Avaya 3050-VM, User Manual, Page: 236 / 274

command to perform key archival. All archived keys are 3DES3KEY encrypted. Keys may only
be archived and restored between devices in the same family.
11.0 Modes
The HSM has two operating modes. These are the FIPS140-1 mode and the non-FIPS140-1
mode. Before the HSM is initialized with the "Initialize Card" command, it is in the non-
FIPS140-1 mode. This command has an input parameter that specifies the mode of the card
after initialization. Once initialized, the board remains in one of the two modes. If one wishes
to change the operating mode of the card, the card must first be uninitialized using the
"Uninitialize Card" command. Then, the card can be initialized with a different operating mode.
Uninitializing the card removes all secrets from the card.
11.1 FIPS 140-1 Mode
In the FIPS 140-1 mode, the board may only perform FIPS approved algorithms. These are
as follows: DES 3DES ** SHA-1 RSA Sign RSA Verify See the table in services section to
identify the conditions necessary for performing various HSM commands in the FIPS140-1
mode. No plaintext private or symmetric keys can cross the cryptographic boundary when the
HSM is in the FIPS140-1 mode. **The 3DES algorithm is used to secure private or symmetric
keys stored in flash and for the key wrapping and unwrapping functions.
11.2 Non-FIPS 140-1 Mode
In the non-FIPS140-1 mode, the user has greater flexibility in the types of algorithms that can
be performed and the manner that keys are handled. For example, in the non-FIPS140-1 mode,
the board can perform all the functions of the FIPS140-1 mode plus other functions like MD5
and RC4. In the non-FIPS140-1 mode, keys may cross the cryptographic boundary in plaintext
form for certain operations (e.g. DES, RSA CRT exponentiation). It is still possible to store keys
on the board so that they cannot be extracted. These non-extractable keys will be erased if a
tamper attempt is detected. See the table in services section to identify the conditions
necessary for performing various HSM commands in the non-FIPS140-1 mode.
12.0 Self-Tests
The following table describes all of the cryptographic self-tests performed by the HSM module.
The following abbreviation is used: KAT = Known Answer Test
HSM Security Policy
236 User Guide April 2013
Comments? infodev@avaya.com