Thales e-Security, Inc 2200 North Commerce Parkway, Suite 200, Weston, FL 33326, USA
TEL: + 1-888-744-4976
FAX: + 1-954-888-6211
http://iss.thalesgroup.com
F
FI
IP
PS
S 1
14
40
0-
-2
2 L
Le
ev
ve
el
l 3
3 S
Se
ec
cu
ur
ri
it
ty
y P
Po
ol
li
ic
cy
y
F
Fi
ir
rm
mw
wa
ar
re
e V
Ve
er
rs
si
io
on
n v
v5
5.
.0
0,
, v
v5
5.
.1
1 (
(w
wi
it
th
h P
Po
oi
in
nt
t-
-t
to
o-
-P
Po
oi
in
nt
t l
li
ic
ce
en
ns
se
e)
)
H
Ha
ar
rd
dw
wa
ar
re
e V
Ve
er
rs
si
io
on
ns
s 1
16
60
00
0X
X4
43
39
9,
, R
Re
ev
v.
. 0
01
1,
, 1
16
60
00
0x
x4
43
39
9,
, R
Re
ev
v.
. 0
02
2
D
Da
at
ta
ac
cr
ry
yp
pt
to
or
r®
® 1
10
00
0M
M E
Et
th
he
er
rn
ne
et
t
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 2 OF 25 25 SEPT 2017
CONTENTS
1. INTRODUCTION ....................................................................................................................4
2. IDENTIFICATION AND AUTHENTICATION POLICY ........................................................... 11
2.1 Crypto-Officer Role ........................................................................................................ 11
2.2 User Role.......................................................................................................................11
2.3 Authentication................................................................................................................12
3. ACCESS CONTROL POLICY............................................................................................... 13
3.1 Roles and Services........................................................................................................ 13
3.2 Cryptographic Keys, CSPs and Access Rights .............................................................. 15
3.3 Zeroisation.....................................................................................................................18
3.4 Other Security-Relevant Information .............................................................................. 18
4. PHYSICAL SECURITY POLICY ........................................................................................... 20
4.1 Inspection/Testing of Physical Security Mechanisms ..................................................... 20
4.1.1 1600X439, Rev. 01 Hardware.......................................................................... 20
4.1.2 1600X439, Rev. 02 Hardware.......................................................................... 22
5. MITIGATION OF OTHER ATTACKS POLICY....................................................................... 23
ACRONYMS AND ABBREVIATIONS .......................................................................................... 24
REFERENCES ............................................................................................................................25
Tables
Table 1-1 FIPS Security Level........................................................................................................5
Table 1-2 Physical Ports and Status Indicators ..............................................................................7
Table 1-3 Physical Port to Logical Port Mapping ............................................................................ 7
Table 1-4 Power-Up Tests .............................................................................................................9
Table 1-5 Conditional Tests ......................................................................................................... 10
Table 2-1 Roles and Required Identification and Authentication.................................................. 12
Table 2-2 Strengths of Authentication Mechanisms..................................................................... 12
Table 3-1 Services Authorized for Crypto Officer ......................................................................... 13
Table 3-2 Services Authorized for User........................................................................................ 14
Table 3-3 Unauthenticated Services ............................................................................................ 15
Table 3-4 Cryptographic Keys and CSPs.................................................................................... 15
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 3 OF 25 25 SEPT 2017
Figures
Figure 1-1 Datacryptor® Ethernet Crypto Module Example Point to Point Network Configuration.. 6
Figure 4-1 1600X439, Rev. 01 Front ............................................................................................ 20
Figure 4-2 1600X439, Rev. 01 AC and DC Rear.......................................................................... 21
Figure 4-3 1600x439, Rev. 01 Top............................................................................................... 21
Figure 4-4 1600X439, Rev. 02 Front ............................................................................................ 22
Figure 4-5 1600X439, Rev. 02 AC and DC Rear.......................................................................... 22
Figure 4-6 1600x439, Rev. 02 Top............................................................................................... 22
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 4 OF 25 25 SEPT 2017
1. INTRODUCTION
Thales e-Security is a global leader in the network security market with over 60,000 network
security devices in operation, being one of the first companies to introduce a link encryption
product to the market in the early 1980s.
The Datacryptor® family represents Thales’ next generation of network security devices for a wide
variety of communications environments. It is the culmination of 20 years experience protecting
wide-area and point-to-point network communications for governments, financial institutions and
information-critical industries worldwide.
This document is the Security Policy1
for the Thales e-Security Datacryptor® 100M Ethernet,
conforming to the FIPS140-2 Security Policy Requirements [1]. This Security Policy applies to the
Datacryptor® 100M Ethernet when operated in Point-to-Point mode with the corresponding
license.
Further information on the Datacryptor® family and the functionality provided by the Datacryptor®
100M Ethernet is available from the Thales web site: http://iss.thalesgroup.com.
This document is updated to reflect the version 5.0 and 5.1 of the firmware which supports the
Point to Point (PP) licensed mode.
Firmware version 5.1 adds support for Automatic Peer Discovery mode when operating in Point to
Point (PP) licensed mode.
Overview
The Datacryptor® 100M Ethernet is a multi-chip standalone cryptographic module which facilitates
secure data transmission across Ethernet networks at 100Mb/s.
Operating at primarily at OSI Layer 2, the Data Link Layer of the protocol stack the Datacryptor®
100M Ethernet is targeted at high speed/high data throughput applications between
telecommunication facilities introducing virtually no overhead or latency to the network. Unlike
Layer 3 IP security devices (IPSEC) the Datacryptor® 100M Ethernet is independent of network
configurations resulting in a solution that is simple and inexpensive to manage.
As a solution for high-speed/high-bandwidth data transport over LANs and WANs, the
Datacryptor® 100M Ethernet enables customers to take advantage of the most cost effective
transport services available while ensuring the confidentiality of the information carried through
these connections.
The Datacryptor® 100M Ethernet is designed to easily fit into a variety of network configurations
supporting multiple modes of operation including bulk, tunnel and Virtual LAN (VLAN).
The Datacryptor® 100M Ethernet comprises a 1’U’ 19 inch rack-mountable tamper-proof metal
enclosure with internal AC and DC power options. With the exception of the mains power
connection, all interfaces are located in the front panel for easy access. In addition to RJ-45 Host
and Network interfaces, dual serial and Ethernet management connections are provided along
with Light Emitting Diode (LEDs) status indicators.
1 This document is non-proprietary and may be reproduced freely in its entirety but not modified or used for
purposes other than that intended.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 5 OF 25 25 SEPT 2017
Figure 1-1 shows a typical Datacryptor® 100M Ethernet configuration where 2 LANs are securely
linked across a public domain Ethernet.
FIPS Security Level
The Datacryptor® 100M Ethernet meets the overall requirements for FIPS 140-2 level 3. Table 1-1
shows the breakdown for each FIPS 140-2 section.
Table 1-1 FIPS Security Level
FIPS 140-2 Section Level
Cryptographic Module Specification 3
Cryptographic Module Ports and Interfaces 3
Roles, Services, and Authentication 3
Finite State Model 3
Physical Security 3
Operational Environment 3
Cryptographic Key Management 3
EMI/EMC 3
Self-Tests 3
Design Assurance 3
Mitigation of Other Attacks N/a
Modes of Operation
The Datacryptor® 100M Ethernet is not configured to run in FIPS Approved mode by default. To
configure FIPS Approved mode (which includes cryptographic services and bypass services) the
user must disable SNMP via the Element Manager. Once configured in this way (with SNMP
disabled), the module will only run in the FIPS Approved mode. The module does not support a
non-Approved mode or service.
The modes of operation are detailed below:
• Standby Mode The module transmits/receives no data via either its Host or Network
interfaces on that channel. This mode is automatically entered if the
module detects an error state or at start-up. In Multipoint Mode the
unit is in Standby if it has no valid keys or it is configured into a block
encryption mode. This mode is indicated by the flashing green
Encrypt LED.
• Plain Text Mode2
All data received through the Host interface on that channel is
transmitted through the Network interface as plain text. Similarly, all
2 This is the bypass mode.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 6 OF 25 25 SEPT 2017
data received through the Network interface on that channel is
transmitted through the Host interface with no decryption applied.
This mode should only be used for diagnostic purposes, or if there is
no security risk to the data if it is transferred unencrypted. This mode
is indicated by the solid red Plain LED. The module does not support
an alternating plaintext mode.
• Encrypt Mode All data received through the Host interface on that channel is
encrypted using the transmit Data Encryption Key (DEK) and then
the encrypted data is transmitted through the Network interface.
Similarly, all data received through the Network interface on that
channel is decrypted using the receive DEK and then the decrypted
data is transmitted through the Host interface. This mode is indicated
by the solid green Encrypt LED.
The mode of operation is selectable by the Crypto Officer using the Secure Remote
Management facility and the current mode of operation is displayed using both the Front Panel
LEDs and the Secure Remote Management (Element Manager PC) facility. Refer to the User
Manual [3] for further details.
Figure 1-1 Datacryptor® Ethernet Crypto Module Example Point to Point Network Configuration
Physical Ports
The Datacryptor® 100M Ethernet uses 100BASE-T ports for user traffic and 10/100BASE-T ports
for management traffic.
The physical ports are described below in Table 1-2 Physical Ports and Status Indicators:
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 7 OF 25 25 SEPT 2017
Table 1-2 Physical Ports and Status Indicators
Port Description
Network Connects to the public network for sending and receiving encrypted
user data and inter-module key exchange data.
Host Connects to the private network for sending and receiving plaintext
user data.
RS-232 Connects to a local terminal for initialization of the module and also
allows remote management from the Element Manager application
utilizing the Point-to-Point (PPP) protocol.
Ethernet Allows the remote management of a unit using the Element Manager
application.
Front Panel LEDs Indicates the operational state of the unit, including Alarm state,
Error state, Plain or Encrypt mode and Host and Network line status.
Line Interface LEDs Indicates module present and laser input detected.
Power Power interface supporting customer options of AC or DC and
international power cord standards.
The physical ports are mapped to four logical ports defined by FIPS 140-2 as described below in
Table 1-3 Physical Port to Logical Port Mapping:
Table 1-3 Physical Port to Logical Port Mapping
Logical Interface Description and Mapping to Physical Port
Data Input Host Line Interface
Network Line Interface
Data Output Host Line Interface
Network Line Interface
Control RS-232 Interface
Ethernet Interface
Status RS-232 Interface
Ethernet Interface
Front Panel LEDs
Line Interface LEDs
User Data Security
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 8 OF 25 25 SEPT 2017
The communications channel between two Datacryptor® 100M Ethernets is assumed to be
vulnerable and therefore the Datacryptor® 100M Ethernet encrypts the entire user data stream3
.
The Datacryptor® 100M Ethernet uses public key cryptography for authentication and key
agreement4
. Symmetric key cryptographic is used for data confidentiality. The authentication
mechanism employs signed X.509 v3 certificates using the Elliptic Curve Digital Signature
Algorithm (ECDSA) for signature verification. The Elliptic Curve Diffie-Hellman protocol is used to
establish a Key Encryption Key (KEK) between modules. Data Encryption Keys (DEKs), used for
encrypting and decrypting data traffic, are derived from the KEK.
Random Number Generation
This consists of a non-deterministic random number source which provides entropy to a NIST
SP800-90A Section 10.1 [2] approved deterministic random bit generator (DRBG).
Establishment of the module’s generated private and secret keys (Elliptic Curve Diffie-Hellman
static/ephemeral and Data Encryption Keys) uses the above random bit generation mechanism.
Algorithm Support
The Datacryptor® 100M Ethernet contains the following algorithms:
• AES-256 for data encryption
• ECDSA using the P-384 curve for signature verification
• SHA-384 hashing algorithm
• ECDH using the P-384 curve for key agreement
SNMP must be disabled during configuration to be a FIPS 140-2 compliant module.
Physical Security
The multi-chip standalone embodiment of the circuitry within the Datacryptor® 100M Ethernet is
contained within a strong metal production-grade enclosure that is opaque within the visible
spectrum to meet the requirements of FIPS 140-2 Level 3. The enclosure completely covers the
module to restrict unauthorized physical access to the module. The physical security includes
measures to provide tamper evidence, tamper detection and response. In the case of tamper
response all sensitive information stored within the module is zeroised.
The Datacryptor® 100M Ethernet’s cryptographic boundary (FIPS 140-2 [1], section 2.1) is the
physical extent of its enclosure.
Secure Remote Management
3 Providing the module is configured to operate in Encrypt mode.
4 This key agreement method provides 192-bits of encryption strength.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 9 OF 25 25 SEPT 2017
The Datacryptor® 100M Ethernet may be remotely and securely managed using the Element
Manager.
Diagnostics
A variety of diagnostics are available to maintain secure operation. These diagnostics include
cryptographic mechanisms, critical functions and environmental monitoring. In addition the module
supports a local loop-back mode to aid in diagnosing network connectivity. Log files are
maintained in the Datacryptor® 100M Ethernet and can be viewed or printed.
If the Datacryptor® 100M Ethernet is faulty, as indicated by the failure of a self-test diagnostic, it
will render itself inoperable until the fault is rectified.
• Power-Up Tests On power-up Known Answer Tests (KAT) are performed on all
cryptographic algorithms and the deterministic random bit generator. In addition the
integrity of all firmware is checked.
Table 1-4 Power-Up Tests
Function Checked Description
ECDSA (CA Algorithm) KAT Test
AES-256-S/W (KEK Algorithm) KAT Test
AES-256 –H/W (traffic
Encrypt/Decrypt Algorithm )
KAT Test
Primitive “Z” Computation KAT Test
SHA-384 KAT Test
Deterministic Random Bit Generator KAT Test
Firmware Integrity 16 bit Error Detection Code (EDC)
Checksum
• Conditional Tests
• The output of both the non-deterministic random number generator and the
deterministic random bit generator are checked whenever random data is requested by
the module. Subsequent random numbers are compared against the last generated
value to verify that these values are not the same.
• The module performs periodic health tests on the instantiate, generate, reseed and
uninstantiate functions of the deterministic random bit generator. The tests performed
are known answer tests (KATs) designed to ensure the deterministic random bit
generator is functioning as expected.
• The module also performs a bypass test before entering an encrypted channel mode.
When switching from a plain to an encrypted channel mode, the module issues an
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 10 OF 25 25 SEPT 2017
encrypted challenge to its peer using the Data Encryption Key (DEK). The challenge is
then decrypted by the peer using its DEK, and if verified, an encrypted response is
returned to the module (using the DEK). The response is decrypted by the module
(using the DEK) and verified. If successful the channel is established as being in an
encrypted state with matching DEKs in each module.
• In the case of a firmware upgrade, this is digitally signed by a CA using ECDSA with
the P-384 curve allowing the module to verify the image so preventing unauthorized
firmware upgrades. After loading firmware onto this module it may no longer be a FIPS
140-2 validated module unless the firmware has been FIPS 140-2 validated. This
feature is used as an upgrade path for future FIPS 140-2 approved modules.
• The module performs a public key validation routine during ECDH and ECDSA
operations which check all the arithmetic properties of the specified ECC public key.
• The module performs a pair-wise consistency test on the modules own ECDSA key
pair that the module generates. This key pair is used to generate and verify digital
signatures so the pair-wise consistency test consists of the generation and verification
of a digital signature.
Table 1-5 Conditional Tests
Function Checked Description
Non-deterministic RNG CRNG
Deterministic Random Bit Generator CRNG
Deterministic Random Bit Generator Health Tests
Bypass Bypass Test
Firmware Upgrade Authentication Verify (ECDSA)
Public Key Validation ECDH and ECDSA
Pair-wise Consistency Test Sign / Verify
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 11 OF 25 25 SEPT 2017
2. IDENTIFICATION AND AUTHENTICATION POLICY
The two roles associated with the Datacryptor® 100M Ethernet are:
Crypto-Officer Commissioning and configuration of the Datacryptor® 100M Ethernet.
User This role occurs when two Datacryptor® 100M Ethernets are communicating
with each other.
The Datacryptor® 100M Ethernet does not support multiple concurrent roles.
2.1 Crypto-Officer Role
The Datacryptor® 100M Ethernet can be managed by the Crypto-Officer using the Element
Manager. This PC-based software application enables a Crypto-Officer to commission and
administer the module via the dedicated Ethernet or serial management port.
Commissioning a module installs a X.509 certificate (containing the CA public key, certificate
name, unit serial number and certificate life time) and the required Elliptic Curve Diffie-Hellman
parameters to allow the Datacryptor® 100M Ethernet to generate a corresponding Elliptic Curve
Diffie-Hellman key set. This information is digitally signed allowing the unit to authenticate the
certificate’s signature using the issuing CA Public key held within the module. The module must be
commissioned before it may be administered.
When administering the module the Element Manager establishes a secure connection
(connection authentication and data confidentiality) to the module. This connection is established
and protected in the same manner as a module to module connection. To establish the secure
connection the Crypto-Officer uses a removable media key-material set containing the Crypto-
Officer’s name and access rights, Elliptic Curve Diffie-Hellman key set and own certificate. To
access the key-material set the Crypto-Officer must login to the Element Manager by presenting
the key-material set and the Crypto-Officer’s own password of at least 8 ASCII printable
characters. This allows the Element Manager to verify the identity of a Crypto-Officer before
establishing a secure connection using the key material set.
2.2 User Role
The Crypto-Officer can download one or more signed X.509 User Certificates to the Datacryptor®
100M Ethernet. Each User Certificate gives a Datacryptor® 100M Ethernet an identity.
Identity-based authentication is implemented between two or more communicating Datacryptor®
100M Ethernets. The modules are then operating in the User role. This identity can be
authenticated to another module which verifies the User Certificate’s signature using the issuing
CA Public key held within the module.
If the issuing CA Public key is not held within the authenticating module then verification cannot be
undertaken. Therefore no communications channel can be established between the two
Datacryptor® 100M Ethernets.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 12 OF 25 25 SEPT 2017
2.3 Authentication
The types and strengths of authentication for each Role identified for the Datacryptor® 100M
Ethernet are given in Table 2-1 and Table 2-2 below.
Table 2-1 Roles and Required Identification and Authentication
Role Type of Authentication Authentication Data
Crypto-Officer Identity based Signed X.509 Digital Certificate
User Identity based Signed X.509 Digital Certificate
The identity of each entity performing a role that requires authentication is held within the X.509
Digital Certificate allowing the identity and authorization of the operator to be validated by
checking the signature (ECDSA) of the certificate.
Table 2-2 Strengths of Authentication Mechanisms
Authentication
Mechanism
Strength of Mechanism
Signed X.509
Digital Certificate
The strength depends upon the size of the private key space. The
Datacryptor® 100M Ethernet uses ECDSA with the P-384 curve, which is a
FIPS Approved algorithm. Therefore the probability of successfully guessing the
private key (384 bits), and hence correctly signing an X.509 certificate, is
significantly less than one in 1,000,000 (2384
).
Multiple attempts to use the authentication mechanism during a one-minute
period do not constitute a threat for secure operation of the Datacryptor® 100M
Ethernet. This is because each attempt requires the Datacryptor® 100M
Ethernet to check the signature on the certificate that is to be loaded. Therefore
the total number of attempts that can be made in a one-minute period will be
limited by the Datacryptor® 100M Ethernet signature verification and response
operation, which takes on average approximately 30 seconds. The majority of
this time is accounted for by the communications overheads since the signature
checking operation within the module is relatively fast.
Given the very large size (384 bits) of the private key space used by the FIPS
Approved signature algorithm (ECDSA) loaded in the Datacryptor® 100M
Ethernet it follows that the probability that an intruder will be able to guess the
private key, and thereby gain authentication, by making multiple attempts is
significantly less than one in 100,000 (2384/2
).
There is no feedback of authentication data to the Crypto-Officer or User that
might serve to weaken the authentication mechanism.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 13 OF 25 25 SEPT 2017
3. ACCESS CONTROL POLICY
3.1 Roles and Services
Tables 3-1, 3-2 and 3-3 list the authorized services available for each role within the Datacryptor®
100M Ethernet. All services within tables 3-1 and 3-2 require authentication to the module.
For further details of each operation refer to the Datacryptor® 100M Ethernet User Guide [3].
Table 3-1 Services Authorized for Crypto Officer
Service Description Input Output Access
Access module Login/logout of the
module
password, crypto
officer public
key, crypto
officer certificate
Command
response
Own Module ECDH Static Key
Pair – read,
Own Module ECDH Ephemeral
Key Pair – read,
Peer Module Public Key – read
CA Public Key – read,
MKEK – read/write,
MDEK – read/write,
MDEKDD – read/write,
Entropy Input String –
read/write,
Seed – read/write,
C Value – read/write,
V Value – read/write.
Manage Key Material Loads module’s key
material, deletes
module’s key material
module public
key, module
certificate
Command
response
CA Public Key – read/write,
Own Module ECDH Static Key
Pair – read/write,
MDEK – read.
General Configuration Display/edit module’s
name, description, time
and interface settings.
Commands and
parameters
Command
response
MDEK – read.
Diagnostics Reboot or erase key
material. Configure
loopback mode
Commands and
parameters
Command
response
Master Key – write (delete),
MDEK – read.
IP Management Display/edit module’s
ports, Ethernet and
serial, configuration.
Commands and
parameters
Command
response
MDEK – read.
IP Routes Display/edit IP routing
information
Commands and
parameters
Command
response
MDEK – read.
Security Display/edit key
lifetimes, and general
key exchange
parameters
Commands and
parameters
Command
response;
key
exchange if
forced.
Own Module ECDH Static
Key Pair – read,
Own Module ECDH Ephemeral
Key Pair – read,
Peer Module Public Key – read
CA Public Key – read,
KEK – read/write,
DEK – write,
DEKDD – write,
Entropy Input String –
read/write,
Seed – read/write,
C Value – read/write,
V Value – read/write,
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 14 OF 25 25 SEPT 2017
Service Description Input Output Access
MDEK – read.
RIP Display/edit RIP version
and RIP password
Commands and
parameters
Command
response
MDEK – read.
Communications Display/edit Ethernet
mode (bulk, tunneling),
interface mode
Commands and
parameters
Command
response
MDEK – read.
Encryption Display current
connection mode - one
of standby, plain or
encrypt and ping the
connected unit.
Commands and
parameters
Command
response,
ping packet
to
connected
peer.
MDEK – read.
Tunneling Display own MAC
address, display/edit
peer MAC address,
filter rules, VLAN
identification and
fragmentation size.
Commands and
parameters
Command
response
MDEK – read.
Environment Display fan speed, and
module temperature.
Commands and
parameters
Command
response.
MDEK – read.
License Display/edit currently
loaded license file for
the Datacryptor
module.
License file Command
response
MDEK – read.
Plaintext Enable module to
perform bypass.
Commands and
parameters.
Bypass test
pass or fail
indicated by
Front Panel
Status LEDs
MDEK – read.
Automatic Peer
Detection
Enable module to
perform automatic peer
detection.
Commands and
parameters
Command
Response
MDEK – read.
Firmware Upgrade Upgrades the firmware
on the module.
Signed firmware
file
Command
response
Thales e-Security Firmware
Upgrade Public Key – read,
MDEK – read.
Table 3-2 Services Authorized for User
Service Description Input Output Accessed
Encrypt Encrypt data received
from the Host interface
and transmit on the
Network interface.
User traffic
(plain)
User traffic
(encrypted)
DEK – read
Decrypt Decrypt data received
from the Network
interface and transmit
on the Host interface.
User traffic
(encrypted)
User traffic
(plain)
DEK - read
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 15 OF 25 25 SEPT 2017
Table 3-3 Unauthenticated Services
Service Description Input Output Accessed
Show Status via LEDs View status of the
module.
None Front Panel
LEDs Status
Indicators
None
Operator Callable Self
Tests via Reboot
Module performs self-
test
Reboot Module Front Panel
LEDs Status
Indicators
None
3.2 Cryptographic Keys, CSPs and Access Rights
The cryptographic keys and CSPs stored in the Datacryptor® 100M Ethernet module are listed in
Table 3-4.
All private and secret keys (Elliptic Curve Diffie-Hellman, KEKs and DEKs) are generated
internally in the module and may not be either loaded or read by the Crypto Officer or User.
Table 3-4 Cryptographic Keys and CSPs
Keys/CSPs Description Key/CSP
Type
and Size
Generated/
Established
Stored Zeroised
Master Key Encrypts all non-volatile
Keys and CSPs stored on
the module
AES
(256 bits)
Generated at start-up
if not present using
the module’s non-
deterministic random
number generator
and an approved
DRBG (cert #188).
SRAM
battery
Backed
(plaintext)
Upon tamper
detect or by user
initiated erasure
of key material.
CA Public Key The public key of the CA
key pair use to verify
subsequent key material
loaded into the module.
ECDSA
(384 bits)
Generated external
and loaded as part of
the commissioning
process.
Non-volatile
memory –
Compact
Flash
(encrypted)
Upon tamper
detect or by user
initiated erasure
of key material.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 16 OF 25 25 SEPT 2017
Keys/CSPs Description Key/CSP
Type
and Size
Generated/
Established
Stored Zeroised
Own Module
Certificate/Elliptic
Curve Diffie-
Hellman Static Key
Pair
An X.509 certificate
containing the module
name, Elliptic Curve Diffie-
Hellman static public key
(the static private key is
stored separately) and
associated parameters.
This key pair is used during
the establishment of the
KEK and the Management
KEK.
ECDH
(384 bits)
The Elliptic Curve
Diffie-Hellman static
key pair is generated
locally by the module,
using the module’s
non-deterministic
random number
generator and an
approved DRBG (cert
#188) from the
parameters supplied
during the
commissioning
process. The module
name and Elliptic
Curve Diffie-Hellman
static public key is
then exported to be
signed by issuing CA
so forming the
module certificate.
Own Module
Certificate
Non-volatile
memory –
Compact
Flash
(encrypted)
ECDH static
private key
– Non-
volatile
memory –
FRAM
(encrypted)
Upon tamper
detect or by user
initiated erasure
of key material.
Elliptic Curve
Diffie-Hellman
Ephemeral Key
Pair
The Elliptic Curve Diffie-
Hellman ephemeral key
pair.
ECDH
(384 bits)
The Elliptic Curve
Diffie-Hellman
ephemeral key pair is
generated locally by
the module, using the
module’s non-
deterministic random
number generator
and an approved
DRBG (cert #188)
from the parameters
supplied during the
commissioning
process. This key pair
is used in conjunction
with the static key pair
to establish the KEK.
Volatile
memory -
SRAM
(encrypted)
Upon tamper
detect or by user
initiated erasure
of key material.
Peer Module
Certificate/ Elliptic
Curve Diffie-
Hellman Static
Public Key
Received during link
establishment between two
modules to allow
authentication of the peer
module using signature
verification (ECDSA).
ECDH
(384 bits)
Generated by peer in
the same manner as
Own Module
Certificate.
Non-Volatile
memory –
Compact
Flash
(encrypted)
Upon tamper
detect or by user
initiated erasure
of key material.
Data Encryption
Keys (DEKs)
A pair of keys (one for
transmit and one for
receive) used for
encryption and decryption
of line data.
AES
(256 bits)
Generated during link
establishment using
AES (KEK), DEKDD
and CMAC KDF
operations.
Volatile
memory –
BRAM &
FRAM
(encrypted)
(up to three
stored with
CRC
integrity
Upon tamper
detect or by user
initiated erasure
of key material.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 17 OF 25 25 SEPT 2017
Keys/CSPs Description Key/CSP
Type
and Size
Generated/
Established
Stored Zeroised
protection)
Data Encryption
Key Derivation
Data/Nonce
(DEKDD)
Random data used to
derive data encryption keys
in conjunction with KEK
256 bits Generated during
DEK derivation using
the module’s non-
deterministic random
number generator
and an approved
DRBG (cert #188).
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Key Encryption
Key (KEK)
Key used to derive data
encryption keys in
conjunction with DEKDD
AES
(256 bits)
Established during
link establishment
with Elliptic Curve
Diffie-Hellman using
the static and
ephemeral key pairs.
Volatile
memory –
BRAM
(encrypted)
Upon tamper
detect or by user
initiated erasure
of key material.
Management Key
Encryption Key
(MKEK)
Key used to derive
management data
encryption keys in
conjunction with MDEKDD
AES
(256 bits)
Established during
management link
establishment with
Elliptic Curve Diffie-
Hellman using the
static and ephemeral
key pairs.
Not Stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Management Data
Encryption Key
(MDEK)
A pair of keys (one for
transmit and one for
receive) used for
encryption and decryption
of management line data.
AES
(256 bits)
Generated during
management link
establishment using
AES (MKEK),
MDEKDD and CMAC
KDF operations.
Not Stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Management Data
Encryption Key
Derivation
Data/Nonce
(MDEKDD)
Random data used to
derive management data
encryption keys in
conjunction with MKEK.
256 bits Generated during
MDEK derivation
using the module’s
non-deterministic
random number
generator and an
approved DRBG (cert
# 188).
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Entropy Input
String
Entropy input into the
approved DRBG during
instantiation
Entropy
(256 bits)
Generated via
internal non-
deterministic RNG
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Seed Used by the approved
DRBG
Seed
(888 bits)
Generated during the
instantiation and
reseed functions of
the DRBG
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 18 OF 25 25 SEPT 2017
Keys/CSPs Description Key/CSP
Type
and Size
Generated/
Established
Stored Zeroised
erased upon the
tamper
response/restart
process.
C Value Internal state value of the
approved DRBG
C Value
(888 bits)
Generated as part of
the internal state of
the DRBG.
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
V Value Internal state value of the
approved DRBG
V Value
(888 bits)
Generated as part of
the internal state of
the DRBG.
Not stored. Not zeroised
directly. The
memory that
holds this CSP is
erased upon the
tamper
response/restart
process.
Thales e-Security
Firmware Upgrade
Public Key
A public key embedded
within the firmware which is
used to verify the integrity
of the firmware during
firmware upgrade.
ECDSA
(384 bits)
Generated externally
and embedded within
the firmware.
Embedded
in the
firmware –
Compact
Flash.
Not zeroised.
3.3 Zeroisation
The Crypto Officer can zeroise keys through the Element Manager application. As indicated in the
table above, the Crypto Officer has the choice to directly delete keys, establish a new link with
another peer module or force the module to generate new keys. Keys that are not zeroised are
encrypted by the master key. The module zeroises the master key when the tamper response and
zeroisation circuitry responds to an intrusion of the enclosure which renders all other keys
indecipherable.
3.4 Other Security-Relevant Information
FIPS Approved Mode of Operation
The Datacryptor® 100M Ethernet operates in a FIPS Approved mode once SNMP is disabled
during configuration.
1. FIPS 140-2 Approved and Certified
• AES #2014 (AES-256, PowerPC Core 405)
• AES #2030 (CMAC using AES-256, Generation only)
• AES #2062 (AES-256, Xilinx XC4VFX40 FPGA)
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 19 OF 25 25 SEPT 2017
• ECDSA #289 (Application)
• ECDSA #304 (Bootstrap)
• Key Agreement Scheme #34 (ECDH, key agreement; key establishment
methodology provides 192 bits of encryption strength)
• NIST SP800-90A DRBG #188
• NIST SP800-108 KDF #1 (Counter Mode)
• SHS #1764 (SHA-384, Application)
• SHS #1808 (SHA-384, Bootstrap)
2. Non-Approved Allowed
• Non-deterministic RNG for generating entropy for approved and certified DRBG
Datacryptor® 100M Ethernet FPGA Details
The Datacryptor® 100M Ethernet cryptographic module utilizes a Xilinx Virtex 4 XC4FX40 FPGA.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 20 OF 25 25 SEPT 2017
4. PHYSICAL SECURITY POLICY
The Datacryptor® 100M Ethernet is a multiple-chip standalone cryptographic module consisting of
production-grade components to meet FIPS 140-2 Level 3.
The Datacryptor® 100M Ethernet is protected by a strong metal production-grade enclosure that is
opaque within the visible spectrum with tamper evident labels (highlighted in red) and tamper
response mechanisms. Attempts to access the module without removing the cover will cause
visible physical damage to the module and/or tamper evident labels.
The module’s ventilation holes on the sides and back on the enclosure are fitted with baffles to
prevent physical probing of the enclosure.
The module has a removable top cover which is protected by tamper response circuitry, which
zeroises all plaintext CSPs. Access to the internal components of the module requires that these
covers are removed.
The module's cryptographic boundary (FIPS 140-2 [1], section 2.1) is the physical extent of its
external casing.
4.1 Inspection/Testing of Physical Security Mechanisms
The following guidelines should be considered when producing a Security Policy for the network in
which the module is deployed.
The Datacryptor® 100M Ethernet should be periodically checked for evidence of tampering, in
particular damage to the tamper evident labels as these are part of the security of the unit. In
addition the audit logs should be checked for activation of the tamper response mechanism.
The frequency of a physical inspection depends on the information being protected and the
environment in which the unit is located. At a minimum it would be expected that a physical
inspection would be made at least monthly and audit logs daily.
The tamper evident labels shall only be applied at the Thales facility. Tamper evident labels are
not available for order or replacement from Thales.
4.1.1 1600X439, Rev. 01 Hardware
Figure 4-1 1600X439, Rev. 01 Front
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 21 OF 25 25 SEPT 2017
Figure 4-2 1600X439, Rev. 01 AC and DC Rear
Figure 4-3 1600x439, Rev. 01 Top
Two undamaged tamper evident labels must be visible for the module to be operated in a FIPs
approved mode of operation. They shall be in the positions shown (see Figure 4-1), one on the left
side of the front panel (position 1) and one on the right side of the front panel (position 2)
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 22 OF 25 25 SEPT 2017
4.1.2 1600X439, Rev. 02 Hardware
Figure 4-4 1600X439, Rev. 02 Front
Figure 4-5 1600X439, Rev. 02 AC and DC Rear
Figure 4-6 1600x439, Rev. 02 Top
Three undamaged tamper evident labels must be visible for the module to be operated in a FIPS
approved mode of operation. They shall be in the positions shown (see Figure 4-1), one on the left
side of the front panel (position 1), one on the right side of the front panel (position 2) and one in
the middle of the front panel (position 3).
3
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 23 OF 25 25 SEPT 2017
5. MITIGATION OF OTHER ATTACKS POLICY
None.
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 24 OF 25 25 SEPT 2017
ACRONYMS AND ABBREVIATIONS
Acronym Definition
AES Advanced Encryption Standard
ANSI American National Standards Institute
CA Certification Authority
CTS Cipher Text Stealing
DEK Data Encryption Key
DRBG Deterministic Random Bit Generator
ECDSA Elliptic Curve Digital Signature Algorithm
ECDH Elliptic Curve Diffie-Hellman
EDC Error Detection Code
FIPS Federal Information Processing Standards
ITU International Telecommunications Union
KAT Know Answer Test
KEK Key Encryption Key
LAN Local Area Network
MAC Media Access Control
NIST National Institute of Standards and Technology
PPP Point-to-Point
PRNG Pseudo Random Number Generator
PSU Power Supply Unit
RIP Routing Information Protocol
RBG Random Bit Generator
SDH Synchronous Digital Hierarchy
SHA Secure Hash Algorithm
SNMP Simple Network Management Protocol
VLAN Virtual LAN
DATACRYPTOR® 100M ETHERNET
SECURITY POLICY
VERSION 006 PAGE 25 OF 25 25 SEPT 2017
REFERENCES
1. FIPS 140-2 Security Requirements for Cryptographic Modules, Federal
Information Processing Standards Publication, 25th
May 2001.
Including Change Notices 2,3,4: 12/03/2002
Available from the NIST web site: http://www.nist.gov/cvmp
2. NIST SP800-90A Recommendation for Random Number Generation Using
Deterministic Random Bit Generators, National Institute of Standards and
Technology Special Publication, March 2007.
Available from the NIST web site: http://www.nist.gov/cmvp
3. Datacryptor® 100M Ethernet User Manual, 1270A450-011, Issue June 2012.
Available from Thales e-Security.
------------------------------------------- END OF DOCUMENT --------------------------------------------------------