808bits

LS2 HSM Family

FIPS 140-3 certificate #5220 · JISA Softech Private Limited · data as of 2026-10-09

LS2 HSM Family, from JISA Softech Private Limited, holds FIPS 140-3 certificate #5220 at overall level 3. The validation is active, with a sunset date of 2029-06-05. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Active. Sunset date 2029-06-05, 969 days away.
Caveat: When operated in approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy

Certificate

Certificate number5220
StandardFIPS 140-3
Statusactive
Sunset date2029-06-05
Overall level3
Module typeHardware
EmbodimentMultiChipEmbed
VendorJISA Softech Private Limited · website
Hardware versionsLS2-G-A050-B0; LS2-G-A100-B0; LS2-G-A200-B0; LS2-G-A300-B0; LS2-G-A400-B0
Firmware versionsMARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.02-1200; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.23-1107-R02-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.02-1200; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R02-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.01-10, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.02-1200, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R01-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.02-1200-SB; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1202, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1202, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107
EntropyENT (P)

Module description

Quoted from the NIST CMVP entry for this certificate.

The LS2 HSM module is a multi-chip Cryptographic Module with firmware and installed in Host CryptoBind HSM and CryptoBind DSS. It consists of multiple firmware components, including an operating system, applications exposing services and interfaces related to secure key management, crypto operations, and policy management of the module.

Security level exceptions

  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms (48)

AlgorithmCAVP certificates
AES-CBCA1947, A1948
AES-CCMA1947
AES-CMACA1947, A1948
AES-CTRA1947
AES-ECBA1947
AES-GCMA1947, A1948
AES-GMACA1947
AES-KWA1948
AES-KWPA1948
Counter DRBGA1948
ECDSA KeyGen (FIPS186-4)A1948, A2393
ECDSA KeyVer (FIPS186-4)A1948
ECDSA SigGen (FIPS186-4)A1947, A1948
ECDSA SigVer (FIPS186-4)A1948
Hash DRBGA1947
HMAC-SHA-1A1948
HMAC-SHA2-256A1947, A1948
HMAC-SHA2-384A1947, A1948
HMAC-SHA2-512A1947, A1948
KAS-ECC Sp800-56Ar3A1948
KAS-ECC-SSC Sp800-56Ar3A1947, A1948
KAS-IFC-SSCA1948
KDA HKDF Sp800-56Cr1A1948
KDA OneStep Sp800-56Cr1A1948
KDA TwoStep Sp800-56Cr1A1948
KDF ANS 9.63A1948
KDF SP800-108A1948
KDF TLSA1947
KTS-IFCA1948, A2393
PBKDFA1948
RSA Decryption PrimitiveA1947, A1948
RSA KeyGen (FIPS186-4)A1948, A2393
RSA SigGen (FIPS186-4)A1948
RSA Signature PrimitiveA1947
RSA SigVer (FIPS186-4)A1946, A1948
SHA-1A1947, A1948
SHA2-256A1946, A1947, A1948
SHA2-384A1947, A1948
SHA2-512A1947, A1948
SHA3-224A1947
SHA3-256A1947
SHA3-384A1947
SHA3-512A1947
SHAKE-128A1947
SHAKE-256A1947
TDES-CBCA1947
TDES-ECBA1947, A1948
TDES-KWA1948

Allowed algorithms

AES (Cert A1947, Key unwrapping. Per IG D.G.; Legacy Key unwrap only • ECB mode: Decrypt; 128, 192, and 256-bit • CBC mode: Decrypt; 128, 192, and 256-bit);AES (Cert A1948, Key unwrapping. Per IG D.G; Legacy Key unwrap only • ECB mode: Decrypt; 128, 192, and 256-bit • CBC mode: Decrypt; 128, 192, and 256-bit);EC Diffie-Hellman with non-NIST recommended curves (Cert A1947, Provides between 112 and 256 bits of encryption strength. Per IGs D.F and C.A.; EC-DH Secp224k1(112 bits), Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits) FRP256v1 (128 bits) • Prime order curve, generated as per FIPS 186-4 Section 6.1.1 (SHA-1*, SHA2-224, SHA2-256, SHA2-384, SHA2-512));ECDSA with non-NIST recommended curves (Cert A1947, Provides between 112 and 256 bits of encryption strength. Per IG C.A.; EC Key generation, sign Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits) FRP256v1 (128 bits) • Prime order curve, generated as per FIPS 186-4 Section 6.1.1 (SHA-1*, SHA2-224, SHA2-256, SHA2-384, SHA2-512))

Tested configurations

  • N/A

Validation history

DateTypeLab
2026-04-01InitialLeidos Accredited Testing & Evaluation (AT&E) Lab

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status active
  • Validation dates on record: 2026-04-01

Source documents