Repository navigation
Is the Session API within the approved scope of CMVP certificate #5313? #60
Description
libsymcrypt.so exports SymCryptSessionSenderInit, SymCryptSessoinReceiverInit, SymCryptSessionGcmEncrypt, SymCryptSessionGcmDecrypt and SymCryptSessionDestroy (VERSION_101.). The 101.2.0 changelog describes these as enabling "multithreaded IV generation within the SymCrypt FIPS boundary."
The #5313 Security Policy does not name a Session service in its services table, and registers IV Generation - External for AES-GCM. The certificate seperately claims IG C.H Scenario 3.
When a caller uses SymCryptSessionSenderInit followed by SymCryptSessionGcmEncrypt, so that the module constructs and increments the nonce internally, is that an approved-mode use of the module under #5313? Does it satisfy the Scenario 3 claim?
Trying to understand so we can use the module in approved mode correctly. Thanks!
Activity
ccalik commentedon Sep 28, 2026
Hi R2rho (@R2rho),
Using AES-GCM via the Session API is an approved operation per Scenario 3 of FIPS 140-3 IG C.H as stated in the Security Policy Document, with the condition that in the case of a power loss/restore a new key must be used.