CKM_DES3_CBC_PAD
Firmware 7.7.3 and Newer Summary
FIPS approved? | Yes |
Supported functions | Encrypt | Decrypt | Wrap | Unwrap |
Functions restricted from FIPS use | Cannot wrap | Cannot encrypt |
Minimum key length (bits) | 128 |
Minimum key length for FIPS use (bits) | 192 |
Minimum legacy key length for FIPS use (bits) | 128 |
Maximum key length (bits) | 192 |
Block size | 8 |
Digest size | 0 |
Key types | DES3 |
Algorithms | DES3 |
Modes | CBC_PAD |
Flags | Extractable |
NOTE
>The 3DES usage counter attribute (CKA_BYTES_REMAINING) has been removed in Luna USB HSM 7 Firmware 7.7.3 and newer, to comply with FIPS 140-3 requirements. This attribute is now ignored on any keys where it is already set.
>In this firmware version, "Functions restricted from FIPS use" has changed for this mechanism, to comply with FIPS 140-3 requirements.
Firmware 7.7.2 Summary
FIPS approved? | Yes |
Supported functions | Encrypt | Decrypt | Wrap | Unwrap |
Functions restricted from FIPS use | Cannot wrap |
Minimum key length (bits) | 128 |
Minimum key length for FIPS use (bits) | 192 |
Minimum legacy key length for FIPS use (bits) | 128 |
Maximum key length (bits) | 192 |
Block size | 8 |
Digest size | 0 |
Key types | DES3 |
Algorithms | DES3 |
Modes | CBC_PAD |
Flags | Extractable |
NOTE 3DES keys have a usage counter attribute (CKA_BYTES_REMAINING) that limits each key instance to encrypting a maximum of 2^16 8-byte blocks of data when the HSM is in FIPS approved configuration (HSM policy 12: Allow non-FIPS algorithms or partition policy 43: Allow Non-FIPS algorithms set to 0). When the counter runs out, that key can no longer be used for encryption, wrapping, deriving, or signing, but can still be used for decrypting, unwrapping, and verifying pre-existing objects. The CKA_BYTES_REMAINING attribute cannot be viewed if the HSM/partition is not in FIPS approved configuration.
The attribute is preserved through backup/restore using a Luna Backup HSM 7; restoring the key restores the counter's setting at the time of backup.
The attribute is not preserved through backup/restore using a Luna Backup HSM G5; restoring the key resets the counter to the maximum.
NOTE To comply with FIPS SP800-131a Rev2 published in March 2019, when the HSM is in FIPS mode, this mechanism is not allowed to wrap objects.