FIPS 140-3 Cryptographic Modules
Karios performs its cryptographic operations using CMVP-validated cryptographic modules and runs on a FIPS-mode operating system. This page lists the cryptographic modules in use. It is a statement of the cryptography Karios employs, not a system-level certification claim - see Certification Scope.
Validated Cryptographic Modules
Component |
Cryptographic module |
FIPS 140-3 |
|---|---|---|
K-Shield security plugin |
Go Cryptographic Module v1.0.0 (CMVP certificate #5247, Security Level 1) |
Validated |
Platform data services and internal TLS (PostgreSQL, Redis, internal certificate authority) |
OpenSSL FIPS Provider 3.1.2 (CMVP certificate #4985) |
Validated |
Platform control-plane services (core, licensing, orchestration, node agent) |
Go / Google BoringCrypto cryptographic module (CMVP certificate #5244, Security Level 1; build-enforced) |
Validated |
Operating Mode
The Linux kernel runs in FIPS mode (
fips=1): it performs power-on cryptographic self-tests and enforces approved algorithms at the kernel cryptographic layer.Cryptographic modules are vendor-affirmed on Debian. The Go Cryptographic Module’s CMVP-tested operating environments are Red Hat Enterprise Linux 9 and Alpine Linux 3.20; Debian is a vendor-affirmed operating environment. Karios does not claim that “Debian is FIPS-validated.”
Certification Scope
Note
These are the cryptographic modules Karios uses. Whether a given deployment meets a specific accreditation - for example FedRAMP, a DoD Impact Level, or CJIS - depends on your organization’s authorization boundary, configuration, and scope, not on documentation alone. Detailed cryptographic-boundary and module security-policy references are available under the applicable compliance engagement.
See Glossary for the FIPS 140-3 definition.