Junos® OS Evolved MACsec Cryptographic Library

Certificate details

Certificate ID #5490
Status active
Validation dates 17.08.2026
Sunset date 01-10-2029
Standard FIPS 140-3
Security level 1
Type Software
Embodiment MultiChipStand
Caveat When operated with module Junos® OS Evolved OpenSSL Cryptographic Module version 3.0.8 validated to FIPS 140-3 under Cert. #5400 in approved mode, and module Junos® OS Evolved Kernel Cryptographic Module version 2.0 validated to FIPS 140-3 under Cert. #5399, operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. The module generates random strings whose strength is modified by available entropy
Exceptions
  • Physical security: N/A
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description Junos® OS Evolved MACsec Cryptographic Library is a shared library in software, which provides cryptographic services for key wrapping, key derivation and random number generation.
Vendor Juniper Networks, Inc. http://www.juniper.net
Lab atsec information security corporation
Algorithms
  • AES-CMACA4156
  • AES-ECBA4156
  • AES-KWA4156
  • HMAC DRBGA3605
  • HMAC-SHA2-256A4246
References

This certificate's webpage directly references 2 certificates, transitively this expands into 2 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES-, AES, CAST, HMAC, CMAC
Schemes
MAC
Randomness
DRBG, RNG, RBG
Libraries
OpenSSL
Block cipher modes
ECB, CBC

Security level
Level 1, level 1

Cross-references

Outgoing
  • 5400 - active - Junos® OS Evolved OpenSSL Cryptographic Module
  • 5399 - active - Junos® OS Evolved Kernel Cryptographic Module
Creation date D:20260817081542-04'00'
Modification date D:20260817081542-04'00'
Pages 29
Creator Microsoft® Word for Microsoft 365
Producer Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5490,
  "dgst": "ac4584b90286aec1",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-256A4246",
        "#A3605",
        "AES-ECBA4156",
        "AES-KWA4156",
        "AES-CMACA4156",
        "#A4156",
        "#A4246",
        "HMAC DRBGA3605"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "-"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      }
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": [
        "5399",
        "5400"
      ]
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      }
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": [
        "5399",
        "5400"
      ]
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES- CMAC",
            "cavpCertName": "A4156",
            "properties": "Direction - Generation, Verification Key Length - 128, 256 MAC Length - MAC Length: 128 Message Length - Message Length: 8-524288 Increment 8",
            "reference": "SP 800-38B"
          },
          {
            "algorithm": "AES-ECB",
            "cavpCertName": "A4156",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-KW",
            "cavpCertName": "A4156",
            "properties": "Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 128, 256",
            "reference": "SP 800-38F"
          },
          {
            "algorithm": "Operating System",
            "cavpCertName": "Hardware Platform",
            "properties": "Processors",
            "reference": "PAA/PAI"
          },
          {
            "algorithm": "Junos\u00ae OS Evolved version 22.4",
            "cavpCertName": "Juniper Networks\u00ae Packet Transport Router Model PTX10001-36MR",
            "properties": "Intel\u00ae Xeon\u00ae D-2163IT",
            "reference": "No"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Wraps AES key",
            "indicator": "ssh_aes_key_wrap() returns 0",
            "inputs": "Key to wrap, Key wrappin g key",
            "name": "Key wrapping",
            "outputs": "Wrapped key",
            "rolesSspAccess": "Crypto Officer - AES key: W,E",
            "secFunImpl": "Key wrapping"
          },
          {
            "description": "Unwraps AES key",
            "indicator": "ssh_aes_key_unwrap( ) returns 0",
            "inputs": "Wrappe d key, Key wrappin g key",
            "name": "Key unwrapping",
            "outputs": "Unwrappe d key",
            "rolesSspAccess": "Crypto Officer - AES key: W,E",
            "secFunImpl": "Key unwrapping"
          },
          {
            "description": "Compute a MAC tag",
            "indicator": "ssh_mac*() functions return 0",
            "inputs": "Message, AES- CMAC key",
            "name": "Message authenticatio n",
            "outputs": "MAC tag",
            "rolesSspAccess": "Crypto Officer - AES key: W,E",
            "secFunImpl": "Message authenticatio n"
          },
          {
            "description": "Generate random bytes (provided by bound",
            "indicator": "ssh_random_get_byte s() returns SSH_CRYPTO_OK",
            "inputs": "Entropy of requeste d bitstring",
            "name": "[EVM] Random number generation",
            "outputs": "Random bytes",
            "rolesSspAccess": "Crypto Officer - [EVM] DRBG entropy input string:",
            "secFunImpl": "Random number generation"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-KW Encrypt",
            "condition": "Test runs at power-on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128/256-bit keys, encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-KW Decrypt",
            "condition": "Test runs at power-on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128/256-bit keys, decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-CMAC (A4156)",
            "condition": "Test runs at power-on before module becomes operational",
            "details": "Message authentication",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128-bit key, encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-256 (A4246)",
            "condition": "Test runs at power-on before the integrity test",
            "details": "[EVM] Message authentication",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC DRBG (A3605)",
            "condition": "Test runs at power-on before module becomes operational",
            "details": "[EVM] SP 800-90A Rev. 1 (Instantiate, reseed, generate) health test",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "HMAC-SHA2- 512 without prediction resistance",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Failure of CAST Failure of integrity tests",
            "description": "General-purpose error state",
            "indicator": "Error message written in syslog, SSH_CRYPTO_LIBRARY_ERROR",
            "name": "Error",
            "recoveryMethod": "Power cycle"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [],
        "found": false,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Automatically entered whenever an approved service is requested",
            "name": "Approved mode",
            "statusIndicator": "Service API returns 0",
            "type": "Approved"
          },
          {
            "description": "CAVP Cert",
            "name": "Algorithm",
            "statusIndicator": "Reference",
            "type": "Properties"
          },
          {
            "description": "",
            "name": "",
            "statusIndicator": "",
            "type": "Payload Length - Payload Length: 128-4096 Increment 128"
          },
          {
            "description": "CAVP Cert",
            "name": "Algorithm",
            "statusIndicator": "Reference",
            "type": "Properties"
          },
          {
            "description": "A3605",
            "name": "HMAC DRBG",
            "statusIndicator": "SP 800-90A Rev. 1",
            "type": "Prediction Resistance - No Mode - SHA2-256"
          },
          {
            "description": "A4246",
            "name": "HMAC-SHA2- 256",
            "statusIndicator": "FIPS 198-1",
            "type": "MAC - MAC: 256 Key Length - Key Length: 112-524288 Increment 8"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "API input parameters for data.",
            "logicalInterface": "Data Input",
            "physicalPort": "N/A"
          },
          {
            "data": "API output parameters for data.",
            "logicalInterface": "Data Output",
            "physicalPort": "N/A"
          },
          {
            "data": "API function calls, API input parameters for control input.",
            "logicalInterface": "Control Input",
            "physicalPort": "N/A"
          },
          {
            "data": "API return codes, API output parameters for status output.",
            "logicalInterface": "Status Output",
            "physicalPort": "N/A"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "None",
            "name": "Crypto Officer",
            "operatorType": "Crypto Officer",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "1",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "N/A",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "HMAC-SHA2-",
            "details": "[EVM] Integrity",
            "indicator": "Module becomes",
            "testMethod": "MAC tag",
            "testProps": "SHA2-",
            "type": "SW/FW"
          },
          {
            "algorithmOrTest": "256 (A4246)",
            "details": "test for module",
            "indicator": "operational",
            "testMethod": "verification",
            "testProps": "256",
            "type": "Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Cryptographic module",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "API input parameters",
            "sfiAlgo": "",
            "source": "Operator calling application (TOEPP)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroizes the SSPs contained within the cipher handle.",
            "method": "Wipe and Free memory block allocated",
            "operatorId": "By calling the cipher related zeroization API function: macsec_util_zeroize_key() for AES keys",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes and then it is released, which renders the SSP values irretrievable. The completion of the zeroization"
          },
          {
            "description": "",
            "method": "",
            "operatorId": "",
            "rationale": "routine indicates that the zeroization procedure succeeded."
          },
          {
            "description": "Automatically zeroized by the module when no longer needed",
            "method": "Automatic",
            "operatorId": "N/A",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
          },
          {
            "description": "De-allocates the volatile memory used to store SSPs",
            "method": "Module Reset",
            "operatorId": "By unloading and reloading the module",
            "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Temporary storage for SSPs used by the module as part of service execution.",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {},
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 1
        },
        "ECB": {
          "ECB": 1
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "OpenSSL": {
          "OpenSSL": 5
        }
      },
      "crypto_protocol": {},
      "crypto_scheme": {
        "MAC": {
          "MAC": 11
        }
      },
      "device_model": {},
      "ecc_curve": {},
      "eval_facility": {
        "atsec": {
          "atsec": 3
        }
      },
      "fips_cert_id": {
        "Cert": {
          "#5399": 1,
          "#5400": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES key 128, 256": 1,
          "SHA2-256": 3
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 2,
          "level 1": 1
        }
      },
      "hash_function": {},
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 16
        },
        "RNG": {
          "RBG": 2,
          "RNG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140": 1,
          "FIPS 140-3": 34,
          "FIPS 198-1": 2,
          "FIPS PUB 140-3": 2
        },
        "NIST": {
          "SP 800-38A": 2,
          "SP 800-38B": 2,
          "SP 800-38F": 2,
          "SP 800-90A": 4,
          "SP 800-90B": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 11,
            "AES-": 3
          },
          "CAST": {
            "CAST": 12
          }
        },
        "constructions": {
          "MAC": {
            "CMAC": 5,
            "HMAC": 13
          }
        }
      },
      "tee_name": {},
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-256A4246",
        "AES-ECBA4156",
        "AES-KWA4156",
        "AES-CMACA4156",
        "HMAC DRBGA3605"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A3605",
        "#A4156",
        "#A4246"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260817081542-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260817081542-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 574095,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://doi.org/10.6028/NIST.SP.800-38B",
          "https://doi.org/10.6028/NIST.FIPS.140-3",
          "https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
          "http://www.atsec.com/",
          "https://doi.org/10.6028/NIST.FIPS.198-1",
          "https://doi.org/10.6028/NIST.SP.800-38F",
          "https://doi.org/10.6028/NIST.SP.800-38A",
          "https://doi.org/10.6028/NIST.SP.800-90Ar1",
          "http://www.juniper.net/"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 29
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "638350542e7fccef4892e973c4067475e4d149716afadf5e37cefef4cea3f9da",
      "source_hash": "f3f5f36605eb76fe70013dd137ce7b6d255cb73e99af929ccebbfee23b40cd0f",
      "txt_hash": "b55e2583e620d57fca6f3e303cd63fe60d7f19b2b3072bb77fdb23eeedbd4410"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When operated with module Junos\u00ae OS Evolved OpenSSL Cryptographic Module version 3.0.8 validated to FIPS 140-3 under Cert. #5400 in approved mode, and module Junos\u00ae OS Evolved Kernel Cryptographic Module version 2.0 validated to FIPS 140-3 under Cert. #5399, operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. The module generates random strings whose strength is modified by available entropy",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
    "date_sunset": "2029-10-01",
    "description": "Junos\u00ae OS Evolved MACsec Cryptographic Library is a shared library in software, which provides cryptographic services for key wrapping, key derivation and random number generation.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Physical security: N/A",
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {
      "5399": 1,
      "5400": 1
    },
    "module_name": "Junos\u00ae OS Evolved MACsec Cryptographic Library",
    "module_type": "Software",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-08-17",
        "lab": "atsec information security corporation",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Juniper Networks, Inc.",
    "vendor_url": "http://www.juniper.net"
  }
}