WIXLIB

JUNOS-FIPS 9.3 L2 OS Cryptographic ModuleTable 4.Strengths of Authentication MechanismsAuthentication MechanismStrength of MechanismUsername and passwordThe module enforces 10-character passwords (at minimum) chosen from the 96 human readable ASCII characters.The module enforces a timed access mechanism as follows: For the first two failedattempts (assuming 0 time to process), no timed access is enforced. Upon the thirdattempt, the module enforces a 5-second delay. Each failed attempt thereafter resultsin an additional 5-second delay above the previous (e.g. 4th failed attempt 10-seconddelay, 5th failed attempt 15-second delay, 6th failed attempt 20-second delay, 7thfailed attempt 25-second delay).This leads to a maximum of 7 possible attempts in a one-minute period for each getty.The best approach for the attacker would be to disconnect after 4 failed attempts, andwait for a new getty to be spawned. This would allow the attacker to perform roughly9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded downto 9 per minute, because there is no such thing as 0.6 attempts. Thus the probability ofa successful random attempt is 1/9610, which is less than 1/1 million. The probability ofa success with multiple consecutive attempts in a one-minute period is 9/(9610), whichis less than 1/100,000.RSA signatureThe module supports RSA (1024 or 2048-bit), which has a minimum equivalentcomputational resistance to attack of either 280 or 2112 depending on the modulus size.Thus the probability of a successful random attempt is 1/(280) or 1/ (2112), which areboth less than 1/1,000,000. The probability of a success with multiple consecutiveattempts in a one-minute period is 5.6e7/(280) or 5.6e7/(2112), which are both less than1/100,000.DSA signatureThe module supports DSA (1024-bit only) which have an equivalent computationalresistance to attack of 280. Thus the probability of a successful random attempt is1/ 280, which is less than 1/1,000,000. The probability of a success with multipleconsecutive attempts in a one-minute period is 5.6e7/(280), which is less than1/100,000.AS2-FIPS PIC passwordThe module supports 32 byte passwords to authenticate the PIC. Thus the probabilityof a successful random attempt is 1/ (25532), which is less than 1/1,000,000. Theprobability of a success with multiple consecutive attempts in a one minute period is4,940,716 /(25532), which is less than 1/100,000.RE-to-RE pre-shared keysThe module uses 160-bit HMAC keys for RE-to-RE authentication. Thus the probabilityof a successful random attempt is 1/(2160), which is less than 1/1,000,000. Theprobability of a success with multiple consecutive attempts in a one-minute period is54,347,880/(2160), which is less than 1/100,000.IKE pre-shared keysThe module uses 160-bit HMAC keys for RE-to-RE authentication. Thus the probabilityof a successful random attempt is 1/(2160), which is less than 1/1 million. Theprobability of a success with multiple consecutive attempts in a one minute period is54,347,880/(2160), which is less than 1/100,000.Protocol peer pre-shared keysThe module supports TCP-MD5 with a 128-bit pre-shared key. Thus the probability ofa successful random attempt is 1/ (2128), which is less than 1/1,000,000. Theprobability of a success with multiple consecutive attempts in a one minute period is54,347,880/(2128), which is less than 1/100,000. Juniper Networks, Inc.8

JUNOS-FIPS 9.3 L2 OS Cryptographic Module6. Access Control PolicyRoles and ServicesTable 5.Services Authorized for RolesRoleAuthorized ServicesUser: Configuration Management: Allows the user to configure the router.Configures and monitors the routervia the console, SSH-2, or TLS. Router Control: Allows the user to modify the state of the router. (Example: shutdown,reboot) Status Checks: Allows the user to get the current status of the router JUNOScript: Provides script handling service for module via SSH-2 or TLS session. SSH-2: Provides encrypted login via the SSH-2 protocol. TLS: Provides encrypted login via the TLS protocol. Console Access: Provides direct login access via the console.Cryptographic Officer: Configuration Management: Allows the CO to configure the router.Configures and monitors the REvia the console, SSH-2, or TLS.Also has permissions to view andedit secrets within the RE. Router Control: Allows the user to modify the state of the router. (Example: shutdown,reboot) Status Checks: Allows the user to get the current status of the router. Zeroize: Allows the user to zeroize the configuration (all CSPs) within the module. Load New Software: Allows the verification and loading of new software into the router.Note: Loading of software invalidates the module’s FIPS 140-2 validation. JUNOScript: Provides script handling service for module via SSH-2 or TLS session. SSH-2: Provides encrypted login via the SSH-2 protocol. TLS: Provides encrypted login via the TLS protocol. Console Access: Provides direct login access via the console.AS2-FIPS PIC Receives SAs: Allows the PIC to receive the SAs associated with a particular IPsectunnel. Secure IPC Tunnel: Allows the PIC to communicate with the RE using a secure tunnel.RE-to-REThe RE role is able to communicatewith other REs to enable failovercapabilities. Configuration Management: Allows propagation of configuration database to the backupRE. Router Control: Allows the master RE to control the state of the backup RE. Status Checks: This service will allow the user to get the current status of the router(ports, number of packets, uptime, and so forth) Secure Transport: Allows the master RE to communicate with the backup RE using asecure IPsec connection. Secure IPC Tunnel: Allows the PIC to communicate with the RE using a secure tunnel. Juniper Networks, Inc.9

JUNOS-FIPS 9.3 L2 OS Cryptographic Module Key Agreement: Allows the negotiation of keys for use with an IPsec tunnel.IKE PeerThis role performs IKE negotiationwith the RE.The IKE peer will create SAs for theAS2-FIPS PIC to use when usingIPsec with a VPN client incyberspace.Protocol Peer Mutual Authentication: Allows validating a known protocol peer.This role allows remote router tocommunicate with the RE viastandard networking protocols.The supported routing protocols(BGP, ISIS, LDP, MSDP, OSPF,RIP2, RSVP, VRRP, and NTP)authenticate peers to each otherfor purpose of updating routingtables. Protocol Exchange: Allows the peers to communicate using an agreed-upon protocol. Secure Protocol Transport: Allows IPsec connection between protocol peer and router.Unauthenticated ServicesThe cryptographic module supports the following unauthenticated services: PIC Software Image Load: Downloads PIC software image to PIC. Receive Service Set Configuration: Allows the PIC to receive service set configuration database. Show Status: Provides the current status of the cryptographic module. Self-tests: Executes the suite of self-tests required by FIPS 140-2. Routing Protocols: Unauthenticated routing protocols (e.g., TCP, UDP) SNMP Traps (Status)Definition of Critical Security Parameters (CSPs)Table 6.Table of CSPsCSPDescriptionSSH-2 Private Host KeyThe first time SSH-2 is configured, the key is generated. RSA, DSA.Used to Identify the host. 1024-bit length set as minimum.SSH-2 Session KeySession keys used with SSH-2, TDES (3 key), AES 128, 192, 256,HMAC-SHA-1 key (160), DH Private Key 1024TLS Host Certificate, Private PortionX.509 certificates for TLS for authentication. RSA or DSATLS Session ParametersSession keys used with TLS, TDES (2 or 3 key), AES 128, 192, 256,HMAC-SHA-1; Pre-master SecretUser Authentication KeyHMAC-SHA-1 KeyUsed to authenticate users to the module.CO Authentication KeyHMAC-SHA-1 KeyUsed to authenticate COs to the module. Juniper Networks, Inc.10

JUNOS-FIPS 9.3 L2 OS Cryptographic ModuleCSPDescriptionIPsec SAsSession keys used within IPsec.TDES (3 key), HMAC-SHA-1IKE Session ParametersNonces, DH Private Key 1024-bit keys, TDES, HMAC-SHA-1, usedwithin IKESecure IPC (Internal) Session KeyTDES (3 Key)Used to communicate securely between the RE and the PICRE-to-RE Authentication KeyHMAC Key (Manual IPsec SA)160 bit key with 96 bit truncated MAC.RE-to-RE Encryption KeyTDES key (Manual IPsec SA)Protocol Peer Authentication KeysTCP-MD5 key to authenticate the routing peer role for the followingprotocols:BGP, ISIS, LDP, MSDP, OSPF, RIP2, RSVP, VRRP, NTP, APSCPASPIC password32 byte passwordRADIUS shared secretUsed to authenticate COs and Users (10 chars minimum)This includes the Authentication Data BlockTACACS shared secretUsed to authenticate COs and Users (10 chars minimum)This includes the Authentication Data BlockManual SA for PICEntered into the RE, which is then passed over to the PIC for use byPIC with IPSECRNG StateInternal state and seed key of RNG Juniper Networks, Inc.11

JUNOS-FIPS 9.3 L2 OS Cryptographic ModuleDefinition of Public KeysTable 7.Table of Public KeysKeyDescription/UsageSSH-2 Public Host KeyFirst time SSH-2 is configured, the key is generated. RSA (1024 or 2048-bit),DSA. Identify the host.TLS Host Certificate, Public PortionX.509 certificates for TLS for authentication. RSA (1024 or 2048-bit) or DSAUser Authentication Public KeysUsed to authenticate users to the module. RSA (1024 or 2048-bit) or DSACO Authentication Public KeysUsed to authenticate CO to the module. RSA (1024 or 2048-bit) or DSAJuniperRootCARSA 2048-bit X.509 certificateUsed to verify the validity of the Juniper image at software load and also atruntime for integrity.EngineeringCARSA 2048-bit X.509 certificateUsed to verify the validity of the Juniper image at software load and also atruntime for integrity.PackageCARSA 2048-bit X.509 certificateUsed to verify the validity of the Juniper image at software load and also atruntime for integrity.PackageProductionRSA 2048-bit X.509 certificateCertificate that holds the public key of the signing key that was used togenerate all the signatures used on the packages and signature lists.RE RSA Verify Key (Public Authentication key)RSA 1024-bit key sent to the PIC to sign data to allow the PIC toauthenticate to the RE by having the PIC sign data that is verified by the RE.PIC RSA Verify (Public Authentication) KeyRSA 1024-bit key to allow the RE to authenticate to the PIC by signing dataand having the PIC verify the signature.PIC RSA Encrypt KeyRSA 1024-bit key used to encrypt the TDES session key.RE RSA Encrypt KeyRSA 1024-bit key sent to the PIC; note that the PIC never uses this key.DH Public KeysUsed within IKE and SSH-2 for key establishment. Juniper Networks, Inc.12

JUNOS-FIPS 9.3 L2 OS Cryptographic ModuleDefinition of CSP Modes of AccessTable 8 defines the relationship between access to CSPs and the different module services. The modes of access shown in the table aredefined as follows:Table 8.CSP Access Rights within Roles & rot.PeerXCryptographic Keys and CSPAccess OperationR Read, W Write, D DeleteConfigurationManagementAll CSPs (R, W, D)ConfigurationManagementNo access to CSPsXConfigurationManagementAll CSPs (R, W)XXXXRouter ControlNo access to CSPsXXXStatus ChecksNo access to CSPsZeroizeAll CSPs (D)Receives SAsRelevant IPsec SAs (R)Key AgreementIPsec SAs (R)XMutual AuthenticationRelevant Authentication data: (R)XProtocol Exchange(OSPF, VRRP, etc)No access to CSPsXLoad New SoftwareNo access to CSPsXJUNOScriptAll CSPs (R, W, D)XJUNOScriptNo access to CSPsXXSSH-2SSH-2 session key (R)XXTLSTLS session parameters (R)XXConsole AccessCO Authentication Key, UserAuthentication Key (R)Secure IPC TunnelSecure IPC (Internal) Session Key(R)XXXXX Juniper Networks, Inc.13

JUNOS-FIPS 9.3 L2 OS Cryptographic ModuleXXSecure transportRE-to-RE Encryption Key, RE-to-REAuthentication Key (R)Secure ProtocoltransportProtocol Peer Authentication Keys(R)7. Operational EnvironmentThe FIPS 140-2 Area 6 Operational Environment requirements are not applicable because the cryptographic module is a limitedoperational environment.8. Security RulesThe cryptographic module’s design corresponds to the cryptographic module’s security rules. This section documents the securityrules enforced by the cryptographic module to implement the security requirements of this FIPS 140-2 Level 2 module.1.2.3.4.The cryptographic module shall provide six distinct operator roles. These are the User role, the Cryptographic Officer role, RE-toRE role, AS2-FIPS PIC role, IKE Peer role, and Protocol Peer role.The cryptographic module shall support both role-based and identity-based authentication mechanisms.Authentication of identity to an authorized role is required for all services that modify, disclose, or substitute CSPs, use Approvedsecurity functions, or otherwise affect the security of the cryptographic module.The cryptographic module shall perform the following tests: Power up testsA. Cryptographic algorithm v.DES - KAT1TDES - KATAES - KATAES - CMAC KATSHA-1 KATSHA-224, 256, 384, 512 KATHMAC-SHA-1 KATHMAC-SHA-256 KATECDH KATECDSA pairwise consistency test (sign/verify) and KATRSA pairwise consistency test (sign/verify and encrypt/decrypt) and KATDSA pairwise consistency test (sign/verify) and KATFIPS 186-2 RNG KATKDF-IKEv1 KATB. Firmware integrity test:i.RSA digital signature verification (PKCS1.5, 2048-bit key, SHA-1) and SHA-1 hashverificationC. Critical functions tests 1i.Verification of Limited Environmentii.Verification of Integrity of Optional PackagesConditional testsA. Pairwise consistency testsThe DES function is used to implement TDES and is not otherwise available for use in the cryptomodule. Juniper Networks, Inc.14

JUNOS-FIPS 9.3 L2 OS Cryptographic Modulei.ECDSA Pairwise Consistency testii.RSA pairwise consistency test (sign/verify and encrypt/decrypt)iii.DSA pairwise consistency test (sign/verify)B. Firmware load test: RSA digital signature verification (2048-bit key)C. Manual key entry test: duplicate key entries testD. Continuous random number generator test: performed on the Approved FIPS 186-2, Appendix 3.1 RNG,and on a non-Approved RNG that is used to seed the Approved RNG.E. Bypass test is not applicable.5.6.7.8.9.10.11.12.13.Any time the cryptographic module is in an idle state, the operator shall be capable of commanding the module to perform thepower-up self-test by power-cycling the module.Prior to each use, the internal RNG shall be tested using the continuous random number generation conditional test.Data output shall be inhibited during self-tests and error states.Key generation, manual key entry and zeroization processes shall be logically isolated from data output.Status information shall not contain CSPs or sensitive data that if misused could lead to a compromise of the module.The module shall support concurrent operators.The FIPS module is a combination of Routing Engine and Juniper router platform chassis in which the RE is installed. TheRouting Engine must be installed in one of the approved platforms as listed in Table 1, per Juniper installation guidance. Theinstallation shall include the placement of tamper labels installed in specific locations on the module. To operate in the FIPSApproved mode of operation, the module must be installed and tamper labels applied to the routing engine hardware as specifiedin Appendix A for the tamper label locations.The Crypto Officer is responsible for properly controlling and installing tamper evident labels. Additionally, the Crypto Officer isresponsible for the direct control and observation of any changes to the module such as reconfigurations where the tamper evidentseals or security appliances are removed or installed to ensure the security of the module is maintained during such changes andthat the module is returned to a FIPS Approved state.The validation of the firmware is invalid upon porting of the firmware module to systems not defined in this security policy.9. Physical Security

JUNOS-FIPS 9.3 L2 OS is 9.3R2.8; the image is junos-juniper-9.3R2.8-fips.tgz. See Table 1 below for hardware platform specifics. JUNOS-FIPS 9.3 L2 OS is a release of the JUNOS operating system, the first routing operating system designed specifically for the Internet. JUNOS is currently deployed in the largest and fastest-growing networks wo .