Cisco FIPS Object Module
Caveat: No assurance of the minimum strength of generated SSPs (e.g., keys).
Certificate
| Certificate number | 4747 |
|---|---|
| Standard | FIPS 140-3 |
| Status | active |
| Sunset date | 2029-07-31 |
| Overall level | 1 |
| Module type | Firmware-hybrid |
| Embodiment | Multi-Chip Stand Alone |
| Vendor | Cisco Systems, Inc. · website |
| Firmware versions | 7.3a |
Module description
The Cisco FIPS Object Module (FOM) is a firmware hybrid library that provides cryptographic services to a vast array of Cisco's networking and collaboration products. The module provides FIPS 140 validated cryptographic algorithms for services such as IPSEC, SRTP, SSH, TLS, 802.1x, etc. The module does not directly implement any of these protocols, instead, it provides the cryptographic primitives and functions to allow a developer to implement the various protocols.
Security level exceptions
- Non-invasive security: N/A
- Mitigation of other attacks: N/A
Approved algorithms
| Algorithm | CAVP certificate |
|---|---|
| AES-CBC | A4446 |
| AES-CCM | A4446 |
| AES-CFB1 | A4446 |
| AES-CFB128 | A4446 |
| AES-CFB8 | A4446 |
| AES-CMAC | A4446 |
| AES-CTR | A4446 |
| AES-ECB | A4446 |
| AES-GCM | A4446 |
| AES-GMAC | A4446 |
| AES-KW | A4446 |
| AES-KWP | A4446 |
| AES-OFB | A4446 |
| AES-XTS Testing Revision 2.0 | A4446 |
| Counter DRBG | A4446 |
| DSA KeyGen (FIPS186-4) | A4446 |
| DSA PQGGen (FIPS186-4) | A4446 |
| DSA PQGVer (FIPS186-4) | A4446 |
| DSA SigGen (FIPS186-4) | A4446 |
| DSA SigVer (FIPS186-4) | A4446 |
| ECDSA KeyGen (FIPS186-4) | A4446 |
| ECDSA KeyVer (FIPS186-4) | A4446 |
| ECDSA SigGen (FIPS186-4) | A4446 |
| ECDSA SigVer (FIPS186-4) | A4446 |
| Hash DRBG | A4446 |
| HMAC DRBG | A4446 |
| HMAC-SHA-1 | A4446 |
| HMAC-SHA2-224 | A4446 |
| HMAC-SHA2-256 | A4446 |
| HMAC-SHA2-384 | A4446 |
| HMAC-SHA2-512 | A4446 |
| HMAC-SHA2-512/224 | A4446 |
| HMAC-SHA2-512/256 | A4446 |
| HMAC-SHA3-224 | A4446 |
| HMAC-SHA3-256 | A4446 |
| HMAC-SHA3-384 | A4446 |
| HMAC-SHA3-512 | A4446 |
| KAS-ECC CDH-Component SP800-56Ar3 | A4446 |
| KAS-ECC-SSC Sp800-56Ar3 | A4446 |
| KAS-FFC-SSC Sp800-56Ar3 | A4446 |
| KAS-IFC-SSC | A4446 |
| KDA HKDF Sp800-56Cr1 | A4446 |
| KDA OneStep Sp800-56Cr1 | A4446 |
| KDF IKEv2 | A4446 |
| KDF SNMP | A4446 |
| KDF SP800-108 | A4446 |
| KDF SRTP | A4446 |
| KDF SSH | A4446 |
| KTS-IFC | A4446 |
| PBKDF | A4446 |
| RSA KeyGen (FIPS186-4) | A4446 |
| RSA SigGen (FIPS186-4) | A4446 |
| RSA SigVer (FIPS186-4) | A4446 |
| Safe Primes Key Generation | A4446 |
| Safe Primes Key Verification | A4446 |
| SHA-1 | A4446 |
| SHA2-224 | A4446 |
| SHA2-256 | A4446 |
| SHA2-384 | A4446 |
| SHA2-512 | A4446 |
| SHA2-512/224 | A4446 |
| SHA2-512/256 | A4446 |
| SHA3-224 | A4446 |
| SHA3-256 | A4446 |
| SHA3-384 | A4446 |
| SHA3-512 | A4446 |
| SHAKE-128 | A4446 |
| SHAKE-256 | A4446 |
| TDES-CBC | A4446 |
| TDES-CFB1 | A4446 |
| TDES-CFB64 | A4446 |
| TDES-CFB8 | A4446 |
| TDES-CMAC | A4446 |
| TDES-CTR | A4446 |
| TDES-ECB | A4446 |
| TDES-OFB | A4446 |
| TLS v1.2 KDF RFC7627 | A4446 |
| TLS v1.3 KDF | A4446 |
Tested configurations
- Linux 4.4 running on Cisco Catalyst 9300 with Intel Xeon D-1526 (Broadwell) with PAA
- Linux 4.5 running on Cisco Unified Computing System (UCS) with Intel Xeon Gold 6244 (Cascade Lake) with PAA
- Linux 5.4 running on ISR 4321 with Intel Atom C2558 (Silvermont) with PAA
Validation history
| Date | Type | Lab |
|---|---|---|
| 2024-08-01 | Initial | Acumen Security |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-08-21: first observed by this tracker, status active
- Validation dates on record: 2024-08-01