operational environments are not listed on the validation certificate.

There are no components excluded from the requirements of the FIPS 140-3 standard. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

Modes List and Description: NonApproved Table 5: Modes List and Description After passing all pre-operational self-test and cryptographic algorithm self-tests executed on start-up, the module Mode Change Instructions and Status: The module automatically switches between the approved and non-approved modes depending on the services

Approved Algorithms: The table below lists all implemented modes or methods of operation for the approved cryptographic algorithms of the module that are employed for approved services (Approved Services table). © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 6: Approved Algorithms Vendor-Affirmed Algorithms: © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL N/A Table 7: Vendor-Affirmed Algorithms Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 8: Non-Approved, Not Allowed Algorithms © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL 2.0: © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL 2.0: © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyGen AsymKeyPairKeyVer AsymKeyPairKeyVer © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL AsymKeyPairKeyVer © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL unencapsulation Table 9: Security Function Implementations

In accordance with FIPS 140-3 IG C.I, the module implements a check that ensures, before performing any cryptographic operation, that the two AES keys used in AES XTS mode are not identical. As the module does not generate symmetric keys, the check is performed when keys are input into the service APIs. Key_1 and Key_2 shall be generated and/or established independently according to the rules for component symmetric keys from NIST SP 800-133rev2, Section 6.3. In addition, Section 4 of SP 800-38E states that the length of a single data unit encrypted or decrypted with AES XTS shall not exceed 2²⁰ AES blocks, that is 16MB, of data per XTS instance. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit.

The module provides password-based key derivation (PBKDF2), compliant with SP 800-132. The module supports option 1a from Section 5.4 of SP 800-132, in which the Master Key (MK) or a segment of it is used directly as the Data Protection Key (DPK). In accordance with SP 800-132 and FIPS 140-3 IG D.N, the following requirements shall be met:

• Derived keys shall only be used in storage applications. The MK shall not be used for other purposes. The module supports a minimum length of 112 bits for the MK or DPK.
• Passwords or passphrases, used as an input for the PBKDF2, shall not be used as cryptographic keys.
• The minimum length of the password or passphrase supported by the module is 8 characters. Assuming the worst-case scenario of all digits, this results in the estimated probability of guessing the password to be at most 10-8. Combined with the minimum iteration count as described below, this provides an acceptable trade-off between user experience and security against brute-force attacks.
• A portion of the salt, with a length of at least 128 bits (shorter salts are not supported by the module), shall be generated randomly using the SP 800-90Ar1 DRBG provided by the module. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

• The iteration count shall be selected as large as possible, if the time required to generate the key using the entered password is acceptable for the users. The minimum iteration count supported by the module is 1000.

The module offers DH and ECDH shared secret computation services compliant to the SP 800-56ARev3 and meeting IG D.F scenario 2 path (1). To meet the required assurances listed in section 5.6 of SP 800-56Arev3, the module shall be used together with an application that implements the “TLS protocol” and the following steps shall be performed. 1. The entity using the module must use the module's "Key pair generation" service for generating DH/ECDH ephemeral keys. This meets the assurances required by key pair owner defined in the section

2. As part of the module's shared secret computation (SSC) service, the module internally performs the public key validation on the peer's public key passed in as input to the SSC function. This meets the public key validity assurance required by the sections 5.6.2.2.2 of SP 800-56ARev3.
3. The module does not support static keys therefore the "assurance of peer's possession of private key" is not applicable.

The module implements the SHA-3 functions as both standalone functions and as part of higher-level algorithms (in compliance with FIPS 140-3 IG C.C). As detailed in Section 2.6 Security Function Implementations with corresponding certificates, the cryptographic algorithms that use SHA-3 functions include RSA signature generation and verification, ECDSA signature generation and verification, EdDSA signature generation and verification, EdDSA key pair generation, KBKDF, KDA HKDF, X9.63 KDF, X9.42 KDF, PBKDF, OneStep KDA, TwoStep KDA, and HMAC. In addition, the implementation of the extendable output functions SHAKE128 and SHAKE256 were verified to have a standalone usage.

The module utilizes the following legacy algorithms as defined in SP 800-131Arev2:

• SHA-1 for RSA Signature Verification and ECDSA Signature Verification purposes.
• ECDSA Signature Verification, under FIPS 186-4, allows verifying elliptic curve-based signatures with curve P-192.

The module’s RSA signature generation and verification implementations were CAVP tested with moduli sizes 2048, 3072, and 4096 bits. These moduli sizes are allowed by FIPS 140-3 IG C.F. The module supports moduli sizes larger than 4096 bits.

The module’s RSA key generation implementation was CAVP tested with moduli sizes 2048, 3072, 4096, 6144, and 8192 bits. These moduli sizes are allowed by FIPS 140-3 IG C.F. The module supports moduli sizes larger than 8192 bits. The number of Miller-Rabin tests is compliant with Table B.1 of FIPS 186-5. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

The module does not establish SSPs using an approved key transport scheme (KTS). However, it does offer approved authenticated algorithms that can be used by an external operator/application as part of an approved KTS. The module does not establish SSPs using an approved key agreement scheme (KAS). However, it does offer some or all of the underlying KAS cryptographic functionality to be used by an external operator/application as part of an approved KAS.

For TLS 1.2 and 1.3, the module offers the AES GCM implementation per Scenario 1 and 5 of the FIPS 140-3 IG C.H respectively. For TLS 1.2 the module is compliant with SP 800-52r2 Section 3.3.1 and the mechanism for IV generation is compliant with RFC 5288 and 8446. For TLS 1.3 defined in RFC8446, the module supports AES GCM cipher suites from Section 3.3.1 of SP800-52r2. The module does not implement the TLS 1.2 or 1.3 protocol. The module’s implementation of AES GCM is used together with an application that runs outside the module’s cryptographic boundary. The design of the TLS protocol implicitly ensures that the counter (the nonce_explicit part of the IV) does not exhaust the maximum number of possible values for a given session key. In the event the module’s power is lost and restored, the consuming application must ensure that a new key for use with the AES GCM key encryption or decryption under this scenario shall be established. Alternatively, the module also implements GCM with internal IV generation per Scenario 2 of IG C.H. The internally generated IVs are always 96 bits and are generated using the approved DRBG internal to the module’s boundary. The module also provides a non-approved AES GCM encryption service which accepts arbitrary external IVs from the operator. The service can be requested by invoking the EVP_EncryptInit_ex2 API function with a nonNULL IV value. When this is the case, the API will set a non-approved service indicator as described in Section 4.3.

To comply with the assurances found in Section 6.4 of SP 800-56Br2, the operator must use the module in the context of the TLS or SSH protocols. Additionally, the module’s approved key pair generation service (see Section 4.3) must be used to generate RSA key pairs, or the key pairs must be obtained from another FIPS-validated module. As part of this service, the module will internally perform the key pair validation of the generated public key. The operator must use the EVP_PKEY_public_check() API to perform partial public key validation of the peer public key, complying with Section 6.4.2.2 of SP 800-56Br2. The operator must also confirm the peer’s possession of private key by using any method specified in Section 6.4.2.3 of SP 800-56Br2.

Table 10: Entropy Certificates © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL NonPhysical Table 11: Entropy Sources The entropy source is statically compiled into the module and hence it is located within the cryptographic boundary of the module. As per the Public document of entropy certificate E191, the entropy source provides In addition to the DRBG algorithms provided to the operator, the module internally uses two dedicated DRBG instances based on SP 800-90A Rev. 1 to generate seeds for asymmetric key pairs and random numbers for security functions. The following parameters are used:

1. Private DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate secret random values (e.g. during asymmetric key pair generation). It can be accessed using RAND_priv_bytes.
2. Public DRBG: AES-256 CTR_DRBG with derivation function. This DRBG is used to generate general purpose random values that do not need to remain secret (e.g. initialization vectors). It can be accessed using RAND_bytes.

The module implements Cryptographic Key Generation (CKG, vendor affirmed), compliant with SP 800-133r2. When random values are required, they are obtained from the SP 800-90Ar1 approved DRBG of type CTR_DRBG, compliant with Section 4 of SP 800-133r2. This method does not use the value V as described in Additional Comment 2 of FIPS 140-3 IG D.H. The following methods are implemented:

• Safe primes key pair generation: Compliant with SP 800-133r2, Section 5.2, which maps to SP 800-56Ar3.
• RSA key pair generation: Compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-5.
• ECC (ECDH and ECDSA) key pair generation: Compliant with SP 800-133r2, Section 5.1 and Section 5.2, which maps to FIPS 186-5.
• EdDSA key pair generation: Compliant with SP 800-133r2, Section 5.1, which maps to FIPS 186-5. Intermediate key generation values are not output from the module and are explicitly zeroized after processing the service. Additionally, the module implements the following key derivation methods, per SP 800-133r2, Section 6.2:
• KBKDF: compliant with SP 800-108r1. This implementation can be used to derive secret keys from a pre-existing key-derivation-key.
• KDA OneStep, KDA TwoStep, HKDF: compliant with SP 800-56Cr2. These implementations shall only be used to derive secret keys in the context of an SP 800-56Ar3 key agreement scheme. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

• ANS X9.42 KDF (CVL), ANS X9.63 KDF (CVL): compliant with SP 800-135r1. These implementations shall only be used to derive secret keys in the context of an ANS X9.42-2001 resp. ANS X9.63- 2001 key agreement scheme. SSH KDF (CVL), TLS 1.2 KDF (CVL), TLS 1.3 KDF (CVL): compliant with SP 800-135r1 and RFC 8446. These implementations shall only be used to derive secret keys in the context of the SSH, TLS 1.2, or TLS 1.3 protocols, respectively. PBKDF2: compliant with option 1a of SP 800-132. This implementation shall only be used to derive keys for use in storage applications.

The module implements key establishment methods as listed in the Security Function Implementations table in Section 2.6.

The module implements the SSH KDF (CVL) for use in the SSH protocol (RFC 4253 and RFC 6668). GCM with internal IV generation in the approved mode is compliant with versions 1.2 and 1.3 of the TLS protocol (RFC

5288 and 8446) and shall only be used in conjunction with the TLS protocol. Additionally, the module implements

the TLS 1.2 and TLS 1.3 key derivation functions for use in the TLS protocol. For Diffie-Hellman, the module supports the use of the safe primes defined in RFC 3526 (IKE) and RFC 7919 (TLS). Note that the module only implements key pair generation, key pair verification, and shared secret computation. No other part of the IKE or TLS protocols is implemented (except for the TLS 1.2 KDF (CVL) and

• IKE (RFC 3526): MODP-2048 (ID = 14), MODP-3072 (ID = 15), MODP-4096 (ID = 16), MODP-6144 (ID = 17), MODP-8192 (ID = 18)
• TLS (RFC 7919): ffdhe2048 (ID = 256), ffdhe3072 (ID = 257), ffdhe4096 (ID = 258), ffdhe6144 (ID = 259), ffdhe8192 (ID = 260) For Elliptic Curve Diffie-Hellman, the module supports the NIST-defined P-224, P-256, P-384, and P-521 curves. No parts of the SSH, TLS, or IKE protocols, other than those mentioned above, have been tested by the CAVP or CMVP. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

N/A N/A N/A N/A Table 12: Ports and Interfaces As a software-only module, the module does not have physical ports. The module does not implement a control © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

The module does not implement any authentication methods.

Table 13: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module when performing a service. The module does not support multiple concurrent operators.

s a e t a W,E t a t W,E W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL a s t W,E e W,E a e W,E a e W,E n n n W,E G,R © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s n keyderivati KeyDeriva n - KeyDerivati W,E G,R n n G,R W,E n n W,E G,R n n W,E G,R © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s n p n W,E p G,R n p n W,E p G,R n n W,E G,R n n d: W,E G,R © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s m W,E G,E (V, G,W,E (V, C): G,W,E a 1; G,R W,E W,E W,E W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s W,E W,E a W,E a W,E a W,E e, W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s e, W,E G,R G,R G,E,Z e, W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s G,R G,R G,R G,R G,E,Z © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s G,E,Z G,R G,R G,E,Z W,E W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s W,E W,E selftests W,E W,E © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s n n n © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s n n n n n © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s - KeyDerivati Z Z d: Z p p © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s (V, © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s Z © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL s (V, C): Z W,E Key unencapsul Unencaps unencaps Unencapsu Key unencapsul W,E Table 14: Approved Services The module provides services to operators that assume the available role. All services are described in detail in the API documentation (manual pages). The Approved Services table defines the services that utilize approved security functions in this module. For the respective tables, the convention below applies when specifying the access permissions (types) that the service has for each SSP.

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g., the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.
• Zeroize (Z): The module zeroizes the SSP. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL To interact with the module, a calling application must use the EVP API layer provided by OpenSSL. This layer will delegate the request to the FIPS provider, which will in turn perform the requested service. Additionally, this EVP API layer can be used to retrieve the approved service indicator for the module. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 15: Non-Approved Services

The module does not have the capability of loading software or firmware from an external source. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

The integrity of the module is verified by comparing a HMAC-SHA2-256 value calculated at runtime with the HMAC-SHA2-256 value embedded in the fips.so file that was computed at build time.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity tests can be invoked on demand by unloading and subsequently re-initializing the module (i.e., rebooting the system), which will perform (among others) the software integrity tests. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

Type of Operational Environment: Modifiable How Requirements are Satisfied: Any SSPs contained within the module are protected by the process isolation and memory separation mechanisms, and only the module has control over these SSPs. If the operating system is properly installed, it provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

Instrumentation tools like the ptrace system call, gdb and strace, userspace live patching, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environment. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

The module is comprised of software only, and therefore this section is not applicable. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

The module does not implement any non-invasive security mechanisms. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

Table 16: Storage Areas SSPs are provided to the module by the calling process and are destroyed when released by the appropriate zeroization function calls. Table 17: SSP Input-Output Methods operational environment. This corresponds to manual distribution, electronic entry/output (“CM Software to/from App via TOEPP Path”) per FIPS 140-3 IG 9.5.A Table 1. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL N/A Table 18: SSP Zeroization Methods All data output is inhibited during zeroization. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL bits - 112256 bits bits - 112256 bits KeyDerivation bits - 112256 bits bits - 112256 bits passwordbased © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL passwordbased bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits 1.2 © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL a (V, V V a a a © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL MODP2048, MODP3072, MODP4096, MODP6144, MODP8192 - 112200 bits MODP2048, MODP3072, MODP4096, MODP6144, MODP8192 - 112200 bits © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL bits - 112256 bits unencapsulation bits - 112256 bits MODP2048, MODP3072, MODP4096, © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL MODP6144, MODP8192 - 112200 bits MODP2048, MODP3072, MODP4096, MODP6144, MODP8192 - 112200 bits bits - 112256 bits bits - 112256 bits bits - 112256 bits © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 19: SSP Table 1 © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL (V, © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 20: SSP Table 2

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes, starting January 1, 2031. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the tests are successfully completed. The module does not return control to the calling application until the tests are completed. If any of these tests fail, the module transitions to the error state.

HMACSHA2-256 Table 21: Pre-Operational Self-Tests The pre-operational software integrity tests are performed automatically when the module is powered on, before the module transitions to the operational state.

© 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL KAS-ECCSSC Sp80056Ar3 KAS-FFCSSC Sp80056Ar3 KDF SP800108 © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL 24character © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL N/A & & & © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL 80056ARev3, 5.6.2.1.4 Table 22: Conditional Self-Tests

Table 23: Pre-Operational Periodic Information © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL Table 24: Conditional Periodic Information

Table 25: Error States In any error state, the output interface is inhibited, and the module cannot perform cryptographic operations.

The software integrity test and cryptographic algorithm self-tests can be invoked on demand by unloading and subsequently re-initializing the module. The PCTs can be invoked on demand by requesting the key pair generation service. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

All configuration items are uniquely identified by a compound value consisting of the package apk full version and revision number plus architecture with the git commit SHA1 value.

No installation, initialization, or startup steps are required as the module is pre-built into the images that the vendor provides.

To verify that the module is prebuilt into a Chainguard image, the Crypto Officer must review the image specification (e.g. Chainguard Console SBOM tab, SPDX image attestation, apk installed package database, syft output, AWS Inspector) to ensure it contains the package “openssl-fips-provider-3.4.0” version “3.4.0-r4”. The Crypto Officer must verify the name and version of the module. This is done by retrieving the parameters OSSL_PROV_PARAM_NAME and OSSL_PROV_PARAM_BUILDINFO from the module. Since there can be several providers for OpenSSL, and since only the “fips” provider is the module, the Crypto Officer must ensure that the “fips” provider of OpenSSL is queried when retrieving these parameters and when requesting any other services. OSSL_PROV_PARAM_NAME must have the value: “Chainguard FIPS Provider for OpenSSL” OSSL_PROV_PARAM_BUILDINFO must have the value: “3.4.0-r4” The Approved and non-Approved modes of operation are specified in section 2.4. The administrative functions are specified in the Approved Services table. All the logical interfaces are specified in section 3.1. The requirements and restrictions that shall be considered when operating the module in approved mode are specified in section 2.7 and section 6.

There is no non-administrator guidance.

As the module does not persistently store SSPs, secure sanitization of the module consists of unloading the module. This will zeroize all SSPs in volatile memory. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL

Certain cryptographic subroutines and algorithms are vulnerable to timing analysis. The module mitigates this vulnerability by using constant-time implementations. This includes, but is not limited to:

• Big number operations: computing GCDs, modular inversion, multiplication, division, and modular exponentiation (using Montgomery multiplication).
• Elliptic curve point arithmetic: addition and multiplication (using the Montgomery ladder).
• EdDSA implementations
• Vector-based AES implementations.

RSA, ECDSA, ECDH, and DH employ blinding techniques to further impede timing and power analysis.

No configuration is needed to enable the aforementioned countermeasures. © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL A Glossary and Abbreviations AES Advanced Encryption Standard AESNI Advanced Encryption Standard New Instructions API Application Programming Interface CAST Cryptographic Algorithm Self-Test CAVP Cryptographic Algorithm Validation Program CBC Cipher Block Chaining CBC-MAC Cipher Block Chaining Message Authentication Code CCM Counter with Cipher Block Chain-Message Authentication Code CCP Cryptographic Co-Processor CFB Cipher Feedback CKG Cryptographic Key Generation CMAC Cipher-based Message Authentication Code CMVP Cryptographic Module Validation Program CSP Critical Security Parameter CTR Counter CTS Ciphertext Stealing DH Diffie-Hellman DRBG Deterministic Random Bit Generator ECB Electronic Code Book ECC Elliptic Curve Cryptographic ECDH Elliptic Curve Diffie-Hellman ECDSA Elliptic Curve Digital Signature Algorithm EVP Envelope FFC Finite Field Cryptography FIPS Federal Information Processing Standards GCM Galois Counter Mode GMAC Galois Counter Mode Message Authentication Code HMAC Keyed-Hash Message Authentication Code IG International Guidance IKE Internet Key Exchange IV Initialization Vector © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL KAS Key Agreement Scheme KAT Known Answer Test KBKDF Key-Based Derivation Function KMAC KECCAK Message Authentication Code KW Key Wrap KWP Key Wrap with Padding MAC Message Authentication Code NIST National Institute of Science and Technology OEAP Optimal Asymmetric Encryption Padding OFB Output Feedback PAA Processor Algorithm Acceleration PBKDF2 Password-based Key Derivation Function v2 PCT Pair-wise Consistency Test PKI Public Key Infrastructure PSP Public Security Parameter PSS Probabilistic Signature Scheme RSA Rivest Shamir Adleman RSADP RSA Decryption Primitive RSAEP RSA Encryption Primitive SHA Secure Hash Algorithm SHAKE Secure Hash Algorithm with Keccak SSC Shared Secret Computation SSH Secure Shell SSP Sensitive Security Parameter TLS Transport Layer Security TOEPP Tested Operational Environment’s Physical Perimeter XOF Extendable Output Function XTS XEX-based Tweaked-codebook mode with cipher text Stealing © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL B References ANS X9.42-2001 Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography 2001 https://webstore.ansi.org/standards/ascx9/ansix9422001 ANS X9.63-2001 Public Key Cryptography for the Financial Services Industry, Key Agreement and Key Transport Using Elliptic Curve Cryptography 2001 https://webstore.ansi.org/standards/ascx9/ansix9632001 FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validationprogram/documents/fips%20140-3/FIPS%20140-3%20IG.pdf FIPS 180-4 Secure Hash Standard (SHS) August 2015 https://doi.org/10.6028/NIST.FIPS.180-4 FIPS 186-4 Digital Signature Standard (DSS) July 2013 https://doi.org/10.6028/NIST.FIPS.180-4 FIPS 186-5 Digital Signature Standard (DSS) February 2023 https://doi.org/10.6028/NIST.FIPS.186-5 FIPS 197 Advanced Encryption Standard (AES) November 2001; Updated May 2023 https://doi.org/10.6028/NIST.FIPS.197-upd1 FIPS 198-1 The Keyed-Hash Message Authentication Code (HMAC) July 2008 https://doi.org/10.6028/NIST.FIPS.198-1 FIPS 202 SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions August 2015 https://doi.org/10.6028/NIST.FIPS.202 PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 http://www.ietf.org/rfc/rfc3447.txt RFC 3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE) May 2003 https://www.ietf.org/rfc/rfc3526.txt © 2025 Chainguard, Inc., atsec information security.

Chainguard FIPS Provider for OpenSSL RFC 5288 AES Galois Counter Mode (GCM) Cipher Suites for TLS August 2008 https://www.ietf.org/rfc/rfc5288.txt RFC 7919 Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS) August 2016 https://www.ietf.org/rfc/rfc7919.txt RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3 August 2018 https://www.ietf.org/rfc/rfc8446.txt SP 800-90Ar1 Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 https://doi.org/10.6028/NIST.SP.800-90Ar1 SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://doi.org/10.6028/NIST.SP.800-90B SP 800-108r1 Recommendation for Key Derivation Using Pseudorandom Functions August 2022; Updated February 2024 https://doi.org/10.6028/NIST.SP.800-108r1-upd1 SP 800-131Ar2 Transitioning the Use of Cryptographic Algorithms and Key Lengths March 2019 https://doi.org/10.6028/NIST.SP.800-131Ar2 SP 800-133r2 Recommendation for Cryptographic Key Generation June 2020 https://doi.org/10.6028/NIST.SP.800-133r2 SP 800-140Br1 Cryptographic Module Validation Program (CMVP) Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B November 2023 https://doi.org/10.6028/NIST.SP.800-140Br1 © 2025 Chainguard, Inc., atsec information security.

Referenced URLs

• www.atsec.com
• https://webstore.ansi.org/standards/ascx9/ansix9422001
• https://webstore.ansi.org/standards/ascx9/ansix9632001
• https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-
• https://doi.org/10.6028/NIST.FIPS.180-4
• https://doi.org/10.6028/NIST.FIPS.186-5
• https://doi.org/10.6028/NIST.FIPS.197-upd1
• https://doi.org/10.6028/NIST.FIPS.198-1
• https://doi.org/10.6028/NIST.FIPS.202
• http://www.ietf.org/rfc/rfc3447.txt
• https://www.ietf.org/rfc/rfc3526.txt
• https://www.ietf.org/rfc/rfc5288.txt
• https://www.ietf.org/rfc/rfc7919.txt
• https://www.ietf.org/rfc/rfc8446.txt
• https://doi.org/10.6028/NIST.SP.800-90Ar1
• https://doi.org/10.6028/NIST.SP.800-90B
• https://doi.org/10.6028/NIST.SP.800-108r1-upd1
• https://doi.org/10.6028/NIST.SP.800-131Ar2
• https://doi.org/10.6028/NIST.SP.800-133r2
• https://doi.org/10.6028/NIST.SP.800-140Br1