Juniper Express 4 MACsec Cryptographic Module

Certificate details

Certificate ID #5489
Status active
Validation dates 17.08.2026
Sunset date 12-11-2029
Standard FIPS 140-3
Security level 1
Type Software-Hybrid
Embodiment MultiChipStand
Caveat When operated with module Junos® OS Evolved OpenSSL Cryptographic Module version 3.0.8 validated to FIPS 140-3 under Cert. #5400 operating in approved mode, and module Junos® OS Evolved Kernel Cryptographic Module version 2.0 validated to FIPS 140-3 under Cert. #5399, operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions
  • Non-invasive security: N/A
  • Mitigation of other attacks: N/A
Description Juniper Express 4 MACsec Cryptographic Module is composed by the MACsec blocks that are part of the Juniper Networks® Express 4 processor in hardware, which provides the AES GCM and XPN algorithm implementations for encrypting and decrypting MACsec traffic, and a device driver in software, which provides the functionality to comply with FIPS 140-3 requirements (i.e. integrity test, self-tests), as well as the API to configure the hardware component.
Vendor Juniper Networks, Inc. http://www.juniper.net
Lab atsec information security corporation
Algorithms
  • AES-GCMA4089
  • AES-XPNA4089
  • HMAC-SHA2-256A4246
References

This certificate's webpage directly references 2 certificates, transitively this expands into 2 certificates.
Certificate
Webpage

Security policy

Extracted keywords

Symmetric Algorithms
AES, CAST, HMAC
Schemes
MAC
Randomness
RBG
Libraries
OpenSSL
Block cipher modes
ECB, CBC, GCM

Security level
Level 1, level 1

Cross-references

Outgoing
  • 5400 - active - Junos® OS Evolved OpenSSL Cryptographic Module
  • 5399 - active - Junos® OS Evolved Kernel Cryptographic Module
Creation date D:20260817081112-04'00'
Modification date D:20260817081112-04'00'
Pages 27
Creator Microsoft® Word for Microsoft 365
Producer Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

Processing updates

  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate data changed.
  • The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5489,
  "dgst": "c363831cbfee684f",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-256A4246",
        "AES-XPNA4089",
        "AES-GCMA4089",
        "#A4089",
        "#A4246"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "4"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      }
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": [
        "5399",
        "5400"
      ]
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      },
      "indirectly_referenced_by": null,
      "indirectly_referencing": {
        "_type": "Set",
        "elements": [
          "5399",
          "5400"
        ]
      }
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": [
        "5399",
        "5400"
      ]
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 1,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A4089",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 128, 256, 120, 248 AAD Length - AAD Length: 128, 256, 120, 0",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "AES-XPN",
            "cavpCertName": "A4089",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 256 Payload Length - Payload Length: 128, 256, 120, 248",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "AAD Length - AAD Length: 128, 256, 120, 0 Tag Length - 128 IV Generation - External IV Generation Mode - 8.2.1 Salt Generation - External",
            "reference": ""
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A4246",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 112-524288 Increment 8",
            "reference": "FIPS 198-1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Perform AES encryptio n",
            "indicator": "macsecv2_drv_tx_reg_port_conf ig_rd() returns 1 in bit corresponding to the MACsec block.",
            "inputs": "Plaintext , IV, AES key",
            "name": "Authenticat ed symmetric encryption",
            "outputs": "Ciphertext",
            "rolesSspAccess": "Crypt o Offic er - AES key: W,E",
            "secFunImpl": "Authenticat ed symmetric encryption"
          },
          {
            "description": "Perform AES decryptio n",
            "indicator": "macsecv2_drv_rx_reg_ port_config_rd() returns 1 in bit corresponding to the MACsec block.",
            "inputs": "Cipherte xt, IV, AES key",
            "name": "Authenticat ed symmetric decryption",
            "outputs": "Plaintext",
            "rolesSspAccess": "Crypt o Offic er - AES key: W,E",
            "secFunImpl": "Authenticat ed symmetric decryption"
          },
          {
            "description": "Return the module status",
            "indicator": "None",
            "inputs": "None",
            "name": "Show status",
            "outputs": "Module status",
            "rolesSspAccess": "Crypt o Offic er",
            "secFunImpl": "None"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES-GCM Encrypt",
            "condition": "Test runs at power- on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128, 256-bit keys, encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM Decrypt",
            "condition": "Test runs at power- on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128, 256-bit keys, decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XPN Encrypt",
            "condition": "Test runs at power- on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128, 256-bit keys, encrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-XPN Decrypt",
            "condition": "Test runs at power- on before module becomes operational",
            "details": "Symmetric operation",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "128, 256-bit keys, decrypt",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-256 (A4246)",
            "condition": "Test runs at power- on before the integrity test",
            "details": "[EVM] Message authentication",
            "indicator": "Module becomes operational",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Failure of CAST Failure of integrity tests",
            "description": "General- purpose error state",
            "indicator": "macsecv2_drv_fips_kat_ok() returns false (CAST failure), macsecv2_drv_integrity_chk_ok() returns false (integrity test failure)",
            "name": "Error",
            "recoveryMethod": "Power cycle"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [],
        "found": false,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "Automatically entered whenever an approved service is requested",
            "name": "Approved mode",
            "statusIndicator": "Service API returns 1",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Decrypted/encrypted data received from network ports",
            "logicalInterface": "Data Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Encrypted/decrypted data sent to network ports",
            "logicalInterface": "Data Output",
            "physicalPort": "N/A"
          },
          {
            "data": "API function calls, API input parameters for control input.",
            "logicalInterface": "Control Input",
            "physicalPort": "N/A"
          },
          {
            "data": "API return codes, API output parameters for status output.",
            "logicalInterface": "Status Output",
            "physicalPort": "N/A"
          },
          {
            "data": "N/A",
            "logicalInterface": "Power",
            "physicalPort": "N/A"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "None",
            "name": "Crypto Officer",
            "operatorType": "Crypto Officer",
            "type": "Role"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "1",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "1",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "1",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "HMAC-",
            "details": "[EVM] Integrity",
            "indicator": "Module becomes",
            "testMethod": "MAC tag",
            "testProps": "HMAC-",
            "type": "SW/FW"
          },
          {
            "algorithmOrTest": "SHA2-256",
            "details": "test for module",
            "indicator": "operational",
            "testMethod": "verification",
            "testProps": "SHA2-256",
            "type": "Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "Cryptographic module",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "API input parameters",
            "sfiAlgo": "",
            "source": "Operator calling application (TOEPP)"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Zeroizes the SSPs contained within the cipher handle.",
            "method": "Wipe and Free memory block allocated",
            "operatorId": "By calling the cipher related zeroization API function: macsecv2_drv_port_tx_sa_delete() for AES keys",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes and then it is released, which renders the SSP values irretrievable. The completion of the zeroization routine indicates that the zeroization procedure succeeded."
          },
          {
            "description": "Automatically zeroized by the module when no longer needed",
            "method": "Automatic",
            "operatorId": "N/A",
            "rationale": "Memory occupied by SSPs is overwritten with zeroes, which renders the SSP values irretrievable."
          },
          {
            "description": "De-allocates the volatile memory used to store SSPs",
            "method": "Module Reset",
            "operatorId": "By unloading and reloading the module",
            "rationale": "Volatile memory used by the module is overwritten within nanoseconds when power is removed."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Temporary storage for SSPs used by the module as part of service execution. The module does not perform persistent storage of SSPs",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "Juniper Networks\u00ae Packet Transport Router Model PTX10001-36MR",
            "hypervisorHostOs": "N/A",
            "operatingSystem": "Junos\u00ae OS Evolved version 22.4",
            "paa_pai": "No",
            "processors": "Intel\u00ae Xeon\u00ae D-2163IT",
            "version": "1.0"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {},
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 1
        },
        "ECB": {
          "ECB": 1
        },
        "GCM": {
          "GCM": 8
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {
        "OpenSSL": {
          "OpenSSL": 5
        }
      },
      "crypto_protocol": {},
      "crypto_scheme": {
        "MAC": {
          "MAC": 5
        }
      },
      "device_model": {},
      "ecc_curve": {},
      "eval_facility": {
        "atsec": {
          "atsec": 3
        }
      },
      "fips_cert_id": {
        "Cert": {
          "#5399": 1,
          "#5400": 1
        }
      },
      "fips_certlike": {
        "Certlike": {
          "AES-GCM Decrypt 128": 1,
          "AES-GCM Encrypt 128": 1,
          "SHA2-256": 3
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 2,
          "level 1": 1
        }
      },
      "hash_function": {},
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140": 1,
          "FIPS 140-3": 36,
          "FIPS 198-1": 1,
          "FIPS PUB 140-3": 2
        },
        "NIST": {
          "SP 800-140B": 1,
          "SP 800-38D": 3
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 18
          },
          "CAST": {
            "CAST": 14
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 8
          }
        }
      },
      "tee_name": {},
      "tls_cipher_suite": {},
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "AES-XPNA4089",
        "HMAC-SHA2-256A4246",
        "AES-GCMA4089"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A4089",
        "#A4246"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260817081112-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260817081112-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 703504,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://1.ieee802.org/security/802-1ae/",
          "https://doi.org/10.6028/NIST.FIPS.140-3",
          "https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements",
          "http://www.atsec.com/",
          "https://doi.org/10.6028/NIST.SP.800-38D",
          "http://www.juniper.net/"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 27
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "17005b840569156af0f013f9789fa8dd56a35976b998bb5a55aa4a033659d6c7",
      "source_hash": "84cfcd3e06193eea49e136338f09abed2e6234c21daf1c5039e4899cd48613c0",
      "txt_hash": "90ef182b0b832c2374f1378171b4f84e33caa228bc15e08017f6f1412f25be7b"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When operated with module Junos\u00ae OS Evolved OpenSSL Cryptographic Module version 3.0.8 validated to FIPS 140-3 under Cert. #5400 operating in approved mode, and module Junos\u00ae OS Evolved Kernel Cryptographic Module version 2.0 validated to FIPS 140-3 under Cert. #5399, operating in approved mode. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/August 2026_020926_0917.pdf",
    "date_sunset": "2029-11-12",
    "description": "Juniper Express 4 MACsec Cryptographic Module is composed by the MACsec blocks that are part of the Juniper Networks\u00ae Express 4 processor in hardware, which provides the AES GCM and XPN algorithm implementations for encrypting and decrypting MACsec traffic, and a device driver in software, which provides the functionality to comply with FIPS 140-3 requirements (i.e. integrity test, self-tests), as well as the API to configure the hardware component.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Non-invasive security: N/A",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {
      "5399": 1,
      "5400": 1
    },
    "module_name": "Juniper Express 4 MACsec Cryptographic Module",
    "module_type": "Software-Hybrid",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-08-17",
        "lab": "atsec information security corporation",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Juniper Networks, Inc.",
    "vendor_url": "http://www.juniper.net"
  }
}