Non-Proprietary 1| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware Non-Proprietary Security Policy FIPS 140-3 Level 2 Document Version 1.0 October 2024 Non-Proprietary 2| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Copyright © 2024 Hewlett Packard Enterprise Company. Hewlett Packard Enterprise Company trademarks include , HPE Aruba Wireless Networks, HPE Aruba Networking, the registered HPE Aruba Networking the Mobile Edge Company logo, HPE Aruba Networking Mobility Management System, Mobile Edge Architecture® , People Move. Networks Must Follow® , RFProtect® , Green Island® . All rights reserved. All other trademarks are the property of their respective owners. HPE Aruba Networking is a Hewlett Packard Enterprise company. The resource assets in this firmware may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names. Open Source Code Certain Hewlett Packard Enterprise Company products include Open Source software code developed by third parties, including software code subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open Source Licenses. The Open Source code used can be found at this site: https://www.arubanetworks.com/open_source Legal Notice The use of Hewlett Packard Enterprise Company switching platforms and software or firmware, by all individuals or corporations, to terminate other vendors’ VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Hewlett Packard Enterprise Company, from any and all legal actions that might be taken against it with respect to infringement of copyright on behalf of those vendors. Warranty This hardware product is protected by the standard HPE Aruba Networking warranty of one year parts/labor. For more information, refer to the ARUBACARE SERVICE AND SUPPORT TERMS AND CONDITIONS. Altering this device (such as painting it) voids the warranty. www.arubanetworks.com 6280 America Center Dr San Jose, CA, USA 95002 Phone: 408.941.4300 Non-Proprietary 3| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Contents 1 General.............................................................................................................................................................................6 1.1 Purpose of this Document......................................................................................................................................6 1.2 Additional HPE Aruba Networking Product Information........................................................................................6 1.3 Acronyms and Abbreviations..................................................................................................................................7 1.4 Security Levels........................................................................................................................................................8 2 Cryptographic Module Specification................................................................................................................................9 2.1 Description .............................................................................................................................................................9 2.1.1 Cryptographic Module Boundary ....................................................................................................................9 2.2 Version Information ...............................................................................................................................................9 2.3 Operating Environments ......................................................................................................................................10 2.3.1 AP-510 Series.................................................................................................................................................11 2.3.2 AP-530 Series.................................................................................................................................................15 2.3.3 AP-580 Series.................................................................................................................................................19 2.3.4 AP-630 Series.................................................................................................................................................23 2.3.5 AP-650 Series.................................................................................................................................................26 2.4 Excluded Components..........................................................................................................................................28 2.5 Modes of Operation .............................................................................................................................................29 2.6 Approved Algorithms............................................................................................................................................29 2.7 Non-Approved Cryptographic Algorithms Allowed in the Approved Mode of Operation....................................33 2.8 Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed..................33 2.9 Non-Approved Algorithms Not Allowed in the Approved Mode of Operation ....................................................33 3 Cryptographic Module Interfaces ..................................................................................................................................34 4 Roles, Services, and Authentication...............................................................................................................................35 4.1 Roles.....................................................................................................................................................................35 4.2 Authentication......................................................................................................................................................37 4.2.1 Crypto Officer Authentication .......................................................................................................................37 4.2.2 User Authentication ......................................................................................................................................37 4.2.3 Wireless Client Authentication......................................................................................................................37 4.2.4 Strength of Authentication Mechanisms.......................................................................................................38 4.3 Services.................................................................................................................................................................39 4.3.1 Approved Services.........................................................................................................................................39 4.3.2 Non-Approved Services .................................................................................................................................43 5 Software / Firmware Security ........................................................................................................................................45 6 Operational Environment...............................................................................................................................................45 7 Physical Security.............................................................................................................................................................46 7.1 Reading TELs.........................................................................................................................................................46 7.2 Applying TELs........................................................................................................................................................47 7.3 Required TEL Locations.........................................................................................................................................47 7.3.1 TELs Placement on the AP-514 and AP-515...................................................................................................48 7.3.2 TELs Placement on the AP-534 and AP-535...................................................................................................49 7.3.3 TELs Placement on the AP-584, AP-585, and AP-587 ....................................................................................50 7.3.4 TELs Placement on the AP-584......................................................................................................................51 7.3.5 TELs Placement on the AP-585......................................................................................................................52 7.3.6 TELs Placement on the AP-587......................................................................................................................53 7.3.7 TELs Placement on the AP-635......................................................................................................................54 7.3.8 TELs Placement on the AP-655......................................................................................................................55 7.4 Inspection/Testing of Physical Security Mechanisms...........................................................................................56 8 Non-Invasive Security.....................................................................................................................................................56 9 Sensitive Security Parameters (SSP) Management ........................................................................................................57 9.1 Non-Deterministic Random Number Generation Specification ...........................................................................65 10 Self-Tests........................................................................................................................................................................66 11 Life-Cycle Assurance.......................................................................................................................................................71 11.1 Product Examination ............................................................................................................................................71 11.2 Package Contents .................................................................................................................................................71 11.3 Pre-Installation Checklist......................................................................................................................................71 11.4 Identifying Specific Installation Locations ............................................................................................................71 11.5 Precautions...........................................................................................................................................................72 11.6 Secure Operation..................................................................................................................................................72 11.6.1 Crypto Officer Management ....................................................................................................................72 Non-Proprietary 4| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 11.6.2 User Guidance..........................................................................................................................................73 11.6.3 Set-up and Configuration .........................................................................................................................73 11.7 Non-Approved Approved Mode Configurations...................................................................................................75 11.8 Full Documentation..............................................................................................................................................75 11.8.1 Related HPE Aruba Networking Documents ............................................................................................75 11.9 End of Life.............................................................................................................................................................76 12 Mitigation of Other Attacks............................................................................................................................................76 Figures Figure 1 - AP-514 Campus Access Point – Front ......................................................................................................................11 Figure 2 - AP-514 Campus Access Point – Back........................................................................................................................11 Figure 3 - AP-515 Campus Access Point – Front ......................................................................................................................11 Figure 4 - AP-515 Campus Access Point – Back........................................................................................................................12 Figure 5 - AP-510 Series Campus Access Point – Interfaces.....................................................................................................14 Figure 6 - AP-534 Campus Access Point – Front ......................................................................................................................15 Figure 7 - AP-534 Campus Access Point – Back........................................................................................................................15 Figure 8 - AP-535 Campus Access Point – Front ......................................................................................................................15 Figure 9 - AP-535 Campus Access Point – Back........................................................................................................................16 Figure 10 - AP-530 Series Campus Access Point – Interfaces...................................................................................................18 Figure 11 - AP-585 Outdoor Access Point – Side......................................................................................................................19 Figure 12 - AP-584 Outdoor Access Point – Bottom (without cover).......................................................................................19 Figure 13 - AP-585 Outdoor Access Point – Top ......................................................................................................................19 Figure 14 - AP-587 Outdoor Access Point – Rear.....................................................................................................................19 Figure 15 - AP-584 Outdoor Access Point – Interfaces (with aesthetic cover).........................................................................21 Figure 16 - AP-585 Outdoor Access Point – Interfaces (with aesthetic cover).........................................................................22 Figure 17 - AP-587 Outdoor Access Point – Interfaces (with aesthetic cover).........................................................................22 Figure 18 - AP-635 Campus Access Point – Front.....................................................................................................................23 Figure 19 - AP-635 Campus Access Point – Back......................................................................................................................23 Figure 20 - AP-630 Series Campus Access Point – Interfaces...................................................................................................25 Figure 21 - AP-655 Campus Access Point – Front.....................................................................................................................26 Figure 22 - AP-655 Campus Access Point – Back......................................................................................................................26 Figure 23 - AP-650 Series Campus Access Point – Interfaces...................................................................................................28 Figure 24 –AP Physical and Cryptographic Boundaries with Interfaces and Components Block Diagram...............................34 Figure 25 - Tamper-Evident Labels...........................................................................................................................................46 Figure 26 – Top View of AP-514 with TELs...............................................................................................................................48 Figure 27 – Bottom View of Aruba AP-514 with TELs ..............................................................................................................48 Figure 28 – Top View of AP-535 with TELs...............................................................................................................................49 Figure 29 – Bottom View of Aruba AP-535 with TELs ..............................................................................................................49 Figure 30 – Placement of TELs 1 and 2 on AP-580 Series APs..................................................................................................50 Figure 31 – Placement of TEL 3 on AP-580 Series APs .............................................................................................................50 Figure 32 – Right Side View of AP-584 with TEL.......................................................................................................................51 Figure 33 – Front View of AP-584 with TEL..............................................................................................................................51 Figure 34 – Left Side View of AP-584 with TELs.......................................................................................................................51 Figure 35 – Right Side View of AP-585 with TEL.......................................................................................................................52 Figure 36 – Front View of AP-585 with TEL..............................................................................................................................52 Figure 37 – Left Side View of AP-585 with TELs.......................................................................................................................52 Figure 38 – Right Side View of AP-587 with TEL.......................................................................................................................53 Figure 39 – Front View of AP-587 with TEL..............................................................................................................................53 Figure 40 – Left Side View of AP-587 with TELs.......................................................................................................................53 Figure 41 – Top View of AP-635 with TELs...............................................................................................................................54 Figure 42 – Bottom View of Aruba AP-635 with TELs ..............................................................................................................54 Figure 43 – Top View of AP-655 with TELs...............................................................................................................................55 Figure 44 – Bottom View of Aruba AP-655 with TELs ..............................................................................................................55 Non-Proprietary 5| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Tables Table 1 – Document Revision History........................................................................................................................................5 Table 2 – Security Levels............................................................................................................................................................8 Table 3 – Cryptographic Components........................................................................................................................................9 Table 4 – Version Information ...................................................................................................................................................9 Table 5 – Cryptographic Module Tested Configurations..........................................................................................................10 Table 6 - AP-510 Series Status Indicator LEDs..........................................................................................................................14 Table 7 - AP-530 Series Status Indicator LEDs..........................................................................................................................18 Table 8 - AP-580 Series Status Indicator LEDs..........................................................................................................................22 Table 9 - AP-630 Series Status Indicator LEDs..........................................................................................................................25 Table 10 - AP-650 Series Status Indicator LEDs........................................................................................................................28 Table 11 – Modes List and Description....................................................................................................................................29 Table 12 – Approved Algorithms - ArubaOS OpenSSL Module................................................................................................29 Table 13 - Approved Algorithms - Aruba CPU Jitter Entropy Source .......................................................................................31 Table 14 - Approved Algorithms - ArubaOS Crypto Module....................................................................................................31 Table 15 - Approved Algorithms - ArubaOS Bootloader Module.............................................................................................32 Table 16 – Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed....................33 Table 17 – Non-Approved Algorithms Not Allowed in the Approved Mode of Operation ......................................................33 Table 18 – Ports and Interfaces ...............................................................................................................................................34 Table 19 – Roles, Service Commands, Input and Output.........................................................................................................35 Table 20 – Characteristics of Roles by AP Configuration when Module is in Approved Mode of Operation...........................36 Table 21 – Roles and Authentication.......................................................................................................................................38 Table 22 – Approved Services..................................................................................................................................................39 Table 23 – Approved Services Not Using Any Approved Security Functions ...........................................................................41 Table 24 – Non-Approved Services..........................................................................................................................................44 Table 25 - Physical Security Inspection Guidelines ..................................................................................................................56 Table 26 – SSPs and Keys .........................................................................................................................................................57 Table 27 – Non-Deterministic Random Number Generation Specification .............................................................................65 Table 28 – Pre-Operational Self-Tests......................................................................................................................................66 Table 29 – Conditional Cryptographic Algorithm Tests............................................................................................................66 Table 30 – Conditional Pairwise Consistency Tests..................................................................................................................69 Table 31 – Conditional Software/Firmware Load Tests ...........................................................................................................70 Preface This document may be freely reproduced and distributed whole and intact including the copyright notice. Products identified herein contain confidential commercial firmware. Valid license required. Document Revision History The following table lists the history of the revisions of this document by version number and date of revision. Table 1 – Document Revision History Version Date Description 1.0 October 2024 Initial FIPS 140-3 Release for HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS version 8.10 Firmware Non-Proprietary 6| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 1 General This section describes: • The purpose of this document. • HPE Aruba Networking documents related to this document contents. • Where to go for additional HPE Aruba Networking product information. • Acronyms and abbreviations. • The assurance security levels for each of the areas described in the FIPS 140-3 Standard. 1.1 Purpose of this Document This release supplement provides information regarding the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 validation from HPE Aruba Networking. HPE Aruba Networking is a Hewlett Packard Enterprise company. The material in this supplement modifies the general HPE Aruba Networking hardware and firmware documentation included with this product and should be kept with your HPE Aruba Networking product documentation. This supplement primarily covers the non-proprietary Cryptographic Module Security Policy for the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP- 655 Access Points with ArubaOS FIPS Firmware. This security policy describes how the Wireless Access Points (APs) meet the security requirements of FIPS 140-3 Level 2 and how to place and maintain the APs in the secure FIPS 140-3 mode. This policy was prepared as part of the FIPS 140-3 Level 2 validation of the product. FIPS 140-3 (Federal Information Processing Standards Publication 140-3, Security Requirements for Cryptographic Modules) details the U.S. Government requirements for cryptographic modules. FIPS 140-3 aligns with ISO/IEC 19790:2012(E) and includes modifications of the Annexes that are allowed to the Cryptographic Module Validation Program (CMVP), as a validation authority. The testing for these requirements will be in accordance with ISO/IEC 24759:2017(E), with the modifications, additions or deletions of vendor evidence and testing allowed as a validation authority under paragraph 5.2. More information about the FIPS 140-3 standard and validation program is available on the National Institute of Standards and Technology (NIST) website at: https://csrc.nist.gov/projects/cryptographic-module-validation-program In addition, in this document, the HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points with ArubaOS FIPS Firmware are referred to as the Wireless Access Point, the AP, the module, the cryptographic module, HPE Aruba Networking Wireless Access Points, HPE Aruba Networking Wireless APs, HPE Aruba Networking Access Points, HPE Aruba Networking APs, and AP-5XX and AP-6XX Wireless APs. 1.2 Additional HPE Aruba Networking Product Information More information is available from the following sources: • See the HPE Aruba Networking web site for the full line of products from HPE Aruba Networking: https://www.arubanetworks.com • The NIST Validated Modules web site contains contact information for answers to technical or sales-related questions for the product: https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search Enter HPE Aruba Networking in the Vendor field then select Search to see a list of FIPS validated HPE Aruba Networking products. Select the Certificate Number for the Module Name ‘HPE Aruba Networking AP-5xx and AP-6xx Access Points’. Non-Proprietary 7| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 1.3 Acronyms and Abbreviations AES Advanced Encryption Standard AP Access Point CAVP Cryptographic Algorithm Validation Program CBC Cipher Block Chaining CCCS Canadian Centre for Cyber Security, a branch of CSE CLI Command Line Interface CMVP Cryptographic Module Validation Program CO Crypto Officer CPSec Control Plane Security protected CSE Communications Security Establishment CSP Critical Security Parameter ECO External Crypto Officer EMC Electromagnetic Compatibility EMI Electromagnetic Interference ESV Entropy Source Validation FE Fast Ethernet GE Gigabit Ethernet GHz Gigahertz HMAC Hashed Message Authentication Code Hz Hertz IKE Internet Key Exchange IPsec Internet Protocol security KAT Known Answer Test KEK Key Encryption Key L2TP Layer-2 Tunneling Protocol LAN Local Area Network LED Light Emitting Diode PCT Pairwise Consistency Test PSP Public Security Parameter SFTP Secure File Transfer Protocol SHA Secure Hash Algorithm SNMP Simple Network Management Protocol SSP Sensitive Security Parameter SPOE Serial & Power Over Ethernet TEL Tamper-Evident Label or seal TFTP Trivial File Transfer Protocol WLAN Wireless Local Area Network Non-Proprietary 8| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 1.4 Security Levels The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points and associated modules are intended to meet overall FIPS 140-3 Level 2 requirements as shown in the following table. Table 2 – Security Levels ISO/IEC 24759 Section 6 [Number Below] FIPS 140-3 Section Title Security Level 1 General 2 2 Cryptographic Module Specification 2 3 Cryptographic Module Interfaces 2 4 Roles, Services, and Authentication 2 5 Software/Firmware Security 2 6 Operational Environment N/A 7 Physical Security 2 8 Non-Invasive Security N/A 9 Sensitive Security Parameter Management 2 10 Self-Tests 2 11 Life-Cycle Assurance 2 12 Mitigation of Other Attacks N/A Overall Overall Security Rating of the Module 2 Non-Proprietary 9| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2 Cryptographic Module Specification 2.1 Description Purpose and Use: The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points (each also referred to as ‘the module’ and ‘AP’) are hardware type cryptographic modules with ArubaOS version 8.10 FIPS Firmware, all contained in hard, opaque plastic cases. Each HPE Aruba Networking Access Point (AP) with ArubaOS version 8.10 FIPS Firmware was validated under FIPS 140-3 Level 2 requirements. ArubaOS is the operating system for HPE Aruba Networking Mobility Conductors, Mobility Controllers/Gateways, and controller-managed HPE Aruba Networking Access Points (APs). Cryptographic services are provided by components of ArubaOS. An access point is a hardware device that creates a wireless local area network (WLAN), connects to a wired router, switch, or hub via an Ethernet cable, and projects a Wi-Fi signal to a designated area. See the diagram and tables below and in following sub-sections for AP details. Module Type: Hardware Module Embodiment: Multiple-chip Standalone Module Characteristics: None 2.1.1 Cryptographic Module Boundary Each access point’s case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. Refer to section 2.3, Operating Environments, for information on each HPE Aruba Networking AP’s hardware, including the processor for each listed in Table 5, Cryptographic Module Tested Configurations. The cryptographic services available to each HPE Aruba Networking AP are provided by the following components: Table 3 – Cryptographic Components Component Type Versions CAVP Cert. # ArubaOS OpenSSL Module Firmware 1.0 A2690 Aruba CPU Jitter Entropy Source Firmware 3.3.1 A2738 ArubaOS Crypto Module Firmware 1.0 A2689 ArubaOS Bootloader Module Firmware 1.0 A2688 2.2 Version Information Table 4 – Version Information Type Versions Hardware HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points (APs) Firmware ArubaOS 8.10.0.5-FIPS Non-Proprietary 10| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3 Operating Environments The module contains a limited operational environment. The HPE Aruba Networking operating system runs on the HPE Aruba Networking access point hardware with cryptographic services provided by the ArubaOS operating system. See the following table of Cryptographic Module Tested Configurations for details. Only the versions that explicitly appear on the validation certificate are formally validated. Table 5 – Cryptographic Module Tested Configurations Access Point Model Part Number Firmware Version Processor - PAA Acceleration Section Below with the Access Point Distinguishing Features AP-514-USF1 HPE SKU Q9H68A ArubaOS 8.10 Broadcom BCM (64-bit ARMv8) 2.3.1 AP-510 Series AP-515-USF1 HPE SKU Q9H73A ArubaOS 8.10 - No acceleration AP-534-USF1 HPE SKU JZ342A ArubaOS 8.10 Qualcomm IPQ (64-bit ARM Cortex A53) 2.3.2 AP-530 Series AP-535-USF1 HPE SKU JZ347A ArubaOS 8.10 - No acceleration AP-584-US TAA AP-584-RW TAA HPE SKU R7T14A HPE SKU R7T15A ArubaOS 8.10 Qualcomm IPQ (64-bit ARM Cortex A53) 2.3.3 AP-580 Series AP-585-US TAA AP-585-RW TAA HPE SKU R7T19A HPE SKU R7T20A ArubaOS 8.10 - No acceleration AP-587-US TAA AP-587-RW TAA HPE SKU R7T24A HPE SKU R7T25A ArubaOS 8.10 AP-635-RW TAA AP-635-US TAA HPE SKU R7J32A HPE SKU R7J33A ArubaOS 8.10 Qualcomm IPQ (64-bit ARM Cortex A53) - No acceleration 2.3.4 AP-630 Series AP-655-RW TAA AP-655-US TAA HPE SKU R7J43A HPE SKU R7J44A ArubaOS 8.10 Qualcomm IPQ (64-bit ARM Cortex A53) - No acceleration 2.3.5 AP-650 Series Note: • For radio regulatory reasons, HPE Aruba Networking part numbers ending with -USF1 are to be sold in the US only. Part numbers ending with -RWF1 are considered ‘rest of the world’ and must not be used for deployment in the United States. From a FIPS perspective, both -USF1 and -RWF1 models are identical and fully FIPS 140-3 compliant. Tested Operational Environment’s Physical Perimeter (TOEPP): The physical perimeter is the production grade enclosure of the hardware chassis of the HPE Aruba Networking access point hardware devices. Non-Proprietary 11| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.1 AP-510 Series This section introduces the HPE Aruba Networking AP-510 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-514 and AP-515 APs, their physical attributes, and their interfaces. Figure 1 - AP-514 Campus Access Point – Front Figure 2 - AP-514 Campus Access Point – Back Figure 3 - AP-515 Campus Access Point – Front Non-Proprietary 12| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Figure 4 - AP-515 Campus Access Point – Back With a maximum concurrent data rate of 4.8 Gbps in the 5 GHz band and 575 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 3 Gbps), the 510 Series Access Points deliver high performance 802.11ax access for mobile and IoT devices in indoor environments for any enterprise environment. The high performance and high density 802.11ax 510 Series Access Points support all mandatory and several optional 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 16 resource units for increased user data rates and reduced latency, bi-directional Multi- User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in the 5 GHz band and 2x2 MIMO with up to two spatial streams (2SS) in the 2.4 GHz band, channel bandwidths up to 160 MHz (in 5 GHz; 40 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 512 associated client devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6 510 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8 features like Aruba Activate and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-514 has four (female) RP-SMA connectors for external dual band antennas (A0 through A3, corresponding with radio chains 0 through 3). The AP-515 has four integrated dual-band downtilt omni- directional antennas for 4x4 MIMO with peak antenna gain of 4.2 dBi in 2.4 GHz and 7.5 dBi in 5 GHz. Built- in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 degrees. Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from 3G/4G LTE cellular networks, Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-514 and AP-515 offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.1.1 Physical Description The HPE Aruba Networking AP-514 and AP-515 Campus Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas each. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configurations validated during the cryptographic module testing included: • AP-514 HW: AP-514-USF1 (HPE SKU Q9H68A) Non-Proprietary 13| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy • AP-515 HW: AP-515-USF1 (HPE SKU Q9H73A) 2.3.1.2 Dimensions / Weight The AP has the following physical dimensions: • Dimensions/weight (AP-515 unit, excluding mount bracket): o 200mm (W) x 200mm (D) x 46mm (H) / 7.9†(W) x 7.9†(D) x 1.8†(H) o 810g / 28.5oz • Dimensions/weight (AP-515; shipping): o 230mm (W) x 220mm (D) x 72mm (H) / 9.1†(W) x 8.7†(D) x 2.8†(H) o 1,010g / 35.5oz 2.3.1.3 Environmental • Operating: o Temperature: 0° C to +50° C (+32° F to +122° F) o Humidity: 5% to 93% non-condensing • Storage and transportation: o Temperature: -40° C to +70° C (-40° F to +158° F) o Humidity: 5% to 93% non-condensing 2.3.1.4 Interfaces The module provides the following network interfaces: • E0: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX) o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) • E1: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX) o Link Aggregation (LACP) support between both network ports for redundancy and capacity o 802.3az Energy Efficient Ethernet (EEE) Antenna interfaces: • 802.11a/b/g/n/ac/ax four external antenna (AP-514) or four internal antenna (AP-515) DC power interface: • 12Vdc nominal, +/- 5% • 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio: • Bluetooth 5.0: up to 8dBm transmit power (class 1) and -95dBm receive sensitivity • Zigbee: up to 8dBm transmit power and -97dBm receive sensitivity Non-Proprietary 14| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Other Interfaces: • Visual indicators (two multi-color LEDs): for System and Radio status • Reset button: factory reset (during device power up) • Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 5 - AP-510 Series Campus Access Point – Interfaces Table 6 - AP-510 Series Status Indicator LEDs LED Type Color/State Meaning System Status (Left) Off AP powered off Green - Blinking Device booting; not ready Green - Solid Device ready Amber - Solid Device ready; power-save mode (802.3af PoE): * Single radio * USB disabled Green or Amber Flashing Device ready, restricted mode: * Uplink negotiated in sub optimal speed; or * Deep sleep mode Red System error condition Radio Status (Right) Off AP powered off, or both radios disabled Green - Solid Both radios enabled in access mode Amber - Solid Both radios enabled in monitor mode Green or Amber Blinking One radio enabled in access (green) or monitor (amber) mode, other disabled Green/Amber Alternating Green: one radio enabled in access mode, Amber: one radio enabled in monitor mode Non-Proprietary 15| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.2 AP-530 Series This section introduces the HPE Aruba Networking AP-530 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-534 and AP-535 APs, their physical attributes, and their interfaces. Figure 6 - AP-534 Campus Access Point – Front Figure 7 - AP-534 Campus Access Point – Back Figure 8 - AP-535 Campus Access Point – Front Non-Proprietary 16| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Figure 9 - AP-535 Campus Access Point – Back With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band and 1,150 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 3.55 Gbps), the 530 Series Access Points deliver high performance 802.11ax access for mobile and IoT devices in indoor environments for any enterprise environment. The high performance and high density 802.11ax 530 Series Access Points support all mandatory and several optional 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, up- and downlink Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in both the 5 GHz and 2.4 GHz bands, channel bandwidths up to 160 MHz (in 5 GHz; 40 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6 530 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8 features like Aruba Activate and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-534 has four (female) RP-SMA connectors for external dual band antennas (A0 through A3, corresponding with radio chains 0 through 3). The AP-535 has four integrated dual-band downtilt omni- directional antennas for 4x4 MIMO with peak antenna gain of 3.5 dBi in 2.4 GHz and 5.4 dBi in 5 GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 degrees. Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from 3G/4G LTE cellular networks, Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-534 and AP-535 offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.2.1 Physical Description The HPE Aruba Networking AP-534 and AP-535 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas each. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included: • AP-534 HW: AP-534-USF1 (HPE SKU JZ342A) • AP-535 HW: AP-535-USF1 (HPE SKU JZ347A) Non-Proprietary 17| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.2.2 Dimensions / Weight The AP has the following physical dimensions: • Dimensions/weight (AP-535 unit, excluding mount bracket): o 240mm (W) x 240mm (D) x 57mm (H) / 9.4†(W) x 9.4†(D) x 2.1†(H) o 1,270g / 44.8oz • Dimensions/weight (AP-535; shipping): o 285mm (W) x 300mm (D) x 105mm (H) / 11.2†(W) x 11.9†(D) x 4.1†(H) o 1,930g / 68.1oz 2.3.2.3 Environmental • Operating: o Temperature: 0° C to +50° C (+32° F to +122° F) o Humidity: 5% to 93% non-condensing • Storage and transportation: o Temperature: -40° C to +70° C (-40° F to +158° F) o Humidity: 5% to 93% non-condensing 2.3.2.4 Interfaces The module provides the following network interfaces: • E0: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX) o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) • E1: One HPE Smart Rate port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX) o Link Aggregation (LACP) support between both network ports for redundancy and capacity o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) Antenna interfaces: • 802.11a/b/g/n/ac/ax four external antenna (AP-534) or four internal antenna (AP-535) DC power interface: • 48Vdc nominal, +/- 5% • 1.35mm/3.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio: • Bluetooth 5.0: up to 8dBm transmit power (class 1) and -95dBm receive sensitivity • Zigbee: up to 8dBm transmit power and -99dBm receive sensitivity Other Interfaces: • Visual indicators (two multi-color LEDs): for System and Radio status • Reset button: factory reset (during device power up) • Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Non-Proprietary 18| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Figure 10 - AP-530 Series Campus Access Point – Interfaces Table 7 - AP-530 Series Status Indicator LEDs LED Type Color/State Meaning System Status (Left) Off AP powered off Green - Blinking Device booting; not ready Green - Solid Device ready Amber - Solid Device ready; power-save mode (802.3at PoE): * Single radio * USB disabled Green or Amber Flashing Device ready, restricted mode: * Uplink negotiated in sub optimal speed; or * Deep sleep mode Red System error condition Radio Status (Right) Off AP powered off, or both radios disabled Green - Solid Both radios enabled in access mode Amber - Solid Both radios enabled in monitor mode Green or Amber Blinking One radio enabled in access (green) or monitor (amber) mode, other disabled Green/Amber Alternating Green: one radio enabled in access mode, Amber: one radio enabled in monitor mode Non-Proprietary 19| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.3 AP-580 Series This section introduces the HPE Aruba Networking AP-580 Series Outdoor Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-584, AP-585 and AP-587 APs, their physical attributes, and their interfaces. Figure 11 - AP-585 Outdoor Access Point – Side Figure 12 - AP-584 Outdoor Access Point – Bottom (without cover) Figure 13 - AP-585 Outdoor Access Point – Top Figure 14 - AP-587 Outdoor Access Point – Rear With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band and 574 Mbps in the 2.4 GHz band (for an aggregate peak data rate of 2.97 Gbps), the AP-580 Series Access Points deliver 802.11ax Gigabit Wi-Fi 6 performance to large scale outdoor environments including universities, large enterprises, and industrial applications. Weatherproofed, and temperature hardened to survive in the harshest outdoor environments, the 580 Series APs withstand exposure to extreme high and low temperatures, persistent moisture, and precipitation, and are fully sealed to keep out airborne contaminants. All electrical interfaces include industrial surge protection and are IP66/67 certified. Non-Proprietary 20| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy The high performance and high density 802.11ax 580 Series Access Points support all mandatory and several optional 802.11ax features, which include Uplink and Downlink Orthogonal Frequency Division Multiple Access (OFDMA) for increased user data rates and reduced latency, bi-directional Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, dual-radio 4x4 MIMO with up to four spatial streams (4SS) in 5 GHz and 4x4 with up to four spatial streams (4SS) in 2.4 GHz, and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and up to 16 BSSIDs per radio. The AP-584 has a total of five Nf connectors for external antennas (four external dual band antennas and one BT antenna), the AP-585 has four internal dual- band omni-directional antennas for 4x4 MIMO in 2.4 GHz with peak antenna gain of 4.4 dBi and 4x4 MIMO in 5 GHz with peak antenna gain of 5.8 dBi plus a BT antenna with 4.8 dBi, and the AP-587 has four internal dual-band directional antennas for 4x4 MIMO in 2.4 GHz with peak antenna gain of 5.8 dBi and 4x4 MIMO in 5 GHz with peak antenna gain of 6.6 dBi plus a BT antenna with 6.3 dBi. In addition to 802.11ax standard capabilities, the Wi-Fi 6 AP-580 Series supports unique features like Aruba ClientMatch radio management and an additional radio (Bluetooth Low-Energy (BLE)) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS 8+ features like Aruba Activate and Air Slice with machine learning technology to automatically optimize the wireless network performance. Additionally, Aruba Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, distributed antenna systems (DAS), and commercial small cell or femtocell equipment, plus Dynamic Frequency Selection (DFS) maximizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-580 Series APs offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.3.1 Physical Description The HPE Aruba Networking AP-584, AP-585 and AP-587 Outdoor Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support both external antennas (AP-584) and internal integrated omni-directional antennas (AP-585 and AP-587). The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The AP-580 Series Access Points configurations validated during the cryptographic modules testing included: • AP-584 HW: AP-584-US TAA (HPE SKU R7T14A) • AP-584 HW: AP-584-RW TAA (HPE SKU R7T15A) • AP-585 HW: AP-585-US TAA (HPE SKU R7T19A) • AP-585 HW: AP-585-RW TAA (HPE SKU R7T20A) • AP-587 HW: AP-587-US TAA (HPE SKU R7T24A) • AP-587 HW: AP-587-RW TAA (HPE SKU R7T25A) 2.3.3.2 Dimensions / Weight The AP-580s have the following physical dimensions (with aesthetic cover): • Dimensions/weight (AP-584 unit, excluding mount bracket): o 324mm (W) x 312mm (D) x 244mm (H) / 12.6†(W) x 12.3†(D) x 9.6†(H) o 5.52 kg / 11.5 lbs • Dimensions/weight (AP-585 unit, excluding mount bracket): o 324mm (W) x 313mm (D) x 320mm (H) / 12.6†(W) x 12.3†(D) x 12.7†(H) o 5.24 kg / 11.5 lbs • Dimensions/weight (AP-587 unit, excluding mount bracket): o 302mm (W) x 300mm (D) x 174mm (H) / 11.9†(W) x 11.8†(D) x 6.9†(H) o 4.51 kg / 9.9 lbs Non-Proprietary 21| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.3.3 Environmental • Operating: o Temperature: -40° C to +65° C (-40° F to +149° F) o Humidity: 5% to 93% non-condensing • Storage and transportation: o Temperature: -40° C to +70° C (-40° F to +158° F) o Humidity: 5% to 93% non-condensing 2.3.3.4 Interfaces Each module provides the following wired network interfaces: • E0/POE+: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX) o 5Gbps Smart Rate: NBase-T and 802.3bz o 802.3az Energy Efficient Ethernet (EEE) o Support for jumbo frames (MTU up to 9,216 bytes) Uplink o PoE-PD: 802.3bt class 6/5, 802.3af/at class 4 POE • E1/SFP+: SFP+ port (10GBASE-R SFP+) o 802.3az Energy Efficient Ethernet (EEE) o Support for jumbo frames (MTU up to 9,216 bytes) Uplink/Downlink • E2/PSE: Ethernet port (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX) o 802.3az Energy Efficient Ethernet (EEE) o Support for jumbo frames (MTU up to 9,216 bytes) Downlink o PoE-PSE: 802.3af/at POE AC power interface: • 100-240V 50/60Hz AC (power cord or power connector kit sold separately) Antenna interfaces: • 802.11a/b/g/n/ac/ax five external antenna (AP-584) or four (AP-585 and AP-587) internal antenna USB-C console port Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio: • Bluetooth 5.0: up to 8dBm transmit power (class 2) and -98dBm receive sensitivity • Zigbee: up to 8dBm transmit power and -96dBm receive sensitivity Other Interfaces: • Visual indicator (one multi-color LED on front): for System and Radio status • Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) • Serial console interface (proprietary; adapter cable included in package; disabled in Approved mode) • Grounding Point Figure 15 - AP-584 Outdoor Access Point – Interfaces (with aesthetic cover) Non-Proprietary 22| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Figure 16 - AP-585 Outdoor Access Point – Interfaces (with aesthetic cover) Figure 17 - AP-587 Outdoor Access Point – Interfaces (with aesthetic cover) Table 8 - AP-580 Series Status Indicator LEDs LED Type Color/State Meaning System Status (during Boot Up) Off AP powered off Red Initial power-up Green - Flashing AP booting; not ready Green - Solid AP ready and GbE (or better) or SFP+ connected. The LED turns off after 1200 seconds. Green / Amber Alternating, 6 seconds period AP ready and 100Mbps Ethernet link established. The LED turns off after 1200 seconds. Green – Flashing, 6 seconds period AP in deep sleep Red – Flashing AP in thermal shutdown System Status (during Operation) Red - Solid System error condition Red – One red blink every 3 seconds Radio 0 fault (5 GHz) Red – Two quick blinks 0.5 seconds apart, cycled every 3 seconds Radio 1 fault (2.4 GHz) Non-Proprietary 23| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.4 AP-630 Series This section introduces the HPE Aruba Networking AP-630 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-635 APs, their physical attributes, and their interfaces. Figure 18 - AP-635 Campus Access Point – Front Figure 19 - AP-635 Campus Access Point – Back With a maximum concurrent data rate of 1.2 Gbps in the 5 GHz band, 574 Mbps in the 2.4 GHz band, and 2.4 Gbps in the 6 GHz band (for an aggregate peak data rate of 3.9 Gbps), the 630 Series Access Points deliver more wireless capacity and/or wider channels with less interference in indoor environments for any enterprise environment. The 630 Series Access Points with Wi-Fi 6E can better support low-latency, bandwidth hungry applications like high-definition video and artificial reality/virtual reality applications while using comprehensive tri-band coverage to meet the growing demands of Wi-Fi from increased use of video, growth in client and IoT devices, and expanded use of cloud. The AP-635 APs support 802.11ax features which include Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 2x2 MIMO with up to two spatial streams (2SS) in all three bands, channel bandwidths up to 160 MHz (in 6 GHz; 80 MHz in 5GHz, and 20 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 512 associated client devices per radio and has a total of four dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6E 630 Series supports unique features like Aruba ClientMatch radio management and an additional radio (for Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS features like Air Slice and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-635 has four integrated dual-band downtilt omni-directional antennas for 2x2 MIMO with peak antenna gain of 4.6 dBi in 2.4 GHz, 7.0 dBi in 5 GHz, and 6.3 dBi in 5 GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 to 40 degrees. Also, the BLE5.0 / Zigbee radio uses an integrated omnidirectional antenna with roughly 30 to 40 degrees downtilt and peak gain of 3.0 dBi. Non-Proprietary 24| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, Dynamic Frequency Selection (DFS) optimizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-635 offers centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.4.1 Physical Description The HPE Aruba Networking AP-635 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support four integrated omni-directional downtilt antennas. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included: • AP-635 HW: AP-635-US TAA (HPE SKU R7J33A) • AP-635 HW: AP-635-RW TAA (HPE SKU R7J32A) 2.3.4.2 Dimensions / Weight The AP has the following physical dimensions: • Dimensions/weight (AP-635 unit, excluding mount bracket): o 220mm (W) x 220mm (D) x 51mm (H) / 8.7†(W) x 8.7†(D) x 2.0†(H) o 1,300g / 45.9oz • Dimensions/weight (AP-635; shipping): o 250mm (W) x 240mm (D) x 85mm (H) / 9.8†(W) x 9.4†(D) x 3.3†(H) o 1,650g / 58.2oz 2.3.4.3 Environmental • Operating: o Temperature: 0° C to +50° C (+32° F to +122° F) o Humidity: 5% to 95% non-condensing • Storage and transportation: o Temperature: -40° C to +70° C (-40° F to +158° F) o Humidity: 5% to 95% non-condensing 2.3.4.4 Interfaces The module provides the following network interfaces: • E0: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX) o 2.5Gbps speeds comply with NBase-T and 802.3bz o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) • E1: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500BASE-T and MDI/MDX) o Link Aggregation (LACP) support between both network ports for redundancy and capacity o 2.5Gbps speeds comply with NBase-T and 802.3bz o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3at/bt POE (class 4 or higher) Antenna interfaces: • 802.11a/b/g/n/ac/ax four internal antenna (AP-635) DC power interface: • 12Vdc nominal, +/- 5% • 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Non-Proprietary 25| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio: • Bluetooth 5.0: up to 5dBm transmit power (class 1) and -100dBm receive sensitivity • Zigbee: up to 5dBm transmit power and -97dBm receive sensitivity Other Interfaces: • Visual indicators (four multi-color LEDs): for System (1) and Radio (3) status • Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) • Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 20 - AP-630 Series Campus Access Point – Interfaces Table 9 - AP-630 Series Status Indicator LEDs LED Type Color/State Meaning System Status (Left) Off AP powered off Green - Blinking Device booting; not ready Green - Solid Device ready Amber - Solid Device ready; power-save mode (802.3at PoE): * Single radio * USB disabled Green or Amber Flashing Device ready, restricted mode: * Uplink negotiated in sub optimal speed; or * Deep sleep mode Red System error condition Radio Status (Right) 2GHz/5GHz/6GHz Off AP powered off, or radio disabled Green - Solid Radio enabled in access mode Amber - Solid Radio enabled in monitor or spectrum analysis mode Green Flashing Radio enabled in uplink or mesh mode Non-Proprietary 26| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.3.5 AP-650 Series This section introduces the HPE Aruba Networking AP-650 Series Campus Access Points (APs) with FIPS 140-3 Level 2 validation. It describes the purpose of the AP-655 APs, their physical attributes, and their interfaces. Figure 21 - AP-655 Campus Access Point – Front Figure 22 - AP-655 Campus Access Point – Back With a maximum concurrent data rate of 2.4 Gbps in the 5 GHz band, 574 Mbps in the 2.4 GHz band, and 4.8 Gbps in the 6 GHz band (for an aggregate peak data rate of 7.8 Gbps), the 650 Series Access Points deliver comprehensive tri-band coverage to meet the growing demands of Wi-Fi due to increased use of video, growth in client and IoT devices, and expanded use of cloud in indoor environments for any growing enterprise environment. The very high performance and extreme density 802.11ax 650 Series Access Points support 802.11ax features, which include up- and downlink Orthogonal Frequency Division Multiple Access (OFDMA) with up to 37 resource units for increased user data rates and reduced latency, up- and downlink Multi-User Multiple Input Multiple Output (MU-MIMO) for improved network capacity with multiples devices capable to transmit simultaneously, 4x4 MIMO with up to four spatial streams (4SS) in each of the 2.4, 5 and 6 GHz bands, channel bandwidths up to 160 MHz (in 6 GHz, 80 MHz in 5 GHz, and 20 MHz in 2.4 GHz), and up to 1024-QAM modulation. Each AP supports up to 1,024 associated client devices per radio and has eight internal dual band antennas. In addition to 802.11ax standard capabilities, the Wi-Fi 6E 650 Series supports unique features like Aruba ClientMatch radio management and additional radios (Bluetooth 5 and Zigbee) for location services, asset tracking services, security solutions and IoT sensors, as well as ArubaOS features like Aruba Air Slice and AirMatch with machine learning technology to automatically optimize the wireless network performance. The AP-655 has eight integrated dual-band downtilt omni-directional antennas for 4x4 MIMO with peak antenna gain of 4.8 dBi in 2.4 GHz, 5.3 dBi in 5GHz, and 5.4 dBi in 6GHz. Built-in antennas are optimized for horizontal ceiling mounted orientation of the AP. The downtilt angle for maximum gain is roughly 30 to 40 degrees. Also, the BLE5.0 / Zigbee radio uses an integrated omnidirectional antenna with roughly 30 to 40 degrees downtilt and peak gain of 3.6 dBi. Non-Proprietary 27| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Additionally, Advanced Cellular Coexistence (ACC) minimizes the impact of interference from cellular networks, Dynamic Frequency Selection (DFS) optimizes the use of available RF spectrum, and Maximum Ratio Combining (MRC) improves receiver performance. When managed by HPE Aruba Networking Mobility Controllers, AP-650 Series APs offer centralized configuration, data encryption, policy enforcement and network services, as well as distributed and centralized traffic forwarding. 2.3.5.1 Physical Description The HPE Aruba Networking AP-655 Access Points are multiple-chip standalone cryptographic modules consisting of hardware and firmware, all contained in hard, opaque plastic cases. The modules contain 802.11 a/b/g/n/ac/ax transceivers and support eight integrated omni-directional downtilt antennas. The case physically encloses the complete set of hardware and firmware components and represents the cryptographic boundary of the module. The Access Point configuration validated during the cryptographic module testing included: • AP-655 HW: AP-555-US TAA (HPE SKU R7J44A) • AP-655 HW: AP-555-RW TAA (HPE SKU R7J43A) 2.3.5.2 Dimensions / Weight The AP has the following physical dimensions: • Dimensions/weight (AP-655 unit, excluding mount bracket): o 260mm (W) x 260mm (D) x 60mm (H) / 10.2†(W) x 10.2†(D) x 2.4†(H) o 1,800g / 63.5oz • Dimensions/weight (AP-655; shipping): o 285mm (W) x 285mm (D) x 95mm (H) / 11.2†(W) x 11.2†(D) x 3.7†(H) o 2,300g / 81.1oz 2.3.5.3 Environmental • Operating: o Temperature: 0° C to +50° C (+32° F to +122° F) o Humidity: 5% to 95% non-condensing • Storage and transportation: o Temperature: -40° C to +70° C (-40° F to +158° F) o Humidity: 5% to 95% non-condensing 2.3.5.4 Interfaces The module provides the following network interfaces: • E0: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX) o 2.5Gbps and 5Gbps speeds comply with NBase-T and 802.3bz o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) • E1: Ethernet port (RJ-45, Auto-sensing link speed 100/1000/2500/5000BASE-T and MDI/MDX) o Link Aggregation (LACP) support between both network ports for redundancy and capacity o 2.5Gbps and 5Gbps speeds comply with NBase-T and 802.3bz o 802.3az Energy Efficient Ethernet (EEE) o PoE-PD: 48 Vdc (nominal) 802.3af/at/bt POE (class 3 or higher) Antenna interfaces: • 802.11a/b/g/n/ac/ax eight internal antenna (AP-655) DC power interface: • 12Vdc nominal, +/- 5% • 2.1mm/5.5mm center-positive circular plug with 9.5-mm length USB 2.0 host interface (Type A connector) Non-Proprietary 28| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Bluetooth 5.0 Low Energy (BLE5.0) and Zigbee (802.15.4) radio: • Bluetooth 5.0: up to 6dBm transmit power (class 1) and -101dBm receive sensitivity • Zigbee: up to 6dBm transmit power and -99dBm receive sensitivity Other Interfaces: • Visual indicators (four multi-color LEDs): for System (1) and Radio (3) status • Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation) • Serial console interface (proprietary; optional adapter cable available; disabled in Approved mode) Figure 23 - AP-650 Series Campus Access Point – Interfaces Table 10 - AP-650 Series Status Indicator LEDs LED Type Color/State Meaning System Status (Left) Off AP powered off Green - Blinking Device booting; not ready Green - Solid Device ready Amber - Solid Device ready; power-save mode (802.3at PoE): * Single radio * USB disabled Green or Amber Flashing Device ready, restricted mode: * Uplink negotiated in sub optimal speed; or * Deep sleep mode Red System error condition Radio Status (Right) 2GHz/5GHz/6GHz Off AP powered off, or radio disabled Green - Solid Radio enabled in access mode Amber - Solid Radio enabled in monitor or spectrum analysis mode Green Flashing Radio enabled in uplink or mesh mode 2.4 Excluded Components There are no excluded components for the module. Non-Proprietary 29| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.5 Modes of Operation Table 11 – Modes List and Description Name Description Approved Mode Status Indicator Approved Mode When the module starts up successfully, after passing all the pre- operational and conditional self-tests, and has been provisioned as per the guidance in section 11.6.3, Set-up and Configuration to be managed by a Mobility Controller in its Approved mode, the module is operating in the Approved mode, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed. Yes To verify Approved mode has been enabled, issue the command: show fips to see: FIPS Settings: Mode Enabled Non- Approved Mode A provisioned AP where FIPS Settings are not enabled. No To verify Approved mode has NOT been enabled, issue the command: show fips to see: FIPS Settings: Mode Disabled Notes: • To change from Approved Mode (FIPS Settings: Mode Enabled) to Non-approved Mode (FIPS Settings: Mode Disabled) requires the operator of the module to zeroize and reboot the module. • The module does not support a degraded mode of operation. • An un-provisioned AP, which by default does not serve any wireless clients, is out of scope of this validation. The Crypto Officer must ensure that the Wireless Access Point is kept in the Approved mode of operation. 2.6 Approved Algorithms The firmware in each module contains the following cryptographic algorithm implementations that will be used for the corresponding security services supported by the module in the Approved mode: • ArubaOS OpenSSL Module algorithm implementation • Aruba Jitterentropy algorithm implementation • ArubaOS Crypto Module algorithm implementation • ArubaOS Bootloader Module algorithm implementation Table 12 – Approved Algorithms - ArubaOS OpenSSL Module CAVP Cert. Algorithm and Standard Mode / Method Description / Key Size(s) / Key Strength(s) Use / Function A2690 AES [FIPS 197] [SP 800-38A] CBC, ECB, CTR (256, ext only, encryption only) 128, 192, 256 Data Encryption/Decryption A2690 AES [FIPS 197] [SP 800-38A] [SP 800-38D] GCM, CCM 128, 256 Data Encryption/Decryption Vendor Affirmed1 CKG [SP 800-133 Rev2] CTR_DRBG N/A Cryptographic Key Generation (using output from DRBG2 as per IG D.H) 1 Vendor Affirmed algorithms are approved by the CMVP but CAVP testing is not available. 2 Resulting symmetric keys and seeds used for asymmetric key generation are unmodified output from SP 800-90A Rev1 DRBG. Non-Proprietary 30| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy A2690 CVL IKEv13 KDF [SP 800-135 Rev1] IKEv1: DSA, PSK IKEv1: DH 2048-bit; SHA2-256, SHA2-384 Key Derivation A2690 DRBG [SP 800-90A Rev1] AES CTR 256 Deterministic Random Bit Generation N/A ESV program certificate #7 [SP 800-90B] Aruba CPU Jitter Entropy Source non-physical entropy source (min-entropy 427.696/512 bits) with SP 800-90B vetted Hash_df (SHA3-256) conditioning component, used solely for seeding min-entropy 256 bits to the SP 800-90A Rev1 approved AES-256 CTR_DRBG (A2690). Entropy Generation A2690 DSA [FIPS 186-4] keyGen, pqgGen L=2048, N=256, SHA2-256 Key Generation, Domain Parameter Generation A2690 ECDSA [FIPS 186-4] KeyGen, KeyVer, SigGen, SigVer KeyGen: P-256, P-384 KeyVer: P-256, P-384 SigGen: P-256, P-384 with SHA2-256, SHA2-384, SHA2-512 SigVer: P-256, P-384 with SHA-1, SHA2-256, SHA2-384, SHA2-512 Key Generation and Verification, Digital Signature Generation and Verification A2690 HMAC [FIPS 198-1] HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 (minimum 112 bits) Message Authentication A2690 KBKDF [SP 800-108 Rev1] CTR HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 Key-based Key Derivation A2690 KAS-SSC [SP 800-56A Rev3] FFC: dhEphem, ECC: Ephemeral Unified FFC: FC with SHA2-256, MODP-2048 with SHA2-256 ECC: P-256 with SHA2-256, P-384 with SHA2-384 KAS Roles - initiator, responder Key Agreement Scheme – Shared Secret Computation (as per IG D.F, Scenario 2 (2)) A2690 KDA [SP 800-56C Rev2] Two-step key derivation HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 Key Derivation Algorithm A2690 RSA [FIPS 186-2] SigVer: SHA-14 , SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 1024 (for legacy SigVer only), 2048 Digital Signature Verification A2690 RSA [FIPS 186-4] KeyGen, SigGen: SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 SigVer: SHA-15 , SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 KeyGen: 2048 SigGen: 2048 SigVer: 1024 (for legacy SigVer only), 2048 Key Generation, Digital Signature Generation and Verification 3 No parts of the IKEv1 protocol, other than the approved cryptographic algorithms and KDF, have been tested by the CAVP and CMVP. 4 SHA-1 is only Approved for use with Signature Verification. 5 SHA-1 is only Approved for use with Signature Verification. Non-Proprietary 31| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy A2690 Safe Primes [SP 800-56A Rev3] KeyGen, KeyVer Safe Prime Groups: MODP-2048 Safe Primes Key Generation and Key Verification A2690 SHS [FIPS 180-4] SHA-1, SHA2-256, SHA2-384, SHA2-512 Byte Only 160, 256, 384, 512 Message Digest AES A2690 KTS [SP 800-38F] AES-GCM6 128, 256 Key Wrapping / Key Transport via IKE/IPSec AES A2690 HMAC A2690 KTS [SP 800-38F] [FIPS 198-1] AES-CBC7 HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 128, 192, 256 Key Wrapping / Key Transport via IKE/IPSec Table 13 - Approved Algorithms - Aruba CPU Jitter Entropy Source CAVP Cert. Algorithm and Standard Mode / Method Description / Key Size(s) / Key Strength(s) Use / Function A2738 SHA-3 [FIPS 202] SHA3-256 256 Entropy Generation and Conditioning Table 14 - Approved Algorithms - ArubaOS Crypto Module CAVP Cert. Algorithm and Standard Mode / Method Description / Key Size(s) / Key Strength(s) Use / Function A2689 AES [FIPS 197] [SP 800-38A] [SP 800-38D] CBC, GCM8 128, 192, 256 Data Encryption/Decryption A2689 CVL IKEv29 KDF [SP 800-135 Rev1] IKEv2 IKEv2: DH 2048-bit; SHA2-256, SHA2-384 Key Derivation A2689 DSA [FIPS 186-4] keyGen, pqgGen L=2048, N=256, SHA2-256 Key Generation, Domain Parameter Generation A2689 ECDSA [FIPS 186-4] KeyGen, KeyVer, SigGen, SigVer KeyGen: P-256, P-384 KeyVer: P-256, P-384 SigGen: P-256, P-384 with SHA2-256, SHA2-384, SHA2-512 SigVer: P-256, P-384 with SHA-1, SHA2-256, SHA2-384, SHA2-512 Key Generation and Verification, Digital Signature Generation and Verification 6 AES-GCM is an authenticated encryption algorithm that is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides 128 or 256 bits of encryption strength. 7 AES-CBC combined with HMAC is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides between 128 and 256 bits of encryption strength. 8 AES GCM IV generation is performed in compliance with IG C.H, Scenario 2. The IV is generated internally and randomly using the Approved DRBG that is internal to the module’s boundary and has a length of 96 bits. 9 No parts of the IKEv2 protocol, other than the approved cryptographic algorithms and KDF, have been tested by the CAVP and CMVP. Non-Proprietary 32| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy A2689 HMAC [FIPS 198-1] HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 (minimum 112 bits) Message Authentication A2689 KAS-SSC [SP 800-56A Rev3] FFC: dhEphem, ECC: Ephemeral Unified FFC: FC with SHA2-256, MODP- 2048 with SHA2-256 ECC: P-256 with SHA2-256, P- 384 with SHA2-384 KAS Roles - initiator, responder Key Agreement Scheme – Shared Secret Computation A2689 RSA [FIPS 186-2] SigVer: SHA-110 , SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 1024 (for legacy SigVer only), 2048 Digital Signature Verification A2689 RSA [FIPS 186-4] KeyGen, SigGen: SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 SigVer: SHA-111 , SHA2-256, SHA2-384, SHA2-512 PKCS1 v1.5 KeyGen: 2048 SigGen: 2048 SigVer: 1024 (for legacy SigVer only), 2048 Key Generation, Digital Signature Generation and Verification A2689 Safe Primes [SP 800-56A Rev3] KeyGen, KeyVer Safe Prime Groups: MODP-2048 Safe Primes Key Generation and Key Verification A2689 SHS [FIPS 180-4] SHA-1, SHA2-256, SHA2-384, SHA2-512 Byte Only 160, 256, 384, 512 Message Digest AES A2689 KTS [SP 800-38F] AES-GCM12 128, 256 Key Wrapping / Key Transport via IKE/IPSec AES A2689 HMAC A2689 KTS [SP 800-38F] [FIPS 198-1] AES-CBC13 HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 128, 192, 256 Key Wrapping / Key Transport via IKE/IPSec Table 15 - Approved Algorithms - ArubaOS Bootloader Module CAVP Cert. Algorithm and Standard Mode / Method Description / Key Size(s) / Key Strength(s) Use / Function A2688 RSA [FIPS 186-4] SigVer: SHA2-256 PKCS1 v1.5 SigVer: 2048 Digital Signature Verification (only) A2688 SHS [FIPS 180-4] SHA2-256 Byte Only 256 Message Digest 10 SHA-1 is only Approved for use with Signature Verification. 11 SHA-1 is only Approved for use with Signature Verification. 12 AES-GCM is an authenticated encryption algorithm that is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides 128 or 256 bits of encryption strength. 13 AES-CBC combined with HMAC is approved for use in key transport per FIPS 140-3 IG D.G. This key establishment methodology provides between 128 and 256 bits of encryption strength. Non-Proprietary 33| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 2.7 Non-Approved Cryptographic Algorithms Allowed in the Approved Mode of Operation The cryptographic module implements no non-Approved algorithms allowed for use in the Approved mode of operation. 2.8 Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed The cryptographic module implements the following non-Approved algorithms allowed in the Approved mode of operation with no security claimed. Table 16 – Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed Algorithm Caveat Use / Function Triple-DES-ECB [no security claimed] Used with the KEK only for internal key obfuscation as per IG 2.4.A 2.9 Non-Approved Algorithms Not Allowed in the Approved Mode of Operation The cryptographic module implements the following non-Approved algorithms that are not permitted for use in the Approved mode of operation. Table 17 – Non-Approved Algorithms Not Allowed in the Approved Mode of Operation Algorithm / Function Use / Function DES Used for older versions of WEP in non-Approved mode HMAC-MD5 Used for older versions of WEP in non-Approved mode MD5 Used for older versions of WEP in non-Approved mode RC4 Used for older versions of WEP in non-Approved mode Null Encryption Used for older versions of WEP in non-Approved mode RSA Non-compliant less than 112 bits, or when used with SHA-1 for signature generation, or when other than 2048-bit modulus sizes are used Diffie-Hellman key agreement; non-compliant less than 112 bits of encryption strength EC Diffie-Hellman key agreement; non-compliant less than 112 bits of encryption strength ECDSA Non-compliant when using 186-2 signature generation Triple-DES-CBC As used in IKE/IPSec Non-Proprietary 34| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 3 Cryptographic Module Interfaces The following table lists all the module’s port and interfaces (physical and logical), and the information passing over the five (5) logical interfaces defined by FIPS 140-3. Table 18 – Ports and Interfaces Physical Port Logical Interface Data That Passes Over Port/Interface • Ethernet Ports • SFP Ports (AP-584/585/587) • 802.11a/b/g/n/ac/ax Antenna Interfaces Data Input Interface • The packets that use the networking functionality of the module • Ethernet Ports • SFP Ports (AP-584/585/587) • 802.11a/b/g/n/ac/ax Antenna Interfaces Data Output Interface • The packets that use the networking functionality of the module • Ethernet Ports • SFP Ports (AP-584/585/587) • 802.11a/b/g/n/ac/ax Antenna Interfaces • Reset button Control Input Interface • Manual control inputs for power and reset through the power interfaces (power supply or POE) • All of the data that is entered into the access point while using the management interfaces • Ethernet Ports • SFP Ports (AP-584/585/587) • 802.11a/b/g/n/ac/ax Antenna Interfaces • LED Status Indicators Status Output Interface • The status indicators displayed through the LEDs (which indicate the physical state of the module, such as power- up (or rebooting), utilization level, and activation state) • The status data that is output from the module while using the management interfaces • The log file (which records the results of self-tests, configuration errors, and monitoring data) • Power Input • Power-Over-Ethernet (POE) Power Interface • The module may be powered by an external power supply (no data passes over the interface) • Operating power may also be provided via a Power Over Ethernet (POE) device (when connected), where the power is provided through the connected Ethernet cable (no data passes over the interface) Notes: • The module does not implement a control output interface. • The module distinguishes between different forms of data, control, and status traffic over the network ports by analyzing the packets header information and contents. • The Console port is disabled when operating in Approved mode by a Tamper-Evident Label (TEL) or seal. • The reset button resets the AP to factory default settings. Figure 24 –AP Physical and Cryptographic Boundaries with Interfaces and Components Block Diagram Non-Proprietary 35| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 4 Roles, Services, and Authentication The following section lists the roles supported by the module, authentication mechanisms used by the module, and services (both security and non-security, Approved and non-Approved) available from the module. 4.1 Roles The module supports the role-based authentication of Crypto Officer, User, and Wireless Client; no additional roles (e.g. Maintenance) are supported. Administrative operations carried out by the HPE Aruba Networking Mobility Controller or Mobility Conductor map to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. Configuration can be performed through a standalone Mobility Controller or by a Mobility Conductor if deployed in the environment. The Mobility Conductor also acts as a CO for the APs. The module supports multiple concurrent operators and internally maintains the separation of the roles assumed by each operator and the corresponding services. Refer to the section 4.2, Authentication below for details on the roles’ sessions authentication. Table 19 – Roles, Service Commands, Input and Output Role Service Input Output Crypto Officer, User Approved mode enable/disable from Mobility Controller14 Command Status of command Crypto Officer, User Key Management Commands and configuration data Status of commands and configuration data Crypto Officer, User Reboot module Command Progress information Crypto Officer, User Self-test triggered by CO/User reboot None Error messages logged if a failure occurs Crypto Officer, User Update module firmware Commands and configuration data Status of commands and configuration data Crypto Officer, User Configure non-security related module parameters Commands and configuration data Status of commands and configuration data Crypto Officer, User Creation/use of secure management session between module and CO IPSec inputs, commands, and data IPSec outputs, status, and data Crypto Officer, User System Status and System Status – module LEDs Commands and configuration data Status of commands and configuration data Crypto Officer, User Creation/use of secure mesh channel Commands and configuration data Status of commands and configuration data Crypto Officer, User Openflow Agent Commands and configuration data Status of commands and configuration data Crypto Officer, User Zeroization Command Progress information User, Wireless Client Generation and use of WPA2/WPA3 cryptographic keys WPA2/WPA3 inputs, commands and data WPA2/WPA3 outputs, status and data User, Wireless Client Use of WPA2/WPA3 Pre-shared secret for establishment of WPA2/WPA3 keys WPA2/WPA3 inputs, commands and data WPA2/WPA3 outputs, status and data User, Wireless Client Wireless bridging services Commands and configuration data Status of commands and configuration data 14 APs must be deployed in a controller-based network running ArubaOS. For APs to be deployed in a controllerless network, refer to the most recent Aruba Instant NIST CMVP validation for guidance on Approved modes. Non-Proprietary 36| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy The defining characteristics of the roles depend on whether the module is configured in one of the four (4) AP configurations listed in the table below. If the AP is configured via corresponding HPE Aruba Networking Mobility Controllers that are in Approved mode and have been validated against FIPS 140-3 requirements, then the module is considered to be in the Approved mode, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed. The Crypto Officer must ensure that the Wireless Access Point is kept in the Approved mode of operation. Table 20 – Characteristics of Roles by AP Configuration when Module is in Approved Mode of Operation AP Configuration when the Module is in the Approved Mode of Operation Description Crypto Officer (CO) Role User Role Wireless Client Role Control Plane Security (CPSec) Protected AP configuration When the module is configured as a Control Plane Security protected AP, it is intended to be deployed in a local/private location (LAN, WAN, MPLS) relative to the Mobility Controller. The module provides cryptographic processing in the form of IPSec for all Control traffic to and from the Mobility Controller. The CO is the Mobility Controller or Mobility Conductor that has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. In the configuration, the User operator shares the same services and authentication techniques as the Mobility Controller in the CO role. In the configuration, a wireless client can create a connection to the module using WPA2/WPA3 Pre- shared secret and access wireless network access services. Remote AP configuration When the module is configured as a Remote AP, it is intended to be deployed in a remote location (relative to the Mobility Controller). The module provides cryptographic processing in the form of IPSec for all traffic to and from the Mobility Controller. The CO is the Mobility Controller or Mobility Conductor that has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. In the configuration, the User operator shares the same services and authentication techniques as the Mobility Controller in the CO role. In the configuration, a wireless client can create a connection to the module using WPA2/WPA3 and access wireless network access/bridging services. When the Remote AP cannot communicate with the controller, the wireless client role authenticates to the module via WPA2/WPA3 Pre- shared secret only. Mesh Portal AP configuration When the module is configured as a Mesh Portal AP, it is intended to be connected over a physical wire to the Mobility Controller. These modules serve as the connection point between the Mesh Point and the Mobility Controller. Mesh Portals communicate with the Mobility Controller through IPSec and with Mesh Points via WPA2/WPA3 session. The Crypto Officer role is the Mobility Controller that authenticates via IKEv2 pre- shared key or RSA/ECDSA certificate authentication method, and Users are the "n" Mesh Points that authenticate via WPA2/WPA3 pre-shared key. The CO is the Mobility Controller or Mobility Conductor that has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. In the configuration, the Mesh Portal AP and adjacent Mesh Point APs are in a given mesh cluster. The Mesh Portal AP must be physically wired to the Mobility Controller. In the configuration, a wireless client can create a connection to the module using WPA2/WPA3 and access wireless network access services. Non-Proprietary 37| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Mesh Point AP configuration When the module is configured as a Mesh Point AP, it is an AP that establishes an all wireless path to the Mesh portal over WPA2/WPA3 and an IPSec tunnel via the Mesh Portal to the Controller. Note: for an AP-587 in Mesh Point AP configuration, it can only connect to another AP-587 in Mesh Portal AP configuration. The CO is the Mobility Controller or Mobility Conductor that has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of SSPs. The first mesh AP configured is the only AP with the direct wired connection. In the configuration, the Mesh Point AP and adjacent mesh APs are in a given mesh cluster. User role can be a Mesh Point AP or a Mesh Portal AP in the given mesh network. In the configuration, a wireless client can create a connection to the module using WPA2/WPA3 and access wireless network access services. Note: • To change AP configurations requires the module to be zeroized and rebooted before the module is in the new AP configuration in Approved mode. 4.2 Authentication The CO must follow the guidance below in section 11.6, Secure Operation, and in the ArubaOS 8.10 User Guide section titled Controller-based AP with AP Console Access to ensure the configured HPE Aruba Networking Access Point (AP) is connected to and managed by the Controller in the Approved mode of operation, and is running the Approved version of ArubaOS (see the following subsections for details on the authentication for each AP role). Once the AP is provisioned to be managed by the Controller, during any subsequent reboots of the AP, the AP boot process will continue automatically to boot the Approved version of ArubaOS (with the appropriate self-tests run) and the AP will be placed in the provisioned AP configuration by the Controller. Authentication for each role depends on the module AP configuration. 4.2.1 Crypto Officer Authentication With the module in the Approved mode of operation, and configured in any of the four (4) AP configurations, the HPE Aruba Networking Mobility Controller or Mobility Conductor implements the Crypto Officer role. Connections between the module and the mobility controller are protected using IPSec. The Crypto Officer’s authentication is accomplished via either Pre-shared secret (IKEv1), RSA digital certificate (IKEv1/IKEv2) or ECDSA digital certificate (IKEv2). The Mobility Conductor interacts with the APs through the Mobility Controller through provisioning of configurations. 4.2.2 User Authentication Authentication for the User role depends on the module configuration. When the module is configured as a Mesh Portal AP or Mesh Point AP, the User role is authenticated via the WPA2/WPA3 pre-shared key. When the module is configured as a Remote AP or CPSec Protected AP, the User role is authenticated via the same IKEv1 pre-shared key or RSA/ECDSA certificate that is used by the Crypto Officer. 4.2.3 Wireless Client Authentication With the module in the Approved mode of operation, the wireless client role (defined in each of the four (4) AP configurations) authenticates to the module via WPA2/WPA3. Please note that WEP and TKIP configurations are not permitted in Approved mode. When a Remote AP cannot communicate with the controller, the wireless client role authenticates to the module via WPA2/WPA3 Pre-shared secret only. Non-Proprietary 38| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 4.2.4 Strength of Authentication Mechanisms The following table describes the relative strength of each supported authentication mechanism. Each authentication mechanism has been designed such that: • The probability of a random attempt succeeding is less than 1-in-1,000,000. • During a one-minute period, the probability of any random attempt succeeding is less than 1-in- 100,000. Table 21 – Roles and Authentication Role Authentication Method Authentication Strength Crypto Officer and User IKEv1 Pre- shared secret based authentication Passwords are required to be a minimum of eight (8)15 ASCII characters and a maximum of 64 with a minimum of one letter and one number, or the password must be exactly 64 HEX characters. Assuming the weakest option of 8 ASCII characters with the listed restrictions, the probability of randomly guessing the correct sequence is one (1) in 3,608,347,333,959,680 (this calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 Integer digits, 52 alphabetic characters, and 32 special characters providing 94 characters to choose from in total. The calculation should be 94^8 (Total number of 8-digit passwords) – 84^8 (Total number of 8-digit passwords without numbers) – 42^8 (Total number of 8-digit passwords without letters) + 32^8 (Total number of 8-digit passwords without letters or numbers, added since it’s double-counted in the previous two subtractions) = 3,608,347,333,959,680). At optimal network conditions (assuming 1ms round-trip latency), an attacker would only get 60,000 guesses per minute. Therefore, the associated probability of a successful random attempt during a one-minute period is 60,000/3,608,347,333,959,680, which meets the authentication objective. Crypto Officer and User RSA Certificate based authentication The module supports 2048-bit RSA key authentication during IKEv1 and IKEv2. RSA 2048-bit keys correspond to 112 bits of security. Assuming the low end of that range, the associated probability of a successful random attempt is one (1) in 2^112, which meets the authentication objective. At optimal network conditions (assuming 1ms round- trip latency), an attacker would only get 60,000 guesses per minute. Therefore, the associated probability of a successful random attempt during a one-minute period is 60,000/2^112, which meets the authentication objective. Crypto Officer and User ECDSA Certificate based authentication ECDSA signing and verification is used to authenticate to the module during IKEv1/IKEv2. Both P-256 and P-384 curves are supported. ECDSA P-256 provides 128 bits of equivalent security, and P-384 provides 192 bits of equivalent security. Assuming the low end of that range, the associated probability of a successful random attempt is one (1) in 2^128, which meets the authentication objective. At optimal network conditions (assuming 1ms round-trip latency), an attacker would only get 60,000 guesses per minute. Therefore, the associated probability of a successful random attempt during a one-minute period is 60,000/2^128, which meets the authentication objective. Wireless Client and Mesh AP User WPA2/WPA3 Pre-shared secret based authentication Passwords are required to be a minimum of eight (8)18 ASCII characters and a maximum of 63 with a minimum of one letter and one number, or the password must be exactly 64 HEX characters. Assuming the weakest option of 8 ASCII characters with the listed restrictions, the probability of randomly guessing the correct sequence is one (1) in 3,608,347,333,959,680 (this calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 Integer digits, 52 alphabetic characters, and 32 special characters providing 94 characters to choose from in total. The calculation should be 94^8 (Total number of 8-digit passwords) – 84^8 (Total number of 8-digit passwords without numbers) – 42^8 (Total number of 8-digit passwords without letters) + 32^8 (Total number of 8-digit passwords without letters or numbers, added since it is double-counted in the previous two subtractions) = 3,608,347,333,959,680). At optimal network conditions (assuming 1ms round-trip latency), an attacker would only get 60,000 guesses per minute. Therefore, the associated probability of a successful random attempt during a one-minute period is 60,000/3,608,347,333,959,680, which meets the authentication objective. 15 As per SP 800-63B, in Approved mode the module checks and enforces a minimum password length of eight (8). Non-Proprietary 39| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 4.3 Services The module provides various services depending on role. These are described in the sections below. The meaning of the letters used to describe the ‘Access Rights to Keys and/or SSPs’ are: • G – Generate The module generates or derives the SSP. • R – Read The Key/SSP is read from the module (e.g. the Key/SSP is output). • W – Write The Key/SSP is updated, imported, or written to the module. • E – Execute The module uses the Key/SSP in performing a cryptographic operation. • Z – Zeroize The module zeroizes the Key/SSP. 4.3.1 Approved Services See the tables below for descriptions of the services, Approved security functions, keys and/or SSPs available to the module’s roles. All Crypto Officer role services are the same for the module in the Approved mode of operation and the AP in any of the four (4) AP configurations - Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP configuration, and Mesh Point AP configuration. The User role for Remote AP configuration and Control Plane Security (CPSec) Protected AP configuration supports the same services as the Crypto Officer role services. The User role for Mesh Portal AP configuration and Mesh Point AP configuration supports the same services as the Wireless Client role services. All Wireless Client role services are the same for the module in the Approved mode of operation and the AP in any of the four (4) AP configurations - Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP configuration, and Mesh Point AP configuration. Table 22 – Approved Services Service Description Approved Security Functions (applicable CAVP Certs) Keys and/or SSPs [row # in SSPs/Keys Used table] Roles Access Rights to Keys and/or SSPs Indicator Update module firmware16 The CO can trigger a module firmware update in a controller- based network by issuing related CLI commands (e.g. update) or WebGUI (e.g. Managed NetworkMaintenanceSoftware Management). RSA SigVer SHA2-256 (A2690, A2688) [11] Factory CA Public Key Crypto Officer, User17 E Successful completion of firmware update shown via output of CLI command to show updated firmware version (e.g. show ver) or related WebGUI display updates (e.g. Managed NetworkConfig urationAccess Points).. 16 Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. 17 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. Non-Proprietary 40| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Key Management The CO can cause the module to generate the SKEYSEED and can configure/modify the IKEv1 shared secret and the WPA2/WPA3 Pre- shared secret (used in advanced Remote AP configuration). The CO can add/overwrite IKEv1/IKEv2 certificates (the RSA and ECDSA private keys are protected by non- volatile memory and cannot be modified). Also, the CO implicitly uses the KEK to read/write configuration to non-volatile memory. AES-GCM AES-CBC HMAC-SHA2-256 HMAC-SHA2-384 (A2690, A2689) [12] IKE Pre-shared Key [15] SKEYSEED [18] IPSec Session Encryption Key [19] IPSec Session Authentication Key [21] IKE RSA Public Key [23] IKE ECDSA Public Key [24] WPA2/WPA3 Pre- shared Key Crypto Officer, User18 W W E E W W W Successful completion of key management configurations shown via output of related CLI commands (e.g. crypto CLI commands for configuring IPsec and IKE) or WebGUI updates (e.g. Managed NetworkConfig urationServices ). Creation/use of secure mesh channel19 The module requires secure connections between mesh points using WPA2/WPA3. KBKDF KDA AES-CCM AES-GCM (A2690) [24] WPA2/WPA3 Pre- shared Key [25] WPA2/WPA3 Pair- Wise Master Key (PMK) [26] WPA2/WPA3 Pairwise Transient Key (PTK) [27] WPA2/WPA3 Session Key [28] WPA2/WPA3 Group Master Key (GMK) [29] WPA2/WPA3 Group Transient Key (GTK) Crypto Officer, User20 E E G/E G/E G/E G/E Successful completion of mesh channel configurations shown via output of related CLI commands (e.g. ap mesh CLI commands for configuring AP mesh options) or WebGUI updates (e.g. Managed NetworkConfig urationAP Groups). Generation and use of WPA2/WPA3 cryptographic keys In all Approved modes, the links between the module and wireless client are secured with WPA2/WPA3. KBKDF KDA AES-CCM AES-GCM (A2690) [24] WPA2/WPA3 Pre- shared Key [25] WPA2/WPA3 Pair- Wise Master Key (PMK) [26] WPA2/WPA3 Pairwise Transient Key (PTK) [27] WPA2/WPA3 Session Key [28] WPA2/WPA3 Group Master Key (GMK) [29] WPA2/WPA3 Group Transient Key (GTK) User20 , Wireless Client E E G/E G/E G/E G/E Successful completion of wireless client configurations shown via output of related CLI commands (e.g. ap mesh CLI commands for configuring AP mesh options) or WebGUI updates (e.g. Managed NetworkConfig urationAP Groups). 18 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 19 This service is only applicable in the Mesh Portal AP and Mesh Point AP configurations. It is not applicable in Remote AP and Control Plane Security (CPSec) Protected AP configurations. 20 Mesh Portal AP configuration and Mesh Point AP configuration only. Non-Proprietary 41| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Creation/use of secure management session between module and CO21 The module supports use of IPSec for securing the management channel. CTR_DRBG KAS-FFC-SSC SafePrimes KeyGen/KeyVer KAS-ECC-SSC ECDSA KeyGen/KeyVer/ SigGen/SigVer IKEv1 KDF HMAC-SHA2-256 HMAC-SHA2-384 IKEv2 KDF AES-CBC AES-GCM RSA SigGen/SigVer (A2690, A2689) [1] DRBG Entropy Input [2] DRBG Seed [3] DRBG Key [4] DRBG V [5] DH Private Key [6] DH Public Key [7] DH Shared Secret [8] ECDH Private Key [9] ECDH Public Key [10] ECDH Shared Secret [12] IKE Pre-shared Key [13] skeyid [14] skeyid_d [15] SKEYSEED [16] IKE Session Authentication Key [17] IKE Session Encryption Key [18] IPSec Session Encryption Key [19] IPSec Session Authentication Key [20] IKE RSA Private Key [21] IKE RSA Public Key [22] IKE ECDSA Private Key [23] IKE ECDSA Public Key Crypto Officer, User22 E G/E G/E G/E G/E G/R/W/E G/E G/E G/R/W/E G/E W/E G/E G/E G/E G/E G/E G/E G/E E R/W/E E R/W/E Successful completion of management channel configurations shown via output of CLI command to show management session tunnel status (e.g. show ap database- summary) or related WebGUI display updates (e.g. Managed NetworkConfig urationServices VPNCertifica tes for VPN Clients). Use of WPA2/WPA3 Pre-shared secret for establishment of WPA2/WPA3 keys When the module is in advanced Remote AP configuration, the links between the module and the Wireless Client are secured with WPA2/WPA3. This is authenticated with a shared secret only. AES-CCM AES-GCM (A2690) [24] WPA2/WPA3 Pre- shared Key User23 , Wireless Client E Successful completion of wireless client configurations shown via output of related CLI commands (e.g. show ap mesh) or WebGUI updates (e.g. Managed NetworkConfig urationAP Groups). Table 23 – Approved Services Not Using Any Approved Security Functions Service Description Approved Security Functions Keys and/or SSPs [row # in SSPs/Keys Used table] Roles Access Rights to Keys and/or SSPs Indicator Approved mode enable/disable The CO enables Approved mode by following the procedures under the Secure Operation section to ensure the AP is configured for Secure Operations. The CO can disable Approved mode by reverting these changes. None None Crypto Officer, User22 None Successful completion of Approved mode configurations shown via output of related CLI commands (e.g. show fips). 21 This service is not available in Mesh Point AP configuration. In Mesh Point AP configuration, the IPSec tunnel will be between the Mesh Portal and the controller, not the Mesh Point and the controller. 22 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. 23 Mesh Portal AP configuration and Mesh Point AP configuration only. Non-Proprietary 42| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Reboot module The CO can remotely trigger a reboot of the AP from the Mobility Controller or Mobility Conductor. The module can also reboot by removing/replacing power. None None Crypto Officer, User24 None Successful completion of module reboot shown via output of related CLI commands (e.g. reboot) or WebGUI updates (e.g. Managed Network Maintenance Software Management Reboot), and module reboots. Self-test triggered by CO/User reboot The CO can trigger a programmatic reset leading to self-test and initialization. None None Crypto Officer, User24 None Status of self- tests in log after reboot shows successful completion of self-tests. System Status CO may view system status information through the secured management channel. None [See Creation/use of secure management session above] Crypto Officer, User24 [See Creation/use of secure managemen t session above] Successful completion shown via output of CLI command to show AP status (e.g. show ap database) or related WebGUI status displays (e.g. Managed NetworkConfig urationAccess Points). System Status – module LEDs The CO may view system status by viewing the module’s LEDs. None None Crypto Officer, User None Successful completion shown via module LEDs (refer to Status Indicator LEDs tables for each AP Series in section 2.3 above). Configure non- security related module parameters CO can configure various operational parameters that do not relate to security. None None Crypto Officer, User24 None Status of command to show operational parameter settings shows successful completion of configurations. Openflow Agent Agent run on device for use with Mobility Conductor SDN. Leveraged by the SDN for discovering of hosts and networks, configuration of networks, and collection of statistics. None None Crypto Officer, User24 None Successful completion shown via output of related CLI commands (e.g. show openflow). 24 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. Non-Proprietary 43| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Wireless bridging services The module bridges traffic between the wireless client and the wired network. None None User25 , Wireless Client None Successful completion shown via output of related CLI commands (e.g. ap wired-ap- profile). Zeroization The cryptographic keys stored in SDRAM memory can be zeroized by rebooting the module. The cryptographic keys (IKEv1 Pre-shared key and WPA2/WPA3 Pre-shared Key) stored in the flash can be zeroized by using command ‘ap wipe out flash’. The ‘no’ command in the CLI can be used to zeroize IKE, IPSec SSPs. Please see CLI guide for details. The other keys/SSPs (RSA/ECDSA public key/private key and certificate) stored in Flash memory can be zeroized by using command ‘ap wipe out flash’. None All SSPs (not including the Factory CA Public Key) will be destroyed. Crypto Officer, User26 Z Successful completion of module reboot shown via output of related CLI commands (e.g. reboot or ap wipe out flash) or WebGUI updates (e.g. Managed Network Maintenance Software Management Reboot), and module reboots. 4.3.2 Non-Approved Services The following table lists non-Approved services available in non-Approved mode (FIPS Settings: Mode Disabled). To indicate if the module is in Approved mode or non-Approved mode, issue the CLI command show fips (see Modes of Operation section above). To change from Approved mode (FIPS Settings: Mode Enabled) to non-Approved mode (FIPS Settings: Mode Disabled) requires the operator of the module to zeroize and reboot the module. The module does not support a degraded mode of operation. An un-provisioned AP, which by default does not serve any wireless clients, is out of scope of this validation. The Crypto Officer must ensure that the Wireless Access Point is kept in the Approved mode of operation. All of the Approved services (see Table 22 and Table 23 above) that are available in Approved mode are also available in non-Approved mode. 25 Mesh Portal AP configuration and Mesh Point AP configuration only. 26 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. Non-Proprietary 44| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Table 24 – Non-Approved Services Service Description Algorithms Accessed Role(s) Indicator IPSec/IKE using Triple-DES IPSec/IKE key management using Triple-DES. This is a non-Approved service available in Approved mode but that is non-Approved for use. Triple-DES Crypto Officer, User Implicit indication via successful completion of the service. Suite-B (bSec) protocol The Suite-B (bSec) protocol is a pre-standard protocol that has been proposed to the IEEE 802.11 committee as an alternative to 802.11i. This is a non-Approved service available in Approved mode but that is non- Approved for use. Suite-B (bSec) protocol Crypto Officer, User Implicit indication via successful completion of the service. Upgrade module firmware via the console port The CO can update the module firmware using the console port if the FIPS TEL or seal is not blocking the console port and the console port has been enabled. This is a non-Approved service that is non-Approved for use in the Approved mode. Triple-DES RSA SigVer SHA2-256 Crypto Officer, User27 Status of command to enable console and to show firmware version. Debugging via the console port The CO can issue commands for debugging using the console port if the FIPS TEL or seal is not blocking the console port and the console port has been enabled. This is a non-Approved service that is non-Approved for use. None Crypto Officer, User27 Status of command to enable console and to debug. Use of non- Approved algorithms and/or sizes. If the module has not been provisioned to operate in one of the Approved modes, then non-Approved algorithms and/or sizes are available for use. This is a non-Approved service that is non-Approved for use. Non-Approved algorithms and/or sizes Crypto Officer, User Implicit indication via successful completion of the service. Note: • For additional information on services offered by the module, please refer to the ArubaOS 8.10 User Guide. 27 Remote AP and Control Plane Security (CPSec) Protected AP configurations only. Non-Proprietary 45| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 5 Software / Firmware Security The module only allows the loading of trusted and verified firmware that is signed by HPE Aruba Networking within the module’s defined cryptographic boundary. Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. HPE Aruba Networking firmware in electronic form is installed by HPE Aruba Networking technical support personnel or downloaded from the HPE Networking Support Portal (NSP) by authenticated licensed customer personnel. ArubaOS (in executable binary format) is the operating system for the HPE Aruba Networking hardware-based HPE Aruba Networking Mobility Conductors, Mobility Controllers, Gateways, and controller-managed Access Points (APs). ArubaOS (in OVA File format) is also the operating system for the HPE Aruba Networking virtual-based HPE Aruba Networking Mobility Controller Virtual Appliances and Mobility Conductor Virtual Appliances. Within the same version of ArubaOS (e.g. ArubaOS version 8.10), all features are the same, but there are components of ArubaOS that are appropriate for different hardware-based or virtual-based HPE Aruba Networking devices, which is why there are different ArubaOS executable binary formats for the same ArubaOS version available. The HPE Aruba Networking ArubaOS Bootloader Module is preloaded and shipped with each HPE Aruba Networking AP device and is executed to boot the ArubaOS operating system from the image partition after performing the firmware integrity test. Rebooting also zeroizes all SSPs prior to execution of the newly loaded firmware. The operator can initiate the firmware integrity test on demand by rebooting the module. The module performs a firmware integrity test when powered on and conditionally whenever a firmware load request is received (refer below to section 10, Self-Tests for details). Both the Firmware Integrity Test and Firmware Load Test use RSA PKCS#1 v1.5 (2048 bits) signature verification with SHA2-256. All data output via the data output interface is inhibited until the software/firmware loading and load test has completed successfully. If the firmware integrity test fails, the module enters the error state (while in this state, the module provides no functionality). The temporary values generated during the firmware integrity test are zeroized upon completion of the integrity test. The operator can determine the version of the loaded firmware through reviewing the log after the firmware upgrade and by using the show status CLI command (use the link in section 1.8, Full Documentation to refer to ArubaOS 8.10 Command-Line Interface Reference Guide and ArubaOS 8.10 User Guide). 6 Operational Environment The module operates in a non-modifiable operational environment. The control plane Operating System (OS) is Linux, a real-time, multi-threaded operating system that supports memory protection between processes. Access to the underlying Linux implementation is not provided directly. Only HPE Aruba Networking provided interfaces are used, and the Command Line Interface (CLI) is a restricted command set. These operating control mechanisms protect against unauthorized execution, unauthorized modification, and unauthorized reading of SSPs, control and status data. The module only allows the loading of trusted and verified firmware that is signed by HPE Aruba Networking. Any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. The module was tested on the platforms listed above in section 2.3, Table 5, Cryptographic Module Tested Configurations. Non-Proprietary 46| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7 Physical Security The HPE Aruba Networking Wireless Access Point is a scalable, multiple-chip standalone network device and is enclosed in a hard, opaque plastic case. The AP enclosure is resistant to probing (please note that this feature has not been validated as part of the FIPS 140-3 validation) and is opaque within the visible spectrum. The enclosure of the AP has been designed to satisfy FIPS 140-3 Level 2 physical security requirements. The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points require Tamper-Evident Labels (TELs) (also known as seals) to allow the detection of the opening of the device and to block the Serial console port. To protect the Access Points (APs) from any tampering with the product, TELs should be applied by the Crypto Officer as covered in the sections below. When applied properly, the TELs allow the Crypto Officer to detect the opening of the device, or physical access to restricted ports like the serial console port (on the bottom of the device). HPE Aruba Networking provides FIPS 140-3 designated TELs which have met the physical security testing requirements for tamper evident labels under the FIPS 140-3 Standard. TELs are not endorsed by the Cryptographic Module Validation Program (CMVP). The tamper-evident labels shall be installed for the module to operate in the Approved mode of operation. HPE Aruba Networking provides double the required amount of TELs. If a customer requires replacement TELs, please call customer support and HPE Aruba Networking will provide the TELs. The Crypto officer shall be responsible for securing the extra TELs at a safe location and managing the use of the TELs. 7.1 Reading TELs Once applied, the TELs included with the Wireless Access Point cannot be surreptitiously broken, removed, or reapplied without an obvious change in appearance: Figure 25 - Tamper-Evident Labels If evidence of tampering is found with the TELs, the module must immediately be powered down and the Crypto Officer must be made aware of a physical security breach. Each TEL also has a unique serial number to prevent replacement with similar labels. To protect the device from tampering, TELs should be applied by the Crypto Officer as pictured below. Non-Proprietary 47| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.2 Applying TELs The Crypto Officer should employ Tamper-Evident Labels (TELs) (also known as seals) by referencing the following general application guidance and the device specific guidance in section 7.3, Required TEL Locations: • Before applying a TEL, make sure the target surfaces are clean and dry. Clean with alcohol and let dry before TEL application. • Do not cut, trim, punch, or otherwise alter the TEL. • Apply the wholly intact TEL firmly and completely to the target surfaces. • Press down firmly across the entire label surface, making several back-and-forth passes to ensure that the label securely adheres to the device. • Record the position and serial number of each applied TEL in a security log immediately after application. • Allow 24 hours for the TEL adhesive seal to completely cure. • To obtain additional or replacement TELS, please call HPE Aruba Networking customer support and request a FIPS Kit. The Crypto Officer (CO) should perform initial setup and configuration of the device(s) as described in section 11, Life-Cycle Assurance before the TELs are applied. 7.3 Required TEL Locations This section displays the locations of all TELs on each module (AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points). Non-Proprietary 48| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.1 TELs Placement on the AP-514 and AP-515 The AP-514 and AP-515 are the same device in all areas except that the AP-514 uses external antennas and the AP-515 uses internal antennas (see above section 2.3.1, AP-510 Series). The AP-514 and AP-515 each require 3 TELs placed in the same locations on each: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 26 and 27 for placement (only AP-514 is shown). TELs 1 and 2 shall be placed on opposite sides of the enclosure along a segment that manifests the least curvature (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the AP enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. Figure 26 – Top View of AP-514 with TELs Figure 27 – Bottom View of Aruba AP-514 with TELs Non-Proprietary 49| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.2 TELs Placement on the AP-534 and AP-535 The AP-534 and AP-535 are the same device in all areas except that the AP-534 uses external antennas and the AP-535 uses internal antennas (see above section 2.3.2, AP-530 Series). The AP-534 and AP-535 each require 3 TELs placed in the same locations on each: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 28 and 29 for placement (only AP-535 is shown). TELs 1 and 2 shall be placed on opposite sides of the enclosure along a segment that manifests the least curvature (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the AP enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. Figure 28 – Top View of AP-535 with TELs Figure 29 – Bottom View of Aruba AP-535 with TELs Non-Proprietary 50| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.3 TELs Placement on the AP-584, AP-585, and AP-587 The AP-584, AP-585, and AP-587 are all outdoor APs of different sizes (see above section 2.3.3, AP-580 Series). Each of the AP-580 Series APs (AP-584, AP-585 and AP-587) requires 3 TELs, one on each side to detect opening the device (label 1 and 2) and one covering the console port to detect access to a restricted port (label 3). The subsequent three sections illustrate the placement of each TEL by device. For all three models, TELs must be applied as described below, with the aesthetic cover removed. Once the TELs have been applied and their serial numbers recorded, the aesthetic cover should be reinstalled. Figure 30 – Placement of TELs 1 and 2 on AP-580 Series APs TELs 1 and 2 shall be applied such that approximately two-thirds of the TEL is adhered to the white chassis casting as shown above. Each TEL shall be located such that it contacts two adjacent ribs. (Wrapping the TEL around a single rib is non-compliant). Wrap the remaining length of TEL around the lip of the enclosure and affix to the plastic antenna cover. Firmly press the TEL against the chassis casing to ensure proper adhesion. Figure 31 – Placement of TEL 3 on AP-580 Series APs TEL 3 shall be placed vertically such that it completely covers the console port plug and additional length shall extends downwards. Wrap the remaining length of TEL around the lip of the enclosure and affix to the plastic antenna cover. Firmly press the TEL against the chassis casing and the console port plug to ensure proper adhesion. Non-Proprietary 51| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.4 TELs Placement on the AP-584 The AP-584 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 32, 33, and 34 for placement. Figure 32 – Right Side View of AP-584 with TEL Figure 33 – Front View of AP-584 with TEL Figure 34 – Left Side View of AP-584 with TELs Non-Proprietary 52| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.5 TELs Placement on the AP-585 The AP-585 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 35, 36, and 37 for placement. Figure 35 – Right Side View of AP-585 with TEL Figure 36 – Front View of AP-585 with TEL Figure 37 – Left Side View of AP-585 with TELs Non-Proprietary 53| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.6 TELs Placement on the AP-587 The AP-587 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 38, 39, and 40 for placement. Figure 38 – Right Side View of AP-587 with TEL Figure 39 – Front View of AP-587 with TEL Figure 40 – Left Side View of AP-587 with TELs Non-Proprietary 54| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.7 TELs Placement on the AP-635 The AP-635 is a campus AP (see above section 2.3.4, AP-630 Series). The AP-635 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 41 and 42 for placement. TELs 1 and 2 shall be placed on opposite sides of the enclosure (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TEL 1 shall be located such that it lands on the flat surface of the chassis. TEL 2 shall be placed approximately opposite TEL 1. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. It is especially important that TELs 2 and 3 be firmly adhered to the chassis. Figure 41 – Top View of AP-635 with TELs Figure 42 – Bottom View of Aruba AP-635 with TELs Non-Proprietary 55| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.3.8 TELs Placement on the AP-655 The AP-655 is a campus AP (see above section 2.3.5, AP-650 Series). The AP-655 requires 3 TELs: one on each side edge (labels 1 and 2) to detect opening the device and one covering the console port (label 3) to detect access to a restricted port. See figures 43 and 44 for placement. TELs 1 and 2 shall be placed on opposite sides of the enclosure (as shown below). These TELs shall be applied such that between one-quarter and one-third of the TEL is adhered to the white cover of the enclosure. The remaining portion shall be wrapped around the side of the cover and the chassis. TEL 2 shall be located such that it lands on the flat surface of the chassis. TEL 1 shall be placed approximately opposite TEL 2. TELs must be firmly pressed down, removing any air bubbles or creases, to ensure proper adhesion. It is especially important that TEL 1 be firmly adhered to the chassis. Figure 43 – Top View of AP-655 with TELs Figure 44 – Bottom View of Aruba AP-655 with TELs Non-Proprietary 56| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 7.4 Inspection/Testing of Physical Security Mechanisms The Crypto Officer should inspect/test the physical security mechanisms according to the recommended test frequency. Table 25 - Physical Security Inspection Guidelines Physical Security Mechanism Recommended Frequency of Inspection/Test Inspection/Test Guidance Details Tamper-evident labels (TELs) Once per month Examine for any sign of removal or tampering. See images above for locations of TELs. If any TELS are found to be missing or damaged, contact a system administrator immediately. Opaque module enclosure Once per month Examine module enclosure for any evidence of new openings or other access to the module internals. If any indication is found that indicates tampering, contact a system administrator immediately. 8 Non-Invasive Security Since the module has not been purposely designed, built and publicly documented to include non- invasive mitigation techniques, the Non-Invasive Security requirements are not applicable. Non-Proprietary 57| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 9 Sensitive Security Parameters (SSP) Management The following are the Sensitive Security Parameters (SSPs) and Keys used in the module. The operator is responsible for zeroizing all SSPs when switching modes. As specified in the Zeroization column of the following table, the majority of SSPs/Keys used in the module are zeroized implicitly by rebooting the module, indicated via the successful completion of the module reboot service. Also as specified in the Zeroization column of the following table, there are a minority of SSPs/Keys used in the module that are zeroized by using the command ‘ap wipe out flash’, indicated via the status of the ‘ap wipe out flash’ command. Table 26 – SSPs and Keys # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys General Keys/SSPs 1 DRBG Entropy Input – CSP 512 bits SP 800-90A Rev1 CTR_DRBG AES-256 Cert. #A2690 64 bytes are retrieved from the entropy source read from entropy source on each call by any service that requires a random number. Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Entropy inputs to the DRBG function, used to construct the DRBG Seed. 2 DRBG Seed – CSP 384 bits SP 800-90A Rev1 CTR_DRBG AES-256 Cert. #A2690 Generated using DRBG derivation function that includes the entropy input from the entropy source read from entropy source. Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Input to the DRBG that determines the internal state of the DRBG (DRBG Key and V). 3 DRBG Key – CSP 256 bits SP 800-90A Rev1 CTR_DRBG AES-256 Cert. #A2690 Derived from the DRBG Seed. Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. This is the internal DRBG key used for SP 800-90A Rev1 CTR_DRBG during generation of random numbers. Non-Proprietary 58| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 4 DRBG V – CSP 128 bits SP 800-90A Rev1 CTR_DRBG AES-256 Cert. #A2690 Derived from the DRBG Seed. Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Internal V value used as part of SP 800-90A Rev1 CTR_DRBG during generation of random numbers. 5 Diffie-Hellman Private Key – CSP 224 bits Diffie- Hellman Group 14 Cert. #A2690 Cert. #A2689 Generated internally in compliance with Diffie-Hellman key agreement scheme by calling Approved DRBG (Cert. #A2690) Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used during the IPSec handshake to establish the Diffie-Hellman Shared Secret. 6 Diffie-Hellman Public Key – PSP 2048 bits Diffie- Hellman Group 14 Cert. #A2690 Cert. #A2689 Generated internally in compliance with Diffie-Hellman key agreement scheme by calling Approved DRBG (Cert. #A2690) Import: N/A Export: in plaintext N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used during the IPSec handshake to establish the Diffie-Hellman Shared Secret. 7 Diffie-Hellman Shared Secret – CSP 2048 bits Diffie- Hellman Group 14 Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Established during Diffie- Hellman Exchange. Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used for deriving IPSec/IKE cryptographic keys. 8 EC Diffie- Hellman Private Key – CSP Curves: P-256 or P-384 EC Diffie- Hellman Cert. #A2690 Cert. #A2689 Generated internally by calling Approved DRBG (Cert. #A2690) during EC Diffie-Hellman Exchange. Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used for establishing EC Diffie- Hellman Shared Secret. Non-Proprietary 59| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 9 EC Diffie- Hellman Public Key – PSP Curves: P-256 or P-384 EC Diffie- Hellman Cert. #A2690 Cert. #A2689 Generated internally by calling Approved DRBG (Cert. #A2690) during EC Diffie-Hellman Exchange. Import: N/A Export: in plaintext N/A Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used for establishing EC Diffie- Hellman Shared Secret. 10 EC Diffie- Hellman Shared Secret – CSP Curves: P-256 or P-384 EC Diffie- Hellman Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Established during EC Diffie- Hellman Exchange. Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used for deriving IPSec/IKE cryptographic keys. 11 Factory CA Public Key –PSP 2048 bits RSA N/A Loaded into the module during manufacturing (i.e. out of scope of module). Import: N/A Export: N/A N/A Stored in TPM Since this is a public key and protected in TPM, the zeroization requirements do not apply. This is a RSA public key. Used for Firmware verification. IPSec/IKE28 12 IKE Pre- shared Key29 – CSP 8 - 64 ASCII or 64 HEX characters Shared Secret Cert. #A2690 Entered by CO role. Import: in plaintext Export: N/A N/A Stored in Flash memory obfuscated with KEK Zeroized by using command ‘ap wipe out flash’. Used for IKEv1 peers authentication. 28 Not used in Mesh Point AP configuration. 29 Applicable only to Remote AP and Mesh Portal modes Non-Proprietary 60| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 13 Skeyid – CSP 160 / 256 / 384 bits Shared Secret Cert. #A2690 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1). Stored in SDRAM memory (plaintext) Zeroized by rebooting the module. A shared secret known only to IKEv1 peers. Used for deriving other keys in IKEv1 protocol implementation. 14 skeyid_d – CSP 160 / 256 / 384 bits Shared Secret Cert. #A2690 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1). Stored in SDRAM memory (plaintext) Zeroized by rebooting the module. A shared secret known only to IKEv1 peers. Used for deriving IKEv1 Session Authentication Key. 15 SKEYSEED – CSP 160 / 256 / 384 bits Shared Secret Cert. #A2689 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv2). Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. A shared secret known only to IKEv2 peers. Used for deriving other keys in IKEv2 protocol. 16 IKE Session Authentication Key – CSP 160 / 256 / 384 bits HMAC-SHA- 1/256/384 Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1/IKEv2). Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. The IKE session (IKE Phase I) authentication key. Used for IKEv1/IKEv2 payload integrity verification. 17 IKE Session Encryption Key – CSP 128 / 192 / 256 bits AES (CBC) Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1/IKEv2). Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. The IKE session (IKE Phase I) encrypt key. Used for IKE payload protection. Non-Proprietary 61| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 18 IPSec Session Encryption Key – CSP 128 / 192 / 256 bits 128 / 256 bits AES (CBC) and AES (GCM) Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1/IKEv2). Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. The IPSec (IKE phase II) encryption key. Used for IPSec traffics protection. IPSec session encryption keys can also be used for the Double Encrypt feature. 19 IPSec Session Authentication Key – CSP 160 bits HMAC-SHA- 1 Cert. #A2690 Cert. #A2689 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-135 Rev1 KDF (IKEv1/IKEv2). Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. The IPSec (IKE Phase II) authentication key. Used for IPSec traffics integrity verification. 20 IKE RSA Private Key – CSP 2048 bits RSA Private Key Cert. #A2690 Cert. #A2689 Generated by the module in compliance with FIPS 186-4 RSA key pair generation method. In both IKEv1 and IKEv2, DRBG (Cert. #A2690) is called for key generation. This key can also be entered by the CO. Import: N/A Export: N/A N/A Stored in Flash memory obfuscated with KEK Zeroized by using command ‘ap wipe out flash’. This is the RSA private key. Used for RSA signature signing in either IKEv1 or IKEv2. Non-Proprietary 62| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 21 IKE RSA Public Key – PSP 2048 bits RSA Public Key Cert. #A2690 Cert. #A2689 Generated by the module in compliance with FIPS 186-4 RSA key pair generation method. In both IKEv1 and IKEv2, DRBG (Cert. #A2690) is called for key generation. This key can also be entered by the CO. Import: N/A Export: N/A N/A Stored in Flash memory obfuscated with KEK Zeroized by using command ‘ap wipe out flash’. This is the RSA public key. Used for RSA signature verification in either IKEv1 or IKEv2. 22 IKE ECDSA Private Key – CSP Curves: P-256 or P-384 ECDSA suite B Cert. #A2689 Generated by the module in compliance with FIPS 186-4 ECDSA key pair generation method. In IKEv2, DRBG (Cert. #A2690) is called for key generation. This key can also be entered by the CO. Import: N/A Export: N/A N/A Stored in Flash memory obfuscated with KEK Zeroized by using command ‘ap wipe out flash’. This is the ECDSA private key. Used for ECDSA signature signing in IKEv2. Non-Proprietary 63| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 23 IKE ECDSA Public Key – PSP Curves: P-256 or P-384 ECDSA suite B Cert. #A2689 Generated by the module in compliance with FIPS 186-4 ECDSA key pair generation method. In IKEv2, DRBG (Cert. #A2690) is called for key generation. This key can also be entered by the CO. Import: N/A Export: N/A N/A Stored in Flash memory obfuscated with KEK Zeroized by using command ‘ap wipe out flash’. This is the ECDSA public key. Used for ECDSA signature verification in IKEv2. WPA2/WPA330 24 WPA2/WPA3 Pre-shared Key – CSP 8-63 ASCII or 64 HEX characters Shared Secret Cert. #A2690 Entered by CO role. Import: in plaintext Export: N/A N/A Stored in Flash memory (obfuscated with KEK). Zeroized by using command ‘ap wipe out flash’. Used for WPA2/WPA3 client/server authentication. 25 WPA2/WPA3 Pair-Wise Master Key (PMK) – CSP 256 bits Shared Secret Cert. #A2690 The PMK is transferred to the module, protected by IPSec secure tunnel. Import: in plaintext Export: N/A N/A Stored in SDRAM (plaintext). Zeroized by rebooting the module. Used to derive the Pairwise Transient Key (PTK) for WPA2/WPA3 communications. 26 WPA2/WPA3 Pairwise Transient Key (PTK) – CSP 384 bits HMAC Cert. #A2690 N/A Import: N/A Export: N/A Derived via key derivation function defined in SP 800-108 Rev1 and SP 800-56C Rev2. Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used to derive the WPA2/WPA3 Session Key. 30 While operating in Mesh Point AP configuration or Mesh Portal AP configuration, the AP will only use PSK for WPA2/WPA3. Remote AP configuration and CPSec Protected AP configuration use both Certificate-based and PSK-based WPA2/WPA3. Non-Proprietary 64| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy # Key / SSP Name / Type Security Strength Security Function and Cert. Number Generation Import / Export Establishment Storage Zeroization Use and Related Keys 27 WPA2/WPA3 Session Key – CSP 128 bits, 128 / 256 bits AES (CCM) and AES (GCM) (WPA3 only) Cert. #A2690 N/A Import: N/A Export: N/A Derived during WPA2/WPA3 4- way handshake by using the KDF defined in SP 800-108 Rev1 and SP 800-56C Rev2. Stored in SDRAM memory (plaintext). Zeroized by rebooting the module. Used as the WPA2/WPA3 Session Key. 28 WPA2/WPA3 Group Master Key (GMK) – CSP 256 bits Shared Secret Cert. #A2690 Generated internally by calling Approved DRBG (Cert. #A2690). Import: N/A Export: N/A N/A Stored in SDRAM memory (plaintext) Zeroized by rebooting the module Used to derive WPA2/WPA3 Group Transient Key GTK. 29 WPA2/WPA3 Group Transient Key (GTK) – CSP 256 bits AES (CCM) and AES (GCM) Cert. #A2690 N/A Import: N/A Export: N/A Derived from WPA2/WPA3 GMK by using the KDF defined in SP 800-108 Rev1 and SP 800-56C Rev2. Stored in SDRAM memory (plaintext) Zeroized by rebooting the module The GTK is the WPA2/WPA3 session key used for broadcast communications protection. Non-Proprietary 65| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Notes: • AES GCM IV generation is performed in compliance with the Implementation Guidance C.H scenario 1 for IKEv2. The module is compliant with RFC 4106 and 7296. Specifically, the module uses RFC 7296 compliant IKEv2 to establish the shared secret SKEYSEED from which the AES GCM encryption keys are derived. When the “nonce†(the IV in RFC 5282) for IKEv2 exhausts the maximum number of possible values for a given security association for IKEv2, either party to the security association for IKEv2 that encounters this condition triggers a rekeying with IKEv2 to establish a new encryption key. • AES GCM IV generation is performed in compliance with the Implementation Guidance C.H scenario 4 for WPA3. The session is reauthenticated by the module after 24 hours which resets the AES GCM IV counter. The 24 hour (86400 seconds) interval is the default setting and shall not be changed while in Approved mode. • In case the module’s power is lost and then restored, a new key for use with the AES-GCM encryption/decryption shall be established. • For keys identified as being “Generated internally", the module implements cryptographic key generation (CKG) compliant to SP 800-133rev2 section 4: The module generates symmetric keys and seeds for asymmetric keys using an unmodified output from the Approved DRBG (Cert. #A2690). • The Approved DRBG (Cert. #A2690) generates a minimum of 256 bits of entropy for use in key generation. • In Remote AP configuration, all SSPs are applicable. • In CPSec Protected AP configuration, the IKEv1 PSK SSPs are not applicable. • In Mesh Point AP configuration, all IPSec/IKE SSPs are not applicable. • SSPs labeled as “Entered by CO†(as well as the RSA public and private keys) are transferred into the module from the Mobility Controller via IPSec. • SSPs labelled as “obfuscated†are obfuscated in accordance to FIPS IG 2.4.A. • Sensitive Security Parameters (SSPs) can be Critical Security Parameters (CSPs) or Public Security Parameters (PSPs). • Keys established while operating in the non-Approved mode cannot be used in Approved mode, and vice versa. 9.1 Non-Deterministic Random Number Generation Specification Table 27 – Non-Deterministic Random Number Generation Specification Entropy Sources Minimum Number of Bits of Entropy Details Aruba CPU Jitter Entropy Source (see NIST Entropy Source Validation (ESV) program certificate #7) Oversampling of 512 bits is performed to ensure that 256 bits of entropy is available to the DRBG. The module employs a SP 800-90A Rev1-compliant Deterministic Random Bit Generator (DRBG) using an AES-256 CTR_DRBG mechanism with DF for random number generation (Cert. #A2690). The module performs the DRBG health tests as defined in section 11.3 of SP 800-90A Rev1. The module uses a SP 800-90B-compliant non-physical entropy source that uses CPU jitter provided by the operational environment as a noise source (Jitterentropy (JENT) with SHA-3 as the vetted conditioning component). Non-Proprietary 66| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 10 Self-Tests The module performs Cryptographic Algorithm Self-Tests (CASTs) when powered on, regardless of which of the four (4) AP configurations is selected. The module also performs Pre-Operational Self-Tests (POSTs) automatically when the module is powered on. In addition, the module performs Conditional tests in the Approved mode of operation (refer to the Modes of Operation section). When a cryptographic algorithm self-test or pre-operational self-test fails, or when a conditional self-test fails, the module enters the Critical Error state (while in this state, the module provides no functionality including inhibition of data output), logs the error, and reboots automatically. During the process when the HPE Aruba Networking Access Point (AP) is powered on and booted, RSA and SHS Conditional Cryptographic Algorithm Self-Test KATs are executed before the RSA Firmware Integrity Test Pre-Operational Self-Test signature verification KAT, then Conditional Cryptographic Algorithm Tests are executed after ArubaOS is booted. The module transitions to the operational state only after the cryptographic algorithm and pre-operational self-tests are passed successfully. All cryptographic algorithm self-tests are run when the module is powered on, prior to the first operational use of the cryptographic algorithm. The module performs the following Pre-Operational Self-Tests (POSTs): Table 28 – Pre-Operational Self-Tests Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details RSA Firmware Integrity Test ArubaOS Bootloader Module 2048-bit public key, PKCS#1-v1.5, signature verification with SHA2-256 message digest SigVer The ArubaOS Bootloader Module performs the firmware integrity test when module powered on, before booting the ArubaOS operating system. The module performs the following Conditional Self-Tests: Table 29 – Conditional Cryptographic Algorithm Tests Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition RSA ArubaOS Bootloader Module 2048, PKCS#1-v1.5 KAT Verify Each run when module powered on, which is prior to the first operational use of the cryptographic algorithms SHS ArubaOS Bootloader Module SHA2-256 KAT Non-Proprietary 67| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition AES ECB ArubaOS OpenSSL Module AES-ECB-128 KAT Encrypt, Decrypt Each run when module powered on, which is prior to the first operational use of the cryptographic algorithms AES CCM ArubaOS OpenSSL Module AES-CCM-192 KAT Encrypt, Decrypt AES GCM ArubaOS OpenSSL Module AES-GCM-256 KAT Encrypt, Decrypt DRBG ArubaOS OpenSSL Module AES-CTR-256, CTR_DRBG with DF, with and without PR KAT SP 800-90A Rev1 Section 11.3 Health Tests for CTR_DRBG (Instantiate, Generate and Reseed) ArubaOS CPU Jitter Entropy Source RCT SP800-90B Section 4.4 Approved Continuous Health Tests (RCT and APT) Tests are applied continuously to digitized samples of the output of the non-physical noise source APT ECDSA ArubaOS OpenSSL Module P-256, P-384 KAT Sign, Verify Each run when module powered on, which is prior to the first operational use of the cryptographic algorithms HMAC ArubaOS OpenSSL Module HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 KAT KAS-SSC-ECC ArubaOS OpenSSL Module Primitive ‘Z’ computation with P-256 curve KAT Ephemeral Unified SP 800- 56A Rev3 based KAS-SSC-FFC ArubaOS OpenSSL Module Shared secret computation, p=2048, q=256 KAT dhEphem SP 800-56A Rev3 based KDA ArubaOS OpenSSL Module Two-step KDF: HMAC-SHA-1, L=2048 KAT SP 800-56C Rev2 based KBKDF ArubaOS OpenSSL Module HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384 KAT SP 800-108 Rev1 based KDF135 ArubaOS OpenSSL Module Key derivation KAT SP 800-135 Rev1 based: IKEv1 RSA ArubaOS OpenSSL Module 2048, PKCS#1-v1.5 KAT Sign, Verify Non-Proprietary 68| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition SHS ArubaOS OpenSSL Module SHA-1, SHA2-256, SHA2-384, SHA2-512 KAT Each run when module powered on, which is prior to the first operational use of the cryptographic algorithms Triple-DES ArubaOS OpenSSL Module TDES-ECB-192 KAT Encrypt, Decrypt, Triple-DES used with KEK only to obfuscate internal keys. No security claimed. SHA-3 ArubaOS CPU Jitter Entropy Source SHA3-256 KAT FIPS 202 based Run when module powered on, which is prior to the first operational use of the cryptographic algorithm AES CBC ArubaOS Crypto Module AES-CBC-256 KAT Encrypt, Decrypt Each run when module powered on, which is prior to the first operational use of the cryptographic algorithms AES GCM ArubaOS Crypto Module AES-GCM-256 KAT Encrypt, Decrypt ECDSA ArubaOS Crypto Module P-256 KAT Sign, Verify HMAC ArubaOS Crypto Module HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 KAT KAS-SSC-ECC ArubaOS Crypto Module Primitive ‘Z’ computation with P-256 curve KAT Ephemeral Unified SP 800- 56A Rev3 based KAS-SSC-FFC ArubaOS Crypto Module Shared secret computation, p=2048, q=256 KAT dhEphem SP 800-56A Rev3 based KDF135 ArubaOS Crypto Module Key derivation KAT SP 800-135 Rev1 based: IKEv2 RSA ArubaOS Crypto Module 2048, PKCS#1-v1.5 KAT Sign, Verify SHS ArubaOS Crypto Module SHA-1, SHA2-256, SHA2-384, SHA2-512 KAT Non-Proprietary 69| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition Triple-DES ArubaOS Crypto Module TDES-CBC-192 KAT Encrypt, Decrypt, Triple-DES used with KEK only to obfuscate internal keys. No security claimed. Run when module powered on, which is prior to the first operational use of the cryptographic algorithm Table 30 – Conditional Pairwise Consistency Tests Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition ECC key pairs ArubaOS OpenSSL Module P-256, P-384 PCT Sign, Verify Each run on key pair generation FFC key pairs ArubaOS OpenSSL Module DH key pair generation PCT SP800-56A Rev3 assurances as per SP 800-56A Rev3 Section 5.6.2.1.4 for PCT RSA key pairs ArubaOS OpenSSL Module 2048, PKCS#1-v1.5 PCT Sign, Verify ECC key pairs ArubaOS Crypto Module P-256, P-384 PCT Sign, Verify FFC key pairs ArubaOS Crypto Module DH key pair generation PCT SP800-56A Rev3 assurances as per SP 800-56A Rev3 Section 5.6.2.1.4 for PCT RSA key pairs ArubaOS Crypto Module 2048, PKCS#1-v1.5 PCT Sign, Verify Non-Proprietary 70| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Table 31 – Conditional Software/Firmware Load Tests Algorithm HPE Aruba Networking Cryptographic Module Component Test Properties Type Details Condition RSA Firmware Load Test ArubaOS OpenSSL Module 2048, PKCS#1-v1.5, signature verification with SHA2-256 SigVer Test is applied by the main ArubaOS code for firmware load during operation RSA Firmware Load Test ArubaOS Bootloader Module 2048, PKCS#1-v1.5, signature verification with SHA2-256 SigVer Test is applied by the ArubaOS Bootloader Module on request to load firmware Notes: • KAT = Known Answer Test, RCT = Repetition Count Test for Entropy Source, APT = Adaptive Proportion Test for Entropy Source, PCT = Pairwise Consistency Test These self-tests are run for the hardware cryptographic implementation as well as for the ArubaOS OpenSSL Module and ArubaOS Crypto Module implementations. Self-test results are written to the serial console. The status can be viewed by using the CLI command: show log crypto all When all Cryptographic Algorithm Self-Tests (CASTs) run when the module is powered on pass, the module will enter the Normal state and the module logs the following message into a log file: KATS: passed In the event any self-test fails, the module will enter a Critical Error state (while in this state, the module provides no functionality and inhibits data output), logs the error, and reboots automatically. If the software/firmware load test fails when module powered on, the module enters the Critical Error state, where the invalid software/firmware file is deleted to clear the error. During the reboot sequence, all LEDs light up (reboot), then all LEDs turn off (power off/cycled), then all LEDs light up (power on), then the LEDs light indicating level of activity (refer to the Status Indicator LED tables for each hardware device listed above in Section 2.3, Table 5). In the event of a KATs failure, the AP logs error messages: • For an AP hardware ArubaOS OpenSSL Module and/or ArubaOS Crypto Module KAT failure: AP rebooted [DATE][TIME] : Restarting System, SW FIPS KAT failed Non-Proprietary 71| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 11 Life-Cycle Assurance This section specifies the procedures for secure installation, initialization, provisioning, start-up, configuration, and operation of the module. Guidance is provided, including references to where to find more guidance documentation. 11.1 Product Examination The units are shipped to the Crypto Officer in factory-sealed boxes using trusted commercial carrier shipping companies. The Crypto Officer should examine the carton for evidence of tampering. Tamper-evidence includes tears, scratches, and other irregularities in the packaging. 11.2 Package Contents The product carton should include the following: • HPE Aruba Networking AP-5XX or AP-6XX Wireless Access Point. • Mounting kit (sold separately). • Tamper-Evident Labels. Inform your supplier if there are any incorrect, missing, or damaged parts. If possible, retain the carton, including the original packing materials. Use these materials to repack and return the unit to the supplier if needed. 11.3 Pre-Installation Checklist You will need the following during installation: • HPE Aruba Networking AP-5XX and AP-6XX Access Point components. • A mount kit compatible with the AP and mount surface (sold separately). • A compatible Category 5 UTP Ethernet cable. • External antennas (when using the AP-514, AP-534, or AP-584). • Phillips or cross-head screwdriver. • (Optional) a compatible 12V DC (AP-514, AP-515, AP-635, or AP-655) or 48V DC (AP-534 or AP-535) or 100-240V AC (AP-584, AP-585, or AP-587) AC-to-DC power adapter with power cord. • (Optional) a compatible PoE midspan injector with power cord. • One USB 2.0 host interface Type A connector (AP-514, AP-515, AP-534, AP-535, AP-635, or AP-655) or USB Type C connector (AP-584, AP-585, or AP-587) console cable • Adequate power supplies and electrical power. • Management Station (PC) with 10/100 Mbps Ethernet port and SSHv2 client software. Also make sure that (at least) one of the following network services is supported: • Aruba Discovery Protocol (ADP) - see the Aruba AP Software Quick Start Guide. • DNS server with an “A†record. • DHCP Server with vendor-specific options. 11.4 Identifying Specific Installation Locations For detailed instructions on identifying AP installation locations, refer to the specific HPE Aruba Networking 5XX or 6XX Series Wireless Access Points Installation Guide, and the section, Identifying Specific Installation Locations. Non-Proprietary 72| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 11.5 Precautions • All HPE Aruba Networking access points should be professionally installed by an HPE Aruba Networking-Certified Mobility Professional (ACMP). • Electrical power is always present while the device is plugged into an electrical outlet. Remove all rings, jewellery, and other potentially conductive material before working with this product. • Never insert foreign objects into the device, or any other component, even when the power cords have been unplugged or removed. • Main power is fully disconnected from the Wireless Access Point only by unplugging all power cords from their power outlets. For safety reasons, make sure the power outlets and plugs are within easy reach of the operator. • Do not handle electrical cables that are not insulated. This includes any network cables. • Keep water and other fluids away from the inside of the product. • Comply with electrical grounding standards during all phases of installation and operation of the product. Do not allow the Wireless Access Point chassis, network ports, power cables, or mounting brackets to contact any device, cable, object, or person attached to a different electrical ground. Also, never connect the device to external storm grounding sources. • Installation or removal of the device or any module must be performed in a static-free environment. The proper use of anti-static body straps and mats is strongly recommended. • Keep modules in anti-static packaging when not installed in the chassis. • Do not ship or store this product near strong electromagnetic, electrostatic, magnetic or radioactive fields. • Do not disassemble chassis or modules. They have no internal user-serviceable parts. When service or repair is needed, contact HPE Aruba Networking. 11.6 Secure Operation The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points meet FIPS 140-3 Level 2 requirements. The information below describes how to keep the Wireless Access Point in the Approved mode of operation. The module can be configured to be in one of four (4) AP configurations and in the Approved mode of operation (see section 2.5, Modes of Operation) via corresponding HPE Aruba Networking Mobility Controllers that are in Approved mode and that have been validated against FIPS 140-3 requirements, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed. 11.6.1 Crypto Officer Management The Crypto Officer must ensure that the Wireless Access Point is always operating in the Approved mode of operation. This can be achieved by ensuring the following: • The Crypto Officer must first enable and then provision the AP into the Approved mode of operation before Users are permitted to use the Wireless Access Point (see the sub-section below named, Enabling Approved Mode on the Staging Controller). • Only HPE Aruba Networking firmware updates signed with SHA2-256/RSA 2048 are permitted. • Passwords must be at least eight (8) characters long. • The Wireless Access Point logs must be monitored. If a strange activity is found, the Crypto Officer should take the Wireless Access Point offline and investigate. Non-Proprietary 73| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy • The Tamper-Evident Labels (TELs) must be regularly examined for signs of tampering. Refer to the table in the above Physical Security section named, Inspection/Testing of Physical Security Mechanisms, for the recommended frequency. • When installing expansion or replacement modules for the HPE Aruba Networking AP-514, AP- 515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP-655 Access Points, use only Approved modules, replace TELs affected by the change, and record the reason for the change, along with the new TEL locations and serial numbers, in the security log. • All configuration performed through the HPE Aruba Networking Mobility Conductor when configured as a managed device must ensure that only the Approved algorithms and services are enabled on the Wireless Access Point in Approved mode. • Refer to the sub-section below named, Non-Approved Approved Mode Configurations, for non- Approved configurations that shall not to be used in the Approved mode. • The operator is responsible for zeroizing all SSPs when switching modes. Keys established while operating in the non-Approved mode cannot be used in the Approved mode, and vice versa. • The guidelines in the above sub-section 2.9 table named, Non-Approved Algorithms Not Allowed in the Approved Mode of Operation, and this sub-section 11.6 named, Secure Operation, must be adhered to. 11.6.2 User Guidance Although outside the boundary of the Wireless Access Point, the operator should be directed to be careful not to provide authentication information and session keys to other parties. Note that the module does not possess persistent storage of SSPs. Any SSP value only exists in volatile memory and that value vanishes when the module is powered off. In the case when the module’s power is lost and then restored, a new key for use with the AES-GCM encryption/decryption shall be established. HPE Aruba Networking generally recommends that the communication between the Controller/Gateways and Access Points be restricted either by having a dedicated layer 2 segment/VLAN or, if Controller/Gateways and Access Points cross layer 3 boundaries, to have firewall policies restricting the communication of these authorized devices. 11.6.3 Set-up and Configuration The HPE Aruba Networking AP-514, AP-515, AP-534, AP-535, AP-584, AP-585, AP-587, AP-635 and AP- 655 Access Points meet FIPS 140-3 Security Level 2 requirements. The sections below describe how to place and keep the Wireless Access Point in the Approved mode of operation. The Crypto Officer (CO) must ensure that the Wireless Access Point is kept in the Approved mode of operation. The Wireless Access Point can be configured to be in one of four (4) AP configurations: Control Plane Security (CPSec) Protected AP, Remote AP and the two (2) Mesh AP configurations, Mesh Portal AP and Mesh Point AP. The module must operate in Approved mode (see Modes of Operation section above). By default, the Wireless Access Point operates in the standard non-Approved mode. The Access Point is managed by an HPE Aruba Networking Mobility Controller in Approved mode, and access to the Mobility Controller’s administrative interface via a non-networked general purpose computer is required to assist in placing the module in Approved mode. The Controller used to provision the AP is referred to as the “staging controllerâ€. The staging controller must be provisioned with the appropriate HPE Aruba Networking firmware image for the module, which has been validated to FIPS 140-3, prior to initiating AP provisioning. Additionally, if a Mobility Conductor appliance is deployed in the environment, provisioning of the APs can be performed by passing policies down from the Mobility Conductor to the Mobility Controller which then provisions the AP. 11.6.3.1 Setting Up Your Wireless Access Point The Crypto Officer shall perform the following steps to ensure the APs are placed in the secure operational state: 1. Review the Aruba AP Software Quick Start Guide. Select the deployment scenario that best fits your installation and follow the scenario’s deployment procedures. 2. Apply TELs according to the directions in the above Physical Security section 7.2, Applying TELs. Non-Proprietary 74| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 3. Enable Approved mode on the staging controller: Log into the staging controller via an SSH client and enter the commands shown in the sub-section below named, Enabling Approved Mode on the Staging Controller. 4. Connect the module via an Ethernet cable to the staging controller - note that this should be a direct connection, with no intervening network or devices. If PoE is being supplied by an injector, this represents the only exception; that is, nothing other than a PoE injector should be present between the module and the staging controller. 5. Provision the AP into one of four (4) AP configurations following the guidance in the ArubaOS 8.10 User Guide: Remote AP configuration, CPSec protected AP configuration, Mesh Portal AP configuration, or Mesh Point AP configuration. 6. Via the logging facility of the staging controller, ensure that the module (the AP) is successfully provisioned with firmware and configuration and in Approved mode. To verify that the image is being run, the CO can enter ‘show ap image’ on the controller to verify the correct image is present on the device. To verify that Approved mode is enabled, enter ‘show fips’. 7. Terminate the administrative session. 8. Disconnect the module from the staging controller and install it on the deployment network. When power is applied, the module (the AP) will attempt to discover and connect to an HPE Aruba Networking Mobility Controller on the network. Once the AP has been provisioned, it is considered to be in Approved mode, provided that the guidelines on services, algorithms, physical security and key management found in this Security Policy are followed. 11.6.3.2 Enabling Approved Mode on the Staging Controller For FIPS 140-3 compliance, users cannot be allowed to access the Wireless Access Point until the CO changes the mode of operation on the staging controller to the Approved mode. There is only one way to enable Approved mode on the staging controller: o Use the CLI via an SSHv2 client to enter the commands in the following sub-section. o For more information on using the CLI, refer to the ArubaOS 8.10 Command-Line Interface Reference Guide. 11.6.3.2.1 Enabling Approved Mode on the Staging Controller with the CLI Login to the staging controller using an SSHv2 client. Enable Approved mode using the following commands: #configure terminal Enter Configuration commands, one per line. End with CNTL/Z (config) #fips enable (config) #exit #write memory Saving Configuration... Configuration Saved. To verify that Approved mode has been enabled, issue the command: show fips to see: FIPS Settings: Mode Enabled If logging in to the staging controller via the Mobility Conductor, please reference the ArubaOS 8.10 User Guide on how to access a managed device. Once connected to the staging controller, the above commands will successfully execute. Non-Proprietary 75| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy Please abide by the sub-section above in this section named, Crypto Officer Management, and sub- section below named, Non-Approved Approved Mode Configurations. 11.7 Non-Approved Approved Mode Configurations When operating in the Approved mode, the following configuration options are non-Approved: • The following configurations are forcibly disabled by the module: o All WEP features. o WPA. o TKIP mixed mode. o Any combination of DES, MD5, and PPTP. o Firmware images signed with SHA- 1. o Enhanced PAPI Security. o Null Encryption. o USB CSR-Key Storage. o Certificates with less than 112 bits security strength as used with IKEv2, IPSec, and/or user authentication. o Telnet. o Extensible Authentication Protocol (EAP)-TLS Termination. o bSec. o IPSec/IKE using Triple-DES. 11.8 Full Documentation Documentation for any HPE Aruba Networking product can be found on the HPE Networking Support Portal (NSP). Filters can be used to limit the displayed results by Product(s), Product Series, Version(s), and File Category. For example, • Full ArubaOS version 8.10 documentation for HPE Aruba Networking Mobility Controllers, Virtual Mobility Controllers, Gateways, Mobility Conductors, and Access Points can be found at the link provided below after authentication. https://networkingsupport.hpe.com/downloads;pageSize=100;fileTypes=DOCUMENT;products=Aruba%20A ccess%20Points,Aruba%20Mobility%20Gateways;softwareGroups=ArubaOS;softwareMajorVersions=8.10 11.8.1 Related HPE Aruba Networking Documents The following HPE Aruba Networking documents can be referenced to ensure that ArubaOS and the HPE Aruba Networking hardware-based equipment or HPE Aruba Networking virtual appliances that run ArubaOS are installed and operated correctly in Approved mode: • Aruba Access Points Installation Guides • ArubaOS 8.10.0.x AP Software Quick Start Guide • ArubaOS 8.10.0.0 Virtual Appliance Installation Guide • ArubaOS 8.10.0.0 User Guide • ArubaOS 8.10.0.x CLI Reference Guide • ArubaOS 8.10.0.0 API Guide • ArubaOS 8.10.0.0 Getting Started Guide • ArubaOS 8.10.0.0 Syslog Reference Guide Non-Proprietary 76| HPE Aruba Networking AP-5XX and AP-6XX Access Points with ArubaOS FIPS Firmware FIPS 140-3 Level 2 Security Policy 11.9 End of Life To determine if an HPE Aruba Networking product is considered end of life, refer to the HPE Aruba Networking end-of life information at https://networkingsupport.hpe.com/end-of-life. If an HPE Aruba Networking product is deemed end-of-life, the CO should work with their HPE Aruba Networking representative to determine the appropriate HPE Aruba Networking product upgrade path to use a newer Approved version. Note that any firmware loaded into this module that is not shown on the module certificate is out of the scope of this validation and requires a separate FIPS 140-3 validation. The module does not possess persistent storage of SSPs. Any SSP value only exists in volatile memory and that value vanishes when the module is powered off. For secure sanitization, firstly the module shall be powered off. Then, if the module is deprecated, the module will be replaced with a newer Approved version with the help of an HPE Aruba Networking-Certified Mobility Professional (ACMP). 12 Mitigation of Other Attacks As per IG 12.A, since the module has not been purposely designed, built and publicly documented to mitigate one or more specific attacks, the Mitigation of Other Attacks requirements are not applicable.