HP-UX Kernel Cryptographic Module 2.1 User Guide (766149-002, April 2014)

1 Overview
The HP-UX Kernel Cryptographic Module ( HP-UX KCM ) is a common cryptographic library in
HP-UX Kernel. It is a library of core cryptographic algorithms, which are used by HP-UX Kernel
products.
HP-UX KCM implements FIPS 140-2 compliant algorithms for commonly used cryptographic
operations such as data encryption/decryption, sign/verify, digest, HMAC, and random number
generation.
HP-UX KCM is available in HP-UX Kernel as a dynamically loadable library with well-defined
interfaces to invoke the crypto functions. This helps to bring modularity and standardization in the
usage of crypto algorithms across the HP-UX Kernel products. HP-UX KCM is available on HP
Integrity platform running HP-UX 11iv3.
The interfaces supported by the library follows RSA Security Inc. PKCS #11 Cryptographic Token
Interface (Cryptoki) v 2.20 specification.
For more information on PKCS, see PKCS #11 v2.20: Cryptographic Token Interface Standard
document.
NOTE: This link will take you outside the Hewlett-Packard (HP) Web site. HP does not control
and is not responsible for information outside of HP.com.
Supported configuration
The supported configuration for HP-UX KCM is HP-UX 11i v3 for HP Integrity Servers.
Features provided in this release
This section discusses the new features available in the HP-UX KCM 2.1 version.
HP-UX Kernel Cryptographic Module 1.0 has been awarded FIPS 140-2 Level 1 certificate
(Certificate #2079).
HP-UX KCM 2.1 depot includes FIPS 140-2 certified HP-UX Kernel Cryptographic Module 1.0 and
KCM 2.1 which is the Non-FIPS version of the library.
The table below lists the FIPS 140-2 compliant algorithms, key lengths, modes, and operations
implemented by HP-UX KCM.
PurposeOperationsKey sizeFIPS algo
Symmetric key operations (FIPS-197
compliant)
Generate, Encrypt, and
Decrypt
128, 192, and 256
Mode: CBC
AES
Asymmetric key operationsGenerate key pair, Sign,
Verify, Wrap key, and
Unwrap key
2048RSA
(FIPS 186-3 and PKCS#1 v1.5 compliant)
Digest operations (FIPS 180-3 compliant)Digest256, 384, and 512SHA-2
Key-Hash Message Authentication Code
(HMAC)
Digest (with key)256, 384, and 512HMAC-SHA2
NIST SP800-90A compliant DRBGGenerate randomRNG
Supported configuration 5