808bits

LS2 HSM Family

FIPS 140-3 certificate #5220 · JISA Softech Private Limited · data as of 2026-08-28
Active. Sunset date 2029-06-05, 1011 days away.
Caveat: When operated in approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy

Certificate

Certificate number5220
StandardFIPS 140-3
Statusactive
Sunset date2029-06-05
Overall level3
Module typeHardware
EmbodimentMultiChipEmbed
VendorJISA Softech Private Limited · website
Hardware versionsLS2-G-A050-B0; LS2-G-A100-B0; LS2-G-A200-B0; LS2-G-A300-B0; LS2-G-A400-B0
Firmware versionsMARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.02-1200; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.02-1102, MARVELL-LS2-UBOOT-10.23-1107-R02-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.02-1200; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R02-SB; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.01-10, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.02-1200, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R01-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1107, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.01-10; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.02-1200-SB; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1150, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107; MARVELL-LS2-FW-10.23-1202, MARVELL-LS2-UBOOT-10.23-1107-R01-SB; MARVELL-LS2-FW-10.23-1202, MARVELL-LS2-UBOOT-10.23-1107-R02-SB, PIN-App:10.23-1107
EntropyENT (P)

Module description

The LS2 HSM module is a multi-chip Cryptographic Module with firmware and installed in Host CryptoBind HSM and CryptoBind DSS. It consists of multiple firmware components, including an operating system, applications exposing services and interfaces related to secure key management, crypto operations, and policy management of the module.

Security level exceptions

  • Operational environment: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A

Approved algorithms

AlgorithmCAVP certificate
AES-CBCA1947
AES-CBCA1948
AES-CCMA1947
AES-CMACA1947
AES-CMACA1948
AES-CTRA1947
AES-ECBA1947
AES-GCMA1947
AES-GCMA1948
AES-GMACA1947
AES-KWA1948
AES-KWPA1948
Counter DRBGA1948
ECDSA KeyGen (FIPS186-4)A1948
ECDSA KeyGen (FIPS186-4)A2393
ECDSA KeyVer (FIPS186-4)A1948
ECDSA SigGen (FIPS186-4)A1947
ECDSA SigGen (FIPS186-4)A1948
ECDSA SigVer (FIPS186-4)A1948
Hash DRBGA1947
HMAC-SHA-1A1948
HMAC-SHA2-256A1947
HMAC-SHA2-256A1948
HMAC-SHA2-384A1947
HMAC-SHA2-384A1948
HMAC-SHA2-512A1947
HMAC-SHA2-512A1948
KAS-ECC Sp800-56Ar3A1948
KAS-ECC-SSC Sp800-56Ar3A1947
KAS-ECC-SSC Sp800-56Ar3A1948
KAS-IFC-SSCA1948
KDA HKDF Sp800-56Cr1A1948
KDA OneStep Sp800-56Cr1A1948
KDA TwoStep Sp800-56Cr1A1948
KDF ANS 9.63A1948
KDF SP800-108A1948
KDF TLSA1947
KTS-IFCA1948
KTS-IFCA2393
PBKDFA1948
RSA Decryption PrimitiveA1947
RSA Decryption PrimitiveA1948
RSA KeyGen (FIPS186-4)A1948
RSA KeyGen (FIPS186-4)A2393
RSA SigGen (FIPS186-4)A1948
RSA Signature PrimitiveA1947
RSA SigVer (FIPS186-4)A1946
RSA SigVer (FIPS186-4)A1948
SHA-1A1947
SHA-1A1948
SHA2-256A1946
SHA2-256A1947
SHA2-256A1948
SHA2-384A1947
SHA2-384A1948
SHA2-512A1947
SHA2-512A1948
SHA3-224A1947
SHA3-256A1947
SHA3-384A1947
SHA3-512A1947
SHAKE-128A1947
SHAKE-256A1947
TDES-CBCA1947
TDES-ECBA1947
TDES-ECBA1948
TDES-KWA1948

Allowed algorithms

AES (Cert A1947, Key unwrapping. Per IG D.G.; Legacy Key unwrap only • ECB mode: Decrypt; 128, 192, and 256-bit • CBC mode: Decrypt; 128, 192, and 256-bit);AES (Cert A1948, Key unwrapping. Per IG D.G; Legacy Key unwrap only • ECB mode: Decrypt; 128, 192, and 256-bit • CBC mode: Decrypt; 128, 192, and 256-bit);EC Diffie-Hellman with non-NIST recommended curves (Cert A1947, Provides between 112 and 256 bits of encryption strength. Per IGs D.F and C.A.; EC-DH Secp224k1(112 bits), Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits) FRP256v1 (128 bits) • Prime order curve, generated as per FIPS 186-4 Section 6.1.1 (SHA-1*, SHA2-224, SHA2-256, SHA2-384, SHA2-512));ECDSA with non-NIST recommended curves (Cert A1947, Provides between 112 and 256 bits of encryption strength. Per IG C.A.; EC Key generation, sign Secp256K1 (128 bits) brainpoolP224r1(112 bits), brainpoolP256r1(128 bits), brainpoolP320r1(160 bits), brainpoolP384r1(192 bits), brainpoolP512r1(256 bits) FRP256v1 (128 bits) • Prime order curve, generated as per FIPS 186-4 Section 6.1.1 (SHA-1*, SHA2-224, SHA2-256, SHA2-384, SHA2-512))

Tested configurations

  • N/A

Validation history

DateTypeLab
2026-04-01InitialLeidos Accredited Testing & Evaluation (AT&E) Lab

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status active
  • Validation dates on record: 2026-04-01

Source documents