This page was not yet optimized for use on mobile devices.
Juniper Networks vSRX 3.0 Virtual Firewall
Certificate details
| Certificate ID | #5150 |
|---|---|
| Status | active |
| Validation dates | 28.01.2026 |
| Sunset date | 27-01-2031 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Software |
| Embodiment | Multi-Chip Stand Alone |
| Caveat | When operated in approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The vSRX Virtual Firewall delivers a complete virtual firewall solution, including advanced security, robust networking, and automated virtual machine life cycle management capabilities for service providers and enterprises. vSRX empowers security professionals to deploy and scale firewall protection in highly dynamic environments. |
| Vendor | Juniper Networks, Inc. http://www.juniper.net |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES, AES-, CAST, TDES, Blowfish, HMACAsymmetric Algorithms
ECDH, ECDSA, Diffie-Hellman, DH, DSAHash functions
SHA-1, SHA1, MD5, RIPEMD160Schemes
MAC, Key AgreementProtocols
SSH, SSHv2, IKEv1, IKEv2, IKE, IPsecRandomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, prime256v1Block cipher modes
CBCTrusted Execution Environments
PSP, SSCSecurity level
Level 1, level 1, level 2Standards
FIPS 140-3, FIPS186-5, FIPS 186-5, FIPS 198-1, FIPS 180-4, FIPS18, FIPS 1403, SP 800-38A, SP 800-90A, SP 800-56A, SP 800-135, NIST SP 800-90B, PKCS #1, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5150,
"dgst": "9ff8476644903ba6",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"AES-CBCA3343",
"HMAC-SHA2-512A3342",
"RSA SigVer (FIPS186-5)A3342",
"HMAC-SHA-1A3342",
"#A3342",
"ECDSA SigVer (FIPS186-5)A3342",
"KAS-ECC-SSC Sp800-56Ar3A3342",
"ECDSA KeyGen (FIPS186-5)A3342",
"HMAC DRBGA3335",
"KDF IKEv2A3343",
"KAS-FFC-SSC Sp800-56Ar3A3342",
"Safe Primes Key VerificationA3342",
"RSA KeyGen (FIPS186-5)A3342",
"SHA2-512A3342",
"#A3340",
"SHA-1A3342",
"ECDSA KeyVer (FIPS186-5)A3342",
"AES-CTRA3342",
"#A3335",
"HMAC-SHA2-256A3343",
"KDF SSHA3341",
"#A3341",
"Safe Primes Key GenerationA3342",
"#A3339",
"#A3343",
"KDF IKEv1A3343",
"SHA2-256A3343",
"ECDSA SigGen (FIPS186-5)A3342",
"RSA SigGen (FIPS186-5)A3342"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"3.0"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A3339",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3342",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A3343",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A3342",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A3335",
"properties": "Prediction Resistance - Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A3342",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3335",
"properties": "Key Length - Key Length: 160, 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3339",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3342",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A3343",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A3342",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A3342",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A3342",
"properties": "Domain Parameter Generation Methods - FC, MODP-2048 Scheme - dhEphem - KAS Role - initiator",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF IKEv1 (CVL)",
"cavpCertName": "A3343",
"properties": "Authentication Method - Digital Signature, Pre-shared Key Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256, 384, 2048 Hash Algorithm - SHA2-256, SHA2-384 Preshared Key Length - Preshared Key Length: 8-256 Increment 8",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF IKEv2 (CVL)",
"cavpCertName": "A3343",
"properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256, 384, 2048 Derived Keying Material Length - Derived Keying Material Length: 1136-2432 Increment 8 Hash Algorithm - SHA2-256, SHA2-384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A3341",
"properties": "Cipher - AES-128, AES-192, AES-256, TDES Hash Algorithm - SHA-1, SHA2-256, SHA2- 384",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A3342",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A3342",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A3342",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A3342",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3335",
"properties": "Message Length - Message Length: 0-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3339",
"properties": "Message Length - Message Length: 8-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3342",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A3343",
"properties": "Message Length - Message Length: 0-51200 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3335",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3340",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A3342",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Security relevant configuratio n (SSH, authenticati on data)",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Commands (SSH configuration: set system services ssh root-login allow)",
"name": "Configure security (security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Root - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - SSH Public Host Key: G - User Authentication Public Keys: W - CO Authentication Public Keys: W Super-user - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRBG V value: E -",
"secFunImpl": "DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen2 RSA KeyGen Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - SSH Public Host Key: G - User Authentication Public Keys: W - CO Authentication Public Keys: W",
"secFunImpl": ""
},
{
"description": "Non- security relevant configuratio n",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Commands (miscellaneous commands e.g., for IP address configuration, routing protocols, etc.)",
"name": "Configure (non- security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "Query the module status",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Command (show)",
"name": "Show status",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorised - User Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "LEDs on the module provide physical status output",
"indicator": "LED(s) on the chassis turned on",
"inputs": "N/A",
"name": "Show status (LED)",
"outputs": "LED",
"rolesSspAccess": "Super-user Operator Read-only Unauthorised Root Unauthenticat ed",
"secFunImpl": "None"
},
{
"description": "Query the module\u0027s versioning information",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Command (show version)",
"name": "Show module\u0027s versioning informatio n",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorised - User Password: E Root - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "Zeroise: Destroy all SSPs",
"indicator": "successf ul deletion of virtual machine",
"inputs": "Power (deletion of virtual machine)",
"name": "Zeroise (Perform zeroisatio n)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRBG V value: Z - HMAC_DRBG Key value: Z - HMAC_DRBG entropy input: Z - HMAC_DRBG",
"secFunImpl": "Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authentication Public Keys: Z - CO Authentication Public Keys: Z - JuniperRootC A: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z - IKE-PSK: Z - IKE-SKEYID: Z - IKE-SEK: Z - IKE-DH-PRI: Z - ESP-SEK: Z - IKE-DH- PUB: Z Root - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z",
"secFunImpl": ""
},
{
"description": "Description",
"indicator": "Indicator",
"inputs": "Inputs",
"name": "Name",
"outputs": "Output s",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Function"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRBG V value: Z - HMAC_DRBG Key value: Z - HMAC_DRBG entropy input: Z - HMAC_DRBG seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authentication Public Keys: Z - CO Authentication Public Keys: Z - JuniperRootC A: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH",
"secFunImpl": "s"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Client Public Key: Z - IKE-PSK: Z - IKE-SKEYID: Z - IKE-SEK: Z - ESP-SEK: Z - IKE-DH-PRI: Z - IKE-DH- PUB: Z",
"secFunImpl": ""
},
{
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Authentication data (Username and password/publi c-key based authentication)",
"name": "Perform approved security functions (SSH connectio n)",
"outputs": "SSH session",
"rolesSspAccess": "Super-user - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: G - SSH DH Public Key: G,E,Z",
"secFunImpl": "KAS1 KAS2 KTS1 ECDSA SigVer DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen RSA SigVer Passwor d Hash"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - CO Password: E - CO Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Root - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - CO Password: E - CO Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Operator - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - HMAC_DRBG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Read-only - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Unauthorised - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - HMAC_DRBG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z",
"secFunImpl": ""
},
{
"description": "Console monitoring and control (CLI)",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Username, password (set system login user \u003cusername\u003e class \u003ccrypto- officer/user class\u003e operator authentication plaintext- password)",
"name": "Console Access",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E Operator - CO Password: E Read-only - User Password: E Unauthorised - User Password: E Root - CO Password: E",
"secFunImpl": "Passwor d Hash"
},
{
"description": "Software initiated reset, performs self-tests on",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI",
"inputs": "Control input/reset signal (request vmhost reboot)",
"name": "Perform self-tests (remote reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session",
"secFunImpl": "KAS1 KAS2 KTS1 DRBG Entropy Souce"
},
{
"description": "demand via SSH",
"indicator": "combined with successf ul completio n of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Key: Z - HMAC_DRBG Key value: G,Z - HMAC_DRBG V value: G,Z - HMAC_DRBG entropy input: G,Z - HMAC_DRBG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Software Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authentication Public Keys: E - CO Authentication Public Keys: E Root - SSH ECDH Private Key: Z - SSH DH",
"secFunImpl": "ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen Passwor d Hash CASTs on boot"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Private Key: Z - SSH Session Key: Z - HMAC_DRBG Key value: G,Z - HMAC_DRBG V value: G,Z - HMAC_DRBG entropy input: G,Z - HMAC_DRBG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Software Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authentication Public Keys: E - CO Authentication Public Keys: E",
"secFunImpl": ""
},
{
"description": "Hardware reset or power cycle",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Control input/reset signal",
"name": "Perform self-tests (local reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - Software Integrity Key: E Root - Software Integrity Key: E Operator - Software Integrity Key: E Read-only - Software Integrity Key: E Unauthorised - Software Integrity Key: E Unauthenticat ed - Software Integrity Key: E",
"secFunImpl": "CASTs on boot"
},
{
"description": "Initiate IPsec connection",
"indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service",
"inputs": "Commands (set security ipsec security- association sa- name; * set interfaces \u003cname\u003e unit 0 family inet address \u003cip address\u003e; * set security ike security- association sa- name)",
"name": "Perform approved security functions (IPsec connectio n)",
"outputs": "IPsec session",
"rolesSspAccess": "Root - IKE-PSK: W,E - IKE-SKEYID: G,E,Z - IKE-SEK: G,E,Z - ESP-SEK: G,E,Z - IKE-DH-PRI: G,E,Z - IKE-DH- PUB: G,R,E,Z Super-user - IKE-PSK: W,E - IKE-SKEYID: G,E,Z - IKE-SEK: G,E,Z - ESP-SEK: G,E,Z",
"secFunImpl": "KTS2 KAS3 KAS4"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- IKE-DH-PRI: G,E,Z - IKE-DH- PUB: G,R,E,Z",
"secFunImpl": ""
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "* The module enforces 10- character passwords (at minimum) chosen from the 96 human readable ASCII characters; The maximum password length is 20- characters; Thus, the probability of a successful random attempt is 1/(96^10), which is less than 1/1,000,000 (million); * The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0 time to process), no timed access is enforced; Upon the third attempt, the module enforces a 5-second delay; Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g., 4th failed attempt = 10-second delay, 5th failed attempt = 15-second delay, 6th failed attempt = 20- second delay, 7th failed attempt = 25-second delay); This leads to a maximum of 7 possible attempts in a one-minute period for each getty; The best approach for the attacker would be to disconnect after 4 failed attempts and wait for a new getty to be spawned; This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts; The probability of a success with multiple consecutive attempts in",
"mechanism": "SHA2-512 (A3340)",
"name": "Username and password over the console and SSH",
"perMinute": "9/(96^10)",
"strength": "1/(96^10)"
},
{
"description": "a one-minute period is 9/(96^10), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "* The module supports ECDSA (P-256, P-384, and P-521), which has a minimum equivalent computational resistance to attack of either 2^128, 2^192 or 2^256 depending on the curve; Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one-minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^128), which is less than 1/100,000",
"mechanism": "ECDSA SigVer (FIPS186-5) (A3342)",
"name": "Username and ECDSA public key over SSH",
"perMinute": "15,000/(2^128)",
"strength": "1/(2^128)"
},
{
"description": "* The module supports RSA (2048, 3072, 4096 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one- minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^112), which is less than 1/100,000",
"mechanism": "RSA SigVer (FIPS186-5) (A3342)",
"name": "Username and RSA public key over SSH",
"perMinute": "15,000/(2^112)",
"strength": "1/ (2^112)"
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC DRBG (A3335)",
"condition": "During boot",
"details": "N/A",
"indicator": "NIST 800-90 HMAC DRBG Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Prediction Resistance: Yes Supports Reseed Capabilities: Mode: SHA2- 256 Entropy Input: 256 Nonce: 128 Personalizati",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "on String Length: 0- 256 Increment 8 Additional Input: 8-256 Increment 8 Returned Bits: 1024",
"type": ""
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3335)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 192 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 256 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 192 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 256 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A3342)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA-1 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 160 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3342)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 512 (A3342)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 512 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 512 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A3342) - P-256",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- ECC- EPHEM- UNIFIED -NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A3342) - P-384",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- ECC- EPHEM- UNIFIED -NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- FFC- SSC",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS- FFC- EPHEM-",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation",
"type": "CAST"
},
{
"algorithmOrTest": "Sp800- 56Ar3 (A3342)",
"condition": "",
"details": "",
"indicator": "NOKC Known Answer Test: Passed",
"testMethod": "",
"testProps": "Methods: MODP-2048",
"type": ""
},
{
"algorithmOrTest": "KDF SSH (A3341)",
"condition": "During boot",
"details": "N/A",
"indicator": "KDF- SSH- SHA2- 256 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Cipher: AES- 128, AES- 192, AES- 256 ; Hash Algorithm: SHA-1, SHA2-256, SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS18 6-5) (A3342)",
"condition": "During boot",
"details": "Sign",
"indicator": "RSA- SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS18 6-5) (A3342)",
"condition": "During boot",
"details": "Verify",
"indicator": "RSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS18 6-5) (A3342)",
"condition": "During boot",
"details": "Sign",
"indicator": "ECDSA- SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS18 6-5) (A3342)",
"condition": "During boot",
"details": "Verify",
"indicator": "ECDSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512 (A3340)",
"condition": "During boot",
"details": "N/A",
"indicator": "SHA-2- 512 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test - NIST SP",
"condition": "During boot and continually",
"details": "Cutoff value C = 21",
"indicator": "pass",
"testMethod": "RCT",
"testProps": "NIST SP 800-90B Repetitive Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "800-90B RCT",
"condition": "",
"details": "",
"indicator": "",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "Entropy test - NIST SP 800-90B APT",
"condition": "During boot and continually",
"details": "W = 512; Cutoff value C = 311",
"indicator": "pass",
"testMethod": "APT",
"testProps": "NIST SP 800-90B Adapative Proportion Test",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS18 6-5) (A3342)",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement in the context of SSHv2 protocol and for key generation for use in ECDSA signature generation/verificati on",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A3342) - PCT",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Capabilities: Domain Parameter: MODP2048",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS18 6-5) (A3342)",
"condition": "On key generation",
"details": "Key pair generated for signature generation/verificati on in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Modulus: 2048 Hash SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "Manual entry test (duplicat e entries)",
"condition": "On configurati on of operator passwords and IKE- PSK",
"details": "N/A",
"indicator": "Comman d prompt with \"fips\" string provided post completio n of the test",
"testMethod": "Duplicate entry test required for entry of operator password s and IKE-PSK via direct connectio n to the module\u0027s console (serial) interface",
"testProps": "Duplicate entry test required for entry of operator passwords and IKE-PSK via direct connection to the module\u0027s console (serial) interface",
"type": "Manu al Entry"
},
{
"algorithmOrTest": "KDF IKEv1 (A3343)",
"condition": "During boot",
"details": "N/A",
"indicator": "IKEV1 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "IKEv1 (IPSec) KDF",
"type": "CAST"
},
{
"algorithmOrTest": "KDF IKEv2 (A3343)",
"condition": "During boot",
"details": "N/A",
"indicator": "IKEV2 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "IKEv2 (IPSec) KDF",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3343) - Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3343) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decryt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3343)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3339) - Encrypt - 128 bits",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A3339) - Decrypt - 128 bits",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A3339)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2- 256 Known Answer",
"testMethod": "KAT",
"testProps": "Key length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "If the pre- operational software integrity test or if any of the CASTs fail",
"description": "If the pre-operation software integrity test, if any of the CASTs or pair-wise consistency tests fail, then the module returns an error indicator, inhibits all data output and enters the hard error state",
"indicator": "\"FIPS error: self-test failure\" for software integrity failure, \"FIPS error 1: \u003cname of the algorithm\u003e Known Answer Test: Failed\" for CAST failure and -1 for pair-wise consistency test failure",
"name": "Hard Error state",
"recoveryMethod": "N/A"
},
{
"conditions": "If the APT or RCT test fails",
"description": "In the event of an APT or RCT health test failure, output from the entropy source is inhibited, all entropy accumulated in the conditioning context is discarded and the start-up health-tests are performed again",
"indicator": "Entropy data discarded in case of APT/RCT failure",
"name": "Soft Error state",
"recoveryMethod": "In case of APT and/or RCT failures, new data continues to be tested by the health tests, and once both health tests indicate a \"pass\", the entropy source again outputs data"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [],
"found": false,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "* The operator can verify that the cryptographic module is in the Approved mode by observing the console prompt and running the \"show version\" command; * When operating in the Approved mode, the prompt will read \"\u003coperator\u003e:fips#\" (e.g. crypto-officer:fips#); * The \"show version\" command will allow the",
"name": "Approved mode",
"statusIndicator": "global indicator (string \u0027fips\u0027 included in the command prompt)",
"type": "Approved"
},
{
"description": "Crypto Officer to verify that the validated software version is running on the module; * The Crypto Officer can also use the \"show system fips\" command under configuration mode (returns \"level 1\") to determine if the module is operating in the Approved mode; * The Approved mode is entered when the module is configured for it and successfully passes all self-tests (both pre-operational and conditional cryptographic algorithm self-tests (CASTs))",
"name": "",
"statusIndicator": "",
"type": ""
},
{
"description": "* The cryptographic module supports a non- Approved mode of operation; * When operated in the non-Approved mode of operation, the module supports non-Approved algorithms as well as the algorithms supported in the Approved mode of operation * The module must be zeroised to transition from the Approved mode to the non-Approved mode",
"name": "Non- Approved mode",
"statusIndicator": "global indicator (implicit indicator based on exclusion of string \u0027fips\u0027 from the command prompt)",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "no security claimed",
"name": "SHA2-256 (Junos 22.2R2- S2.3 - LibMD Implementation)",
"use": "Used to store operator passwords in hashed form, per IG 2.4.A: Use of a non-approved cryptographic algorithm to \"obfuscate\" a CSP"
},
{
"caveat": "no security claimed",
"name": "SHA-1 (Junos 22.2R2- S2.3 - Kernel Implementation)",
"use": "Used for an extraneous check in the Kernel, per IG 2.4.A: Use of an approved, non-approved or proprietary algorithm for a purpose that is not security relevant"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "RSA with key size less than 2048",
"use": "SSH"
},
{
"name": "ECDSA with ed25519 curve",
"use": "SSH"
},
{
"name": "EC Diffie-Hellman with ed25519 curve",
"use": "SSH"
},
{
"name": "ARCFOUR",
"use": "SSH"
},
{
"name": "Blowfish",
"use": "SSH"
},
{
"name": "CAST",
"use": "SSH"
},
{
"name": "DSA (SignGen, SigVer, non-compliant)",
"use": "SSH"
},
{
"name": "HMAC-MD5",
"use": "SSH"
},
{
"name": "HMAC-RIPEMD160",
"use": "SSH"
},
{
"name": "UMAC",
"use": "SSH"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "Security relevant configuration",
"name": "Configure security (security relevant)",
"role": "Root, Super-user"
},
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"name": "Perform approved security functions (SSH connection)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "Virtual Ethernet Ports, Virtual Serial Ports",
"logicalInterface": "Data Input",
"physicalPort": "N/A"
},
{
"data": "Virtual Ethernet Ports, Virtual Serial Ports",
"logicalInterface": "Data Output",
"physicalPort": "N/A"
},
{
"data": "Virtual Ethernet Ports, Virtual Serial Ports",
"logicalInterface": "Control Input",
"physicalPort": "N/A"
},
{
"data": "Virtual Ethernet Ports, Virtual Serial Ports",
"logicalInterface": "Status Output",
"physicalPort": "N/A"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Super-user",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Operator",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Read-only",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Root",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Unauthorised",
"operatorType": "User",
"type": "Identity"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "N/A",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Software Integrity Test",
"details": "Verify",
"indicator": "FIPS Self-tests Passed",
"testMethod": "KAT",
"testProps": "Using ECDSA P-256 with SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "NVRAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered over SSH - NVRAM",
"sfiAlgo": "KTS1",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Loaded at manufacture",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered through the CLI via console",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "",
"distribution": "",
"entry": "",
"format": "",
"name": "connection - NVRAM",
"sfiAlgo": "",
"source": ""
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input during SSH negotiation",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (host key)",
"sfiAlgo": "",
"source": "NVRAM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (Key Agreement public key)",
"sfiAlgo": "",
"source": "RAM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during IPsec negotiation",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Deletion of the vSRX 3.0 instance",
"method": "Deletion of virtual instance",
"operatorId": "Operator initiated",
"rationale": "Used to provide zeroisation as a service"
},
{
"description": "Power cycling the underlying host platform to zeroise temporary SSPs",
"method": "Power-cycle",
"operatorId": "Operator initiated",
"rationale": "Power cycling the underlying host platform to zeroise temporary SSPs"
},
{
"description": "Termination of sessions automatically zeroises temporary SSPs used as part of the session",
"method": "Session termination",
"operatorId": "Module initiated",
"rationale": "Termination of sessions automatically zeroises temporary SSPs used as part of the session"
},
{
"description": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of session key",
"method": "Derivation of session key",
"operatorId": "Module initiated",
"rationale": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of session key"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Non-Volatile Random Access Memory",
"name": "NVRAM",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [
{
"hardwarePlatform": "HP ProLiant DL380 Gen9 Server",
"hypervisorHostOs": "VMware ESXi 7.0",
"operatingSystem": "Junos OS 22.2R2-S2.3",
"paa_pai": "No",
"processors": "Intel Xeon E5- 2660 v4",
"version": "Junos OS 22.2R2-S2.3"
},
{
"hardwarePlatform": "PacStar 451 Server",
"hypervisorHostOs": "VMware ESXi 7.0",
"operatingSystem": "Junos OS 22.2R2-S2.3",
"paa_pai": "No",
"processors": "Intel Xeon E- 2254ML",
"version": "Junos OS 22.2R2-S2.3"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type :Symmetric and Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4",
"reference": "NIST SP800-133r2 Section 4: Symmetric key generation and Asymmetric seed generation using an unmodified output from an Approved DRBG (example 1); The module supports the following per NIST SP 800-133r2: 1. Section 5.1: Key Pairs for Digital Signature Schemes 2. Section 5.2: Key Pairs for Key Establishment 3. Section 6.2.1: Derivation of symmetric keys"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 44
},
"ECDSA": {
"ECDSA": 72
}
},
"FF": {
"DH": {
"DH": 44,
"Diffie-Hellman": 5
},
"DSA": {
"DSA": 4
}
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 20
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"IKE": {
"IKE": 11,
"IKEv1": 5,
"IKEv2": 6
},
"IPsec": {
"IPsec": 13
},
"SSH": {
"SSH": 180,
"SSHv2": 8
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 7
},
"MAC": {
"MAC": 3
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 48,
"P-384": 18,
"P-521": 12,
"prime256v1": 2
}
},
"eval_facility": {},
"fips_cert_id": {
"Cert": {
"#1": 1
}
},
"fips_certlike": {
"Certlike": {
"AES (128": 1,
"AES- 128": 1,
"AES- 192": 1,
"AES- 256": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"DRBG 256": 1,
"DRBG 440": 1,
"HMAC- SHA-1": 2,
"HMAC-SHA-1": 4,
"PKCS #1": 2,
"SHA- 256": 2,
"SHA-1": 10,
"SHA-2- 512": 1,
"SHA1": 1,
"SHA2- 256": 10,
"SHA2- 384": 1,
"SHA2- 512": 3,
"SHA2-256": 22,
"SHA2-384": 4,
"SHA2-512": 10
}
},
"fips_security_level": {
"Level": {
"Level 1": 4,
"level 1": 1,
"level 2": 2
}
},
"hash_function": {
"MD": {
"MD5": {
"MD5": 1
}
},
"RIPEMD": {
"RIPEMD160": 2
},
"SHA": {
"SHA1": {
"SHA-1": 10,
"SHA1": 1
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 28
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 12,
"FIPS 1403": 1,
"FIPS 180-4": 8,
"FIPS 186-5": 7,
"FIPS 198-1": 6,
"FIPS18": 6,
"FIPS186-5": 27
},
"NIST": {
"NIST SP 800-90B": 3,
"SP 800-135": 3,
"SP 800-38A": 4,
"SP 800-56A": 4,
"SP 800-90A": 1
},
"PKCS": {
"PKCS #1": 1
},
"X509": {
"X.509": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 5,
"AES-": 23,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 65
}
},
"DES": {
"3DES": {
"TDES": 1
}
},
"constructions": {
"MAC": {
"HMAC": 26
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 8
},
"IBM": {
"SSC": 10
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"AES-CBCA3343",
"HMAC-SHA2-512A3342",
"RSA SigVer (FIPS186-5)A3342",
"HMAC-SHA-1A3342",
"ECDSA SigVer (FIPS186-5)A3342",
"RSA SigGen (FIPS186-5)A3342",
"KAS-ECC-SSC Sp800-56Ar3A3342",
"ECDSA KeyGen (FIPS186-5)A3342",
"HMAC DRBGA3335",
"KDF IKEv2A3343",
"KAS-FFC-SSC Sp800-56Ar3A3342",
"RSA KeyGen (FIPS186-5)A3342",
"SHA2-512A3342",
"SHA-1A3342",
"ECDSA KeyVer (FIPS186-5)A3342",
"AES-CTRA3342",
"HMAC-SHA2-256A3343",
"KDF SSHA3341",
"Safe Primes Key GenerationA3342",
"KDF IKEv1A3343",
"SHA2-256A3343",
"ECDSA SigGen (FIPS186-5)A3342",
"Safe Primes Key VerificationA3342"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A3340",
"#A3342",
"#A3339",
"#A3343",
"#A3335",
"#A3341"
]
},
"policy_metadata": {
"/CreationDate": "D:20260114065508-05\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "44656ec2-9547-4acd-a129-1b6e89f55d00",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-01-13T13:53:01Z",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a",
"/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1",
"/ModDate": "D:20260114065508-05\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1104860,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 62
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "cbeb3c3f7fe323cfbe24f15d85f85350223bc143012681dc9f250cbce619aec5",
"source_hash": "2a0570a81178ae661cfd263c6b7a18c5079e413f202dc9e3df4f4f6602b8aa24",
"txt_hash": "620d6dbebb27f149825d971966d562c354c46633c89366d40a4cff22ead6b6c3"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When operated in approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/January 2026_250226_0720.pdf",
"date_sunset": "2031-01-27",
"description": "The vSRX Virtual Firewall delivers a complete virtual firewall solution, including advanced security, robust networking, and automated virtual machine life cycle management capabilities for service providers and enterprises. vSRX empowers security professionals to deploy and scale firewall protection in highly dynamic environments.",
"embodiment": "Multi-Chip Stand Alone",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Physical security: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Juniper Networks vSRX 3.0 Virtual Firewall",
"module_type": "Software",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-01-28",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "Juniper Networks, Inc.",
"vendor_url": "http://www.juniper.net"
}
}