This page was not yet optimized for use on mobile devices.
HPE Juniper Networking QFX5120-48YM
Certificate details
| Certificate ID | #5509 |
|---|---|
| Status | active |
| Validation dates | 01.09.2026 |
| Sunset date | 31-08-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The HPE Juniper Networking QFX5120 Switch delivers high scale, high availability, and high performance for data center and campus deployments. The QFX5120 Switch is a versatile routing and switching platform addressing higher server access speed and campus distribution use cases while offering high-density 1GbE/10GbE/25GbE and 100GbE uplinks for collapsed spine data center or campus distribution deployments. The QFX5120-48YM is a 10GbE/25GbE/100GbE data center leaf and campus distribution switch. |
| Vendor | HPE Juniper Networking http://www.juniper.net |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES256, AES-128, AES-192, AES-256, AES-, CAST, TDES, Blowfish, HMAC, CMACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, Diffie-Hellman, DH, DSAHash functions
SHA-1, RIPEMD160Schemes
MAC, Key AgreementProtocols
SSH, SSHv2, TLS 1.3Randomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, prime256v1Block cipher modes
CBC, CTR, GCMTrusted Execution Environments
PSP, SSCSecurity level
Level 1, Level 3, level 1Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5509,
"dgst": "16676c1285da37e8",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"AES-CMACA6551",
"SHA2-256A7286",
"Safe Primes Key VerificationA7286",
"KAS-FFC-SSC Sp800-56Ar3A7286",
"HMAC DRBGA6620",
"AES-CTRA7286",
"SHA-1A7286",
"#A6550",
"Safe Primes Key GenerationA7286",
"KAS-ECC-SSC Sp800-56Ar3A7286",
"KDF SP800-108A6551",
"AES-CBCA7286",
"RSA KeyGen (FIPS186-5)A7286",
"HMAC-SHA2-512A7286",
"ECDSA KeyGen (FIPS186-4)A7286",
"#A6620",
"AES-GCMAES 4545",
"#A7286",
"ECDSA SigGen (FIPS186-4)A7286",
"HMAC-SHA-1A7286",
"ECDSA SigVer (FIPS186-4)A7286",
"AES-XPNAES 4545",
"KDF SSHA7286",
"RSA SigVer (FIPS186-5)A7286",
"ECDSA KeyVer (FIPS186-4)A7286",
"RSA SigGen (FIPS186-5)A7286",
"AES-KWA6551",
"HMAC-SHA2-256A7286",
"#A6551",
"SHA2-512A7286"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6551",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A7286",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A6551",
"properties": "Direction - Generation, Verification Key Length - 128, 256 MAC Length - MAC Length: 8, 64, 120 Message Length - Message Length: 0, 32768, 524288",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A7286",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - Yes Counter Tests Performed - Yes",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "AES 4545",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Tag Length - 104, 112, 120, 128, 64, 96 IV Length - IV Length: 96 Payload Length - Payload Length: 120, 128 AAD Length - AAD Length: 120, 128",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A6551",
"properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128",
"reference": "SP 800-38F"
},
{
"algorithm": "",
"cavpCertName": "",
"properties": "Payload Length - Payload Length: 128, 192, 256, 320, 4096",
"reference": ""
},
{
"algorithm": "AES-XPN",
"cavpCertName": "AES 4545",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 120, 128 AAD Length - AAD Length: 120, 128 Tag Length - 104, 112, 120, 128, 64, 96 Salt Generation - External",
"reference": "SP 800-38D"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A6620",
"properties": "Prediction Resistance - Yes Supports Reseed - Yes Mode - SHA2-512 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0-256 Increment 8 Additional Input - Additional Input: 8-256 Increment 8 Returned Bits - 1024",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A7286",
"properties": "MAC - MAC: 160 Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A6620",
"properties": "MAC - MAC: 256 Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A7286",
"properties": "MAC - MAC: 256 Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A7286",
"properties": "MAC - MAC: 512 Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A7286",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Hash Function Z - SHA2-256, SHA2-384, SHA2-512 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A7286",
"properties": "Domain Parameter Generation Methods - FC, MODP-2048 Hash Function Z - SHA2-256 Scheme - dhEphem - KAS Role - initiator",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A6551",
"properties": "KDF Mode - Counter MAC Mode - CMAC-AES128, CMAC- AES256 Supported Lengths - Supported Lengths: 128, 256 Fixed Data Order - Before Fixed Data Counter Length - 8 Supports Empty IV - No Custom Key In Length - 0",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A7286",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2- 384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Fixed Public Exponent - 010001 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A7286",
"properties": "Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5 Fixed Public Exponent - 010001 Public Exponent Mode - fixed",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A7286",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A7286",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A7286",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6620",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A7286",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6550",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6620",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A7286",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Security relevant configurat ion (SSH, authentic ation data)",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Commands (SSH configuratio n: set system services ssh root-login allow)",
"name": "Configur e security (security relevant )",
"outputs": "Traffic",
"rolesSspAccess": "Root - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DR BG V value: E - HMAC_DR BG Key value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - SSH Public Host Key: G - User Authenticati on Public Keys: W - CO Authenticati on Public",
"secFunImpl": "DRBG Entropy Source Password Hash"
},
{
"description": "Descripti on",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access Keys: W Super-user - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DR BG V value: E - HMAC_DR BG Key value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - SSH Public Host Key: G - User Authenticati on Public Keys: W - CO Authenticati on Public",
"secFunImpl": ""
},
{
"description": "Non- security relevant configurat ion",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes",
"inputs": "Commands (miscellane ous commands e.g., for IP address configuratio n, routing protocols, etc.)",
"name": "Configur e (non- security relevant )",
"outputs": "Traffic",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "",
"indicator": "sful complet ion of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Query the module status",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Command (show system fips chassis level, requests system fips self-tests)",
"name": "Show status",
"outputs": "CLI output (show system fips chassis level: returns \u0027level 1\u0027 to indicate that the module is operating in the Approved mode and no output/blank to indicate that it is operating in the non- Approved mode; request system fips self-tests: module continues to be operational upon successful execution/re turns an error indicator and enters an error state in case",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthoris ed - User Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "LEDs on the module provide physical",
"indicator": "LED(s) on the chassis turned on",
"inputs": "N/A",
"name": "Show status (LED)",
"outputs": "LED",
"rolesSspAccess": "Super-user Operator Read-only Unauthoris ed Root",
"secFunImpl": "None"
},
{
"description": "status output",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Unauthentic ated",
"secFunImpl": ""
},
{
"description": "Query the module\u0027s versioning informatio n",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Command (show version)",
"name": "Show module\u0027 s versioni ng informat ion",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthoris ed - User Password: E Root - CO Password:",
"secFunImpl": "Password Hash"
},
{
"description": "Destroy all SSPs",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Command (request vmhost zeroise no- forwarding)",
"name": "Zeroise (Perfor m zeroisati on)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DR BG V value: Z - HMAC_DR",
"secFunImpl": "Password Hash"
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "BG Key value: Z - HMAC_DR BG entropy input: Z - HMAC_DR BG seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authenticati on Public Keys: Z - CO Authenticati on Public Keys: Z - JuniperRoo tCA: Z - PackageCA : Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key:",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Z - MACsec PSK: Z - MACsec SAK: Z - MACsec KEK: Z - MACsec ICK: Z Root - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DR BG V value: Z - HMAC_DR BG Key value: Z - HMAC_DR BG entropy input: Z - HMAC_DR BG seed: Z - ECDH Shared Secret: Z - DH Shared",
"secFunImpl": ""
},
{
"description": "Descripti",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "on",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authenticati on Public Keys: Z - CO Authenticati on Public Keys: Z - JuniperRoo tCA: Z - PackageCA : Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z - MACsec PSK: Z - MACsec SAK: Z - MACsec KEK: Z - MACsec ICK: Z",
"secFunImpl": "Functions"
},
{
"description": "Initiate SSH connectio n for SSH monitorin",
"indicator": "Global Approv ed Mode indicato",
"inputs": "Authenticati on data (Username and password/p",
"name": "Perform approve d security function",
"outputs": "SSH session",
"rolesSspAccess": "Super-user - SSH Private Host Key: E - SSH",
"secFunImpl": "KAS1 KAS2 KTS1 ECDSA SigVer2"
},
{
"description": "g and control (CLI)",
"indicator": "r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "ublic-key based authenticati on)",
"name": "s (SSH connecti on)",
"outputs": "",
"rolesSspAccess": "ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DR BG V value: E - HMAC_DR BG Key value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: G - SSH DH Public Key: G,E,Z - SSH ECDH Public Key: G,E,Z - CO Password: E - CO Authenticati",
"secFunImpl": "DRBG Entropy Source ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen RSA SigVer Password Hash"
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "on Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Root - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DR BG V value: E - HMAC_DR BG Key value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - CO Password: E - CO Authenticati on Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Operator - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DR BG V value: E - HMAC_DR BG entropy input: E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- HMAC_DR BG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticati on Public Keys: E - HMAC_DR BG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Read-only - SSH Private Host Key: E - SSH ECDH",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DR BG V value: E - HMAC_DR BG Key value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticati on Public",
"secFunImpl": "Functions"
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Unauthoris ed - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DR BG V value: E - HMAC_DR BG entropy input: E - HMAC_DR BG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E",
"secFunImpl": ""
},
{
"description": "Descripti on",
"indicator": "Indicat or",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Access - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticati on Public Keys: E - HMAC_DR BG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z",
"secFunImpl": ""
},
{
"description": "Console monitorin g and control (CLI)",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Username, password (set system login user \u003cusername \u003e class \u003ccrypto- officer/user class\u003e operator authenticati on plaintext- password)",
"name": "Console Access",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E Operator - CO Password: E Read-only - User Password: E Unauthoris ed - User Password: E Root - CO Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "Software initiated reset, performs self-tests on demand via SSH or via a command",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Control input/reset signal (request vmhost reboot); via a command (request system fips self-test)",
"name": "Perform self- tests (remote reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DR BG Key value: G,Z - HMAC_DR BG V value: G,Z - HMAC_DR BG entropy input: G,Z - HMAC_DR BG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - SSH Private Host Key: E - SSH",
"secFunImpl": "KAS1 KAS2 KTS1 DRBG Entropy Source ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen Password Hash CASTs on boot"
},
{
"description": "Descripti on",
"indicator": "Indicat",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outputs",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "or",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Public Host Key: E - User Authenticati on Public Keys: E - CO Authenticati on Public Keys: E Root - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DR BG Key value: G,Z - HMAC_DR BG V value: G,Z - HMAC_DR BG entropy input: G,Z - HMAC_DR BG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH DH Public Key: G,E - CO Password: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authenticati on Public Keys: E - CO Authenticati on Public Keys: E",
"secFunImpl": ""
},
{
"description": "Hardware reset or power cycle",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Control input/reset signal",
"name": "Perform self- tests (local reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user Root Operator Read-only Unauthoris ed Unauthentic ated",
"secFunImpl": "CASTs on boot"
},
{
"description": "Verificatio n and loading of a validated firmware image into the router/swi tch",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet",
"inputs": "Image, commands",
"name": "Load Image",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E - JuniperRoo tCA: E - PackageCA : E Root - CO Password:",
"secFunImpl": "ECDSA SigVer Password Hash"
},
{
"description": "",
"indicator": "ion of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "E - JuniperRoo tCA: E - PackageCA : E",
"secFunImpl": ""
},
{
"description": "Initiate MACsec connectio n",
"indicator": "Global Approv ed Mode indicato r \"fips\" at the CLI combin ed with succes sful complet ion of each service",
"inputs": "Commands (set security macsec connectivity -association connectivity - association- name; set security macsec connectivity -association connectivity - association- name pre- shared key)",
"name": "Perform approve d security function s (MACse c connecti on)",
"outputs": "MACsec session",
"rolesSspAccess": "Root - MACsec PSK: W,E - MACsec SAK: G,R,E - MACsec KEK: G,E - MACsec ICK: G,E Super-user - MACsec PSK: W,E - MACsec SAK: G,R,E - MACsec KEK: G,E - MACsec ICK: G,E",
"secFunImpl": "MACsec Encryption/Decr yption KTS2 MACsec Key Derivation"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "* The module enforces 10- character passwords (at minimum) chosen from the 96 human readable ASCII characters; The maximum password length is 20- characters; Thus, the probability of a successful random attempt is 1/(96^10), which is less than 1/1,000,000 (million); * The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0 time to process), no timed access is enforced; Upon the third attempt, the module enforces a 5-second delay; Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g., 4th failed attempt = 10-second delay, 5th failed attempt = 15-second delay, 6th failed attempt = 20- second delay, 7th failed attempt = 25-second delay); This leads to a maximum of 7 possible attempts in a one-minute period for each getty; The best approach for the attacker would be to disconnect after 4 failed attempts and wait for a new getty",
"mechanism": "SHA2-512 (A6550)",
"name": "Username and password over the console and SSH",
"perMinute": "9/(96^10)",
"strength": "1/(96^10)"
},
{
"description": "to be spawned; This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts; The probability of a success with multiple consecutive attempts in a one-minute period is 9/(96^10), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "* The module supports ECDSA (P-256, P-384, and P-521), which has a minimum equivalent computational resistance to attack of either 2^128, 2^192 or 2^256 depending on the curve; Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one-minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^128),",
"mechanism": "ECDSA SigVer (FIPS186-5) (A7286)",
"name": "Username and ECDSA public key over SSH",
"perMinute": "15,000/(2^128)",
"strength": "1/(2^128)"
},
{
"description": "* The module supports RSA (2048, 3072, 4096 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one- minute period to a maximum of 15,000 attempts; The probability of a success with multiple",
"mechanism": "RSA SigVer (FIPS186-5) (A7286)",
"name": "Username and RSA public key over SSH",
"perMinute": "15,000/(2^112)",
"strength": "1/ (2^112)"
},
{
"description": "consecutive attempts in a one- minute period is 15,000/(2^112), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC DRBG (A6620)",
"condition": "During boot",
"details": "N/A",
"indicator": "NIST 800- 90 HMAC DRBG Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Prediction Resistance: Yes Supports Reseed Capabilities: Mode: SHA2-256 Entropy Input: 256 Nonce: 128 Personalizati on String Length: 0-",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "256 Increment 8 Additional Input: 8-256 Increment 8 Returned Bits: 1024",
"type": ""
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A6620)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286)- Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286) - Encrypt - 192 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286) - Encrypt - 256 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286) - Decrypt - 192 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A7286) - Decrypt - 256 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A7286)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA-1 Known Answer",
"testMethod": "KAT",
"testProps": "Key Length: 160 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A7286)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A7286)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-512 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 512 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A7286) - P256",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A7286) - P384",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A7286)",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-FFC- EPHEM- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: MODP-2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A7286)",
"condition": "During boot",
"details": "N/A",
"indicator": "KDF-SSH- SHA2-256 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Cipher: AES- 128, AES- 192, AES- 256 ; Hash Algorithm: SHA-1, SHA2-256, SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS18 6-5) (A7286)",
"condition": "During boot",
"details": "Sign",
"indicator": "RSA-SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS18 6-5) (A7286)",
"condition": "During boot",
"details": "Verify",
"indicator": "RSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS18 6-5) (A7286)",
"condition": "During boot",
"details": "Sign",
"indicator": "ECDSA- SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS18 6-5) (A7286)",
"condition": "During boot",
"details": "Verify",
"indicator": "ECDSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512 (A6550)",
"condition": "During boot",
"details": "N/A",
"indicator": "SHA-2- 512 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Test - RCT",
"condition": "During boot and continually",
"details": "Cutoff value C = 21",
"indicator": "pass",
"testMethod": "RCT",
"testProps": "NIST SP 800-90B Repetitive Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test - APT",
"condition": "During boot and continually",
"details": "W = 512; Cutoff value C = 311",
"indicator": "pass",
"testMethod": "APT",
"testProps": "NIST SP 800-90B Adapative Proportion Test",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS 186-5) - PCT",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement and signature generation/verificat ion in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS- FFC- SSC",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Capabilities: Domain",
"type": "PCT"
},
{
"algorithmOrTest": "Sp800- 56Ar3 (A7286) - PCT",
"condition": "",
"details": "in the context of SSHv2 protocol",
"indicator": "",
"testMethod": "",
"testProps": "Parameter: MODP2048",
"type": ""
},
{
"algorithmOrTest": "RSA KeyGen (FIPS18 6-5) (A7286)",
"condition": "On key generation",
"details": "Key pair generated for signature generation/verificat ion in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Modulus: 2048 Hash SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "AES-KW (A6551) - Encrypt",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- KEYWRA P Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-KW (A6551) - Decrypt",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- KEYWRA P Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800- 108 (A6551)",
"condition": "During boot",
"details": "N/A",
"indicator": "KBKDF Known Answer Test:Pass ed",
"testMethod": "KAT",
"testProps": "Mode: Counter",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM (AES 4545) - Encrypt",
"condition": "During boot",
"details": "Encrypt",
"indicator": "0",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM (AES 4545) - Decrypt",
"condition": "During boot",
"details": "Decrypt",
"indicator": "0",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A6551) - Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES128- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A6551) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES128- CMAC Known Answer",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test: Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES- CMAC (A6551) - Encrypt - 256 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES256- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A6551) - Decrypt - 256 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES256- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "Firmwar e Load Test",
"condition": "On loading of firmware from an external source",
"details": "Verify",
"indicator": "Host OS upgrade staged. Reboot the system to complete installation !",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "Manual entry test (duplicat e entries)",
"condition": "On configurati on of operator passwords and MACsec PSK",
"details": "N/A",
"indicator": "Command prompt with \"fips\" string provided post completion of the test",
"testMethod": "Duplicate entry test required for entry of operator passwor ds and MACsec PSK via direct connecti on to the module\u0027s console (serial) interface",
"testProps": "Duplicate entry test required for entry of operator passwords and MACsec PSK via direct connection to the module\u0027s console (serial) interface",
"type": "Manu al Entry"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "If the pre- operational firmware integrity test or if any of the CASTs fail",
"description": "If the pre-operation firmware integrity test, if any of the CASTs or pair-wise consistency tests fail, then the module returns an error indicator, inhibits all data output and enters the hard error state",
"indicator": "\"FIPS error: self-test failure\" for firmware integrity failure, \"FIPS error 1: \u003cname of the algorithm\u003e Known Answer Test: Failed\" for CAST failure and -1 for pair-wise consistency test failure",
"name": "Hard Error state",
"recoveryMethod": "N/A"
},
{
"conditions": "If the firmware load test fails If the APT or RCT test fails",
"description": "*In case of a firmware load test failure, the module rejects the firmware, returns an error indicator and enters the soft error state *In the event of an APT or RCT health test failure, output from the entropy source is inhibited, all entropy accumulated in the conditioning context is discarded and the start-up",
"indicator": "veriexec: cannot verify \u003cimg_file\u003e.esig: ERROR: Failed loading signature file \u003cpath/to/signature\u003e; entropy data discarded in case of APT/RCT failure",
"name": "Soft Error state",
"recoveryMethod": "N/A for firmware load test failure; In case of APT and/or RCT failures, new data continues to be tested by the health tests, and once both health tests indicate a \"pass\", the entropy source again outputs data"
},
{
"conditions": "",
"description": "health-tests are performed again",
"indicator": "",
"name": "",
"recoveryMethod": ""
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "The module is completely enclosed in a rectangular nickel or clear zinc coated, cold rolled steel, plated steel and brushed aluminum enclosure; The module enclosure is made of production grade materials; There are no ventilation holes, gaps, slits, cracks, slots,"
},
{
"inspectFreq": "",
"inspectGuidance": "",
"mechanism": "or crevices that would allow for any sort of observation of any component contained within the cryptographic boundary"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "\u2022 The operator can verify that the cryptographic module is in the Approved mode by observing the console prompt and running the \u0027show version\u0027 command; \u2022 When operating in the Approved mode, the prompt will read \u0027\u003coperator\u003e:fips#\u0027 (e.g. root:fips#); \u2022 The \u0027show version\u0027 command will allow the Crypto Officer to verify that the validated firmware version is running on the module; \u2022 The Crypto Officer can also use the \u0027show system fips chassis level\u0027 command (returns \u0027level 1\u0027) to determine if the module is op erating in the Approved mode; \u2022 The Approved mode is entered when the module is configured for it and successfully passes all self-tests (both pre-operational and conditional cryptographic algorithm self-tests (CASTs))",
"name": "Approved mode",
"statusIndicator": "global indicator (string \u0027fips\u0027 included in the command prompt)",
"type": "Approved"
},
{
"description": "\u2022 The cryptographic module supports a non - Approved mode of operation; \u2022 When operated in the non-Approved mode of operation, the module supports non-Approved algorithms as well as the algorithms supported in the Approved mode of operation",
"name": "Non- Approved mode",
"statusIndicator": "global indicator (implicit indicator based on exclusion of string \u0027fips\u0027 from the command prompt)",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "no security claimed",
"name": "SHA2-256 (Junos 23.4R2 - LibMD Implementation)",
"use": "Used to store operator passwords in hashed form, per IG 2.4.A: Use of a non-approved cryptographic algorithm to \"obfuscate\" a CSP"
},
{
"caveat": "no security claimed",
"name": "SHA-1 (Junos 23.4R2 - Kernel Implementation)",
"use": "Used for an extraneous check in the Kernel, per IG 2.4.A: Use of an approved, non-approved or proprietary algorithm for a purpose that is not security relevant"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "RSA with key size less than 2048",
"use": "SSH"
},
{
"name": "ECDSA with ed25519 curve",
"use": "SSH"
},
{
"name": "EC Diffie-Hellman with ed25519 curve",
"use": "SSH"
},
{
"name": "ARCFOUR",
"use": "SSH"
},
{
"name": "Blowfish",
"use": "SSH"
},
{
"name": "CAST",
"use": "SSH"
},
{
"name": "DSA (SignGen, SigVer, non-compliant)",
"use": "SSH"
},
{
"name": "HMAC-MD5",
"use": "SSH"
},
{
"name": "HMAC-RIPEMD160",
"use": "SSH"
},
{
"name": "UMAC",
"use": "SSH"
},
{
"name": "TDES",
"use": "SSH"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160",
"description": "Security relevant configuration",
"name": "Configure security (security relevant)",
"role": "Root, Super-user"
},
{
"alg_accessed": "UMAC TDES",
"description": "",
"name": "",
"role": ""
},
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC TDES",
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"name": "Perform approved security functions (SSH connection)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "RJ-45 management port (labeled C1 and C0) (No. of ports: 2)",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (Management Port)"
},
{
"data": "RJ-45 Console Serial Port (No. of ports: 1)",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Serial"
},
{
"data": "USB port, load Junos Image (No. of ports: 1)",
"logicalInterface": "Data Input Control Input",
"physicalPort": "USB"
},
{
"data": "Power supplies, (No. of ports: 2)",
"logicalInterface": "Power",
"physicalPort": "Power"
},
{
"data": "Chassis status LEDs (labeled ALM, SYS, MST, and ID) (No. of LEDs: 4); Power supply LEDs (No. of LEDs: 2); Fan module LEDs (No. of LEDs: 5)",
"logicalInterface": "Status Output",
"physicalPort": "Alarm LEDs"
},
{
"data": "Reset (No. of ports: 1)",
"logicalInterface": "Control Input",
"physicalPort": "Reset Button"
},
{
"data": "10M OUT and PPS OUT ports, (No. of ports: 2)",
"logicalInterface": "Data Input Data Output",
"physicalPort": "10M OUT and PPS OUT ports"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Super-user",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Operator",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Read-only",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Root",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Unauthorised",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Firmware Integrity Test",
"details": "Verify",
"indicator": "\"FIPS Self-tests Passed\"",
"testMethod": "KAT",
"testProps": "Using ECDSA P-256 with SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "NVRAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered over SSH - NVRAM",
"sfiAlgo": "KTS1",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Loaded at manufacture",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered through the CLI via console connection - NVRAM",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint (MACsec peer)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output encrypted with MAcsec KEK",
"sfiAlgo": "KTS2",
"source": "RAM"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input during SSH negotiation",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (host key)",
"sfiAlgo": "",
"source": "NVRAM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (Key Agreement public key)",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Command used to zeroise the module: request vmhost zeroize no-forwarding",
"method": "Zeroisation command",
"operatorId": "Operator initiated",
"rationale": "Used to provide zeroisation as a service"
},
{
"description": "Power cycling the module to zeroise temporary SSPs",
"method": "Power-cycle",
"operatorId": "Operator initiated",
"rationale": "Power cycling the module to zeroise temporary SSPs"
},
{
"description": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session",
"method": "Session termination",
"operatorId": "Module initiated",
"rationale": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session"
},
{
"description": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem",
"method": "Not zeroised",
"operatorId": "N/A",
"rationale": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem"
},
{
"description": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key",
"method": "Derivation of SSH session key",
"operatorId": "Module initiated",
"rationale": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Non-Volatile Random Access Memory",
"name": "NVRAM",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "N/A",
"fwVersion": "Junos OS 23.4R2",
"hwVersion": "QFX5120- 48YM",
"modelPartNum": "QFX5120- 48YM",
"processors": "Intel Xeon D-1627 (Hewitt Lake-DE)"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4",
"reference": "NIST SP800-133r2 Section 4: Symmetric key generation and Asymmetric seed generation using an unmodified output from an Approved DRBG (example 1); The module supports the following per NIST SP 800-133r2: 1. Section 5.1: Key Pairs for Digital Signature Schemes 2. Section 5.2: Key Pairs for Key Establishment 3. Section 6.2.1: Derivation of symmetric keys"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 44
},
"ECDSA": {
"ECDSA": 77
}
},
"FF": {
"DH": {
"DH": 44,
"Diffie-Hellman": 8
},
"DSA": {
"DSA": 3
}
},
"RSA": {
"RSA 2048": 1
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 8
},
"CTR": {
"CTR": 2
},
"GCM": {
"GCM": 5
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"SSH": {
"SSH": 195,
"SSHv2": 9
},
"TLS": {
"TLS": {
"TLS 1.3": 1
}
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 6
},
"MAC": {
"MAC": 11
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 50,
"P-384": 24,
"P-521": 24,
"prime256v1": 2
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1,
"#13": 1,
"#2": 1,
"#4": 1,
"#8": 1
}
},
"fips_certlike": {
"Certlike": {
"AES 4545": 9,
"AES CBC 128, 192": 1,
"AES CTR 128": 1,
"AES- 128": 1,
"AES- 192": 1,
"AES- 256": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"AES256": 1,
"HMAC- SHA-1": 2,
"HMAC-SHA-1": 6,
"PKCS #1": 2,
"RSA 2048": 1,
"RSA2": 1,
"SHA-1": 10,
"SHA-2- 512": 1,
"SHA2- 256": 2,
"SHA2- 384": 1,
"SHA2- 512": 2,
"SHA2-256": 26,
"SHA2-384": 3,
"SHA2-512": 14
}
},
"fips_security_level": {
"Level": {
"Level 1": 4,
"Level 3": 1,
"level 1": 7
}
},
"hash_function": {
"RIPEMD": {
"RIPEMD160": 2
},
"SHA": {
"SHA1": {
"SHA-1": 10
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 27
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 18,
"FIPS 180-4": 6,
"FIPS 186-5": 12,
"FIPS 198-1": 4,
"FIPS18": 5,
"FIPS186-5": 14
},
"NIST": {
"NIST SP 800-108": 3,
"NIST SP 800-90B": 2,
"SP 800-108": 5,
"SP 800-135": 2,
"SP 800-38A": 3,
"SP 800-38B": 1,
"SP 800-38D": 4,
"SP 800-38F": 1,
"SP 800-56A": 4,
"SP 800-56C": 1,
"SP 800-90A": 2
},
"PKCS": {
"PKCS #1": 1
},
"X509": {
"X.509": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 20,
"AES-": 19,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"AES256": 1
},
"CAST": {
"CAST": 67
}
},
"DES": {
"3DES": {
"TDES": 3
}
},
"constructions": {
"MAC": {
"CMAC": 9,
"HMAC": 24
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 20
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"AES-CMACA6551",
"SHA2-256A7286",
"Safe Primes Key VerificationA7286",
"KAS-FFC-SSC Sp800-56Ar3A7286",
"HMAC DRBGA6620",
"AES-CTRA7286",
"SHA-1A7286",
"Safe Primes Key GenerationA7286",
"KAS-ECC-SSC Sp800-56Ar3A7286",
"KDF SP800-108A6551",
"RSA KeyGen (FIPS186-5)A7286",
"AES-CBCA7286",
"HMAC-SHA2-512A7286",
"ECDSA KeyGen (FIPS186-4)A7286",
"AES-GCMAES 4545",
"ECDSA SigGen (FIPS186-4)A7286",
"HMAC-SHA-1A7286",
"ECDSA SigVer (FIPS186-4)A7286",
"AES-XPNAES 4545",
"KDF SSHA7286",
"RSA SigVer (FIPS186-5)A7286",
"ECDSA KeyVer (FIPS186-4)A7286",
"RSA SigGen (FIPS186-5)A7286",
"AES-KWA6551",
"HMAC-SHA2-256A7286",
"SHA2-512A7286"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A6551",
"#A7286",
"#A6620",
"#A6550"
]
},
"policy_metadata": {
"/CreationDate": "D:20260817092520-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260817092520-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 826863,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program",
"http://www.juniper.net/support/downloads/junos.html",
"https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/entropy/E215_PublicUse.pdf"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 70
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "da573a71d487d81fd30bfa48918efb9710766a6e1b2969f4761e6f10830350fa",
"source_hash": "42ba49fd5579dc510ee10f6259fd37b51f7dd99076e48cf57eed6c66c7be3042",
"txt_hash": "c741b51cbe148a2e4b1ae43a57fbca008a85c235a920ad34c5037c86b5eb2bd4"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/September 2026_071026_0710.pdf",
"date_sunset": "2031-08-31",
"description": "The HPE Juniper Networking QFX5120 Switch delivers high scale, high availability, and high performance for data center and campus deployments. The QFX5120 Switch is a versatile routing and switching platform addressing higher server access speed and campus distribution use cases while offering high-density 1GbE/10GbE/25GbE and 100GbE uplinks for collapsed spine data center or campus distribution deployments. The QFX5120-48YM is a 10GbE/25GbE/100GbE data center leaf and campus distribution switch.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "HPE Juniper Networking QFX5120-48YM",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-09-01",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "HPE Juniper Networking",
"vendor_url": "http://www.juniper.net"
}
}