{"_type": "sec_certs.sample.fips.FIPSCertificate", "dgst": "9ff8476644903ba6", "cert_id": 5150, "web_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.WebData", "module_name": "Juniper Networks vSRX 3.0 Virtual Firewall", "validation_history": [{"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry", "date": "2026-01-28", "validation_type": "Initial", "lab": "Acumen Security"}], "vendor_url": "http://www.juniper.net", "vendor": "Juniper Networks, Inc.", "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/January 2026_250226_0720.pdf", "module_type": "Software", "standard": "FIPS 140-3", "status": "active", "level": 1, "caveat": "When operated in approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.", "exceptions": ["Roles, services, and authentication: Level 3", "Physical security: N/A", "Non-invasive security: N/A", "Mitigation of other attacks: N/A"], "embodiment": "Multi-Chip Stand Alone", "description": "The vSRX Virtual Firewall delivers a complete virtual firewall solution, including advanced security, robust networking, and automated virtual machine life cycle management capabilities for service providers and enterprises. vSRX empowers security professionals to deploy and scale firewall protection in highly dynamic environments.", "tested_conf": null, "hw_versions": null, "fw_versions": null, "sw_versions": null, "mentioned_certs": {}, "historical_reason": null, "date_sunset": "2031-01-27", "revoked_reason": null, "revoked_link": null}, "pdf_data": {"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData", "keywords": {"fips_cert_id": {"Cert": {"#1": 1}}, "fips_security_level": {"Level": {"Level 1": 4, "level 1": 1, "level 2": 2}}, "fips_certlike": {"Certlike": {"HMAC-SHA-1": 4, "HMAC- SHA-1": 2, "SHA2-256": 22, "SHA2-384": 4, "SHA2-512": 10, "SHA-1": 10, "SHA2- 384": 1, "SHA- 256": 2, "SHA2- 256": 10, "SHA2- 512": 3, "SHA-2- 512": 1, "SHA1": 1, "PKCS #1": 2, "AES-128": 1, "AES-192": 1, "AES-256": 1, "AES (128": 1, "AES- 128": 1, "AES- 192": 1, "AES- 256": 1, "DRBG 256": 1, "DRBG 440": 1}}, "vendor": {}, "eval_facility": {}, "symmetric_crypto": {"AES_competition": {"AES": {"AES-128": 1, "AES-192": 1, "AES-256": 1, "AES": 5, "AES-": 23}, "CAST": {"CAST": 65}}, "DES": {"3DES": {"TDES": 1}}, "miscellaneous": {"Blowfish": {"Blowfish": 3}}, "constructions": {"MAC": {"HMAC": 26}}}, "asymmetric_crypto": {"ECC": {"ECDH": {"ECDH": 44}, "ECDSA": {"ECDSA": 72}}, "FF": {"DH": {"Diffie-Hellman": 5, "DH": 44}, "DSA": {"DSA": 4}}}, "pq_crypto": {}, "hash_function": {"SHA": {"SHA1": {"SHA-1": 10, "SHA1": 1}}, "MD": {"MD5": {"MD5": 1}}, "RIPEMD": {"RIPEMD160": 2}}, "crypto_scheme": {"MAC": {"MAC": 3}, "KA": {"Key Agreement": 7}}, "crypto_protocol": {"SSH": {"SSH": 180, "SSHv2": 8}, "IKE": {"IKEv1": 5, "IKEv2": 6, "IKE": 11}, "IPsec": {"IPsec": 13}}, "randomness": {"PRNG": {"DRBG": 28}, "RNG": {"RBG": 2}}, "cipher_mode": {"CBC": {"CBC": 20}}, "ecc_curve": {"NIST": {"P-256": 48, "P-384": 18, "P-521": 12, "prime256v1": 2}}, "crypto_engine": {}, "tls_cipher_suite": {}, "crypto_library": {}, "vulnerability": {}, "side_channel_analysis": {}, "device_model": {}, "tee_name": {"AMD": {"PSP": 8}, "IBM": {"SSC": 10}}, "os_name": {}, "cplc_data": {}, "ic_data_group": {}, "standard_id": {"FIPS": {"FIPS 140-3": 12, "FIPS186-5": 27, "FIPS 186-5": 7, "FIPS 198-1": 6, "FIPS 180-4": 8, "FIPS18": 6, "FIPS 1403": 1}, "NIST": {"SP 800-38A": 4, "SP 800-90A": 1, "SP 800-56A": 4, "SP 800-135": 3, "NIST SP 800-90B": 3}, "PKCS": {"PKCS #1": 1}, "X509": {"X.509": 2}}, "javacard_version": {}, "javacard_api_const": {}, "javacard_packages": {}, "certification_process": {}}, "policy_metadata": {"pdf_file_size_bytes": 1104860, "pdf_is_encrypted": false, "pdf_number_of_pages": 62, "/CreationDate": "D:20260114065508-05'00'", "/Creator": "Microsoft\u00ae Word for Microsoft 365", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ActionId": "44656ec2-9547-4acd-a129-1b6e89f55d00", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_ContentBits": "1", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Enabled": "true", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Method": "Privileged", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Name": "UNCLASSIFIED", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SetDate": "2026-01-13T13:53:01Z", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_SiteId": "da9cbe40-ec1e-4997-afb3-17d87574571a", "/MSIP_Label_4dd2c6e0-f1e3-4cf2-bd0b-256ab4cff3af_Tag": "10, 0, 1, 1", "/ModDate": "D:20260114065508-05'00'", "/Producer": "Microsoft\u00ae Word for Microsoft 365", "pdf_hyperlinks": {"_type": "Set", "elements": ["https://csrc.nist.gov/projects/cryptographic-module-validation-program"]}}, "module_algorithms": {"_type": "Set", "elements": ["AES-CBCA3343", "HMAC-SHA2-512A3342", "RSA SigVer (FIPS186-5)A3342", "HMAC-SHA-1A3342", "ECDSA SigVer (FIPS186-5)A3342", "RSA SigGen (FIPS186-5)A3342", "KAS-ECC-SSC Sp800-56Ar3A3342", "ECDSA KeyGen (FIPS186-5)A3342", "HMAC DRBGA3335", "KDF IKEv2A3343", "KAS-FFC-SSC Sp800-56Ar3A3342", "RSA KeyGen (FIPS186-5)A3342", "SHA2-512A3342", "SHA-1A3342", "ECDSA KeyVer (FIPS186-5)A3342", "AES-CTRA3342", "HMAC-SHA2-256A3343", "KDF SSHA3341", "Safe Primes Key GenerationA3342", "KDF IKEv1A3343", "SHA2-256A3343", "ECDSA SigGen (FIPS186-5)A3342", "Safe Primes Key VerificationA3342"]}, "policy_algorithms": {"_type": "Set", "elements": ["#A3340", "#A3342", "#A3339", "#A3343", "#A3335", "#A3341"]}, "is_br1_format": true, "br1_deviations": 0, "br1_tables": {"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables", "security_levels": {"section": 1, "subsection": 2, "found": true, "entries": [{"section": "1", "title": "General", "level": "1"}, {"section": "2", "title": "Cryptographic module specification", "level": "1"}, {"section": "3", "title": "Cryptographic module interfaces", "level": "1"}, {"section": "4", "title": "Roles, services, and authentication", "level": "3"}, {"section": "5", "title": "Software/Firmware security", "level": "1"}, {"section": "6", "title": "Operational environment", "level": "1"}, {"section": "7", "title": "Physical security", "level": "N/A"}, {"section": "8", "title": "Non-invasive security", "level": "N/A"}, {"section": "9", "title": "Sensitive security parameter management", "level": "1"}, {"section": "10", "title": "Self-tests", "level": "1"}, {"section": "11", "title": "Life-cycle assurance", "level": "1"}, {"section": "12", "title": "Mitigation of other attacks", "level": "N/A"}, {"section": "", "title": "Overall Level", "level": "1"}]}, "tested_module_id_hw": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_module_id_hw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "tested_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": true, "entries": [{"operatingSystem": "Junos OS 22.2R2-S2.3", "hardwarePlatform": "HP ProLiant DL380 Gen9 Server", "processors": "Intel Xeon E5- 2660 v4", "paa_pai": "No", "hypervisorHostOs": "VMware ESXi 7.0", "version": "Junos OS 22.2R2-S2.3"}, {"operatingSystem": "Junos OS 22.2R2-S2.3", "hardwarePlatform": "PacStar 451 Server", "processors": "Intel Xeon E- 2254ML", "paa_pai": "No", "hypervisorHostOs": "VMware ESXi 7.0", "version": "Junos OS 22.2R2-S2.3"}]}, "vendor_affirmed_op_env_sw_fw_hy": {"section": 2, "subsection": 2, "found": false, "entries": []}, "modes_of_operation": {"section": 2, "subsection": 4, "found": true, "entries": [{"name": "Approved mode", "description": "* The operator can verify that the cryptographic module is in the Approved mode by observing the console prompt and running the \"show version\" command; * When operating in the Approved mode, the prompt will read \"<operator>:fips#\" (e.g. crypto-officer:fips#); * The \"show version\" command will allow the", "type": "Approved", "statusIndicator": "global indicator (string 'fips' included in the command prompt)"}, {"name": "", "description": "Crypto Officer to verify that the validated software version is running on the module; * The Crypto Officer can also use the \"show system fips\" command under configuration mode (returns \"level 1\") to determine if the module is operating in the Approved mode; * The Approved mode is entered when the module is configured for it and successfully passes all self-tests (both pre-operational and conditional cryptographic algorithm self-tests (CASTs))", "type": "", "statusIndicator": ""}, {"name": "Non- Approved mode", "description": "* The cryptographic module supports a non- Approved mode of operation; * When operated in the non-Approved mode of operation, the module supports non-Approved algorithms as well as the algorithms supported in the Approved mode of operation * The module must be zeroised to transition from the Approved mode to the non-Approved mode", "type": "Non- Approved", "statusIndicator": "global indicator (implicit indicator based on exclusion of string 'fips' from the command prompt)"}]}, "approved_algorithms": {"section": 2, "subsection": 5, "found": true, "entries": [{"algorithm": "AES-CBC", "cavpCertName": "A3339", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CBC", "cavpCertName": "A3342", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CBC", "cavpCertName": "A3343", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "AES-CTR", "cavpCertName": "A3342", "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256", "reference": "SP 800-38A"}, {"algorithm": "ECDSA KeyGen (FIPS186-5)", "cavpCertName": "A3342", "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA KeyVer (FIPS186-5)", "cavpCertName": "A3342", "properties": "Curve - P-256, P-384, P-521", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigGen (FIPS186-5)", "cavpCertName": "A3342", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No", "reference": "FIPS 186-5"}, {"algorithm": "ECDSA SigVer (FIPS186-5)", "cavpCertName": "A3342", "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512", "reference": "FIPS 186-5"}, {"algorithm": "HMAC DRBG", "cavpCertName": "A3335", "properties": "Prediction Resistance - Yes Mode - SHA2-256", "reference": "SP 800-90A Rev. 1"}, {"algorithm": "HMAC-SHA-1", "cavpCertName": "A3342", "properties": "Key Length - Key Length: 160", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A3335", "properties": "Key Length - Key Length: 160, 256", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A3339", "properties": "Key Length - Key Length: 256", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A3342", "properties": "Key Length - Key Length: 256", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-256", "cavpCertName": "A3343", "properties": "Key Length - Key Length: 256", "reference": "FIPS 198-1"}, {"algorithm": "HMAC-SHA2-512", "cavpCertName": "A3342", "properties": "Key Length - Key Length: 512", "reference": "FIPS 198-1"}, {"algorithm": "KAS-ECC-SSC Sp800-56Ar3", "cavpCertName": "A3342", "properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KAS-FFC-SSC Sp800-56Ar3", "cavpCertName": "A3342", "properties": "Domain Parameter Generation Methods - FC, MODP-2048 Scheme - dhEphem - KAS Role - initiator", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "KDF IKEv1 (CVL)", "cavpCertName": "A3343", "properties": "Authentication Method - Digital Signature, Pre-shared Key Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256, 384, 2048 Hash Algorithm - SHA2-256, SHA2-384 Preshared Key Length - Preshared Key Length: 8-256 Increment 8", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF IKEv2 (CVL)", "cavpCertName": "A3343", "properties": "Diffie-Hellman Shared Secret Length - Diffie- Hellman Shared Secret Length: 256, 384, 2048 Derived Keying Material Length - Derived Keying Material Length: 1136-2432 Increment 8 Hash Algorithm - SHA2-256, SHA2-384", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "KDF SSH (CVL)", "cavpCertName": "A3341", "properties": "Cipher - AES-128, AES-192, AES-256, TDES Hash Algorithm - SHA-1, SHA2-256, SHA2- 384", "reference": "SP 800-135 Rev. 1"}, {"algorithm": "RSA KeyGen (FIPS186-5)", "cavpCertName": "A3342", "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigGen (FIPS186-5)", "cavpCertName": "A3342", "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5", "reference": "FIPS 186-5"}, {"algorithm": "RSA SigVer (FIPS186-5)", "cavpCertName": "A3342", "properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5", "reference": "FIPS 186-5"}, {"algorithm": "Safe Primes Key Generation", "cavpCertName": "A3342", "properties": "Safe Prime Groups - MODP-2048", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "Safe Primes Key Verification", "cavpCertName": "A3342", "properties": "Safe Prime Groups - MODP-2048", "reference": "SP 800-56A Rev. 3"}, {"algorithm": "SHA-1", "cavpCertName": "A3342", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A3335", "properties": "Message Length - Message Length: 0-51200 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A3339", "properties": "Message Length - Message Length: 8-51200 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A3342", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-256", "cavpCertName": "A3343", "properties": "Message Length - Message Length: 0-51200 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A3335", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A3340", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}, {"algorithm": "SHA2-512", "cavpCertName": "A3342", "properties": "Message Length - Message Length: 0-65536 Increment 8", "reference": "FIPS 180-4"}]}, "vendor_affirmed_algos": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "CKG - Section 4", "algoPropList": "Key Type :Symmetric and Asymmetric", "implName": "N/A", "reference": "NIST SP800-133r2 Section 4: Symmetric key generation and Asymmetric seed generation using an unmodified output from an Approved DRBG (example 1); The module supports the following per NIST SP 800-133r2: 1. Section 5.1: Key Pairs for Digital Signature Schemes 2. Section 5.2: Key Pairs for Key Establishment 3. Section 6.2.1: Derivation of symmetric keys"}]}, "non_approved_allowed_algos": {"section": 2, "subsection": 5, "found": false, "entries": []}, "non_approved_allowed_NSC": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "SHA2-256 (Junos 22.2R2- S2.3 - LibMD Implementation)", "caveat": "no security claimed", "use": "Used to store operator passwords in hashed form, per IG 2.4.A: Use of a non-approved cryptographic algorithm to \"obfuscate\" a CSP"}, {"name": "SHA-1 (Junos 22.2R2- S2.3 - Kernel Implementation)", "caveat": "no security claimed", "use": "Used for an extraneous check in the Kernel, per IG 2.4.A: Use of an approved, non-approved or proprietary algorithm for a purpose that is not security relevant"}]}, "non_approved_not_allowed": {"section": 2, "subsection": 5, "found": true, "entries": [{"name": "RSA with key size less than 2048", "use": "SSH"}, {"name": "ECDSA with ed25519 curve", "use": "SSH"}, {"name": "EC Diffie-Hellman with ed25519 curve", "use": "SSH"}, {"name": "ARCFOUR", "use": "SSH"}, {"name": "Blowfish", "use": "SSH"}, {"name": "CAST", "use": "SSH"}, {"name": "DSA (SignGen, SigVer, non-compliant)", "use": "SSH"}, {"name": "HMAC-MD5", "use": "SSH"}, {"name": "HMAC-RIPEMD160", "use": "SSH"}, {"name": "UMAC", "use": "SSH"}]}, "ports_interfaces": {"section": 3, "subsection": 1, "found": true, "entries": [{"physicalPort": "N/A", "logicalInterface": "Data Input", "data": "Virtual Ethernet Ports, Virtual Serial Ports"}, {"physicalPort": "N/A", "logicalInterface": "Data Output", "data": "Virtual Ethernet Ports, Virtual Serial Ports"}, {"physicalPort": "N/A", "logicalInterface": "Control Input", "data": "Virtual Ethernet Ports, Virtual Serial Ports"}, {"physicalPort": "N/A", "logicalInterface": "Status Output", "data": "Virtual Ethernet Ports, Virtual Serial Ports"}]}, "authentication_methods": {"section": 4, "subsection": 1, "found": true, "entries": [{"name": "Username and password over the console and SSH", "description": "* The module enforces 10- character passwords (at minimum) chosen from the 96 human readable ASCII characters; The maximum password length is 20- characters; Thus, the probability of a successful random attempt is 1/(96^10), which is less than 1/1,000,000 (million); * The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0 time to process), no timed access is enforced; Upon the third attempt, the module enforces a 5-second delay; Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g., 4th failed attempt = 10-second delay, 5th failed attempt = 15-second delay, 6th failed attempt = 20- second delay, 7th failed attempt = 25-second delay); This leads to a maximum of 7 possible attempts in a one-minute period for each getty; The best approach for the attacker would be to disconnect after 4 failed attempts and wait for a new getty to be spawned; This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts; The probability of a success with multiple consecutive attempts in", "mechanism": "SHA2-512 (A3340)", "strength": "1/(96^10)", "perMinute": "9/(96^10)"}, {"name": "", "description": "a one-minute period is 9/(96^10), which is less than 1/100,000", "mechanism": "", "strength": "", "perMinute": ""}, {"name": "Username and ECDSA public key over SSH", "description": "* The module supports ECDSA (P-256, P-384, and P-521), which has a minimum equivalent computational resistance to attack of either 2^128, 2^192 or 2^256 depending on the curve; Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one-minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^128), which is less than 1/100,000", "mechanism": "ECDSA SigVer (FIPS186-5) (A3342)", "strength": "1/(2^128)", "perMinute": "15,000/(2^128)"}, {"name": "Username and RSA public key over SSH", "description": "* The module supports RSA (2048, 3072, 4096 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million) * Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one- minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^112), which is less than 1/100,000", "mechanism": "RSA SigVer (FIPS186-5) (A3342)", "strength": "1/ (2^112)", "perMinute": "15,000/(2^112)"}]}, "roles": {"section": 4, "subsection": 2, "found": true, "entries": [{"name": "Super-user", "type": "Identity", "operatorType": "Crypto Officer (CO)", "authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH"}, {"name": "Operator", "type": "Identity", "operatorType": "User", "authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH"}, {"name": "Read-only", "type": "Identity", "operatorType": "User", "authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH"}, {"name": "Root", "type": "Identity", "operatorType": "Crypto Officer (CO)", "authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH"}, {"name": "Unauthorised", "type": "Identity", "operatorType": "User", "authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH"}]}, "approved_services": {"section": 4, "subsection": 3, "found": true, "entries": [{"name": "Configure security (security relevant)", "description": "Security relevant configuratio n (SSH, authenticati on data)", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Commands (SSH configuration: set system services ssh root-login allow)", "outputs": "Traffic", "secFunImpl": "DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen2 RSA KeyGen Passwor d Hash", "rolesSspAccess": "Root - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - SSH Public Host Key: G - User Authentication Public Keys: W - CO Authentication Public Keys: W Super-user - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRBG V value: E -"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - SSH Public Host Key: G - User Authentication Public Keys: W - CO Authentication Public Keys: W"}, {"name": "Configure (non- security relevant)", "description": "Non- security relevant configuratio n", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Commands (miscellaneous commands e.g., for IP address configuration, routing protocols, etc.)", "outputs": "Traffic", "secFunImpl": "Passwor d Hash", "rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E"}, {"name": "Show status", "description": "Query the module status", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Command (show)", "outputs": "CLI output", "secFunImpl": "Passwor d Hash", "rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorised - User Password: E"}, {"name": "Show status (LED)", "description": "LEDs on the module provide physical status output", "indicator": "LED(s) on the chassis turned on", "inputs": "N/A", "outputs": "LED", "secFunImpl": "None", "rolesSspAccess": "Super-user Operator Read-only Unauthorised Root Unauthenticat ed"}, {"name": "Show module's versioning informatio n", "description": "Query the module's versioning information", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Command (show version)", "outputs": "CLI output", "secFunImpl": "Passwor d Hash", "rolesSspAccess": "Super-user - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorised - User Password: E Root - CO Password: E"}, {"name": "Zeroise (Perform zeroisatio n)", "description": "Zeroise: Destroy all SSPs", "indicator": "successf ul deletion of virtual machine", "inputs": "Power (deletion of virtual machine)", "outputs": "N/A", "secFunImpl": "Passwor d Hash", "rolesSspAccess": "Super-user - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRBG V value: Z - HMAC_DRBG Key value: Z - HMAC_DRBG entropy input: Z - HMAC_DRBG"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authentication Public Keys: Z - CO Authentication Public Keys: Z - JuniperRootC A: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z - IKE-PSK: Z - IKE-SKEYID: Z - IKE-SEK: Z - IKE-DH-PRI: Z - ESP-SEK: Z - IKE-DH- PUB: Z Root - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z"}, {"name": "Name", "description": "Description", "indicator": "Indicator", "inputs": "Inputs", "outputs": "Output s", "secFunImpl": "Security Function", "rolesSspAccess": "SSP Access"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "s", "rolesSspAccess": "- SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRBG V value: Z - HMAC_DRBG Key value: Z - HMAC_DRBG entropy input: Z - HMAC_DRBG seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authentication Public Keys: Z - CO Authentication Public Keys: Z - JuniperRootC A: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Client Public Key: Z - IKE-PSK: Z - IKE-SKEYID: Z - IKE-SEK: Z - ESP-SEK: Z - IKE-DH-PRI: Z - IKE-DH- PUB: Z"}, {"name": "Perform approved security functions (SSH connectio n)", "description": "Initiate SSH connection for SSH monitoring and control (CLI)", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Authentication data (Username and password/publi c-key based authentication)", "outputs": "SSH session", "secFunImpl": "KAS1 KAS2 KTS1 ECDSA SigVer DRBG Entropy Souce ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen RSA SigVer Passwor d Hash", "rolesSspAccess": "Super-user - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: G - SSH DH Public Key: G,E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - CO Password: E - CO Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Root - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - CO Password: E - CO Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Operator - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - HMAC_DRBG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Read-only - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG Key value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Unauthorised - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRBG V value: E - HMAC_DRBG entropy input: E - HMAC_DRBG seed: E - ECDH Shared Secret: G,E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authentication Public Keys: E - HMAC_DRBG Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z"}, {"name": "Console Access", "description": "Console monitoring and control (CLI)", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Username, password (set system login user <username> class <crypto- officer/user class> operator authentication plaintext- password)", "outputs": "N/A", "secFunImpl": "Passwor d Hash", "rolesSspAccess": "Super-user - CO Password: E Operator - CO Password: E Read-only - User Password: E Unauthorised - User Password: E Root - CO Password: E"}, {"name": "Perform self-tests (remote reset)", "description": "Software initiated reset, performs self-tests on", "indicator": "Global Approved Mode indicator \"fips\" at the CLI", "inputs": "Control input/reset signal (request vmhost reboot)", "outputs": "N/A", "secFunImpl": "KAS1 KAS2 KTS1 DRBG Entropy Souce", "rolesSspAccess": "Super-user - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session"}, {"name": "", "description": "demand via SSH", "indicator": "combined with successf ul completio n of each service", "inputs": "", "outputs": "", "secFunImpl": "ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen Passwor d Hash CASTs on boot", "rolesSspAccess": "Key: Z - HMAC_DRBG Key value: G,Z - HMAC_DRBG V value: G,Z - HMAC_DRBG entropy input: G,Z - HMAC_DRBG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Software Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authentication Public Keys: E - CO Authentication Public Keys: E Root - SSH ECDH Private Key: Z - SSH DH"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "Private Key: Z - SSH Session Key: Z - HMAC_DRBG Key value: G,Z - HMAC_DRBG V value: G,Z - HMAC_DRBG entropy input: G,Z - HMAC_DRBG seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Software Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authentication Public Keys: E - CO Authentication Public Keys: E"}, {"name": "Perform self-tests (local reset)", "description": "Hardware reset or power cycle", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Control input/reset signal", "outputs": "N/A", "secFunImpl": "CASTs on boot", "rolesSspAccess": "Super-user - Software Integrity Key: E Root - Software Integrity Key: E Operator - Software Integrity Key: E Read-only - Software Integrity Key: E Unauthorised - Software Integrity Key: E Unauthenticat ed - Software Integrity Key: E"}, {"name": "Perform approved security functions (IPsec connectio n)", "description": "Initiate IPsec connection", "indicator": "Global Approved Mode indicator \"fips\" at the CLI combined with successf ul completio n of each service", "inputs": "Commands (set security ipsec security- association sa- name; * set interfaces <name> unit 0 family inet address <ip address>; * set security ike security- association sa- name)", "outputs": "IPsec session", "secFunImpl": "KTS2 KAS3 KAS4", "rolesSspAccess": "Root - IKE-PSK: W,E - IKE-SKEYID: G,E,Z - IKE-SEK: G,E,Z - ESP-SEK: G,E,Z - IKE-DH-PRI: G,E,Z - IKE-DH- PUB: G,R,E,Z Super-user - IKE-PSK: W,E - IKE-SKEYID: G,E,Z - IKE-SEK: G,E,Z - ESP-SEK: G,E,Z"}, {"name": "", "description": "", "indicator": "", "inputs": "", "outputs": "", "secFunImpl": "", "rolesSspAccess": "- IKE-DH-PRI: G,E,Z - IKE-DH- PUB: G,R,E,Z"}]}, "non_approved_services": {"section": 4, "subsection": 4, "found": true, "entries": [{"name": "Configure security (security relevant)", "description": "Security relevant configuration", "alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC", "role": "Root, Super-user"}, {"name": "Perform approved security functions (SSH connection)", "description": "Initiate SSH connection for SSH monitoring and control (CLI)", "alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie-Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC", "role": "Root, Super-user, Operator, Read-Only, Unauthorized"}]}, "mechanisms_actions": {"section": 7, "subsection": 1, "found": false, "entries": []}, "storage_areas": {"section": 9, "subsection": 1, "found": true, "entries": [{"name": "NVRAM", "description": "Non-Volatile Random Access Memory", "persistance": "Static"}, {"name": "RAM", "description": "Random Access Memory", "persistance": "Dynamic"}]}, "ssp_io_methods": {"section": 9, "subsection": 2, "found": true, "entries": [{"name": "Entered over SSH - NVRAM", "source": "External endpoint", "dest": "NVRAM", "format": "Encrypted", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": "KTS1"}, {"name": "Loaded at manufacture", "source": "External endpoint", "dest": "NVRAM", "format": "Plaintext", "distribution": "N/A", "entry": "N/A", "sfiAlgo": ""}, {"name": "Entered through the CLI via console", "source": "External endpoint", "dest": "NVRAM", "format": "Plaintext", "distribution": "Manual", "entry": "Direct", "sfiAlgo": ""}, {"name": "connection - NVRAM", "source": "", "dest": "", "format": "", "distribution": "", "entry": "", "sfiAlgo": ""}, {"name": "Input during SSH negotiation", "source": "External endpoint", "dest": "RAM", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Output during SSH negotiation (host key)", "source": "NVRAM", "dest": "External endpoint", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Output during SSH negotiation (Key Agreement public key)", "source": "RAM", "dest": "External endpoint", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}, {"name": "Output during IPsec negotiation", "source": "RAM", "dest": "External endpoint", "format": "Plaintext", "distribution": "Automated", "entry": "Electronic", "sfiAlgo": ""}]}, "ssp_zeroization_methods": {"section": 9, "subsection": 3, "found": true, "entries": [{"method": "Deletion of virtual instance", "description": "Deletion of the vSRX 3.0 instance", "rationale": "Used to provide zeroisation as a service", "operatorId": "Operator initiated"}, {"method": "Power-cycle", "description": "Power cycling the underlying host platform to zeroise temporary SSPs", "rationale": "Power cycling the underlying host platform to zeroise temporary SSPs", "operatorId": "Operator initiated"}, {"method": "Session termination", "description": "Termination of sessions automatically zeroises temporary SSPs used as part of the session", "rationale": "Termination of sessions automatically zeroises temporary SSPs used as part of the session", "operatorId": "Module initiated"}, {"method": "Derivation of session key", "description": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of session key", "rationale": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of session key", "operatorId": "Module initiated"}]}, "self_tests": {"section": 10, "subsection": 1, "found": true, "entries": [{"algorithmOrTest": "Software Integrity Test", "testProps": "Using ECDSA P-256 with SHA2-256", "testMethod": "KAT", "type": "SW/FW Integrity", "indicator": "FIPS Self-tests Passed", "details": "Verify"}]}, "cond_self_tests": {"section": 10, "subsection": 2, "found": true, "entries": [{"algorithmOrTest": "HMAC DRBG (A3335)", "testProps": "Prediction Resistance: Yes Supports Reseed Capabilities: Mode: SHA2- 256 Entropy Input: 256 Nonce: 128 Personalizati", "testMethod": "KAT", "type": "CAST", "indicator": "NIST 800-90 HMAC DRBG Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "", "testProps": "on String Length: 0- 256 Increment 8 Additional Input: 8-256 Increment 8 Returned Bits: 1024", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "HMAC- SHA2- 256 (A3335)", "testProps": "Key Length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA2- 256 Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 128 bits", "testProps": "Key Length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Encrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 192 bits", "testProps": "Key Length: 192 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Encrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Encrypt - 256 bits", "testProps": "Key Length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Encrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 128 bits", "testProps": "Key Length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Decrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 192 bits", "testProps": "Key Length: 192 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Decrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3342) - Decrypt - 256 bits", "testProps": "Key Length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Decrypt", "condition": "During boot"}, {"algorithmOrTest": "HMAC- SHA-1 (A3342)", "testProps": "Key Length: 160 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA-1 Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "HMAC- SHA2- 256 (A3342)", "testProps": "Key Length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA2- 256 Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "HMAC- SHA2- 512 (A3342)", "testProps": "Key Length: 512 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA2- 512 Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A3342) - P-256", "testProps": "Domain Parameter Generation Methods: P- 256", "testMethod": "KAT", "type": "CAST", "indicator": "KAS- ECC- EPHEM- UNIFIED -NOKC Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A3342) - P-384", "testProps": "Domain Parameter Generation Methods: P- 384", "testMethod": "KAT", "type": "CAST", "indicator": "KAS- ECC- EPHEM- UNIFIED -NOKC Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "KAS- FFC- SSC", "testProps": "Domain Parameter Generation", "testMethod": "KAT", "type": "CAST", "indicator": "KAS- FFC- EPHEM-", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "Sp800- 56Ar3 (A3342)", "testProps": "Methods: MODP-2048", "testMethod": "", "type": "", "indicator": "NOKC Known Answer Test: Passed", "details": "", "condition": ""}, {"algorithmOrTest": "KDF SSH (A3341)", "testProps": "Cipher: AES- 128, AES- 192, AES- 256 ; Hash Algorithm: SHA-1, SHA2-256, SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "KDF- SSH- SHA2- 256 Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "RSA SigGen (FIPS18 6-5) (A3342)", "testProps": "Modulus 2048 bits SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "RSA- SIGN Known Answer Test: Passed", "details": "Sign", "condition": "During boot"}, {"algorithmOrTest": "RSA SigVer (FIPS18 6-5) (A3342)", "testProps": "Modulus 2048 bits SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "RSA- VERIFY Known Answer Test: Passed", "details": "Verify", "condition": "During boot"}, {"algorithmOrTest": "ECDSA SigGen (FIPS18 6-5) (A3342)", "testProps": "Curve: P-256 Hash Algorithm: SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "ECDSA- SIGN Known Answer Test: Passed", "details": "Sign", "condition": "During boot"}, {"algorithmOrTest": "ECDSA SigVer (FIPS18 6-5) (A3342)", "testProps": "Curve: P-256 Hash Algorithm: SHA2-256", "testMethod": "KAT", "type": "CAST", "indicator": "ECDSA- VERIFY Known Answer Test: Passed", "details": "Verify", "condition": "During boot"}, {"algorithmOrTest": "SHA2- 512 (A3340)", "testProps": "SHA2-512", "testMethod": "KAT", "type": "CAST", "indicator": "SHA-2- 512 Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "Entropy test - NIST SP", "testProps": "NIST SP 800-90B Repetitive Count Test", "testMethod": "RCT", "type": "CAST", "indicator": "pass", "details": "Cutoff value C = 21", "condition": "During boot and continually"}, {"algorithmOrTest": "800-90B RCT", "testProps": "", "testMethod": "", "type": "", "indicator": "", "details": "", "condition": ""}, {"algorithmOrTest": "Entropy test - NIST SP 800-90B APT", "testProps": "NIST SP 800-90B Adapative Proportion Test", "testMethod": "APT", "type": "CAST", "indicator": "pass", "details": "W = 512; Cutoff value C = 311", "condition": "During boot and continually"}, {"algorithmOrTest": "ECDSA KeyGen (FIPS18 6-5) (A3342)", "testProps": "Curve: P-256 Hash Algorithm: SHA2-256", "testMethod": "PCT", "type": "PCT", "indicator": "0", "details": "Key pair generated for SSP agreement in the context of SSHv2 protocol and for key generation for use in ECDSA signature generation/verificati on", "condition": "On key generation"}, {"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A3342) - PCT", "testProps": "Capabilities: Domain Parameter: MODP2048", "testMethod": "PCT", "type": "PCT", "indicator": "0", "details": "Key pair generated for SSP agreement in the context of SSHv2 protocol", "condition": "On key generation"}, {"algorithmOrTest": "RSA KeyGen (FIPS18 6-5) (A3342)", "testProps": "Modulus: 2048 Hash SHA2-256", "testMethod": "PCT", "type": "PCT", "indicator": "0", "details": "Key pair generated for signature generation/verificati on in the context of SSHv2 protocol", "condition": "On key generation"}, {"algorithmOrTest": "Manual entry test (duplicat e entries)", "testProps": "Duplicate entry test required for entry of operator passwords and IKE-PSK via direct connection to the module's console (serial) interface", "testMethod": "Duplicate entry test required for entry of operator password s and IKE-PSK via direct connectio n to the module's console (serial) interface", "type": "Manu al Entry", "indicator": "Comman d prompt with \"fips\" string provided post completio n of the test", "details": "N/A", "condition": "On configurati on of operator passwords and IKE- PSK"}, {"algorithmOrTest": "KDF IKEv1 (A3343)", "testProps": "IKEv1 (IPSec) KDF", "testMethod": "KAT", "type": "CAST", "indicator": "IKEV1 Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "KDF IKEv2 (A3343)", "testProps": "IKEv2 (IPSec) KDF", "testMethod": "KAT", "type": "CAST", "indicator": "IKEV2 Known Answer Test: Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3343) - Encrypt - 128 bits", "testProps": "Key length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Encrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3343) - Decrypt - 128 bits", "testProps": "Key length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Decryt", "condition": "During boot"}, {"algorithmOrTest": "HMAC- SHA2- 256 (A3343)", "testProps": "Key length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA2- 256 Known Answer Test : Passed", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3339) - Encrypt - 128 bits", "testProps": "Key length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Encrypt", "condition": "During boot"}, {"algorithmOrTest": "AES- CBC (A3339) - Decrypt - 128 bits", "testProps": "Key length: 128 bits", "testMethod": "KAT", "type": "CAST", "indicator": "AES- CBC Known Answer Test : Passed", "details": "Decrypt", "condition": "During boot"}, {"algorithmOrTest": "HMAC- SHA2- 256 (A3339)", "testProps": "Key length: 256 bits", "testMethod": "KAT", "type": "CAST", "indicator": "HMAC- SHA2- 256 Known Answer", "details": "N/A", "condition": "During boot"}, {"algorithmOrTest": "", "testProps": "", "testMethod": "", "type": "", "indicator": "Test : Passed", "details": "", "condition": ""}]}, "error_states": {"section": 10, "subsection": 4, "found": true, "entries": [{"name": "Hard Error state", "description": "If the pre-operation software integrity test, if any of the CASTs or pair-wise consistency tests fail, then the module returns an error indicator, inhibits all data output and enters the hard error state", "conditions": "If the pre- operational software integrity test or if any of the CASTs fail", "recoveryMethod": "N/A", "indicator": "\"FIPS error: self-test failure\" for software integrity failure, \"FIPS error 1: <name of the algorithm> Known Answer Test: Failed\" for CAST failure and -1 for pair-wise consistency test failure"}, {"name": "Soft Error state", "description": "In the event of an APT or RCT health test failure, output from the entropy source is inhibited, all entropy accumulated in the conditioning context is discarded and the start-up health-tests are performed again", "conditions": "If the APT or RCT test fails", "recoveryMethod": "In case of APT and/or RCT failures, new data continues to be tested by the health tests, and once both health tests indicate a \"pass\", the entropy source again outputs data", "indicator": "Entropy data discarded in case of APT/RCT failure"}]}}}, "heuristics": {"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics", "algorithms": {"_type": "Set", "elements": ["AES-CBCA3343", "HMAC-SHA2-512A3342", "RSA SigVer (FIPS186-5)A3342", "HMAC-SHA-1A3342", "#A3342", "ECDSA SigVer (FIPS186-5)A3342", "KAS-ECC-SSC Sp800-56Ar3A3342", "ECDSA KeyGen (FIPS186-5)A3342", "HMAC DRBGA3335", "KDF IKEv2A3343", "KAS-FFC-SSC Sp800-56Ar3A3342", "Safe Primes Key VerificationA3342", "RSA KeyGen (FIPS186-5)A3342", "SHA2-512A3342", "#A3340", "SHA-1A3342", "ECDSA KeyVer (FIPS186-5)A3342", "AES-CTRA3342", "#A3335", "HMAC-SHA2-256A3343", "KDF SSHA3341", "#A3341", "Safe Primes Key GenerationA3342", "#A3339", "#A3343", "KDF IKEv1A3343", "SHA2-256A3343", "ECDSA SigGen (FIPS186-5)A3342", "RSA SigGen (FIPS186-5)A3342"]}, "extracted_versions": {"_type": "Set", "elements": ["3.0"]}, "cpe_matches": null, "verified_cpe_matches": null, "related_cves": null, "policy_prunned_references": {"_type": "Set", "elements": []}, "module_prunned_references": {"_type": "Set", "elements": []}, "policy_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "module_processed_references": {"_type": "sec_certs.sample.certificate.References", "directly_referenced_by": null, "indirectly_referenced_by": null, "directly_referencing": null, "indirectly_referencing": null}, "direct_transitive_cves": null, "indirect_transitive_cves": null}, "state": {"_type": "sec_certs.sample.fips.InternalState", "module": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": null, "txt_hash": null, "json_hash": null}, "policy": {"_type": "sec_certs.sample.document_state.DocumentState", "download_ok": true, "convert_ok": true, "extract_ok": true, "source_hash": "2a0570a81178ae661cfd263c6b7a18c5079e413f202dc9e3df4f4f6602b8aa24", "txt_hash": "620d6dbebb27f149825d971966d562c354c46633c89366d40a4cff22ead6b6c3", "json_hash": "cbeb3c3f7fe323cfbe24f15d85f85350223bc143012681dc9f250cbce619aec5"}}}