This page was not yet optimized for use on mobile devices.
Juniper Networks PTX10008 and PTX10016 Packet Transport Routers
Certificate details
| Certificate ID | #4961 |
|---|---|
| Status | active |
| Validation dates | 07.02.2025 |
| Sunset date | 06-02-2027 |
| Standard | FIPS 140-3 |
| Security level | 1 |
| Type | Hardware |
| Embodiment | Multi-Chip Stand Alone |
| Caveat | Interim validation. When operated in Approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs. |
| Exceptions |
|
| Description | The cryptographic module provides for an encrypted connection, using SSH, between the management station and the module. The cryptographic module also provides for an encrypted connection, using MACsec, between devices. |
| Vendor | Juniper Networks, Inc. http://www.juniper.net |
| Lab | Acumen Security |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES, AES-128, AES-192, AES-256, AES-, CAST, TDES, Blowfish, HMAC, CMACAsymmetric Algorithms
RSA 2048, ECDH, ECDSA, Diffie-Hellman, DH, DSAHash functions
SHA-1, RIPEMD160Schemes
MAC, Key AgreementProtocols
SSH, SSHv2Randomness
DRBG, RBGElliptic Curves
P-256, P-384, P-521, prime256v1Block cipher modes
CBC, CTR, GCMTrusted Execution Environments
PSP, SSCSecurity level
Level 1, Level 3, level 1Standards
FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS18, SP 800-38A, SP 800-38B, SP 800-38D, SP 800-38F, SP 800-90A, SP 800-56A, SP 800-108, SP 800-135, NIST SP 800-108, NIST SP 800-90B, PKCS 1, X.509Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 4961,
"dgst": "b0ff7bdc481ed43a",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"ECDSA KeyGen (FIPS186-4)A4301",
"KAS-FFC-SSC Sp800-56Ar3A4301",
"AES-CTRA4301",
"KAS-ECC-SSC Sp800-56Ar3A4301",
"SHA-1A4301",
"KDF SSHA4301",
"RSA SigGen (FIPS186-4)A4301",
"HMAC-SHA2-512A4301",
"SHA2-256A4303",
"SHA2-512A4306",
"AES-ECBA4304",
"AES-GCMAES 4369",
"ECDSA KeyVer (FIPS186-4)A4301",
"RSA KeyGen (FIPS186-4)A4301",
"KDF SP800-108A4304",
"ECDSA SigVer (FIPS186-4)A4301",
"AES-CMACA4304",
"AES-KWA4304",
"Safe Primes Key VerificationA4301",
"RSA SigVer (FIPS186-4)A4301",
"Safe Primes Key GenerationA4301",
"#A4306",
"#A4303",
"HMAC-SHA-1A4301",
"#A4304",
"ECDSA SigGen (FIPS186-4)A4301",
"AES-XPNAES 4369",
"AES-CBCA4304",
"HMAC DRBGA4303",
"HMAC-SHA2-256A4303",
"#A4301"
]
},
"cpe_matches": {
"_type": "Set",
"elements": [
"cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*",
"cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*"
]
},
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A4301",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CBC",
"cavpCertName": "A4304",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CMAC",
"cavpCertName": "A4304",
"properties": "Direction - Generation, Verification Key Length - 128, 256",
"reference": "SP 800-38B"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A4301",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A4301",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-ECB",
"cavpCertName": "A4304",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-GCM",
"cavpCertName": "AES 4369",
"properties": "Direction - Decrypt, Encrypt IV Generation - External Key Length - 128, 256",
"reference": "SP 800-38D"
},
{
"algorithm": "AES-KW",
"cavpCertName": "A4304",
"properties": "Direction - Decrypt, Encrypt Key Length - 128",
"reference": "SP 800-38F"
},
{
"algorithm": "AES-XPN",
"cavpCertName": "AES 4369",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 IV Generation - External",
"reference": "SP 800-38D"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigGen (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "ECDSA SigVer (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-4"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A4301",
"properties": "Prediction Resistance - Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A4303",
"properties": "Prediction Resistance - Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A4303",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A4301",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A4301",
"properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KAS-FFC-SSC Sp800-56Ar3",
"cavpCertName": "A4301",
"properties": "Domain Parameter Generation Methods - FC, MODP-2048 Scheme - dhEphem - KAS Role - initiator",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SP800-108",
"cavpCertName": "A4304",
"properties": "KDF Mode - Counter Supported Lengths - Supported Lengths: 128, 256",
"reference": "SP 800-108 Rev. 1"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A4301",
"properties": "Cipher - AES-128, AES-192, AES-256, TDES Hash Algorithm - SHA-1, SHA2-256, SHA2-384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Key Generation Mode - B.3.3 Modulo - 2048, 3072, 4096 Primality Tests - Table C.2 Private Key Format - Standard",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigGen (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Signature Type - PKCS 1.5 Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "RSA SigVer (FIPS186-4)",
"cavpCertName": "A4301",
"properties": "Signature Type - PKCS 1.5 Modulo - 2048, 3072, 4096",
"reference": "FIPS 186-4"
},
{
"algorithm": "Safe Primes Key Generation",
"cavpCertName": "A4301",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "Safe Primes Key Verification",
"cavpCertName": "A4301",
"properties": "Safe Prime Groups - MODP-2048",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A4303",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4301",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4303",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A4306",
"properties": "Message Length - Message Length: 0- 65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Security relevant configurati on (SSH, authenticat ion data)",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Commands (SSH configuration : set system services ssh root-login allow)",
"name": "Configur e security (security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Root - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - SSH Public Host Key: G - User Authenticatio",
"secFunImpl": "DRBG DRBG2 Password Hash CKG"
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu ts",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "n Public Keys: W - CO Authenticatio n Public Keys: W Super-user - SSH Private Host Key: G - User Password: W,E - CO Password: W,E - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - SSH Public Host Key: G - User Authenticatio n Public Keys: W - CO Authenticatio n Public Keys: W",
"secFunImpl": "Functions"
},
{
"description": "Non- security relevant configurati on",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success",
"inputs": "Commands (miscellaneo us commands e.g., for IP address configuration , routing",
"name": "Configur e (non- security relevant)",
"outputs": "Traffic",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "",
"indicator": "ful completi on of each service",
"inputs": "protocols, etc.)",
"name": "",
"outputs": "",
"rolesSspAccess": "",
"secFunImpl": ""
},
{
"description": "Query the module status",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Command (show)",
"name": "Show status",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Root - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorise d - User Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "LEDs on the module provide physical status output",
"indicator": "LED(s) on the chassis turned on",
"inputs": "N/A",
"name": "Show status (LED)",
"outputs": "LED",
"rolesSspAccess": "Super-user Operator Read-only Unauthorise d Root Unauthentic ated",
"secFunImpl": "None"
},
{
"description": "Query the module\u0027s versioning information",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Command (show version)",
"name": "Show module\u0027s versionin g informati on",
"outputs": "CLI output",
"rolesSspAccess": "Super-user - CO Password: E Operator - User Password: E Read-only - User Password: E Unauthorise d - User Password: E Root - CO Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "Destroy all SSPs",
"indicator": "Global Approve d Mode",
"inputs": "Command (request vmhost",
"name": "Zeroise (Perform",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH Private Host",
"secFunImpl": "Password Hash"
},
{
"description": "Descriptio",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "n",
"indicator": "indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "zeroise no- forwarding)",
"name": "zeroisati on)",
"outputs": "ts",
"rolesSspAccess": "Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRB G V value: Z - HMAC_DRB G Key value: Z - HMAC_DRB G entropy input: Z - HMAC_DRB G seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authenticatio n Public Keys: Z - CO Authenticatio n Public Keys: Z - JuniperRoot CA: Z",
"secFunImpl": "Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z - MACsec PSK: Z - MACsec SAK: Z - MACsec KEK: Z - MACsec ICK: Z Root - SSH Private Host Key: Z - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - User Password: Z - CO Password: E,Z - HMAC_DRB G V value: Z - HMAC_DRB G Key value: Z -",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "HMAC_DRB G entropy input: Z - HMAC_DRB G seed: Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: Z - SSH Public Host Key: Z - User Authenticatio n Public Keys: Z - CO Authenticatio n Public Keys: Z - JuniperRoot CA: Z - PackageCA: Z - SSH ECDH Public Key: Z - SSH DH Public Key: Z - SSH ECDH Client Public Key: Z - SSH DH Client Public Key: Z - MACsec PSK: Z - MACsec SAK: Z - MACsec KEK: Z - MACsec ICK: Z",
"secFunImpl": ""
},
{
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Authenticatio n data (Username and password/pu blic-key based authenticatio n)",
"name": "Perform approve d security functions (SSH connecti on)",
"outputs": "SSH sessio n",
"rolesSspAccess": "Super-user - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: G - SSH DH Public Key: G,E,Z - SSH ECDH Public Key: G,E,Z - CO Password: E - CO Authenticatio n Public",
"secFunImpl": "KAS1 KAS2 KTS1 ECDSA SigVer2 DRBG DRBG2 Entropy Souce ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen RSA SigVer Password Hash CKG"
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "ts",
"rolesSspAccess": "Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Root - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicato",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "r",
"inputs": "",
"name": "",
"outputs": "ts",
"rolesSspAccess": "Public Key: G,E,Z - CO Password: E - CO Authenticatio n Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Operator - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "ts",
"rolesSspAccess": "Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - HMAC_DRB G Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Read-only - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G Key value: E - HMAC_DRB G entropy input: E - HMAC_DRB G seed: E - ECDH",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "ts",
"rolesSspAccess": "Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public Key: W,E,Z Unauthorise d - SSH Private Host Key: E - SSH ECDH Private Key: G,E,Z - SSH DH Private Key: G,E,Z - SSH Session Key: G,E,Z - HMAC_DRB G V value: E - HMAC_DRB G entropy input: E",
"secFunImpl": ""
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu ts",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- HMAC_DRB G seed: E - ECDH Shared Secret: G,E,Z - DH Shared Secret: G,E,Z - HMAC Key: G,E,Z - SSH Public Host Key: E - SSH ECDH Public Key: G,E,Z - SSH DH Public Key: G,E,Z - User Password: E - User Authenticatio n Public Keys: E - HMAC_DRB G Key value: E - SSH ECDH Client Public Key: W,E,Z - SSH DH Client Public",
"secFunImpl": "Functions"
},
{
"description": "Console monitoring and control (CLI)",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of",
"inputs": "Username, password (set system login user \u003cusername\u003e class \u003ccrypto- officer/user class\u003e operator authenticatio n plaintext- password)",
"name": "Console Access",
"outputs": "N/A",
"rolesSspAccess": "Key: W,E,Z Super-user - CO Password: E Operator - CO Password: E Read-only - User Password: E Unauthorise d - User Password: E",
"secFunImpl": "Password Hash"
},
{
"description": "",
"indicator": "each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Root - CO Password: E",
"secFunImpl": ""
},
{
"description": "Software initiated reset, performs self-tests on demand via SSH",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Control input/reset signal (request vmhost reboot)",
"name": "Perform self-tests (remote reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DRB G Key value: G,Z - HMAC_DRB G V value: G,Z - HMAC_DRB G entropy input: G,Z - HMAC_DRB G seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO Password: E - Firmware Integrity Key: E - SSH Private Host Key: E",
"secFunImpl": "KAS1 KAS2 KTS1 DRBG DRBG2 Entropy Souce ECDSA KeyGen ECDSA KeyGen2 ECDSA KeyVer ECDSA SigGen RSA KeyGen RSA SigGen Password Hash CKG CASTs on boot"
},
{
"description": "Descriptio n",
"indicator": "Indicato r",
"inputs": "Inputs",
"name": "Name",
"outputs": "Outpu",
"rolesSspAccess": "SSP Access",
"secFunImpl": "Security Functions"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "ts",
"rolesSspAccess": "- SSH Public Host Key: E - User Authenticatio n Public Keys: E - CO Authenticatio n Public Keys: E Root - SSH ECDH Private Key: Z - SSH DH Private Key: Z - SSH Session Key: Z - HMAC_DRB G Key value: G,Z - HMAC_DRB G V value: G,Z - HMAC_DRB G entropy input: G,Z - HMAC_DRB G seed: G,Z - ECDH Shared Secret: Z - DH Shared Secret: Z - HMAC Key: G,E,Z - SSH ECDH Public Key: G,E - SSH DH Public Key: G,E - CO",
"secFunImpl": ""
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Password: E - Firmware Integrity Key: E - SSH Private Host Key: E - SSH Public Host Key: E - User Authenticatio n Public Keys: E - CO Authenticatio n Public Keys: E",
"secFunImpl": ""
},
{
"description": "Hardware reset or power cycle",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Control input/reset signal",
"name": "Perform self-tests (local reset)",
"outputs": "N/A",
"rolesSspAccess": "Super-user - Firmware Integrity Key: E Root - Firmware Integrity Key: E Operator - Firmware Integrity Key: E Read-only - Firmware Integrity Key: E Unauthorise d - Firmware Integrity Key: E Unauthentic ated - Firmware Integrity Key: E",
"secFunImpl": "CASTs on boot"
},
{
"description": "Verification and loading of a validated firmware image into",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI",
"inputs": "Image, commands",
"name": "Load Image",
"outputs": "N/A",
"rolesSspAccess": "Super-user - CO Password: E - Firmware Integrity Key: E",
"secFunImpl": "ECDSA SigVer Password Hash"
},
{
"description": "the router/swit ch",
"indicator": "combine d with success ful completi on of each service",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- JuniperRoot CA: E - PackageCA: E Root - CO Password: E - Firmware Integrity Key: E - JuniperRoot CA: E - PackageCA: E",
"secFunImpl": ""
},
{
"description": "Initiate MACsec connection",
"indicator": "Global Approve d Mode indicator \u0027fips\u0027 at the CLI combine d with success ful completi on of each service",
"inputs": "Commands (set security macsec connectivity- association connectivity- association- name; set security macsec connectivity- association connectivity- association- name pre- shared key)",
"name": "Perform approve d security functions (MACsec connecti on)",
"outputs": "MACs ec sessio n",
"rolesSspAccess": "Root - MACsec PSK: W,E - MACsec SAK: G,R,E - MACsec KEK: G,E - MACsec ICK: G,E Super-user - MACsec PSK: W,E - MACsec SAK: G,R,E - MACsec KEK: G,E - MACsec ICK: G,E",
"secFunImpl": "CKG MACsec Encryption/Decry ption KTS2 MACsec Key Derivation"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "\u2022 The module enforces 10- character passwords (at minimum) chosen from the 96 human readable ASCII characters; The maximum password length is 20- characters; Thus, the probability of a successful random attempt is 1/(96^10), which is less than 1/1,000,000 (million); \u2022 The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0 time to process), no timed access is enforced; Upon the third attempt, the module enforces a 5-second delay; Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g., 4th failed attempt = 10-second delay, 5th failed attempt = 15-second delay, 6th failed attempt = 20- second delay, 7th failed attempt",
"mechanism": "SHA2-512 (A4306)",
"name": "Username and password over the console and SSH",
"perMinute": "9/(96^10)",
"strength": "1/(96^10)"
},
{
"description": "= 25-second delay); This leads to a maximum of 7 possible attempts in a one-minute period for each getty; The best approach for the attacker would be to disconnect after 4 failed attempts and wait for a new getty to be spawned; This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60 mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts; The probability of a success with multiple consecutive attempts in a one-minute period is 9/(96^10), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
},
{
"description": "\u2022 The module supports ECDSA (P-256, P-384, and P-521), which has a minimum equivalent computational resistance to attack of either 2^128, 2^192 or 2^256 depending on the curve; Thus, the probability of a successful random attempt is 1/(2^128), which is less than 1/1,000,000 (million) \u2022 Configurable SSH connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one-minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^128), which is less than 1/100,000",
"mechanism": "ECDSA SigVer (FIPS186-4) (A4301)",
"name": "Username and ECDSA public key over SSH",
"perMinute": "15,000/(2^128)",
"strength": "1/(2^128)"
},
{
"description": "\u2022 The module supports RSA (2048, 3072, 4096 bits), which has a minimum equivalent computational resistance to attack of 2^112 (2048 bits); Thus, the probability of a successful random attempt is 1/ (2^112), which is less than 1/1,000,000 (million) \u2022 Configurable SSH",
"mechanism": "RSA SigVer (FIPS186-4) (A4301)",
"name": "Username and RSA public key over SSH",
"perMinute": "15,000/(2^112)",
"strength": "1/ (2^112)"
},
{
"description": "connection establishment rate limits the number of connection attempts, and thus failed authentication attempts in a one- minute period to a maximum of 15,000 attempts; The probability of a success with multiple consecutive attempts in a one- minute period is 15,000/(2^112), which is less than 1/100,000",
"mechanism": "",
"name": "",
"perMinute": "",
"strength": ""
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "HMAC DRBG (A4303)",
"condition": "During boot",
"details": "N/A",
"indicator": "NIST 800- 90 HMAC DRBG Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Prediction Resistance: Yes Supports Reseed Capabilities: Mode: SHA2-256 Entropy Input: 256 Nonce: 128 Personalizati on String Length: 0- 256 Increment 8 Additional Input: 8-256 Increment 8 Returned Bits: 1024",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A4303)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES-CBC Known Answer",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 192 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CBC (A4301)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES-CBC Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "NIST 800- 90 HMAC DRBG Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Mode: SHA2-256, Entropy Input: 256 , Nonce: 128, Personalizati on String Length: 0- 256 , Increment 8 , Additional Input: 8-256 Increment 8 , Returned Bits: 1024",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA-1 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA-1 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 160 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2- 256 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-256 Known Answer Test : Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-",
"condition": "During boot",
"details": "N/A",
"indicator": "HMAC- SHA2-512 Known",
"testMethod": "KAT",
"testProps": "Key Length: 512 bits",
"type": "CAST"
},
{
"algorithmOrTest": "512 (A4301)",
"condition": "",
"details": "",
"indicator": "Answer Test : Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-ECC- EPHEM- UNIFIED- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KAS-FFC- EPHEM- NOKC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Domain Parameter Generation Methods: MODP-2048",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A4301)",
"condition": "During boot",
"details": "N/A",
"indicator": "KDF-SSH- SHA2-256 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Cipher: AES- 128, AES- 192, AES- 256 ; Hash Algorithm: SHA-1, SHA2-256, SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS18 6-4) (A4301)",
"condition": "During boot",
"details": "Sign",
"indicator": "RSA-SIGN Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS18 6-4) (A4301)",
"condition": "During boot",
"details": "Verify",
"indicator": "RSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Modulus 2048 bits SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen",
"condition": "During boot",
"details": "Sign",
"indicator": "ECDSA- SIGN",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash",
"type": "CAST"
},
{
"algorithmOrTest": "(FIPS18 6-4) (A4301)",
"condition": "",
"details": "",
"indicator": "Known Answer Test: Passed",
"testMethod": "",
"testProps": "Algorithm: SHA2-256",
"type": ""
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS18 6-4) (A4301)",
"condition": "During boot",
"details": "Verify",
"indicator": "ECDSA- VERIFY Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2- 512 (A4306)",
"condition": "During boot",
"details": "N/A",
"indicator": "SHA-2- 512 Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "SHA2-512",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test",
"condition": "During boot and continually",
"details": "Cutoff value C = 21",
"indicator": "pass",
"testMethod": "RCT",
"testProps": "NIST SP 800-90B Repetitive Count Test",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy test",
"condition": "During boot and continually",
"details": "W = 512; Cutoff value C = 311",
"indicator": "pass",
"testMethod": "APT",
"testProps": "NIST SP 800-90B Adapative Proportion Test",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS18 6-4) (A4301)",
"condition": "On key generation",
"details": "Key pair generated for signature generation/verificat ion in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS18 6-4) (A4301)",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "KAS- FFC- SSC Sp800- 56Ar3 (A4301)",
"condition": "On key generation",
"details": "Key pair generated for SSP agreement in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Capabilities: Domain Parameter: MODP2048",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS18 6-4) (A4301)",
"condition": "On key generation",
"details": "Key pair generated for signature generation/verificat ion in the context of SSHv2 protocol",
"indicator": "0",
"testMethod": "PCT",
"testProps": "Modulus: 2048 Hash SHA2-256",
"type": "PCT"
},
{
"algorithmOrTest": "AES-KW (A4304)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES- KEYWRA P Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES-KW (A4304)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES- KEYWRA P Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SP800- 108 (A4304)",
"condition": "During boot",
"details": "N/A",
"indicator": "KBKDF Known Answer Test:Pass ed",
"testMethod": "KAT",
"testProps": "Mode: Counter",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM (AES 4369)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "0",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- GCM (AES 4369)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "0",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A4304)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES128- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A4304)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES128- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 128 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A4304)",
"condition": "During boot",
"details": "Encrypt",
"indicator": "AES256- CMAC Known Answer Test: Passed",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "AES- CMAC (A4304)",
"condition": "During boot",
"details": "Decrypt",
"indicator": "AES256- CMAC Known Answer",
"testMethod": "KAT",
"testProps": "Key Length: 256 bits",
"type": "CAST"
},
{
"algorithmOrTest": "",
"condition": "",
"details": "",
"indicator": "Test: Passed",
"testMethod": "",
"testProps": "",
"type": ""
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS18 6-4) (A4301)",
"condition": "On loading of firmware from an external source",
"details": "Verify",
"indicator": "Host OS upgrade staged. Reboot the system to complete installation !",
"testMethod": "KAT",
"testProps": "Curve: P-256 Hash Algorithm: SHA2-256",
"type": "SW/F W Load"
},
{
"algorithmOrTest": "Manual entry test (duplicat e entries)",
"condition": "On configurati on of operator passwords and MACsec PSK",
"details": "N/A",
"indicator": "Command prompt with \"fips\" string provided post completion of the test",
"testMethod": "Duplicate entry test required for entry of operator passwor ds and MACsec PSK via direct connecti on to the module\u0027s console (serial) interface",
"testProps": "Duplicate entry test required for entry of operator passwords and MACsec PSK via direct connection to the module\u0027s console (serial) interface",
"type": "Manu al Entry"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "If the pre- operational firmware integrity test, fails, if any of the CASTs fail or if a pairwise consistency test fails",
"description": "If the pre-operation firmware integrity test, if any of the CASTs or pair- wise consistency tests fail, then the module returns an error indicator, inhibits all data output and enters the hard error state",
"indicator": "\"FIPS error: self- test failure\" for firmware integrity failure, \"FIPS error 1: \u003cname of the algorithm\u003e Known Answer Test: Failed\" for CAST failure and -1 for pair-wise consistency test failure",
"name": "Hard Error state",
"recoveryMethod": "N/A"
},
{
"conditions": "If the firmware load test fails If the APT or RCT test fails",
"description": "\u2022In case of a firmware load test failure, the module rejects the firmware, returns an error indicator and enters the soft error state \u2022In the event of an APT or RCT health test failure, output from the entropy source is inhibited, all entropy accumulated in the conditioning context is discarded and the start- up health-tests are performed again",
"indicator": "\"Validation Error\" for the firmware load test failure; entropy data discarded in case of APT/RCT failure",
"name": "Soft Error state",
"recoveryMethod": "N/A for firmware load test failure; In case of APT and/or RCT failures, new data continues to be tested by the health tests, and once both health tests indicate a \u0027pass\u0027, the entropy source again outputs data"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "N/A",
"inspectGuidance": "N/A",
"mechanism": "N/A"
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "\u2022 The operator can verify that the cryptographic module is in the Approved mode by observing the console prompt and running the \u0027show version\u0027 command; \u2022 When operating in the Approved mode, the prompt will read \u0027\u003coperator\u003e:fips#\u0027 (e.g. root:fips#); \u2022 The \u0027show version\u0027 command will allow the Crypto Officer to verify that the validated firmware version is running on the module; \u2022 The Crypto Officer can also use the \u0027show system fips chassis level\u0027 command (returns \u0027level 1\u0027) to determine if the module is operating in the Approved mode; \u2022 The Approved mode is entered when the module is configured for it and successfully passes all self-tests (both pre-operational and conditional cryptographic algorithm self-tests (CASTs))",
"name": "Approved mode",
"statusIndicator": "global indicator (string \u0027fips\u0027 included in the command prompt)",
"type": "Approved"
},
{
"description": "\u2022 The cryptographic module supports a non- Approved mode of operation; \u2022 When operated in the non-Approved mode of operation, the module supports non-Approved algorithms as well as the algorithms supported in the Approved mode of operation",
"name": "Non- Approved mode",
"statusIndicator": "global indicator (implicit indicator based on exclusion of string \u0027fips\u0027 from the command prompt)",
"type": "Non- Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [
{
"caveat": "no security claimed",
"name": "SHA2-256 (Junos 22.4R2 - LibMD Implementation)",
"use": "Used to store operator passwords in hashed form, per IG 2.4.A: Use of a non-approved cryptographic algorithm to \u0027obfuscate\u0027 a CSP"
},
{
"caveat": "no security claimed",
"name": "SHA-1 (Junos 22.4R2 - Kernel Implementation)",
"use": "Used for an extraneous check in the Kernel, per IG 2.4.A: Use of an approved, non-approved or proprietary algorithm for a purpose that is not security relevant"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [
{
"algoPropList": "",
"implName": "N/A",
"name": "N/A",
"reference": "N/A"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [
{
"name": "RSA with key size less than 2048",
"use": "SSH"
},
{
"name": "ECDSA with ed25519 curve",
"use": "SSH"
},
{
"name": "EC Diffie-Hellman with ed25519 curve",
"use": "SSH"
},
{
"name": "ARCFOUR",
"use": "SSH"
},
{
"name": "Blowfish",
"use": "SSH"
},
{
"name": "CAST",
"use": "SSH"
},
{
"name": "DSA (SignGen, SigVer, non-compliant)",
"use": "SSH"
},
{
"name": "HMAC-MD5",
"use": "SSH"
},
{
"name": "HMAC-RIPEMD160",
"use": "SSH"
},
{
"name": "UMAC",
"use": "SSH"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve",
"description": "Security relevant configuration",
"name": "Configure security (security relevant)",
"role": "Root, Super-user"
},
{
"alg_accessed": "EC Diffie- Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "",
"name": "",
"role": ""
},
{
"alg_accessed": "None",
"description": "Non-security relevant configuration",
"name": "Configure (non- security relevant)",
"role": "Root, Super-user"
},
{
"alg_accessed": "None",
"description": "Query the module status",
"name": "Show status",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
},
{
"alg_accessed": "None",
"description": "LEDs on the module provide physical status output",
"name": "Show status (LED)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized, Unauthenticated"
},
{
"alg_accessed": "None",
"description": "Query the module\u0027s versioning information",
"name": "Show module\u0027s versioning information",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
},
{
"alg_accessed": "None",
"description": "Destroy all SSPs",
"name": "Zeroise (Perform zeroisation)",
"role": "Root, Super-user"
},
{
"alg_accessed": "RSA with key size less than 2048 ECDSA with ed25519 curve EC Diffie- Hellman with ed25519 curve ARCFOUR Blowfish CAST DSA (SignGen, SigVer, non- compliant) HMAC-MD5 HMAC- RIPEMD160 UMAC",
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"name": "Perform approved security functions (SSH connection)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
},
{
"alg_accessed": "None",
"description": "Console monitoring and control (CLI)",
"name": "Console Access",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
},
{
"alg_accessed": "None",
"description": "Software initiated reset, performs self-tests on demand",
"name": "Perform self-tests (remote reset)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized"
},
{
"alg_accessed": "None",
"description": "Hardware reset or power cycle",
"name": "Perform self-tests (local reset)",
"role": "Root, Super-user, Operator, Read-Only, Unauthorized, Unauthenticated"
},
{
"alg_accessed": "None",
"description": "Verification and loading of a validated firmware image into the router/switch",
"name": "Load Image",
"role": "Root, Super-user"
},
{
"alg_accessed": "None",
"description": "Initiate MACsec connection",
"name": "Perform approved security functions (MACsec connection)",
"role": "Root, Super-user"
}
],
"found": true,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "LAN, Communications/remote management",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (Management port)"
},
{
"data": "Console Serial Port",
"logicalInterface": "Data Input Data Output",
"physicalPort": "Serial"
},
{
"data": "",
"logicalInterface": "Control Input Status Output",
"physicalPort": ""
},
{
"data": "USB port, load Junos Image",
"logicalInterface": "Data Input Control Input",
"physicalPort": "USB"
},
{
"data": "Power connector, Power over Ethernet",
"logicalInterface": "Power",
"physicalPort": "Power"
},
{
"data": "Status indicator lighting",
"logicalInterface": "Status Output",
"physicalPort": "Alarm LEDs"
},
{
"data": "Reset signal",
"logicalInterface": "Control Input",
"physicalPort": "Reset Button"
},
{
"data": "SMB In/out (clock synchronization)",
"logicalInterface": "Data Input Data Output",
"physicalPort": "PTP-capable connections"
},
{
"data": "Online/Offline signal",
"logicalInterface": "Control Input",
"physicalPort": "Online/Offline Button"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Super-user",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Operator",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Read-only",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "Root",
"operatorType": "Crypto Officer (CO)",
"type": "Identity"
},
{
"authMethodList": "Username and password over the console and SSH",
"name": "Unauthorised",
"operatorType": "User",
"type": "Identity"
},
{
"authMethodList": "Username and ECDSA public key over SSH Username and RSA public key over SSH",
"name": "",
"operatorType": "",
"type": ""
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "1",
"section": "1",
"title": "General"
},
{
"level": "1",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "1",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "3",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "1",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "1",
"section": "6",
"title": "Operational environment"
},
{
"level": "1",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "1",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "1",
"section": "10",
"title": "Self-tests"
},
{
"level": "1",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "1",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Firmware Integrity Test",
"details": "Verify",
"indicator": "FIPS Self-tests Passed",
"testMethod": "KAT",
"testProps": "Using ECDSA P-256 with SHA2-256",
"type": "SW/FW Integrity"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "NVRAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entered over SSH - NVRAM",
"sfiAlgo": "KTS1",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "N/A",
"entry": "N/A",
"format": "Plaintext",
"name": "Loaded at manufacture",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "NVRAM",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Entered through the CLI via console connection - NVRAM",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint (MACsec peer)",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output encrypted with MAcsec KEK",
"sfiAlgo": "KTS2",
"source": "RAM"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Input during SSH negotiation",
"sfiAlgo": "",
"source": "External endpoint"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (host key)",
"sfiAlgo": "",
"source": "NVRAM"
},
{
"dest": "External endpoint",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output during SSH negotiation (Key Agreement public key)",
"sfiAlgo": "",
"source": "RAM"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Command used to zeroise the module: request vmhost zeroize no-forwarding",
"method": "Zeroisation command",
"operatorId": "Operator initiated",
"rationale": "Used to provide zeroisation as a service"
},
{
"description": "Power cycling the module to zeroise temporary SSPs",
"method": "Power-cycle",
"operatorId": "Operator initiated",
"rationale": "Power cycling the module to zeroise temporary SSPs"
},
{
"description": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session",
"method": "Session termination",
"operatorId": "Module initiated",
"rationale": "Termination of SSH sessions automatically zeroises temporary SSPs used as part of the session"
},
{
"description": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem",
"method": "Not zeroised",
"operatorId": "N/A",
"rationale": "PSP not zeroised since it cannot be modified due to being inaccessible in the filesystem"
},
{
"description": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key",
"method": "Derivation of SSH session key",
"operatorId": "Module initiated",
"rationale": "EC Diffie-Hellman/Diffie- Hellman shared secrets are zeroised after use in derivation of SSH session key"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Non-Volatile Random Access Memory",
"name": "NVRAM",
"persistance": "Static"
},
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "JNP10K-PWR-AC; JNP10K- PWR-DC; JNP10K-PWRAC2; JNP10K-PWR-DC2",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "PTX10008",
"modelPartNum": "PTX10008",
"processors": "Intel Xeon E3- 1125v2"
},
{
"features": "JNP10K-PWR-AC; JNP10K- PWR-DC; JNP10K-PWRAC2; JNP10K-PWR-DC2",
"fwVersion": "Junos OS 22.4R2.8",
"hwVersion": "PTX10016",
"modelPartNum": "PTX10016",
"processors": "Intel Xeon E3- 1125v2"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4 and 5.1",
"reference": "NIST SP800-133r2 Section 4: Asymmetric seed generation using an unmodified output from an Approved DRBG; Section 5.1: Key Pairs for Digital Signature Schemes"
},
{
"algoPropList": "Key Type:Asymmetric",
"implName": "N/A",
"name": "CKG - Section 4 and 5.2",
"reference": "NIST SP800-133r2 Section 4: Asymmetric seed generation using an unmodified output from an Approved DRBG; Section 5.2: Key Pairs for Key Establishment"
},
{
"algoPropList": "Key Type:Symmetric",
"implName": "N/A",
"name": "CKG - Section 6.2.1",
"reference": "NIST SP800-133r2 Section 6.2.1: Derivation of symmetric keys"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECDH": {
"ECDH": 44
},
"ECDSA": {
"ECDSA": 79
}
},
"FF": {
"DH": {
"DH": 43,
"Diffie-Hellman": 6
},
"DSA": {
"DSA": 3
}
},
"RSA": {
"RSA 2048": 1
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 9
},
"CTR": {
"CTR": 3
},
"GCM": {
"GCM": 5
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {},
"crypto_protocol": {
"SSH": {
"SSH": 191,
"SSHv2": 9
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 6
},
"MAC": {
"MAC": 4
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 58,
"P-384": 26,
"P-521": 26,
"prime256v1": 2
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"- PKCS 1": 2,
"AES 4369": 6,
"AES CBC 128, 192": 1,
"AES CTR 128": 1,
"AES- 128": 1,
"AES- 192": 1,
"AES- 256": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"AES-CMAC 2": 1,
"DRBG 2": 3,
"DRBG 256": 1,
"DRBG 440": 1,
"DRBG2": 14,
"HMAC 198": 2,
"HMAC- SHA-1": 4,
"HMAC-SHA-1": 6,
"PKCS 1": 2,
"RSA 2048": 1,
"RSA2": 1,
"SHA-1": 8,
"SHA-2- 512": 1,
"SHA2- 256": 2,
"SHA2- 512": 1,
"SHA2-256": 32,
"SHA2-384": 3,
"SHA2-512": 17
}
},
"fips_security_level": {
"Level": {
"Level 1": 4,
"Level 3": 1,
"level 1": 4
}
},
"hash_function": {
"RIPEMD": {
"RIPEMD160": 2
},
"SHA": {
"SHA1": {
"SHA-1": 9
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 31
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 15,
"FIPS 180-4": 6,
"FIPS 186-4": 8,
"FIPS 198-1": 4,
"FIPS18": 8,
"FIPS186-4": 30
},
"NIST": {
"NIST SP 800-108": 2,
"NIST SP 800-90B": 2,
"SP 800-108": 1,
"SP 800-135": 1,
"SP 800-38A": 5,
"SP 800-38B": 1,
"SP 800-38D": 4,
"SP 800-38F": 1,
"SP 800-56A": 4,
"SP 800-90A": 2
},
"PKCS": {
"PKCS 1": 2
},
"X509": {
"X.509": 2
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 18,
"AES-": 17,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 69
}
},
"DES": {
"3DES": {
"TDES": 1
}
},
"constructions": {
"MAC": {
"CMAC": 8,
"HMAC": 25
}
},
"miscellaneous": {
"Blowfish": {
"Blowfish": 3
}
}
},
"tee_name": {
"AMD": {
"PSP": 9
},
"IBM": {
"SSC": 20
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"ECDSA KeyGen (FIPS186-4)A4301",
"KAS-FFC-SSC Sp800-56Ar3A4301",
"AES-CTRA4301",
"KAS-ECC-SSC Sp800-56Ar3A4301",
"SHA-1A4301",
"HMAC-SHA2-256A4303",
"KDF SSHA4301",
"RSA SigGen (FIPS186-4)A4301",
"HMAC-SHA2-512A4301",
"SHA2-256A4303",
"AES-ECBA4304",
"AES-GCMAES 4369",
"ECDSA KeyVer (FIPS186-4)A4301",
"RSA KeyGen (FIPS186-4)A4301",
"KDF SP800-108A4304",
"ECDSA SigVer (FIPS186-4)A4301",
"AES-CMACA4304",
"AES-KWA4304",
"Safe Primes Key VerificationA4301",
"RSA SigVer (FIPS186-4)A4301",
"Safe Primes Key GenerationA4301",
"HMAC-SHA-1A4301",
"ECDSA SigGen (FIPS186-4)A4301",
"AES-XPNAES 4369",
"AES-CBCA4304",
"HMAC DRBGA4303",
"SHA2-512A4306"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A4304",
"#A4303",
"#A4301",
"#A4306"
]
},
"policy_metadata": {
"/Author": "Prasiddhi Tembulkar Intertek",
"/Comments": "",
"/Company": "",
"/CreationDate": "D:20241212153000-05\u002700\u0027",
"/Creator": "Acrobat PDFMaker 24 for Word",
"/Keywords": "",
"/ModDate": "D:20241212153122-05\u002700\u0027",
"/Producer": "Adobe PDF Library 24.3.144",
"/SourceModified": "",
"/Subject": "",
"/Title": "",
"pdf_file_size_bytes": 1052560,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program",
"http://www.juniper.net/support/downloads/junos.html"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 67
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "b101c4c05f87a4eccb58f7ae283075ddda98e096324bcfaad8d79b520311d37a",
"source_hash": "c2e5b11c028327d36d0f207984c521c74651e1297274b232cf6c2e10d0c5de81",
"txt_hash": "f57fc8717af7f323e010b502d9c1503fe2cae088165e07f9be499874de948d42"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "Interim validation. When operated in Approved mode. When installed, initialized and configured as specified in Section 11 of the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs.",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/February 2025_030325_1258.pdf",
"date_sunset": "2027-02-06",
"description": "The cryptographic module provides for an encrypted connection, using SSH, between the management station and the module. The cryptographic module also provides for an encrypted connection, using MACsec, between devices.",
"embodiment": "Multi-Chip Stand Alone",
"exceptions": [
"Roles, services, and authentication: Level 3",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 1,
"mentioned_certs": {},
"module_name": "Juniper Networks PTX10008 and PTX10016 Packet Transport Routers",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2025-02-07",
"lab": "Acumen Security",
"validation_type": "Initial"
}
],
"vendor": "Juniper Networks, Inc.",
"vendor_url": "http://www.juniper.net"
}
}