NITROXIII CNN35XX-NFBE HSM Family
NITROXIII CNN35XX-NFBE HSM Family, from Marvell, holds FIPS 140-2 certificate #4263 at overall level 3. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its algorithm certificates, its validation history, and the list moves this tracker has observed, which NIST does not date.
Caveat: When operated in FIPS mode
Certificate
| Certificate number | 4263 |
|---|---|
| Standard | FIPS 140-2 |
| Status | historical |
| Overall level | 3 |
| Module type | Hardware |
| Embodiment | Multi-Chip Embedded |
| Vendor | Marvell · website |
| Hardware versions | P/Ns CNL3560P-NFBE-G, CNL3560P-NFBE-2.0-G, CNL3560P-NFBE-3.0-G, CNL3560B-NFBE-2.0-G, CNL3560B-NFBE-3.0-G, CNL3560-NFBE-G, CNL3560-NFBE-2.0-G, CNL3560-NFBE-3.0-G, CNL3560A-NFBE-3.0-G, CNL3560C-NFBE-3.0-G, CNL3560D-NFBE-3.0-G, CNL3560E-NFBE-3.0-G, CNL3560F-NFBE-3.0-G, CNL3530-NFBE-G, CNL3530-NFBE-2.0-G, CNL3530-NFBE-3.0-G, CNL3530B-NFBE-2.0-G, CNL3530B-NFBE-3.0-G, CNL3530A-NFBE-3.0-G, CNL3530C-NFBE-3.0-G, CNL3530D-NFBE-3.0-G, CNL3530E-NFBE-3.0-G, CNL3530F-NFBE-3.0-G, CNL3510-NFBE-G, CNL3510-NFBE-2.0-G, CNL3510-NFBE-3.0-G, CNL3510P-NFBE-G, CNL3510P-NFBE-2.0-G, CNL3510P-NFBE-3.0-G, CNL3510A-NFBE-3.0-G, CNL3510C-NFBE-3.0-G, CNL3510D-NFBE-3.0-G, CNL3510E-NFBE-3.0-G, CNL3510F-NFBE-3.0-G, CNN3560P-NFBE-G, CNN3560P-NFBE-2.0-G, CNN3560P-NFBE-3.0-G, CNN3560-NFBE-G, CNN3560-NFBE-2.0-G, CNN3560-NFBE-3.0-G, CNN3560A-NFBE-3.0-G, CNN3560C-NFBE-3.0-G, CNN3560D-NFBE-3.0-G, CNN3560E-NFBE-3.0-G, CNN3560F-NFBE-3.0-G, CNN3530-NFBE-G, CNN3530-NFBE-2.0-G, CNN3530-NFBE-3.0-G, CNN3530A-NFBE-3.0-G, CNN3530C-NFBE-3.0-G, CNN3530D-NFBE-3.0-G, CNN3530E-NFBE-3.0-G, CNN3530F-NFBE-3.0-G, CNN3510-NFBE-G, CNN3510-NFBE-2.0-G, CNN3510-NFBE-3.0-G, CNN3510A-NFBE-3.0-G, CNN3510C-NFBE-3.0-G, CNN3510D-NFBE-3.0-G, CNN3510E-NFBE-3.0-G, CNN3510F-NFBE-3.0-G, CNN3510LP-NFBE-2.0-G, CNN3510LP-NFBE-3.0-G, CNN3510LPB-NFBE-2.0-G, CNN3510LPB-NFBE-3.0-G, CNN3510LPA-NFBE-3.0-G, CNN3510LPC-NFBE-3.0-G, CNN3510LPD-NFBE-3.0-G, CNN3510LPE-NFBE-3.0-G, CNN3510LPF-NFBE-3.0-G, CNN3505LP-NFBE-2.0-G, CNN3505LP-NFBE-3.0-G, CNN3505LPA-NFBE-3.0-G,CNN3505LPC-NFBE-3.0-G, CNN3505LPD-NFBE-3.0-G, CNN3505LPE-NFBE-3.0-G and CNN3505LPF-NFBE-3.0-G |
| Firmware versions | CNN35XX-NFBE-FW-1.1 build 02 and CNN35XX-NFBE-FW-1.1 build 05 |
Module description
Quoted from the NIST CMVP entry for this certificate.
CNN35XX-NFBE HSM Family is a high performance purpose built solution for key management and crypto acceleration compliance to FIPS 140-2 level 3. The module supports flexible key store that can be partitioned up to 32 individually managed and isolated partitions. This is a SRIOV capable PCIe adapter and can be used in a virtualization environment to extend services like virtual key management, offloading general and TLS specific crypto operations through dedicated logical I/O channels. This product is suitable for PKI users, vendors, TLS servers/load balancers.
Security level exceptions
- Mitigation of Other Attacks: N/A
Approved algorithms (15)
| Algorithm | CAVP certificates |
|---|---|
| AES | 2033, 2034, 2035, 3205, 3206 |
| CKG | vendor affirmed |
| CVL | 167, 563, A1936, A1937 |
| DRBG | 680 |
| DSA | 916 |
| ECDSA | 589 |
| ENT | |
| HMAC | 1233, 2019 |
| KAS | A1934 |
| KAS-RSA | A1935 |
| KBKDF | 65 |
| KTS | |
| RSA | 1634, A1936 |
| SHS | 1780, 2652 |
| Triple-DES | 1311 |
Allowed algorithms
RSA (CVL Cert #A1936, key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength)
Tested configurations
- N/A
Validation history
| Date | Type | Lab |
|---|---|---|
| 2022-07-13 | Initial | UL Verification Services, Inc. |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status historical at the time of the earliest snapshot
- 2026-09-22: observed moving from active to historical
- Validation dates on record: 2022-07-13