ASTRO CDEM Motorola Advanced Crypto Engine (MACE) (reconstructed)

Certificate

Standard	FIPS 140-3
Overall level	3
Module type	Hardware
Embodiment	Single Chip
Status	Active
Sunset date	1/22/2031
Caveat	When installed, initialized and configured as specified in Section 11 of Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Vendor	Motorola Solutions, Inc.

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for ASTRO CDEM Motorola Advanced Crypto Engine (MACE)
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

Underlying clues

flowchart LR
  %% Deterministic clue tier for ASTRO CDEM Motorola Advanced Crypto Engine (MACE)
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>no library/version identified</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Page 1 ↑

Motorola Solutions, Inc. ASTRO CDEM Motorola Advanced Crypto Engine (MACE) Document Version: R01.00.00 Date: January 16, 2025 Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 2 ↑

Table of Contents

#	Section	Page

Page 3 ↑

Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 4 ↑

List of Tables

Item	Page
Table 1: Security Levels	5
Table 2: Tested Module Identification – Hardware	8
Table 3 – Approved Mode Drop-in Algorithms	8
Table 4: Modes List and Description	9
Table 5: Approved Algorithms	10
Table 6: Vendor-Affirmed Algorithms	10
Table 7: Non-Approved, Allowed Algorithms with No Security Claimed	11
Table 8: Security Function Implementations	13
Table 9: Entropy Certificates	14
Table 10: Entropy Sources	14
Table 11: Ports and Interfaces	16
Table 12: Authentication Methods	18
Table 13: Roles	18
Table 14: Approved Services	25
Table 15: Mechanisms and Actions Required	29
Table 16: EFP/EFT Information	29
Table 17: Hardness Testing Temperatures	30
Table 18: Storage Areas	32
Table 19: SSP Input-Output Methods	32
Table 20: SSP Zeroization Methods	33
Table 21: SSP Table 1	35
Table 22: SSP Table 2	37
Table 23: Pre-Operational Self-Tests	38
Table 24: Conditional Self-Tests	40
Table 25: Pre-Operational Periodic Information	40
Table 26: Conditional Periodic Information	41
Table 27: Error States	42
Table 28 References	45
Table 29 Acronyms and Definitions	45
Figure 1 – ASTRO CDEM MACE IC (Top)	6
Figure 2 – ASTRO CDEM MACE IC (Interfaces)	7
Figure 3 – Cryptographic Boundary	7

Page 5 ↑

requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 1403) for an overall Security Level 3 module.

1.2 Security Levels

The FIPS 140-3 security levels for the Module are as follows from Table 1: Section Title Security Level

1 General 3

2 Cryptographic module specification 3

3 Cryptographic module interfaces 3

4 Roles, services, and authentication 3

5 Software/Firmware security 3

6 Operational environment N/A

7 Physical security 3

8 Non-invasive security N/A

9 Sensitive security parameter management 3

10 Self-tests 3

11 Life-cycle assurance 3

12 Mitigation of other attacks N/A

Overall Level 3 Table 1: Security Levels Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 6 ↑

2 – Cryptographic Module Specification

This document covers the Motorola Solutions ASTRO CDEM MACE module, hereafter denoted as the Module. The Module is implemented as a single-chip cryptographic module to meet FIPS 140-3 level 3 physical security requirements as defined by FIPS 140-3. The ASTRO CDEM MACE provides key storage and generation and performs all crypto processing for the Motorola Solutions ASTRO CDEM product.

2.1 Description

Purpose and Use: The Module is intended for use by US Federal agencies or other markets that require FIPS 140-3 validated overall Security Level

The Module is intended to be used in ASTRO CDEM unit. Module Type: Hardware Module Embodiment: SingleChip Cryptographic Boundary: The physical form of the Module is depicted in Figure 1 and Figure
The Module is a single-chip embedded embodiment. The cryptographic boundary is shown in Figure
Figure 1 – ASTRO CDEM MACE IC (Top) Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Page 7 ↑

Figure 2

ASTRO CDEM MACE IC (Interfaces) Power IRQ/FIQ Clock ASTRO CDEM MACE RAM Interface Reset Tamper SSI Ethernet RS232 KVL Front Panel LED Indicators: Alarm, Interface Interface Interface Port Interface Interface Power, Ready, Tx Clear, Status Figure 3
Cryptographic Boundary Motorola Solutions Public Material
May be reproduced only in its original entirety (without revision).

Page 8 ↑

2.2 Tested and Vendor Affirmed Module Version and Identification

Tested Module Identification

Hardware: The ASTRO CDEM MACE cryptographic module is tested on the following operational environment. Model and/or Part Hardware Version Firmware Version Processors Features Number ASTRO 5185912Y03, R03.01.02 with Motorola Advanced CDEM 5185912Y05, AES-256 DIA Crypto Engine N/A MACE 5185912T05 R01.00.07 (MACE) Table 2: Tested Module Identification
Hardware The ASTRO CDEM MACE cryptographic module supports the following approved algorithms which may be installed separately from the MACE base firmware using the program update service. While the installation of AES may be done separately, for the purposes of this validation the MACE includes this firmware Table 3
Approved Mode Drop-in Algorithms Algorithm* Algorithm FW Version Base FW Version Cert. # AES256 R01.00.07 R03.01.02 A5275 N/A for this module. N/A for this module. N/A for this module. N/A for this module.

2.3 Excluded Components

The module does not exclude any components from the cryptographic boundary.

2.4 Modes of Operation

Modes List and Description: Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 9 ↑

Mode Status Description Type Name Indicator approved Operating in approved mode Approved Display output Table 4: Modes List and Description The ASTRO CDEM MACE is originally non-compliant and must be configured to operate in an approved mode of operation. The MACE must be installed, initialized and configured, including a required change of the factory-default password in order to be in an approved mode. Documented below are the additional configuration settings that are required for the MACE to be used in an Approved Mode of operation at overall Security Level

The approved mode is indicated by using the “Set FIPS Mode” service. The result from this service will display: Encrypted only Key fill is Enabled. Module is operating in FIPS 140-3 Level 3 approved mode When the module is in the approved operating mode, the “Module Status” service can be used to verify the firmware version matches an approved version listed on NIST’s website: https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules Mode Change Instructions and Status: The module can be configured to operate in a FIPS 140-3 Approved mode of operation at overall Security Level
To configure the module to operate in Approved mode, the operator must log in as the CO using the default password and:
Change the default password
Activate and configure the periodic self-test timer
Type the command “fips enable” to configure the Module into approved mode(Level 3). Additionally, the Module supports a “drop-in algorithm” via the Program Update service. Drop-in algorithms may be added or removed from the Module independent of the base FW. In order to remain in the Approved Mode, only Approved algorithms may be loaded into the Module, in particular AES-256 (Cert. # A5275). The loading and unloading of any firmware within the validated cryptographic module invalidates the Module’s validation and zeroizes all SSPs except those entered at manufacturing. The Module is then in a non-compliant state. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Page 10 ↑

2.5 Algorithms

Approved Algorithms: The Module implements the Approved cryptographic algorithms listed in the table below. CAVP Algorithm Properties Reference Cert Direction - Decrypt, Encrypt AES-CBC A5273 SP 800-38A Key Length - 256 Direction - Decrypt, Encrypt AES-CBC A5275 SP 800-38A Key Length - 256 Direction - Decrypt, Encrypt AES-CFB8 A5273 SP 800-38A Key Length - 256 Direction - Decrypt, Encrypt AES-ECB A5275 SP 800-38A Key Length - 256 Direction - Decrypt AES-KW A5438 SP 800-38F Key Length - 256 Direction - Decrypt, Encrypt AES-OFB A5273 SP 800-38A Key Length - 256 Direction - Decrypt, Encrypt AES-OFB A5275 SP 800-38A Key Length - 256 Prediction Resistance - No SP 800-90A Counter DRBG A5437 Mode - AES-256 Rev. 1 Derivation Function Enabled - Yes RSA SigVer Modulo - 2048 A5253 FIPS 186-5 (FIPS186-5) Signature Type - pkcs1v1.5 Message Length - Message Length: 0SHA2-256 SHS 817 FIPS 180-4

51200 Increment 8

Table 5: Approved Algorithms ApprovedAlgorithmsTable From Web Cryptik ApprovedAlgorithmsTable Vendor-Affirmed Algorithms: The Module implements the FIPS Vendor Affirmed cryptographic algorithms listed. Name Properties Implementation Reference Key SP800-133rev2 Sections 4 example 1 CKG N/A Type:Symmetric and IG D.H CKG - Key SP800-133rev2 Sections 6.3 #2 and IG N/A IDK Type:Symmetric C.I Table 6: Vendor-Affirmed Algorithms Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 11 ↑

Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: The Module implements the FIPS Non-Approved, Allowed cryptographic Algorithms with No Security Claimed. Name Caveat Use and Function [IG 2.4.A] P25 AES OTAR. AES MAC is applied No Security Claimed. AES directly to the plaintext OTAR key components and AES MAC is used as part of then KTS encryption is performed on the OTAR key MAC OTAR but is considered components and decrypted within the module using obfuscation. AES KW Cert #5438 Table 7: Non-Approved, Allowed Algorithms with No Security Claimed Non-Approved, Not Allowed Algorithms: N/A for this module. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 12 ↑

2.6 Security Function Implementations

The following table shows the Security Function Implementations that the module implements: Name Type Description Properties Algorithms AES-CBC: (A5275) AES A5275 Encryption BC-UnAuthEncrypt Block Cipher AES-OFB: (A5275) AES-ECB: (A5275) AES-CBC: (A5275) AES A5275 Decryption BC-UnAuthDecrypt Block Cipher AES-OFB: (A5275) AES-ECB: (A5275) Counter DRBG: Symmetric Key Key Generation CKG (A5437) Generation CKG : () Digital Signature RSA SigVer (FIPS186Signature Verification DigSig-SigVer Verification 5): (A5253) Entropy ENT-ESV Entropy Source Caveat:Key establishment methodology provides Key Transport AES-KW: (A5438) KTS-Unwrap KTS-Unwrap 256 bits strength Unwrapping AES MAC: () Standard:SP 800-38F IG D.G:Approved method in KW mode SHA SHA Secure Hash Standard SHA2-256: (SHS 817) AES-CFB8: (A5273) AES A5273 Encryption BC-UnAuthEncrypt Block Cipher AES-CBC: (A5273) AES-OFB: (A5273) AES-CFB8: (A5273) AES A5273 Decryption BC-UnAuthDecrypt Block Cipher AES-CBC: (A5273) AES-OFB: (A5273) Symmetric Key IDK Generation CKG CKG - IDK: () Generation Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 13 ↑

Name Type Description Properties Algorithms AES-256 CTR Counter DRBG: DRBG DRBG Deterministic RBG (A5437) Table 8: Security Function Implementations Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 14 ↑

2.7 Algorithm Specific Information

The module does not have any algorithm specific information.

2.8 RBG and Entropy

Cert Vendor Name Number E132 Motorola Solutions Inc Table 9: Entropy Certificates The Module uses the following entropy sources: Entropy Operational Sample Conditioning Name Type per Environment Size Component Sample Motorola Solutions Advanced Atmel Crypto Engine Entropy Physical 1 bit 0.13862 N/A 5186912 Source Table 10: Entropy Sources

2.9 Key Generation

For Key Generation methods, see Section 2.6 Security Function Implementations above.

2.10 Key Establishment

For Key Establishment methods, see Section 2.6 Security Function Implementations above.

2.11 Industry Protocols

The module does not implement any Industry Protocols Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 15 ↑

3 Cryptographic Module Interfaces

3.1 Ports and Interfaces

The Module’s ports and associated FIPS defined logical interface categories are listed below. Logical Physical Port Data That Passes Interface(s) Data Input Data Output Synchronous Control Provides an interface to the unprotected network and entry of Interface (SSI) Input the Crypto Officer password in encrypted form. Status Output Data Input Data Output This interface routes packets between subnets. The IP stack Ethernet Port Control of this interface will use the subnet information to determine (EP) Input how to route packets between physical network interfaces. Status Output Data Output Control RS232 Provides an interface for factory programming and execution Input Interface of RS232 shell commands. Status Output Data Input Data Output Provides an interface to the Key Variable Loader. The Traffic Key Variable Control Encryption Key (TEK) is entered in encrypted form over the Loader (KVL) Input KVL interface. Status Output Data Input Data Output Control This interface provides storage for non-security related stack RAM Input information. Status Output Power Power This interface powers all circuitry. Tamper Control The interface is used for zeroization of Traffic Encryption Interface Input Keys (TEKs), KPK. Control Reset Interface This interface forces a reset of the module. Input Alarm LED Status The Alarm LED output is used to drive the external Alarm output Output LED red to indicate a fatal error has been detected. Power LED Status The Power LED output is used to drive the external Power output Output LED green when power is supplied to the module. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 16 ↑

Logical Physical Port Data That Passes Interface(s) The Ready LED output is used to drive the external Ready Ready LED Status LED green when the module is ready to communicate with a output Output KVL. TX Clear LED Status The TX Clear LED output is used to drive the external TX output Output Clear LED orange when a "Bypass Rule" is programmed. The Status LED output is used to drive the external Status LED green to indicate a good battery, and a Traffic Encryption Key (TEK) has been loaded. The Status LED Status LED Status output is used to drive the external Status LED yellow to output Output indicate a good battery, but no Traffic Encryption Key (TEK) has been loaded. The Status LED output is used to drive the external Status LED red to indicate a low or dead battery. Control IRQ/FIQ External interrupts. Input Control Clock Clock input Input Table 11: Ports and Interfaces Note: The module does not support Control Output. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 17 ↑

4 Roles, Services, and Authentication

4.1 Authentication Methods

Metho Security d Description Mechanis Strength Each Attempt Strength per Minute Name m The password requires a minimum of 1 Upper case, 1 Lower case, 1 IdentityNumerical and 1 special based. character. Since the Crypto-Officer minimum password Password: a length is 15 ASCII 15-16 ASCII printable characters and After the CO password (printable) there are 95 ASCII has been incorrectly characters printable characters, the entered 10 consecutive password is probability of a times, the Module will authenticated successful random erase all CSPs, reset to gain access attempt is 1 in the CO password back to Crypto{(10)*(262)*(32)*(9511)}, to the default and set an Officer SHA2-256 AM1 The password requires a alarm, at which time the services (SHS 817) minimum of 1 Upper module must be power assocaited to case, 1 Lower case, 1 cycled to become the RS232 Numerical and 1 special operational again. The Interface. It character. Since the strength per minute is 10 should be minimum password in noted that length is 15 ASCII {(10)*(262)*(32)*(95^11) after printable characters and } authenticating there are 95 ASCII , this printable characters, the password may probability of a be changed at successful random any time. attempt is 1 in {(10)*(262)*(32)*(95^11) } Identity After the CO password based. has been incorrectly Crypto-Officer entered 15 consecutive Password: a The minimum password times, the Module will

10 length is 10 hex digits. erase all CSPs, and set

SHA2-256 AM2 hexadecimal The probability of a an alarm, at which time (SHS 817) digit long successful random the module must be password is attempt is 10^16 power cycled to become authenticated operational again. The to gain access strength per minute is to Crypto 15x10^16. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 18 ↑

Metho Security d Description Mechanis Strength Each Attempt Strength per Minute Name m Officer services associated to the Synchronous Interface (SSI) port. It should be noted that after authenticating , this password may be changed at any time. Table 12: Authentication Methods

4.2 Roles

The Module supports one distinct operator role, the Cryptographic Officer (CO). The authentication method and services available to the CO will depend on the physical port used. The CO may be logged into both ports at the same time. In addition, the Module supports services which do not require authentication (UA). The Roles Table below lists all operator roles supported by the Module. The Module does not support concurrent operators. Name Type Operator Type Authentication Methods Crypto-Officer (AM1) Identity CO AM1 Crypto-Officer (AM2) Identity CO AM2 Table 13: Roles

4.3 Approved Services

All approved services implemented by the Module are listed in the table below: The SSPs modes of access shown in the table below are defined as:

G = Generate: The Module generates or derives the SSP.
R = Read: The SSP is read from the Module (e.g., the SSP is output).
W = Write: The SSP is updated, imported, or written to the Module (SSP is input).
E = Execute: The Module uses the SSP in performing a cryptographic operation. Motorola Solutions Public Material
May be reproduced only in its original entirety (without revision).

Page 19 ↑

Z = Zeroize: The Module zeroizes the SSP Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns Update the ASTRO CDEM MACE firmware. Firmware Cryptoupgrades Officer are (AM2) authenticat - FW-LDed using a Pub: Z digital - BKK: Z signature. - IDK: Z Approv The AES - PEK: Z ed The ASTRO Program A5273 - KPK: Z mode CDEM Update Decrypti - KEK: Z Program indicat Firmware MACE is Public on - TEK: Z Update or and Image upgraded to Signature IDK - IDK-ROM: service new Key is used Generati Z status firmware. to validate on - IDK-Block: output the Z signature of - CO PWD the (AM1): Z firmware - CO PWD image (AM2): Z being - PWD Hash: loaded Z before it is allowed to be executed using AM2. CryptoApprov Officer Generate ed The DRBG (AM2) Entropy into mode is seeded - DRBGGenerate the ASTRO indicat and DRBG Seed Entropy EI/Seed: G Entropy CDEM or and initialized. - DRBGMACE service Success/fail State: G using AM2. status ure status - DRBGoutput nonce: G Approv Decrypted CryptoLoad keys AES ed keys that Officer into the Encrypted A5273 OTEK mode were (AM2) ASTRO Keys Decrypti indicat imported - KEK: E CDEM on or and encrypted - TEK: E Motorola Solutions Public Material
May be reproduced only in its original entirety (without revision).

Page 20 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns MACE service into the using AM2. status ASTRO output CDEM MACE. Success/fail ure status. CryptoOfficer Modify the SHA Approv (AM1) current AES ed - PEK: E password Updated the A5273 Change mode - KPK: G,E,Z used to CO Encrypti CO indicat - KEK: Z identify and Password password. on Password or and - TEK: Z authenticat Success/fail AES (AM1) service - CO PWD e the CO ure status A5273 status (AM1): role using Decrypti output G,E,Z AM1. on - PWD Hash: G,E,Z CryptoOfficer Modify the SHA Approv (AM2) current AES ed - PEK: E password Updated the A5273 Change mode - KPK: G,E,Z used to CO Encrypti CO indicat - KEK: Z identify and Password password. on Password or and - TEK: Z authenticat Success/fail AES (AM2) service - CO PWD e the CO ure status. A5273 status (AM2): role using Decrypti output G,E,Z AM2. on - PWD Hash: G,E,Z Approv ed Cryptomode Officer indicat Validate the SHA (AM1) or and Successful current AES - PEK: E service authenticatio password A5273 - KPK: G,E,Z Validate status n will allow used to Encrypti - KEK: Z CO output access to identify and Password on - TEK: Z Password Approv the services authenticat AES - CO PWD (AM1) ed allowed for e the CO A5273 (AM1): Z mode CO role role using Decrypti - CO PWD indicat (AM1). AM1. on (AM2): Z or and - PWD Hash: service Z status output Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 21 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns CryptoOfficer Validate the SHA (AM2) Approv Successful current AES - PEK: E ed authenticatio password A5273 - KPK: G,E,Z Validate mode n will allow used to Encrypti - KEK: Z CO indicat access to identify and Password on - TEK: Z Password or and the services authenticat AES - CO PWD (AM2) service allowed for e the CO A5273 (AM1): Z status CO role role using Decrypti - CO PWD output (AM2). AM2. on (AM2): Z - PWD Hash: Z Approv ed Exits Logout mode command CO/Exits CryptoLogout indicat shell Command In command None Officer CO (AM1) or and interface shell (AM1) service using AM1. interface status output Approv ed mode CryptoLogout indicat Reboot/Comm CO Logout Logout CO None Officer CO (AM2) or and and In (AM2) service status output CryptoOfficer Approv (AM2) ed - TEK: E mode AES - KEK: E Encrypt Ciphertext. indicat A5275 - KPK: E Encrypt data using Plaintext Success/fail or and Encrypti - DRBGAM2. ure status. service on EI/Seed: E status - DRBGoutput State: E - DRBGnonce: E Approv Cryptoed AES Officer Decrypt Plaintext. mode A5275 (AM2) Decrypt data using Ciphertext Success/fail indicat Decrypti - TEK: E AM2. ure status. or and on - KEK: E service - KPK: E Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 22 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns status output Approv Provide ed Module HW firmware mode version, CryptoModule version, indicat version Command in None Officer Status current or and information, (AM1) FIPS status service and FIPS using AM1. status status. output AES A5275 Encrypti on Perform AES module A5275 self-tests Decrypti comprised on of Key cryptograph Generati ic algorithm on tests, Signatur CryptoApprov firmware e Officer ed integrity Verificati (AM1) mode test, and Power on - FW-LDindicat Success/Re Self-Tests critical on/Command Entropy Pub: E or and set. functions In KTS- Unauthentic service test. Unwrap ated status Initiated by SHA - FW-LDoutput module AES Pub: E reset or A5273 transition Encrypti from power on off state to AES power on A5273 state using Decrypti AM1 or UA. on IDK Generati on DRBG Set Approv Updated Cryptoconfiguratio ed module Officer Module n mode Configuration configuratio (AM1) Configurat None parameters indicat parameters n. - KPK: G,E,Z ion used to or and Success/fail - KEK: Z specify service ure status. - TEK: Z Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 23 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns module status - CO PWD behavior output (AM1): W,Z using AM1. - PWD Hash: W,Z - CO PWD (AM2): W,Z Approv Updated ed Update module mode module approved CryptoSet FIPS indicat Configuration approved mode/Displa None Officer Mode or and parameters mode using y current (AM1) service AM1. approved status mode output Set configuratio Approv n ed Updated parameters mode OTEK CryptoConfigure used for indicat Configuration configuratio None Officer OTEK communicat or and parameters n. (AM1) ion with the service Success/fail KMF for status ure status. OTEK using output AM1. Provides Approv module ed firmware mode Show CryptoVersion and indicat Command In module None Officer Query hardware or and version info (AM1) version service numbers status using AM1. output Approv ed Key is mode Mark key marked for CryptoDelete indicat for deletion Command In deletion. None Officer Key or and using AM2. Success/fail (AM2) service ure status. status output Perform a Approv Keys KTSkey Perform ed imported Unwrap Cryptotransport Key mode into the AES Officer process for Command In Transport indicat MACE. A5273 (AM2) OTEK Process or and Success/fail Decrypti - KEK: W service service ure status. on using AM2. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 24 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns status output Approv Keys Imports Cryptoed imported keys to the Officer mode into the KVL ASTRO (AM2) indicat Encrypted ASTRO KTSTransfer CDEM - BKK: E or and Keys CDEM Unwrap Key MACE via - KPK: E service MACE. KVL using - KEK: W status Success/fail AM2. - TEK: W output ure status. Zeroize Approv selected Keys ed key deleted from Cryptomode KVL variables the ASTRO Officer indicat Delete from the Command In CDEM None (AM2) or and Key ATRO MACE. - KEK: Z service CDEM Success/fail - TEK: Z status MACE ure status. output using AM2. Approv Obtain ed status mode CryptoKVL information indicat Show key Officer Check about a Command In None or and status (AM2) Key specific service - BKK: E key/keyset status using AM2. output Approv ed Provides KVL mode algorithm Show list of CryptoQuery indicat version Command In supported None Officer Algorithm or and numbers algorithms (AM2) List service using AM2. status output Approv Provides ed module mode KVL Show Cryptofirmware indicat Query Command In module None Officer version or and Version version info (AM1) numbers service using AM2. status output Provide the Approv Error logs CryptoExtract history of ed out. Command In None Officer Error Log error events mode Success/Fail (AM1) using AM1. indicat ure status. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 25 ↑

Security Descriptio Indicat Name Inputs Outputs Functio SSP Access n or ns or and service status output Unauthentic ated - DRBGEI/Seed: Z - DRBGState: Z - DRBGnonce: Z - BKK: Z Approv - IDK: Z ed - PEK: Z Reset/powe mode - KPK: Z Reset r cycle the Reset Button indicat Reset the - KEK: Z Crypto ASTRO press/Cycle None or and MACE. - TEK: Z Module CDEM power. service - CO PWD MACE. status (AM1): Z output - CO PWD (AM2): Z - PWD Hash: Z - FW-LDPub: Z - IDK-ROM: Z - IDK-Block: Z Zeroize the KPK and all Unauthentic keys and ated CSPs in the Approv - KPK: G,Z key ed - KEK: Z database mode Erase - TEK: Z and causes indicat Erase Button Zeroize all Crypto None - CO PWD a new KPK or and press CSPs Module (AM1): Z to be service - CO PWD generated. status (AM2): Z Resets the output - PWD Hash: password to Z the factory default. Table 14: Approved Services Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 26 ↑

4.4 Non-Approved Services

There are no Non-Approved services available while the module is in the approved mode. N/A for this module.

4.5 External Software/Firmware Loaded

This module supports loading of external firmware via the Program Update service. Execution of the successfully loaded firmware is only effective after the next reset of the security module. Any firmware loaded into the module other than that listed in section 2.2 Tested and Vendor Affirmed Module Version and Identification, is outside the scope of this Security Policy and requires a separate FIPS 140-3 validation. The module validates the integrity of the externally loaded firmware via procedures described in section

5.1 Integrity Techniques

Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 27 ↑

5 Software/Firmware Security

5.1 Integrity Techniques

The Module has a limited modifiable operational environment under the FIPS 140-3 definitions. The Module is composed of the following firmware components:

Component 1: Executable - binary
Component 2: Drop in Algorithms - binary The firmware components are protected with the FW-LD-Pub key described in section 9.4 SSPs. The FWLD-Pub key is loaded into the module at manufacturing The operator can initiate the integrity test on demand by power cycling the Module.

5.2 Initiate on Demand

The operator can initiate the integrity test on demand by power cycling the Module. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 28 ↑

6 Operational Environment

6.1 Operational Environment Type and Requirements

Type of Operational Environment: Limited The ASTRO CDEM MACE has a limited operational environment under the FIPS 140-3 definitions with a Physical Security at Level 3. Therefore, per the FIPS 140-3 Management Manual Section 7.5, partial validations and non-applicable areas in this section are not applicable. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 29 ↑

7 Physical Security

The ASTRO CDEM MACE is a production grade, single-chip cryptographic module with standard passivation over the modules circuitry as defined by FIPS 140-3 and is designed to meet level 3 physical security requirements. The information below is applicable to cryptographic module hardware kit numbers 5185912Y03, 5185912Y05, and 5185912T05, which have identical physical security characteristics.

7.1 Mechanisms and Actions Required

The ASTRO CDEM MACE is covered with a hard-opaque epoxy coating that provides evidence of attempts to tamper with the ASTRO CDEM MACE. The security provided from the hardness of the ASTRO CDEM MACE's epoxy encapsulate is claimed at the temperature range of -40 to 85 degrees Celsius. No assurance of the epoxy hardness is claimed for this physical security mechanism outside of this range. The ASTRO CDEM MACE does not contain any doors, removable covers, or ventilation holes or slits. No maintenance access interface is available. No special procedures are required to maintain physical security of the ASTRO CDEM MACE while delivering to operators. Inspection Mechanism Inspection Guidance Frequency Covered with a hard-opaque epoxy coating that Look for signs of tampering. provides evidence of attempts to tamper with Periodically Remove from service if the ASTRO CDEM MACE. tampering found. Table 15: Mechanisms and Actions Required

7.2 EFP/EFT Information

EFP Temp/Voltage Temperature or or Result Type Voltage EFT Shutdown - A tamper flag is raised, a LowTemperature -38.1°C EFP wake-up reset of the product is triggered. Shutdown - A tamper flag is raised, a HighTemperature 101.4°C EFP wake-up reset of the product is triggered. 1.65V - VDDCORE : Shutdown - A general reset of the chip is LowVoltage EFP 1.350V - VVDBU asserted. Shutdown- A tamper flag is raised, a 2.04V - VDDCORE : HighVoltage EFP wake-up reset of the product is 2.292V - VVDBU triggered. Table 16: EFP/EFT Information Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 30 ↑

7.3 Hardness Testing Temperature Ranges

Temperature Temperature Type LowTemperature -40°C HighTemperature 85°C Table 17: Hardness Testing Temperatures Notes: The module is hardness tested at the lowest and highest temperatures within the module's intended temperature range of operation. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 31 ↑

8 Non-Invasive Security

The Module does not implement any mitigation method against non-invasive attack. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 32 ↑

9 Sensitive Security Parameters Management

9.1 Storage Areas

Persistence Storage Area Name Description Type System Memory (S1) Stored in the volatile memory (RAM). Dynamic Stored in the flash in plaintext, associated by Flash Memory (S2) Static memory location (pointer). Flash Memory - Stored in the flash in encrypted, associated by Static Encrypted (S3) memory location (pointer). Table 18: Storage Areas

9.2 SSP Input-Output Methods

Format Distribution Entry SFI or Name From To Type Type Type Algorithm Input Flash Application encrypted Memory - AES A5273 Software Encrypted Manual Electronic on the IDK Encrypted Decryption (outside) (I1) (S3) Input Flash Application encrypted Memory - AES A5273 Software Encrypted Manual Electronic on the Encrypted Decryption (outside) PEK(I2) (S3) Input Flash encrypted Memory - KTSOTAR Encrypted Automated Electronic on the KEK Encrypted Unwrap (I3) (S3) Input Flash Application encrypted Memory - AES A5273 Software Encrypted Manual Electronic on the BKK Encrypted Decryption (outside) (I4) (S3) Table 19: SSP Input-Output Methods

9.3 SSP Zeroization Methods

Zeroization Operator Description Rationale Method Initiation Zeroized by the "Program Update" SSPs zeroized upon loading Z1 service by overwriting with a fixed Yes of new firmware. pattern of 0s. * Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 33 ↑

Zeroization Operator Description Rationale Method Initiation Zeroized by module power cycle or SSPs in volatile memory Z2 hard reset by overwriting with a Yes zeroized. fixed pattern of 0s. * Zeroized by the "Configure Module" CO zeroize module when Z3 service by overwriting with a fixed configuring into an Approved Yes pattern of 0s. mode. Zeroized by the "Change CO Password (AM1)" service by Old CO password zeroized Z4 Yes overwriting with a fixed pattern of as new CO password set 0s. Zeroized by the "Validate CO CO password zeroized after Password (AM1)" service by Z5 too many failed login Yes overwriting with a fixed pattern of attempts 0s. Zeroized by the "Change CO Old Crypto Officer password Password (AM2)" service by Z6 zeroized as new Crypto Yes overwriting with a fixed pattern of Officer password set 0s. Zeroized by the "Validate CO Crypto Officer password Password (AM2)" service by Z7 zeroized after too many Yes overwriting with a fixed pattern of failed login attempts 0s. Zeroized by Tamper event. (KPK) is Z8 Zeroizes KPK N/A zeroized with a fixed pattern of 0s. Table 20: SSP Zeroization Methods Note: For zeroization methods with an asterisk, once zeroization is complete the Module will reboot, indicating successful zeroization. The output status of all other methods of success of zeroization are implicit and any attempt to use previous keys/CSPs will trigger an error. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 34 ↑

9.4 SSPs

All usage of these SSPs by the Module are described in the services detailed in Section 4.3 Size - Type - Established Name Description Generated By Used By Strength Category By DRBG- Internally generated by the 2770 N/A - CSP Entropy DRBG EI/Seed HWRNG N/A DRBG- CTR_DRBG internal state: V (128 256 N/A - CSP DRBG DRBG State bits) and Key (AES 256) 256 DRBG- Internally generated by the 128 N/A - CSP Entropy DRBG nonce HWRNG N/A A 256-bit AES OFB (A5273) key

256 - Symmetric Key - AES A5273

BKK used to decrypt keys loaded from Other

256 CSP Decryption

KVL A 256-bit AES CBC key used to

256 - Symmetric Key - AES A5273

IDK decrypt downloaded firmware IDK Generation

256 CSP Decryption

images. 256-bit AES-CFB8 key used for

256 - Symmetric Key - Pre-loaded at AES A5273

PEK decrypting passwords during

256 CSP manufacturing Decryption

256 bit AES CFB-8 key used to

256 - Symmetric Key - Generation

KPK encrypt all TEKs and KEKs stored Key Generation

256 CSP AES A5273

in the flash. Decryption 256-bit AES-KW key used for KTS-Unwrap

256 - Symmetric Key -

KEK decryption of keys in key AES A5273

256 CSP

transport operation Decryption 256-bit AES-KW key used for KTS-Unwrap

256 - Symmetric Key -

TEK enabling secure communication AES A5273

256 CSP

with target devices. Decryption AES A5273 CO 8-32 ASCII characters CO N/A - Authentication - Encryption PWD password. N/A CSP AES A5273 (AM1) Decryption Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 35 ↑

Size - Type - Established Name Description Generated By Used By Strength Category By AES A5273 CO 8-32 ASCII characters Crypto N/A - Authentication - Encryption PWD Officer password. N/A CSP AES A5273 (AM2) Decryption PWD 256-bit password hash stored in 256 - Authentication SHA SHA Hash the non-volatile memory. 128 CSP 2048-bit RSA key used to validate the signature of the firmware Asymmetric FW-LD- 2048 - Pre-loaded at Signature image during FW integrity and Public Key Pub 112 manufacturing Verification FW Loading before it is allowed to PSP be executed. A 256-bit AES CBC key used in IDK- the re-construction of IDK per 256 - Symmetric - Pre-loaded at CKG - IDK ROM SP800-133r2 (Section 6.3 #2) via 256 CSP manufacturing XOR using IDK Block A 256-bit AES CBC key used in Generated with an IDK- the re-construction of IDK per 256 - Symmetric Key - approved RBG and CKG - IDK Block SP800-133r2 (Section 6.3 #2) via 256 CSP pre-loaded at XOR using IDK ROM manufacturing Table 21: SSP Table 1 Storage Name Input - Output Storage Zeroization Related SSPs Duration DRBG-nonce:Used DRBG- When module is System Memory (S1):Plaintext Z2 With EI/Seed reset DRBG-State:Generates DRBG-EI/Seed:Derived When the module From DRBG-State System Memory (S1):Plaintext Z2 is rest DRBG-nonce:Derived From DRBG-EI/Seed:Used DRBG- When module is System Memory (S1):Plaintext Z2 With nonce reset DRBG-State:Generates Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 36 ↑

Storage Name Input - Output Storage Zeroization Related SSPs Duration Input encrypted on System Memory (S1):Plaintext When module is Z1 KEK:Decrypts BKK the IDK (I1) Flash Memory (S2):Plaintext reset Z2 TEK:Decrypts IDK-ROM:Derived From When module is IDK-Block:Derived IDK System Memory (S1):Plaintext Z2 reset From PEK:Decrypts KEK:Decrypts CO PWD (AM1):Decrypts Input encrypted on System Memory (S1):Plaintext When module is Z1 PEK CO PWD the IDK (I1) Flash Memory (S2):Plaintext reset Z2 (AM2):Decrypts PWD Hash:Used With Z1 Z3 Z4 System Memory (S1):Plaintext When module is DRBG-State:Derived KPK Z5 Flash Memory (S2):Plaintext reset From Z6 Z7 Z8 Input encrypted on the KEK (I3) System Memory (S1):Plaintext When module is Z1 KPK:Encrypted by KEK Input encrypted on Flash Memory (S2):Plaintext reset Z2 TEK:Decrypts the BKK (I4) Input encrypted on System Memory (S1):Plaintext the KEK (I3) When module is Z1 TEK Flash Memory - Encrypted KPK:Encrypted by Input encrypted on reset Z2 (S3):Encrypted the BKK (I4) Z1 Z3 System Memory (S1):Plaintext CO PWD Input encrypted on When module is Z4 Flash Memory - Encrypted PEK:Encrypted by (AM1) the PEK(I2) reset Z5 (S3):Encrypted Z6 Z7 Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 37 ↑

Storage Name Input - Output Storage Zeroization Related SSPs Duration Z1 Z3 System Memory (S1):Plaintext CO PWD Input encrypted on When module is Z4 Flash Memory - Encrypted PEK:Encrypted by (AM2) the PEK(I2) reset Z5 (S3):Encrypted Z6 Z7 Z1 Z3 CO PWD (AM1):Hash System Memory (S1):Plaintext When module is Z4 of PWD Hash Flash Memory - Encrypted reset Z5 CO PWD (AM2):Hash (S3):Encrypted Z6 of Z7 System Memory (S1):Plaintext When module is FW-LD-Pub Z1 IDK:Encrypted by Flash Memory (S2):Plaintext reset System Memory (S1):Plaintext When module is Z1 IDK:Generates IDK-ROM Flash Memory (S2):Plaintext reset Z2 IDK-Block:Paired With System Memory (S1):Plaintext When module is Z1 IDK:Generates IDK-Block Flash Memory (S2):Plaintext reset Z2 IDK-ROM:Paired With Table 22: SSP Table 2 Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 38 ↑

10 Self-Tests

10.1 Pre-Operational Self-Tests

The ASTRO CDEM MACE performs self-tests to ensure the proper operation. Per FIPS 140-3 these are categorized as either pre-operational selftests or conditional self-tests. Pre-operational self–tests are available on demand by power cycling the ASTRO CDEM MACE. In addition, pre-operational self–tests are periodically performed by the ASTRO CDEM MACE as configured by the operator during the module configuration as shown in section 11.1 Installation, Initialization, and Startup Procedures The ASTRO CDEM MACE will not accept any commands when a periodic self-test is required; the commands still in the I/O buffer will be processed by the ASTRO CDEM MACE after periodic self-test ends and will execute when the I/O buffer is emptied. The ASTRO CDEM MACE logs the most recent self-test errors to the internal flash; the operator (CO) can extract the error logs using Extract Error Log service. The Module performs the following pre-operational self-tests in table below Algorithm or Test Test Properties Test Type Indicator Details Test Method Firmware SHA2-256 (Cert. #817), RSA- SW/FW E2 on When the ASTRO CDEM MACE is KAT Integrity 2048 (Cert. #A5253) Integrity failure powered up, the digital signature is verified. Table 23: Pre-Operational Self-Tests

10.2 Conditional Self-Tests

The Module performs the following conditional self-tests in the table below Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 39 ↑

Algorithm or Test Test Test Properties Indicator Details Conditions Test Method Type AES-Encryption ES1 on AES-256 KAT CAST Encryption Bootup/Periodic (A5273) failure AES-Decryption ES1 on AES-256 KAT CAST Decryption Bootup/Periodic (A5273) failure AES-Encryption ES1 on AES-256 KAT CAST Encryption Bootup/Periodic (A5275) failure AES-Decryption ES1 on AES-256 KAT CAST Decryption Bootup/Periodic (A5275) failure AES-KW ES1 on AES-256 KAT CAST Decryption Bootup/Periodic (A5438) failure AES-256 CTR_DRBG Counter DRBG ES1 on instantiation, generate KATs AES-256 CTR KAT CAST Bootup/Periodic (A5437) failure performed before the first random data generation SHA2, -256, KAT performed SHA2-256 (SHS E2 on SHA2-256 KAT CAST before Pre-Operational FW Bootup 817) failure integrity tests. RSA SigVer RSA-2048 SigVer, performed E2 on (FIPS186-5) RSA-2048 SigVer KAT CAST before Pre-Operational FW Bootup failure (A5253) integrity tests. Entropy 90B Designed to quickly detect Start-up catastrophic failures that cause ES1 on Repetition Repetition Count Test RCT CAST the noise source to become Bootup failure Count Test "stuck" on a single output value (RCT) for a long period of time Entropy 90B Designed to detect a large loss of Start-up entropy that might occur as a Adaptive Proportion ES1 on Adaptive ADP CAST result of some physical failure or Bootup Test failure Proportion Test environment al change affecting (ADP) the noise source 2048-bit RSA A digital signature is generated SW/FW E2 on loading a new Firmware Load Signature KAT over the code when it is built Load failure firmware image Verification/SHA2-256 using SHA-256 and RSA-2048. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 40 ↑

Algorithm or Test Test Test Properties Indicator Details Conditions Test Method Type The digital signature is verified upon download into the ASTRO CDEM MACE. Table 24: Conditional Self-Tests

10.3 Periodic Self-Test Information

Algorithm or Test Test Method Test Type Period Periodic Method Firmware Integrity KAT SW/FW Integrity On Demand Manually Table 25: Pre-Operational Periodic Information Algorithm or Test Test Method Test Type Period Periodic Method AES-Encryption On KAT CAST Manually/Programmatically (A5273) Demand/Periodically AES-Decryption On KAT CAST Manually/Programmatically (A5273) Demand/Periodically AES-Encryption On KAT CAST Manually/Programmatically (A5275) Demand/Periodically AES-Decryption On KAT CAST Manually/Programmatically (A5275) Demand/Periodically On AES-KW (A5438) KAT CAST Manually/Programmatically Demand/Periodically Counter DRBG On KAT CAST Manually/Programmatically (A5437) Demand/Periodically Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 41 ↑

Algorithm or Test Test Method Test Type Period Periodic Method On SHA2-256 (SHS 817) KAT CAST Manually/Programmatically Demand/Periodically RSA SigVer (FIPS186- On KAT CAST Manually/Programmatically 5) (A5253) Demand/Periodically Entropy 90B Start-up Repetition Count Test RCT CAST On Demand Manually (RCT) Entropy 90B Start-up Adaptive Proportion ADP CAST On Demand Manually Test (ADP) Firmware Load KAT SW/FW Load On Demand Manually Table 26: Conditional Periodic Information Conditional self–tests are periodically performed by the ASTRO CDEM MACE every X hours, where X is configured by the operator during module configuration (1 hour to 720 hours). The ASTRO CDEM MACE will not accept any commands when a periodic self-test is required; the commands still in the I/O buffer will be processed by the ASTRO CDEM MACE end the periodic self-test executed when the I/O buffer is emptied. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 42 ↑

10.4 Error States

Recovery Name Description Conditions Indicator Method The ASTRO CDEM MACE enters the critical error state. In this state, the Sets the The ASTRO ASTRO CDEM MACE Reboot/Power status ES1 CDEMMACE fails a stores the status into the cycle the module alarm KAT. internal flash memory and LED. then halts all further operation by entering an infinite loop. The ASTRO The ASTRO CDEM MACE CDEMMACE fails a enters the firmware firmware loading signature validation failure Reboot/Power Sets the during program state. In this state, the cycle the module status ES2 upgrade and/or ASTRO CDEM MACE halts or re-flashing a alarm firmware integrity all further operations by new image. LED. pre-operational self- entering the flash test. programming mode. Table 27: Error States Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 43 ↑

11 Life-Cycle Assurance

11.1 Installation, Initialization, and Startup Procedures

Installation and Initialization: The Module is originally a non-compliant module and must be initialized to be in Approved mode. There is no non-Approved mode. During initialization the operator shall configure the Module from the instructions below:

Upon first access, the operator will use the default passwords provided by Motorola in a separate communication.
The operator will then change the default passwords based on the requirements in the Roles and Authentication table.
The operator will set the periodic self-tests timer as part of the Module configuration in every X minutes, where X is a minimum value = 1 hour and maximum value = 720 hours. Note: the default minimum = 0* but must be changed to a minimum of 1.
The operator will then complete Module configuration using the Module Configuration and Configure OTEK services.
Finally, the operator will set the Module to the Approved mode using the Set FIPS Mode service. * periodic self-tests will not perform if minimum = 0 Delivery: The Module is used in multiple Motorola Solutions, Inc. products. Motorola uses commercially available courier systems such as UPS, FedEx, and DHL with a tracking number and requires a signature at the end from an authorized client.

11.2 Administrator Guidance

Use vendor provided product specific user guide for secure operations.

11.3 Non-Administrator Guidance

11.4 Design and Rules

Rules of Operation

The Module provides one distinct operator role: Cryptographic Officer.
The Module provides identity-based authentication. Motorola Solutions Public Material – May be reproduced only in its original entirety (without revision).

Page 44 ↑

The Module clears previous authentications on power cycle.
An operator does not have access to any cryptographic services prior to assuming an authorized role.
The Module allows the operator to initiate power-up self-tests by power cycling power or resetting the Module.
All self-tests do not require any operator action.
Data output is inhibited during key generation, self-tests, zeroization, and error states.
Status information does not contain CSPs or sensitive data that if misused could lead to a compromise of the Module.
There are no restrictions on which keys or SSPs are zeroized by the zeroization service.
The Module does not support concurrent operators.
The Module does not support a maintenance interface or role.
The Module does not support manual SSP establishment method.
The Module does not have any proprietary external input/output devices used for entry/output of data.
The Module does not enter or output plaintext CSPs.
The Module does store some CSPs in plaintext.
The Module does not output intermediate key values. The Module does not provide bypass services or ports/interfaces.

11.5 Maintenance Requirements

11.6 End of Life

After the end-of-life, the operator should zeroize all SSPs using “Erase Crypto Module“ service followed by shredding the ASTRO CDEM MACE chip.

12 Mitigation of Other Attacks

The Module does not implement any mitigation method against other attacks. Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 45 ↑

References and Definitions The following standards are referred to in this Security Policy. Table 28 References Abbreviation* Full Specification Name [FIPS140-3] Security Requirements for Cryptographic Modules, March 22, 2019 [ISO19790] International Standard, ISO/IEC 19790, Information technology

Security techniques
Test requirements for cryptographic modules, Third edition, March 2017 [ISO24759] International Standard, ISO/IEC 24759, Information technology
Security techniques
Test requirements for cryptographic modules, Second and Corrected version, 15 December 2015 [IG] Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program, August 30, 2024 [133] NIST Special Publication 800-133, Recommendation for Cryptographic Key Generation, Revision 2, June 2020 [186-5] National Institute of Standards and Technology, Digital Signature Standard (DSS), Federal Information Processing Standards Publication 186-5, February 2023. [197] National Institute of Standards and Technology, Advanced Encryption Standard (AES), Federal Information Processing Standards Publication 197, November 26, 2001, Updated May 9, 2023 [180] National Institute of Standards and Technology, Secure Hash Standard, Federal Information Processing Standards Publication 180-4, August, 2015 [38A] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation, Methods and Techniques, Special Publication 800-38A, December 2001 [38F] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping, Special Publication 800-38F, December 2012 [90A] National Institute of Standards and Technology, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Special Publication 800-90A, Revision 1, June 2015. [90B] National Institute of Standards and Technology, Recommendation for the Entropy Sources Used for Random Bit Generation, Special Publication 800-90B, January 2018. [OTAR] Project 25
Digital Radio Over-The-Air-Rekeying (OTAR) Messages and Procedures [TIA102.AACA-A], September 2014 Table 29 Acronyms and Definitions Motorola Solutions Public Material
May be reproduced only in its original entirety (without revision).

Page 46 ↑

Acronym* Definition AES Advanced Encryption Standard BKK Black Keyloading Key CAI Common Air Interface CBC Cipher Block Chaining CDEM CAI Data Encryption Module CFB Cipher Feedback CKG Cryptographic Key Generation CSP Critical Security Parameter DRBG Deterministic Random Bit Generator DRBG-El DRBG Entropy Input ECB Electronic Code Book FIPS Federal Information Processing Standards FW Firmware FW-LD-Pub Firmware Load Public Key IC Integrated Circuit IDK Image Decryption Key IV Initialization Vector KAT Known Answer Test KPK Key Protection Key KEK Key Encryption Key KVL Key Variable Loader MAC Message Authentication Code MACE Motorola Advanced Crypto Engine OFB Output Feedback OTAR Over The Air Rekeying PEK Password Encryption Key PWD Hash Password Hash RSA Rivest–Shamir–Adleman SSI Synchronous Serial Interface SSP Sensitive Security Parameter TEK Traffic Encryption Key Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).

Page 47 ↑

Acronym* Definition UA Unauthenticated Service Motorola Solutions Public Material

May be reproduced only in its original entirety (without revision).