808bits

Linux Kernel FIPS Object Module (KFOM) Cryptographic Module

FIPS 140-3 certificate #4744 · Cisco Systems, Inc. · data as of 2026-10-09

Linux Kernel FIPS Object Module (KFOM) Cryptographic Module, from Cisco Systems, Inc., holds FIPS 140-3 certificate #4744 at overall level 1. The validation is active, with a sunset date of 2029-07-28. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Active. Sunset date 2029-07-28, 1022 days away.
Caveat: No assurance of the minimum strength of generated SSPs (e.g., keys). No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.

Certificate

Certificate number4744
StandardFIPS 140-3
Statusactive
Sunset date2029-07-28
Overall level1
Module typeFirmware-hybrid
EmbodimentMulti-Chip Stand Alone
VendorCisco Systems, Inc. · website
Hardware versionsARMv8 Cortex-A53, Intel Xeon Gold 6138
Firmware versions1.0

Module description

Quoted from the NIST CMVP entry for this certificate.

The Cisco Linux Kernel FIPS Object Module (KFOM) is a firmware hybrid cryptographic library that serves the operating system kernel. It does not implement any security protocols, instead only allowing for Linux kernel applications access to using approved algorithms.

Security level exceptions

  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms (22)

AlgorithmCAVP certificates
AES-CBCA1182, A1185
AES-CBC-CS3A1182, A1185
AES-CCMA1182, A1185
AES-CMACA1182, A1185
AES-CTRA1182, A1185
AES-ECBA1182, A1185
AES-GCMA1182, A1185
AES-GMACA1182, A1185
AES-XTSA1182, A1185
Counter DRBGA1182, A1185
Hash DRBGA1182, A1185
HMAC DRBGA1182, A1185
HMAC-SHA-1A1182, A1185
HMAC-SHA2-224A1182, A1185
HMAC-SHA2-256A1182, A1185
HMAC-SHA2-384A1182, A1185
HMAC-SHA2-512A1182, A1185
SHA-1A1182, A1185
SHA2-224A1182, A1185
SHA2-256A1182, A1185
SHA2-384A1182, A1185
SHA2-512A1182, A1185

Tested configurations

  • Linux 4.9 running on Cisco Meraki MX68CW with ARMv8 Cortex-A53 with PAA
  • Ubuntu 18.04 running on Cisco UCS C220 M5 with Intel Xeon Gold 6138 (Skylake) with PAA

Validation history

DateTypeLab
2024-07-29InitialAcumen Security

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status active
  • Validation dates on record: 2024-07-29

Source documents