This page was not yet optimized for use on mobile devices.
Juniper Networks EX2300, EX2300-C and EX3400 Ethernet Switches
Certificate details
| Certificate ID | #5281 |
|---|---|
| Status | active |
| Validation dates | 20.05.2026 |
| Sunset date | 19-05-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The Juniper Networks EX2300, EX2300-C and EX3400 Ethernet Switches are cryptographic modules that are defined as multi-chip standalone modules that execute JUNOS OS 22.4R2.8 firmware. The cryptographic boundaries for the EX2300, EX2300-C and EX3400 Ethernet Switches are defined as the outer edge of each switch. The cryptographic modules' operational environment is a limited operational environment. |
| Vendor | Juniper Networks, Inc. http://www.juniper.net |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES, AES-, CAST, TDES, Blowfish, HMACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, Diffie-Hellman, DH, DSAHash functions
SHA-1, RIPEMD160Schemes
MAC, Key AgreementProtocols
SSH, SSHv2Randomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, prime256v1Block cipher modes
CBC, CTRTrusted Execution Environments
PSP, SSCSecurity level
Level 1, Level 3, level 1Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS18, SP 800-38A, SP 800-90A, SP 800-56A, SP 800-135, NIST SP 800-90B, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5281,
"dgst": "8caeb7558c53eb3f",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"KAS-FFC-SSC Sp800-56Ar3A4301",
"ECDSA KeyVer (FIPS186-5)A4301",
"AES-CTRA4301",
"KAS-ECC-SSC Sp800-56Ar3A4301",
"ECDSA SigGen (FIPS186-5)A4301",
"SHA-1A4301",
"KDF SSHA4301",
"HMAC-SHA2-512A4301",
"SHA2-256A4303",
"SHA2-512A4306",
"#A4301",
"AES-CBCA4301",
"ECDSA KeyGen (FIPS186-5)A4301",
"RSA KeyGen (FIPS186-5)A4301",
"RSA SigGen (FIPS186-5)A4301",
"Safe Primes Key VerificationA4301",
"Safe Primes Key GenerationA4301",
"#A4306",
"#A4303",
"HMAC-SHA-1A4301",
"RSA SigVer (FIPS186-5)A4301",
"HMAC DRBGA4303",
"HMAC-SHA2-256A4303",
"ECDSA SigVer (FIPS186-5)A4301"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*",
"cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4301",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A4301",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A4303",
"properties": "Prediction Resistance - Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4303",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A4301",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A4301",
"properties": "Domain Parameter Generation Methods - FC, MODP-2048 Scheme - dhEphem - KAS Role - initiator",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A4301",
"properties": "Cipher - AES-128, AES-192, AES-256, TDES Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A4301",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A4301",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A4301",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4303",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4306",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Security relevant configurati on (SSH, authenticat ion data)",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Commands (SSH configuration: set system services ssh root-login allow)",
"name": "Configur e security (security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Root - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - SSH Public Host Key: G - User Authenticatio n Public Keys: W - CO Authenticatio n Public Keys: W Super-user - SSH Private Host Key: G - User",
"secFunImpl": "DRBG Entropy Souce Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Password: W,E - CO Password: W,E - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - SSH Public Host Key: G - User Authenticatio n Public Keys: W - CO Authenticatio n Public Keys: W",
"secFunImpl": ""
},
{
"description": "Non- security relevant configurati on",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Commands (miscellaneo us commands e.g., for IP address configuration, routing protocols, etc.)",
"name": "Configur e (non- security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "Query the module status",
"indicator": "Global Approve d Mode",
"inputs": "Command (show system fips chassis",
"name": "Show status",
"outputs": "CLI output (show system fips chassis",
"rolesSspAccess": "Super-user - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "",
"indicator": "indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "level, requests system fips self-tests)",
"name": "",
"outputs": "level: returns \u0027level 1\u0027 to indicate that the module is operating in the Approved mode and no output/blank to indicate that it is operating in the non- Approved mode; request system fips self-tests: module continues to be operational upon successful execution/retu rns an error indicator and enters an error state in case of a failure)",
"rolesSspAccess": "Root - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorised - User Password: E",
"secFunImpl": ""
},
{
"description": "LEDs on the module provide physical status output",
"indicator": "LED(s) on the chassis turned on",
"inputs": "N/A",
"name": "Show status (LED)",
"outputs": "LED",
"rolesSspAccess": "Super-user Operator Read-only Unauthorised Root Unauthentica ted",
"secFunImpl": "None"
},
{
"description": "Query the module\u0027s versioning information",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf",
"inputs": "Command (show version)",
"name": "Show module\u0027s versionin g informati on",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Operator - User Password: E Read-only - User Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "",
"indicator": "ul completi on of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Unauthorised - User Password: E Root - CO Password: E",
"secFunImpl": ""
},
{
"description": "Zeroise: Destroy all SSPs",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Command (request vmhost zeroise no- forwarding)",
"name": "Zeroise (Perform zeroisati on)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRB G V value: Z - HMAC_DRB G Key value: Z - HMAC_DRB G entropy input: Z - HMAC_DRB G seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public",
"secFunImpl": "Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Host Key: Z - User Authenticatio n Public Keys: Z - CO Authenticatio n Public Keys: Z - JuniperRoot CA: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z Root - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRB G V value: Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- HMAC_DRB G Key value: Z - HMAC_DRB G entropy input: Z - HMAC_DRB G seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authenticatio n Public Keys: Z - CO Authenticatio n Public Keys: Z - JuniperRoot CA: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z",
"secFunImpl": ""
},
{
"description": "Initiate SSH",
"indicator": "Global Approve",
"inputs": "Authenticatio n data",
"name": "Perform approved",
"outputs": "SSH session",
"rolesSspAccess": "Super-user - SSH",
"secFunImpl": "KAS1 KAS2"
},
{
"description": "connection for SSH monitoring and control (CLI)",
"indicator": "d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "(Username and password/pu blic-key based authenticatio n)",
"name": "security functions (SSH connecti on)",
"outputs": "",
"rolesSspAccess": "Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: G - SSH DH Public Key: G,E,Z - SSH ECDH Public Key: G,E,Z - CO Password: E - CO Authenticatio",
"secFunImpl": "KTS1 ECDSA SigVer2 DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen 2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen RSA SigVer Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "n Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Root - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - CO Password: E - CO Authenticatio n Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Operator - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - HMAC_DRB G Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Read-only - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Unauthorised - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - HMAC_DRB G Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Client Public Key: W,E,Z",
"secFunImpl": ""
},
{
"description": "Console monitoring and control (CLI)",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Username, password (set system login user \u003cusername\u003e class \u003ccrypto- officer/user class\u003e operator authenticatio n plaintext- password)",
"name": "Console Access",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E Operator - CO Password: E Read-only - User Password: E Unauthorised - User Password: E Root - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "Software initiated reset, performs self-tests on demand via SSH",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Control input/reset signal (request vmhost reboot)",
"name": "Perform self-tests (remote reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DRB G Key value: G,Z - HMAC_DRB G V value: G,Z - HMAC_DRB G entropy input: G,Z - HMAC_DRB G seed: G,Z - ECDH Shared Secret: Z - DH Shared",
"secFunImpl": "KAS1 KAS2 KTS1 DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen 2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen Passwor d Hash CASTs on boot"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Firmware Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authenticatio n Public Keys: E - CO Authenticatio n Public Keys: E Root - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DRB G Key value: G,Z - HMAC_DRB G V value: G,Z -",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "HMAC_DRB G entropy input: G,Z - HMAC_DRB G seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Firmware Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authenticatio n Public Keys: E - CO Authenticatio n Public",
"secFunImpl": ""
},
{
"description": "Hardware reset or power cycle",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf",
"inputs": "Control input/reset signal",
"name": "Perform self-tests (local reset)",
"outputs": "N/A",
"rolesSspAccess": "Keys: E Super-user - Firmware Integrity Key: E Root - Firmware Integrity Key: E Operator",
"secFunImpl": "CASTs on boot"
},
{
"description": "",
"indicator": "ul completi on of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- Firmware Integrity Key: E Read-only - Firmware Integrity Key: E Unauthorised - Firmware Integrity Key: E Unauthentica ted - Firmware Integrity Key: E",
"secFunImpl": ""
},
{
"description": "Verification and loading of a validated firmware image into the router/swit ch",
"indicator": "Global Approve d Mode indicator \"fips\" at the CLI combine d with successf ul completi on of each service",
"inputs": "Image, commands",
"name": "Load Image",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E - Firmware Integrity Key: E - JuniperRoot CA: E - PackageCA: E Root - CO Password: E - Firmware Integrity Key: E - JuniperRoot CA: E - PackageCA: E",
"secFunImpl": "ECDSA SigVer Passwor d Hash"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "* The module enforces 10- character passwords (at minimum) chosen from the 96 human readable ASCII characters; The maximum password length is 20- characters; Thus, the probability of a successful random attempt is 1/(96^10), which is less than 1/1,000,000 (million); * The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0 time to process), no timed access is enforced; Upon the third attempt, the module enforces a 5-second delay; Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g., 4th failed attempt = 10-second delay, 5th failed attempt = 15-second delay, 6th failed attempt = 20- second delay, 7th failed attempt = 25-second delay); This leads to a maximum of 7 possible attempts in a one-minute period for each getty; The best approach for the attacker would be to disconnect after 4 failed attempts and wait for a new getty to be spawned; This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts; The",
"mechanism": "SHA2-512 (A4306)",
"name": "Username and password over the console and SSH",
"perMinute": "9/(96^10)",
"strength": "1/(96^10)"
},
{
"description": "probability of a success with multiple consecutive attempts in a one-minute period is 9/(96^10), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "* The module supports ECDSA (P-256, P-384, and P-521), which has a minimum equivalent computational resistance to attack of either 2^128, 2^192 or 2^256 depending on the curve; Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one-minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^128),",
"mechanism": "ECDSA SigVer (FIPS186-5) (A4301)",
"name": "Username and ECDSA public key over SSH",
"perMinute": "15,000/(2^128)",
"strength": "1/(2^128)"
},
{
"description": "which is less than 1/100,000 * The module supports RSA (2048, 3072, 4096 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one- minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^112), which is less than 1/100,000",
"mechanism": "RSA SigVer (FIPS186-5) (A4301)",
"name": "Username and RSA public key over SSH",
"perMinute": "15,000/(2^112)",
"strength": "1/ (2^112)"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC DRBG (A4303)",
"condition": "During boot",
"details": "N/A",
"indicator": "NIST 800-90 HMAC DRBG Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Prediction Resistance: Yes Supports Reseed Capabilities: Mode: SHA2- 256 Entropy Input: 256 Nonce: 128 Personalizati on String Length: 0- 256 Increment 8 Additional Input: 8-256 Increment 8 Returned Bits: 1024",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "256 (A4303)",
"condition": "",
"details": "",
"indicator": "256 Known Answer Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES- CBC (A4301) - Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301) - Encrypt - 192 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301) - Encrypt - 256 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301) - Decrypt - 192 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301) - Decrypt - 256 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA-1 Known Answer",
"testMethod": "KAT",
"testProps": "Key Length: 160 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 512 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 512 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A4301) - P-256",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A4301) - P-384",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- FFC- EPHEM- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: MODP-2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KDF- SSH- SHA2- 256",
"testMethod": "KAT",
"testProps": "Cipher: AES- 128, AES- 192, AES- 256 ; Hash",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Known Answer Test: Passed",
"testMethod": "",
"testProps": "Algorithm: SHA-1, SHA2-256, SHA2-512",
"type": ""
},
{
"algorithmOrTest": "RSA SigGen (FIPS18 6-5) (A4301)",
"condition": "During boot",
"details": "Sign",
"indicator": "RSA- SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS18 6-5) (A4301)",
"condition": "During boot",
"details": "Verify",
"indicator": "RSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS18 6-5) (A4301)",
"condition": "During boot",
"details": "Sign",
"indicator": "ECDSA- SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS18 6-5) (A4301)",
"condition": "During boot",
"details": "Verify",
"indicator": "ECDSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512 (A4306)",
"condition": "During boot",
"details": "N/A",
"indicator": "SHA-2- 512 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test - NIST SP 800-90B RCT",
"condition": "During boot and continually",
"details": "Cutoff value C = 21",
"indicator": "pass",
"testMethod": "RCT",
"testProps": "NIST SP 800-90B Repetitive Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test - NIST SP 800-90B APT",
"condition": "During boot and continually",
"details": "W = 512; Cutoff value C = 311",
"indicator": "pass",
"testMethod": "APT",
"testProps": "NIST SP 800-90B Adapative Proportion Test",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Curve: P-256 Hash",
"type": "PCT"
},
{
"algorithmOrTest": "(FIPS18 6-5) (A4301)",
"condition": "",
"details": "in the context of SSHv2 protocol and for key generation for use in ECDSA signature generation/verificat ion",
"indicator": "",
"testMethod": "",
"testProps": "Algorithm: SHA2-256",
"type": ""
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A4301) - PCT",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Capabilities: Domain Parameter: MODP2048",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS18 6-5) (A4301)",
"condition": "On key generation",
"details": "Key pair generated for signature generation/verificat ion in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Modulus: 2048 Hash SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "Firmware Load Test",
"condition": "On loading of firmware from an external source",
"details": "Verify",
"indicator": "Host OS upgrade staged. Reboot the system to complete installatio n!",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "Manual entry test (duplicat e entries)",
"condition": "On configurati on of operator passwords",
"details": "N/A",
"indicator": "Comman d prompt with \"fips\" string provided post completio n of the test",
"testMethod": "Duplicate entry test required for entry of operator passwor ds via direct connecti on to the module\u0027s console (serial) interface",
"testProps": "Duplicate entry test required for entry of operator passwords via direct connection to the module\u0027s console (serial) interface",
"type": "Manu al Entry"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "If the pre- operational firmware integrity test or if any of the CASTs fail",
"description": "If the pre-operation firmware integrity test, if any of the CASTs or pair-wise consistency tests fail, then the module returns an error indicator, inhibits all data output and enters the hard error state",
"indicator": "\"FIPS error: self-test failure\" for firmware integrity failure, \"FIPS error 1: \u003cname of the algorithm\u003e Known Answer Test: Failed\" for CAST failure and -1 for pair-wise consistency test failure",
"name": "Hard Error state",
"recoveryMethod": "N/A"
},
{
"conditions": "If the firmware load test fails If the APT or RCT test fails",
"description": "*In case of a firmware load test failure, the module rejects the firmware, returns an error indicator and enters the soft error state *In the event of an APT or RCT health test failure, output from the entropy source is inhibited, all entropy accumulated in the conditioning context is discarded",
"indicator": "\"veriexec: cannot verify \u003cimg_file\u003e.esig: ERROR: Failed loading signature file \u003cpath/to/signature\u003e\" for the firmware load test failure; entropy data discarded in case of APT/RCT failure",
"name": "Soft Error state",
"recoveryMethod": "N/A for firmware load test failure; In case of APT and/or RCT failures, new data continues to be tested by the health tests, and once both health tests indicate a \"pass\", the entropy source"
},
{
"conditions": "",
"description": "and the start-up health-tests are performed again",
"indicator": "",
"name": "",
"recoveryMethod": "again outputs data"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "N/A"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "\u2022 The operator can verify that the cryptographic module is in the Approved mode by observing the console prompt and running the \u0027show version\u0027 command; \u2022 When operating in the Approved mode, the prompt will read \u0027\u003coperator\u003e:fips#\u0027 (e.g. root:fips#); \u2022 The \u0027show version\u0027 command will allow the Crypto Officer to verify that the validated firmware version is running on the module; \u2022 The Crypto Officer can also use the \u0027show system fips chassis level\u0027 command (returns \u0027level 1\u0027) to determine if the module is op erating in the Approved mode; \u2022 The Approved mode is entered when the module is configured for it and successfully passes all self-tests (both pre-operational and conditional cryptographic algorithm self-tests (CASTs))",
"name": "Approved mode",
"statusIndicator": "global indicator (string \u0027fips\u0027 included in the command prompt)",
"type": "Approved"
},
{
"description": "\u2022 The cryptographic module supports a non - Approved mode of operation; \u2022 When operated in the non-Approved mode of operation, the module supports non-Approved algorithms as well as the algorithms supported in the Approved mode of operation",
"name": "Non- Approved mode",
"statusIndicator": "global indicator (implicit indicator based on exclusion of string \u0027fips\u0027 from the command prompt)",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "no security claimed",
"name": "SHA2-256 (Junos 22.4R2 - LibMD Implementation)",
"use": "Used to store operator passwords in hashed form, per IG 2.4.A: Use of a non-approved cryptographic algorithm to \"obfuscate\" a CSP"
},
{
"caveat": "no security claimed",
"name": "SHA-1 (Junos 22.4R2 - Kernel Implementation)",
"use": "Used for an extraneous check in the Kernel, per IG 2.4.A: Use of an approved, non-approved or proprietary algorithm for a purpose that is not security relevant"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [
{
"algoPropList": "",
"implName": "N/A",
"name": "N/A",
"reference": "N/A"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "RSA with key size less than 2048",
"use": "SSH"
},
{
"name": "ECDSA with ed25519 curve",
"use": "SSH"
},
{
"name": "EC Diffie-Hellman with ed25519 curve",
"use": "SSH"
},
{
"name": "ARCFOUR",
"use": "SSH"
},
{
"name": "Blowfish",
"use": "SSH"
},
{
"name": "CAST",
"use": "SSH"
},
{
"name": "DSA (SignGen, SigVer, non-compliant)",
"use": "SSH"
},
{
"name": "HMAC-MD5",
"use": "SSH"
},
{
"name": "HMAC-RIPEMD160",
"use": "SSH"
},
{
"name": "UMAC",
"use": "SSH"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "Security relevant configuration",
"name": "Configure security (security relevant)",
"role": "Root, Super-user"
},
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"name": "Perform approved security functions (SSH connection)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "LAN, Communications/remote management",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (Management Port)"
},
{
"data": "Console Serial Port",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Serial"
},
{
"data": "USB port, load Junos Image",
"logicalInterface": "Data Input Control Input",
"physicalPort": "USB"
},
{
"data": "Power connector",
"logicalInterface": "Power",
"physicalPort": "Power"
},
{
"data": "Status indicator lighting",
"logicalInterface": "Status Output",
"physicalPort": "Alarm LEDs"
},
{
"data": "Reset signal",
"logicalInterface": "Control Input",
"physicalPort": "Reset Button"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Super-user",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Operator",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Read-only",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Root",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Unauthorised",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Firmware Integrity Test",
"details": "Verify",
"indicator": "FIPS Self-tests Passed",
"testMethod": "KAT",
"testProps": "Using ECDSA P-256 with SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "NVRAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered over SSH - NVRAM",
"sfiAlgo": "KTS1",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Loaded at manufacture",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered through the CLI via console connection - NVRAM",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input during SSH negotiation",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (host key)",
"sfiAlgo": "",
"source": "NVRAM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (Key Agreement public key)",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Command used to zeroise the module: request vmhost zeroize no-forwarding",
"method": "Zeroisation command",
"operatorId": "Operator initiated",
"rationale": "Used to provide zeroisation as a service"
},
{
"description": "Power cycling the module to zeroise temporary SSPs",
"method": "Power-cycle",
"operatorId": "Operator initiated",
"rationale": "Power cycling the module to zeroise temporary SSPs"
},
{
"description": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session",
"method": "Session termination",
"operatorId": "Module initiated",
"rationale": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session"
},
{
"description": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem",
"method": "Not zeroised",
"operatorId": "N/A",
"rationale": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem"
},
{
"description": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key",
"method": "Derivation of SSH session key",
"operatorId": "Module initiated",
"rationale": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Non-Volatile Random Access Memory",
"name": "NVRAM",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-C-12P",
"modelPartNum": "EX2300-C-12P",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-C-12T",
"modelPartNum": "EX2300-C-12T",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-24P",
"modelPartNum": "EX2300-24P",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-24T",
"modelPartNum": "EX2300-24T",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-48P",
"modelPartNum": "EX2300-48P",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX2300-48T",
"modelPartNum": "EX2300-48T",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX3400-24P",
"modelPartNum": "EX3400-24P",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX3400-24T",
"modelPartNum": "EX3400-24T",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX3400-48P",
"modelPartNum": "EX3400-48P",
"processors": "ARM Cortex A9"
},
{
"features": "NA",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "EX3400-48T",
"modelPartNum": "EX3400-48T",
"processors": "ARM Cortex A9"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4",
"reference": "NIST SP800-133r2 Section 4: Symmetric key generation and Asymmetric seed generation using an unmodified output from an Approved DRBG (example 1); The module supports the following per NIST SP 800-133r2: 1. Section 5.1: Key Pairs for Digital Signature Schemes 2. Section 5.2: Key Pairs for Key Establishment 3. Section 6.2.1: Derivation of symmetric keys"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 44
},
"ECDSA": {
"ECDSA": 76
}
},
"FF": {
"DH": {
"DH": 44,
"Diffie-Hellman": 5
},
"DSA": {
"DSA": 3
}
},
"RSA": {
"RSA 2048": 1
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 14
},
"CTR": {
"CTR": 2
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"SSH": {
"SSH": 189,
"SSHv2": 8
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 5
},
"MAC": {
"MAC": 3
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 58,
"P-384": 22,
"P-521": 16,
"prime256v1": 2
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"AES CBC 128, 192": 1,
"AES CTR 128": 1,
"AES- 128": 1,
"AES- 192": 1,
"AES- 256": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"DRBG 256": 1,
"DRBG 440": 1,
"HMAC- SHA-1": 2,
"HMAC-SHA-1": 6,
"RSA 2048": 1,
"RSA2": 1,
"SHA-1": 8,
"SHA-2- 512": 1,
"SHA2- 256": 4,
"SHA2- 512": 3,
"SHA2-256": 19,
"SHA2-384": 3,
"SHA2-512": 10
}
},
"fips_security_level": {
"Level": {
"Level 1": 4,
"Level 3": 1,
"level 1": 7
}
},
"hash_function": {
"RIPEMD": {
"RIPEMD160": 2
},
"SHA": {
"SHA1": {
"SHA-1": 8
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 24
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 13,
"FIPS 180-4": 5,
"FIPS 186-5": 7,
"FIPS 198-1": 4,
"FIPS18": 6,
"FIPS186-5": 28
},
"NIST": {
"NIST SP 800-90B": 4,
"SP 800-135": 1,
"SP 800-38A": 2,
"SP 800-56A": 4,
"SP 800-90A": 1
},
"X509": {
"X.509": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 5,
"AES-": 15,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 49
}
},
"DES": {
"3DES": {
"TDES": 1
}
},
"constructions": {
"MAC": {
"HMAC": 19
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 10
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"KAS-FFC-SSC Sp800-56Ar3A4301",
"ECDSA KeyVer (FIPS186-5)A4301",
"AES-CTRA4301",
"KAS-ECC-SSC Sp800-56Ar3A4301",
"ECDSA SigGen (FIPS186-5)A4301",
"SHA-1A4301",
"HMAC-SHA2-256A4303",
"KDF SSHA4301",
"HMAC-SHA2-512A4301",
"SHA2-256A4303",
"AES-CBCA4301",
"ECDSA KeyGen (FIPS186-5)A4301",
"RSA KeyGen (FIPS186-5)A4301",
"RSA SigGen (FIPS186-5)A4301",
"Safe Primes Key VerificationA4301",
"Safe Primes Key GenerationA4301",
"HMAC-SHA-1A4301",
"RSA SigVer (FIPS186-5)A4301",
"HMAC DRBGA4303",
"SHA2-512A4306",
"ECDSA SigVer (FIPS186-5)A4301"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4306",
"#A4301",
"#A4303"
]
},
"policy_metadata": {
"/Author": "Ahona Chattopadhyay Intertek",
"/CreationDate": "D:20260518101748-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260518101748-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 892098,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program",
"http://www.juniper.net/support/downloads/junos.html",
"https://www.acumensecurity.net/"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 62
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "d03778605712c24504b549c739b00ad9bcae412026eaa180141d1029e63ac9f0",
"source_hash": "2bb9ae75ca795d1d5cb661d26551a113fb8e00be9b8ac629f92eb8df40c0db62",
"txt_hash": "0ec4b2506baf6fac9a12b0c7ab0f832d666fac692a7004e6ec4aaea69b2fb9a8"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/May 2026_030626_0716.pdf",
"date_sunset": "2031-05-19",
"description": "The Juniper Networks EX2300, EX2300-C and EX3400 Ethernet Switches are cryptographic modules that are defined as multi-chip standalone modules that execute JUNOS OS 22.4R2.8 firmware. The cryptographic boundaries for the EX2300, EX2300-C and EX3400 Ethernet Switches are defined as the outer edge of each switch. The cryptographic modules\u0027 operational environment is a limited operational environment.",
"embodiment": "MultiChipStand",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Juniper Networks EX2300, EX2300-C and EX3400 Ethernet Switches",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-05-20",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "Juniper Networks, Inc.",
"vendor_url": "http://www.juniper.net"
}
}