Inline Crypto Engine (ICE)
Inline Crypto Engine (ICE), from Google, LLC, holds FIPS 140-3 certificate #5565 at overall level 1. The validation is active, with a sunset date of 2031-10-29. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.
Caveat: No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.
Certificate
| Certificate number | 5565 |
|---|---|
| Standard | FIPS 140-3 |
| Status | active |
| Sunset date | 2031-10-29 |
| Overall level | 1 |
| Module type | Hardware |
| Embodiment | SingleChip |
| Vendor | Google, LLC · website |
Module description
Quoted from the NIST CMVP entry for this certificate.
The Inline Crypto Engine (ICE) module is comprised of a sub-chip cryptographic subsystem in the Google IN763 SoC. The module provides a cryptographic engine supporting cryptographic offload for IPsec and PSP protocols. The ICE module processes network infrastructure packets in both the Ingress and Egress directions. In addition to providing the cryptographic primitives for the security protocols it also provides packet integrity authentication and anti-replay protection.
Security level exceptions
- Software/Firmware security: N/A
- Non-invasive security: N/A
- Mitigation of other attacks: N/A
Approved algorithms (4)
| Algorithm | CAVP certificates |
|---|---|
| AES-CMAC | A7627 |
| AES-GCM | A7627, A7628, A7629 |
| AES-GMAC | A7627, A7628 |
| KDF SP800-108 | A7627 |
Validation history
| Date | Type | Lab |
|---|---|---|
| 2026-10-30 | Initial | Acumen Security |
Status timeline
As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.
- 2026-11-02: first observed by this tracker, status active
- Validation dates on record: 2026-10-30