This page was not yet optimized for use on mobile devices.
HPE Juniper Networking SRX1600 Service Gateway
Certificate details
| Certificate ID | #5398 |
|---|---|
| Status | active |
| Validation dates | 12.07.2026 |
| Sunset date | 11-07-2031 |
| Standard | FIPS 140-3 |
| Security level | 2 |
| Type | Hardware |
| Embodiment | MultiChipStand |
| Caveat | When installed, initialized and configured as specified in Section 11.1 of the Security Policy |
| Exceptions |
|
| Description | The SRX1600 Service Gateway offers outstanding protection, performance, scalability, availability, and integrated security services. Designed for high-performance security services architecture, and seamless integration of networking and security in a single platform, the SRX1600 is best suited for campuses, regional headquarters and enterprise data centers with a focus on application visibility and control, intrusion prevention, advanced threat protection, authentication, confidentiality of information, and integrated cloud-based security. |
| Vendor | HPE Juniper Networking http://www.juniper.net |
| Lab | Teron Labs |
| Algorithms |
|
| References | This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates. |
Security policy
Extracted keywords
Symmetric Algorithms
AES-128, AES-192, AES-256, AES-, AES, CAST, HMAC, CBC-MACAsymmetric Algorithms
RSA 2048, RSA 4096, ECDSA, ECC, Diffie-Hellman, DHHash functions
SHA-1Schemes
MAC, Key Exchange, Key AgreementProtocols
SSH, SSHv2Randomness
DRBG, RBGLibraries
OpenSSLElliptic Curves
P-256, P-384, P-521Block cipher modes
CBC, CTRTrusted Execution Environments
PSP, SSCSecurity level
Level 2, level 2Automated analysis
Automated inference - use with caution
All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.No automatically derived data are available in this section.
Cross-references
No references are available for this certificate.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate data changed.
-
The certificate was first processed.
{
"_type": "sec_certs.sample.fips.FIPSCertificate",
"cert_id": 5398,
"dgst": "def76dbc0fbda59d",
"heuristics": {
"_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
"algorithms": {
"_type": "Set",
"elements": [
"#A5633",
"SHA2-384A6736",
"#A6736",
"ECDSA SigVer (FIPS186-5)A6736",
"AES-CBCA6736",
"#A5107",
"HMAC-SHA-1A6736",
"HMAC-SHA2-512A6736",
"SHA-1A6736",
"SHA2-256A6736",
"KDF SSHA6736",
"Conditioning Component AES-CBC-MAC SP800-90BA2518",
"#A2518",
"#A5108",
"HMAC-SHA2-256A6736",
"ECDSA KeyGen (FIPS186-5)A6736",
"AES-CTRA6736",
"RSA SigGen (FIPS186-5)A6736",
"RSA SigVer (FIPS186-5)A6736",
"ECDSA KeyVer (FIPS186-5)A6736",
"HMAC DRBGA5108",
"SHA2-512A6736",
"RSA KeyGen (FIPS186-5)A6736",
"KAS-ECC-SSC Sp800-56Ar3A6736",
"ECDSA SigGen (FIPS186-5)A6736"
]
},
"cpe_matches": null,
"direct_transitive_cves": null,
"extracted_versions": {
"_type": "Set",
"elements": [
"-"
]
},
"indirect_transitive_cves": null,
"module_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"module_prunned_references": {
"_type": "Set",
"elements": []
},
"policy_processed_references": {
"_type": "sec_certs.sample.certificate.References",
"directly_referenced_by": null,
"directly_referencing": null,
"indirectly_referenced_by": null,
"indirectly_referencing": null
},
"policy_prunned_references": {
"_type": "Set",
"elements": []
},
"related_cves": null,
"verified_cpe_matches": null
},
"pdf_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
"br1_deviations": 0,
"br1_tables": {
"_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
"approved_algorithms": {
"entries": [
{
"algorithm": "AES-CBC",
"cavpCertName": "A6736",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "AES-CTR",
"cavpCertName": "A6736",
"properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
"reference": "SP 800-38A"
},
{
"algorithm": "ECDSA KeyGen (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - testing candidates",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA KeyVer (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Curve - P-256, P-384, P-521",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigGen (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
"reference": "FIPS 186-5"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A6736",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-256",
"cavpCertName": "A6736",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2-512",
"cavpCertName": "A6736",
"properties": "Key Length - Key Length: 512",
"reference": "FIPS 198-1"
},
{
"algorithm": "KAS-ECC-SSC Sp800-56Ar3",
"cavpCertName": "A6736",
"properties": "Domain Parameter Generation Methods - P- 256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
"reference": "SP 800-56A Rev. 3"
},
{
"algorithm": "KDF SSH (CVL)",
"cavpCertName": "A6736",
"properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2- 384, SHA2-512",
"reference": "SP 800-135 Rev. 1"
},
{
"algorithm": "RSA KeyGen (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 Primality Tests - 2powSecStr Private Key Format - standard",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigGen (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "RSA SigVer (FIPS186-5)",
"cavpCertName": "A6736",
"properties": "Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A6736",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A6736",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-384",
"cavpCertName": "A6736",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A6736",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "Conditioning Component AES-CBC-MAC SP800- 90B",
"cavpCertName": "A2518",
"properties": "Key Length - 128",
"reference": "SP 800-90B"
},
{
"algorithm": "ECDSA SigVer (FIPS186-5)",
"cavpCertName": "A5633",
"properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
"reference": "FIPS 186-5"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A5633",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "HMAC DRBG",
"cavpCertName": "A5108",
"properties": "Prediction Resistance - Yes Mode - SHA2-256",
"reference": "SP 800-90A Rev. 1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A5108",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A5108",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "HMAC-SHA-1",
"cavpCertName": "A5107",
"properties": "Key Length - Key Length: 160",
"reference": "FIPS 198-1"
},
{
"algorithm": "HMAC-SHA2- 256",
"cavpCertName": "A5107",
"properties": "Key Length - Key Length: 256",
"reference": "FIPS 198-1"
},
{
"algorithm": "SHA-1",
"cavpCertName": "A5107",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-256",
"cavpCertName": "A5107",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
},
{
"algorithm": "SHA2-512",
"cavpCertName": "A5107",
"properties": "Message Length - Message Length: 0-65536 Increment 8",
"reference": "FIPS 180-4"
}
],
"found": true,
"section": 2,
"subsection": 5
},
"approved_services": {
"entries": [
{
"description": "Security relevant configuration",
"indicator": "\u0027:fips\u0027 suffix in CLI prompt",
"inputs": "CLI commands,Configurat ion of the users (including permissions and passwords), ssh (including ciphers, macs, key-exchange, host-key algorithm), syslog, authentication login settings (retries, back-off factor and",
"name": "Configur e security",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer - HMAC DRBG V value: E - HMAC DRBG Key value: E - HMAC DRBG Entropy Input (kernel):",
"secFunImpl": "SHA (LibMD) MAC (LibMD) DRBG (Kernel) ECDSA KeyGen (PKID) RSA KeyGen"
},
{
"description": "",
"indicator": "",
"inputs": "threshold) . Configuration carried out by executing CLI commands and providing parameters. Configuration can also be done by providing configuration text files.",
"name": "",
"outputs": "",
"rolesSspAccess": "E - HMAC DRBG Seed: E - CO-PW: W - User-PW: W - SSH-Priv: G,R,W - Auth-User Pub: W",
"secFunImpl": "(PKID) ENT"
},
{
"description": "Non-security relevant configuration",
"indicator": "None",
"inputs": "CLI commands, QoS features, VLAN addressing and integrated routing, Configuration of Network Interfaces, Firewall Services",
"name": "Configur e",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer",
"secFunImpl": "None"
},
{
"description": "Show status",
"indicator": "None",
"inputs": "CLI command",
"name": "Show status",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer User",
"secFunImpl": "None"
},
{
"description": "Zeroize/destr oy all CSPs",
"indicator": "None",
"inputs": "CLI command",
"name": "Zeroize",
"outputs": "None (completi on indicator is implicitly provided by the module rebooting)",
"rolesSspAccess": "Cryptographic Officer - HMAC DRBG V value: Z - HMAC DRBG Key value: Z - HMAC DRBG Seed: Z - HMAC DRBG Entropy Input (kernel): Z - SSH-DH-",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "Shared-Secret: Z - SSH-Priv: Z - SSH-SEKs: Z - SSH-SEKs (Auth): Z - CO-PW: Z - User-PW: Z - SSH-PUB: Z - Auth-User Pub: Z - Root-CA: Z - Package-CA: Z - SSH-DH- PUB (self): Z - SSH-DH- PUB (peer): Z",
"secFunImpl": ""
},
{
"description": "Initiate SSH connection for SSH monitoring and control (CLI)",
"indicator": "\u0027:fips\u0027 suffix in CLI prompt",
"inputs": "SSH packets",
"name": "SSH connect",
"outputs": "SSH packets, status",
"rolesSspAccess": "Cryptographic Officer - HMAC DRBG V value: E - HMAC DRBG Key value: E - HMAC DRBG Entropy Input (kernel): E - HMAC DRBG Seed: E - SSH-DH- Shared-Secret: G,E - SSH-DH-",
"secFunImpl": "Enc/Dec (SSH) KAS- SSC (SSH) ECDSA SigGen (SSH) ECDSA SigVer (SSH) MAC (SSH) KDF (SSH) AES- CBC- MAC"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "priv: G,E - SSH-SEKs: G,E - SSH-SEKs (Auth): G,E - Auth-CO Pub: E - SSH-Priv: E - CO-PW: E - SSH-DH- PUB (self): G,R - SSH-DH- PUB (peer): W,E User - HMAC DRBG V value: E - HMAC DRBG Key value: E - HMAC DRBG Entropy Input (kernel): E - HMAC DRBG Seed: E - SSH-Priv: E - User-PW: E - SSH-DH- Shared-Secret: G,E - SSH-DH- priv: G,E - SSH-SEKs: G,E",
"secFunImpl": "(Intel) RSA SigGen (SSH) RSA SigVer (SSH) Full KAS (SSH) KAS- ECC KeyGen (SSH) ENT KTS (SSH)"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "- SSH-SEKs (Auth): G,E - SSH-DH- PUB (self): G,R - SSH-DH- PUB (peer): W,E - Auth-User Pub: E",
"secFunImpl": ""
},
{
"description": "Console monitoring and control (CLI)",
"indicator": "None",
"inputs": "CLI command",
"name": "Console access",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer - CO-PW: E User - User-PW: R,E",
"secFunImpl": "None"
},
{
"description": "Software initiated reset",
"indicator": "None",
"inputs": "CLI command",
"name": "Remote reset",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer - HMAC DRBG V value: Z - HMAC DRBG Key value: Z - HMAC DRBG Entropy Input (kernel): Z - HMAC DRBG Seed: Z - SSH-DH- Shared-Secret: Z - SSH-DH- priv: Z - SSH-SEKs: Z - SSH-SEKs",
"secFunImpl": "None"
},
{
"description": "",
"indicator": "",
"inputs": "",
"name": "",
"outputs": "",
"rolesSspAccess": "(Auth): Z - SSH-DH- PUB (self): Z - SSH-DH- PUB (peer): Z",
"secFunImpl": ""
},
{
"description": "Hardware reset or power cycle",
"indicator": "None",
"inputs": "Manual power cycle",
"name": "Local reset",
"outputs": "Status",
"rolesSspAccess": "Unauthenticat ed - HMAC DRBG V value: Z - HMAC DRBG Key value: Z - HMAC DRBG Entropy Input (kernel): Z - HMAC DRBG Seed: Z - SSH-DH- Shared-Secret: Z - SSH-SEKs: Z - SSH-SEKs (Auth): Z - SSH-DH- PUB (self): Z - SSH-DH- PUB (peer): Z",
"secFunImpl": "None"
},
{
"description": "Traffic requiring no cryptographic services",
"indicator": "None",
"inputs": "Traffic in",
"name": "Traffic",
"outputs": "Traffic out",
"rolesSspAccess": "Unauthenticat ed",
"secFunImpl": "None"
},
{
"description": "Loading of firmware image",
"indicator": "\u0027:fips\u0027 suffix in CLI prompt",
"inputs": "CLI command, image location",
"name": "Load Image",
"outputs": "status",
"rolesSspAccess": "Cryptographic Officer - Root-CA: E - Package-CA: E",
"secFunImpl": "Verify image"
},
{
"description": "On demand execution of all pre- operational and conditional algorithm self-tests",
"indicator": "None",
"inputs": "Local or remote reset",
"name": "Perform self- tests",
"outputs": "status",
"rolesSspAccess": "Cryptographic Officer User Unauthenticat ed",
"secFunImpl": "None"
},
{
"description": "Show firmware version",
"indicator": "None",
"inputs": "CLI command",
"name": "Show version",
"outputs": "Status",
"rolesSspAccess": "Cryptographic Officer User",
"secFunImpl": "None"
}
],
"found": true,
"section": 4,
"subsection": 3
},
"authentication_methods": {
"entries": [
{
"description": "User and CO authentication via SSH or console. Minimum of 10 ASCII character passwords..",
"mechanism": "SHA (LibMD)",
"name": "Password authentication",
"perMinute": "Timed access mechanism allows max of 10 attempts / min. Probability of guessing: 10/(96^10) \u003c 1/100,000.",
"strength": "Probability of guessing: 1/(96^10) \u003c 1/1,000,000."
},
{
"description": "User/CO authentication via SSH",
"mechanism": "ECDSA SigVer (SSH), RSA SigVer (SSH)",
"name": "Signature authentication",
"perMinute": "A rate of 1 CPU cycle per failed authentication for the Intel(R) Xeon(R) D- 1713NT processor (4 cores, 2.2 GHz) allows for the probability of success by brute-force attack: 60 x 4 x 2.2 x 10^9 x 1/(2^112) \u003c 1/100,000.",
"strength": "Strength of signature algorithm, minimum 112-bits. Probability of success for random attempt: 1/(2^112) \u003c 1/1,000,000."
}
],
"found": true,
"section": 4,
"subsection": 1
},
"cond_self_tests": {
"entries": [
{
"algorithmOrTest": "Entropy Source (start- up)",
"condition": "On power- up",
"details": "Start-up",
"indicator": "Console output / output of entropy source",
"testMethod": "APT, RCT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "Entropy Source (continuous)",
"condition": "On power- up",
"details": "Continuous",
"indicator": "Console output / output of entropy source",
"testMethod": "APT, RCT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A6736) Encrypt",
"condition": "On power- up",
"details": "Encrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A6736) Decrypt",
"condition": "On power- up",
"details": "Decrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A6736) Encrypt",
"condition": "On power- up",
"details": "Encrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CTR (A6736) Decrypt",
"condition": "On power- up",
"details": "Decrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC DRBG (A5108)",
"condition": "On power- up",
"details": "Instantiate, reseed, and generate",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "CAST"
},
{
"algorithmOrTest": "KAS-ECC- SSC Sp800- 56Ar3 (A6736)",
"condition": "On power- up",
"details": "Derivation of the expected shared secret",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "P-256 (SHA 256)",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigGen (FIPS186-5) (A6736)",
"condition": "On power- up",
"details": "Sign",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "P-256, P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA SigVer (FIPS186-5) (A6736)",
"condition": "On power- up",
"details": "Verify",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "P-256, P- 384",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA- 1 (A6736)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size: 160 bits, = 160",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A6736)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size: 256 bits, = 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-512 (A6736)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size: 512 bits, = 512",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigGen (FIPS186-5) (A6736)",
"condition": "On power- up",
"details": "Sign",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "RSA 2048 w/ SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "RSA SigVer (FIPS186-5) (A6736)",
"condition": "On power- up",
"details": "Verify",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "RSA 2048 w/ SHA2- 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A6736)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A6736)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-384 (A6736)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A6736)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "KDF SSH (A6736)",
"condition": "On power- up",
"details": "Key derivation",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "SHA-1, SHA2-256, SHA2-384",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5107)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5107)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5107)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA- 1 (A5107)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size: 160 bits, = 160",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A5107)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size: 256 bits, = 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A5108) Encrypt",
"condition": "On power- up",
"details": "Encrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "AES-CBC (A5108) Decrypt",
"condition": "On power- up",
"details": "Decrypt",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key Sizes: 128, 192, 256",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC-SHA- 1 (A5108)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size:160 bits, = 160",
"type": "CAST"
},
{
"algorithmOrTest": "HMAC- SHA2-256 (A5108)",
"condition": "On power- up",
"details": "MAC",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "Key size:256 bits, = 256",
"type": "CAST"
},
{
"algorithmOrTest": "SHA-1 (A5108)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-256 (A5108)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "SHA2-512 (A5108)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "n/a",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyGen (FIPS186-5) (A6736)",
"condition": "On key generation",
"details": "Generation and Verification of ECDSA signature",
"indicator": "Returned key/transition critical error state",
"testMethod": "PCT",
"testProps": "P-256, P- 384, P-521",
"type": "PCT"
},
{
"algorithmOrTest": "RSA KeyGen (FIPS186-5) (A6736)",
"condition": "On key generation",
"details": "Generation and Verification of signature",
"indicator": "Returned key/transition critical error state",
"testMethod": "PCT",
"testProps": "RSA 2048, RSA 4096",
"type": "PCT"
},
{
"algorithmOrTest": "FW load",
"condition": "On FW load",
"details": "Verification of ECDSA signature on FW",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "ECDSA P- 256 with SHA2-256",
"type": "SW/FW Load"
},
{
"algorithmOrTest": "Manual SSP entry",
"condition": "On manual, direct entry of SSP",
"details": "Duplicate entry",
"indicator": "PASS/FAIL console output",
"testMethod": "Duplicate entry",
"testProps": "-",
"type": "Manual Entry"
},
{
"algorithmOrTest": "SHA2-256 (A5633)",
"condition": "On power- up",
"details": "Hash",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "N/A",
"type": "CAST"
},
{
"algorithmOrTest": "ECDSA KeyVer (FIPS186-5) (A6736)",
"condition": "On key generation",
"details": "Generation and Verification of ECDSA signature",
"indicator": "Returned key/transition critical error state",
"testMethod": "PCT",
"testProps": "P-256, P- 384, P-521",
"type": "PCT"
}
],
"found": true,
"section": 10,
"subsection": 2
},
"error_states": {
"entries": [
{
"conditions": "On self-test error, PCT",
"description": "The cryptographic module ceases to perform cryptographic operations, inhibits all data output, and provides status of the error via syslog messages and console status output",
"indicator": "Console status output",
"name": "Critical Failure state",
"recoveryMethod": "Power cycle"
},
{
"conditions": "Firmware load test, continuous entropy health test failure",
"description": "A non-critical self-test failure occurs, causing a failure of the triggering operation",
"indicator": "Console displays error",
"name": "Soft Error State",
"recoveryMethod": "The module processes the error, and resumes normal operation"
}
],
"found": true,
"section": 10,
"subsection": 4
},
"mechanisms_actions": {
"entries": [
{
"inspectFreq": "Once per month by the Cryptographic Officer",
"inspectGuidance": "Seals should be free of any tamper evidence.",
"mechanism": "Tamper seals (part # Juniper Networks XXXXXX (barcode))"
},
{
"inspectFreq": "n/a",
"inspectGuidance": "n/a",
"mechanism": "Opaque metal enclosure."
}
],
"found": true,
"section": 7,
"subsection": 1
},
"modes_of_operation": {
"entries": [
{
"description": "Approved mode of operation enabled by following the configuration commands in Section 11.1",
"name": "Approved",
"statusIndicator": "Suffix string \":fips\" in the cli prompt",
"type": "Approved"
}
],
"found": true,
"section": 2,
"subsection": 4
},
"non_approved_allowed_NSC": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_allowed_algos": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_not_allowed": {
"entries": [],
"found": false,
"section": 2,
"subsection": 5
},
"non_approved_services": {
"entries": [],
"found": false,
"section": 4,
"subsection": 4
},
"ports_interfaces": {
"entries": [
{
"data": "LAN communications",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (data)"
},
{
"data": "Remote management",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "Ethernet (mgmt.)"
},
{
"data": "Local management",
"logicalInterface": "Control Input Status Output",
"physicalPort": "Serial"
},
{
"data": "Reset",
"logicalInterface": "Control Input",
"physicalPort": "Reset Button"
},
{
"data": "Power on/off",
"logicalInterface": "Control Input",
"physicalPort": "Power Button"
},
{
"data": "Status indicator lighting",
"logicalInterface": "Status Output",
"physicalPort": "LED"
},
{
"data": "Power",
"logicalInterface": "Power",
"physicalPort": "Power"
},
{
"data": "Firmware load port",
"logicalInterface": "Data Input Control Input",
"physicalPort": "USB"
},
{
"data": "Two 1/10/25 GbE SFP28 MACsec ports for network traffic",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "SFP28"
},
{
"data": "Four 1/10 GbE SFP+ MACsec ports for network traffic",
"logicalInterface": "Data Input Data Output Control Input Status Output",
"physicalPort": "SFP+"
}
],
"found": true,
"section": 3,
"subsection": 1
},
"roles": {
"entries": [
{
"authMethodList": "Password authentication Signature authentication",
"name": "User",
"operatorType": "Monitor",
"type": "Role"
},
{
"authMethodList": "Password authentication Signature authentication",
"name": "Cryptographic Officer",
"operatorType": "CO",
"type": "Role"
}
],
"found": true,
"section": 4,
"subsection": 2
},
"security_levels": {
"entries": [
{
"level": "2",
"section": "1",
"title": "General"
},
{
"level": "2",
"section": "2",
"title": "Cryptographic module specification"
},
{
"level": "2",
"section": "3",
"title": "Cryptographic module interfaces"
},
{
"level": "2",
"section": "4",
"title": "Roles, services, and authentication"
},
{
"level": "2",
"section": "5",
"title": "Software/Firmware security"
},
{
"level": "N/A",
"section": "6",
"title": "Operational environment"
},
{
"level": "2",
"section": "7",
"title": "Physical security"
},
{
"level": "N/A",
"section": "8",
"title": "Non-invasive security"
},
{
"level": "2",
"section": "9",
"title": "Sensitive security parameter management"
},
{
"level": "2",
"section": "10",
"title": "Self-tests"
},
{
"level": "2",
"section": "11",
"title": "Life-cycle assurance"
},
{
"level": "N/A",
"section": "12",
"title": "Mitigation of other attacks"
},
{
"level": "2",
"section": "",
"title": "Overall Level"
}
],
"found": true,
"section": 1,
"subsection": 2
},
"self_tests": {
"entries": [
{
"algorithmOrTest": "Firmware Integrity check",
"details": "ECDSA Verify",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "ECDSA P- 256 with SHA2-256",
"type": "SW/FW Integrity"
},
{
"algorithmOrTest": "Critical functions test",
"details": "The module implements a critical function that checks that any file that is executed is registered in a manifest of executable files that comes with the firmware. A pre- operational critical function test is implemented that verifies the integrity of the operational environment is being enforced by having the kernel attempt to run a specific executable file that does not contain a hash in the manifest file. The test is successful if it verifies that the specific file cannot be executed.",
"indicator": "PASS/FAIL console output",
"testMethod": "KAT",
"testProps": "SHA2-256",
"type": "Critical Function"
}
],
"found": true,
"section": 10,
"subsection": 1
},
"ssp_io_methods": {
"entries": [
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Entry via SSH",
"sfiAlgo": "KTS (SSH)",
"source": "Remote CO"
},
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Manual CLI entry",
"sfiAlgo": "",
"source": "Local CO"
},
{
"dest": "RAM",
"distribution": "Manual",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entry via console",
"sfiAlgo": "",
"source": "Local CO"
},
{
"dest": "Remote CO",
"distribution": "Automated",
"entry": "Electronic",
"format": "Encrypted",
"name": "Output via SSH",
"sfiAlgo": "KTS (SSH)",
"source": "RAM"
},
{
"dest": "Local CO",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Output via console",
"sfiAlgo": "",
"source": "RAM"
},
{
"dest": "RAM",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Entry as part of KAS",
"sfiAlgo": "",
"source": "Remote peer"
},
{
"dest": "Remote peer",
"distribution": "Automated",
"entry": "Electronic",
"format": "Plaintext",
"name": "Output as part of KAS",
"sfiAlgo": "",
"source": "RAM"
},
{
"dest": "SSD",
"distribution": "Manual",
"entry": "Direct",
"format": "Plaintext",
"name": "Pre-loaded",
"sfiAlgo": "",
"source": "Manufacturer"
}
],
"found": true,
"section": 9,
"subsection": 2
},
"ssp_zeroization_methods": {
"entries": [
{
"description": "Zeroization of SSPs in RAM via invocation of local or remote reset service",
"method": "Reset",
"operatorId": "Yes, both User and CO, via invocation of Local Reset or Remote Reset services",
"rationale": "RAM is volatile and all data is lost when power is taken off. Zeroization is practically instantaneous."
},
{
"description": "This command wipes clean all the SSPs/configs as well as the disk and installs a factory default firmware image",
"method": "Zeroize CLI command",
"operatorId": "Yes, CO via invocation of zeroize CLI command",
"rationale": "This command overwrites all data on disk and forces a power cycle"
},
{
"description": "Zeroization of SSPs in memory when no longer needed",
"method": "Explicit zeroize function",
"operatorId": "No. The operator cannot directly initiate this method.",
"rationale": "Use of explicit zeroization function destroys SSP information immediately by overwriting memory area with zeroes"
}
],
"found": true,
"section": 9,
"subsection": 3
},
"storage_areas": {
"entries": [
{
"description": "Random Access Memory",
"name": "RAM",
"persistance": "Dynamic"
},
{
"description": "Solid-Stated Drive",
"name": "SSD",
"persistance": "Static"
}
],
"found": true,
"section": 9,
"subsection": 1
},
"tested_module_id_hw": {
"entries": [
{
"features": "16 x 1 GbE 10/100/1000 BASE-T ports; 4 x 1 GbE/10 GbE SFP+ ports; 4x10GbE SFP ports+; 2 x 1 GbE/10 GbE/25 GbE SFP28 ports; 2 x 1 GbE SFP ports",
"fwVersion": "Junos OS 23.4R1.9",
"hwVersion": "SRX1600",
"modelPartNum": "SRX1600",
"processors": "Intel(R) Xeon(R) D- 1713NT"
}
],
"found": true,
"section": 2,
"subsection": 2
},
"tested_module_id_hw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_module_id_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"tested_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
},
"vendor_affirmed_algos": {
"entries": [
{
"algoPropList": "Key type:Asymmetric",
"implName": "N/A",
"name": "CKG",
"reference": "SP 800-133 Rev. 2 Section 4, example 1 direct output from DRBG."
}
],
"found": true,
"section": 2,
"subsection": 5
},
"vendor_affirmed_op_env_sw_fw_hy": {
"entries": [],
"found": false,
"section": 2,
"subsection": 2
}
},
"is_br1_format": true,
"keywords": {
"asymmetric_crypto": {
"ECC": {
"ECC": {
"ECC": 1
},
"ECDSA": {
"ECDSA": 47
}
},
"FF": {
"DH": {
"DH": 6,
"Diffie-Hellman": 4
}
},
"RSA": {
"RSA 2048": 4,
"RSA 4096": 2
}
},
"certification_process": {},
"cipher_mode": {
"CBC": {
"CBC": 1
},
"CTR": {
"CTR": 1
}
},
"cplc_data": {},
"crypto_engine": {},
"crypto_library": {
"OpenSSL": {
"OpenSSL": 6
}
},
"crypto_protocol": {
"SSH": {
"SSH": 104,
"SSHv2": 1
}
},
"crypto_scheme": {
"KA": {
"Key Agreement": 2
},
"KEX": {
"Key Exchange": 1
},
"MAC": {
"MAC": 15
}
},
"device_model": {},
"ecc_curve": {
"NIST": {
"P-256": 36,
"P-384": 20,
"P-521": 28
}
},
"eval_facility": {},
"fips_cert_id": {},
"fips_certlike": {
"Certlike": {
"AES CBC 128/192/256": 1,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1,
"DRBG 256": 1,
"HMAC-SHA- 1": 6,
"HMAC-SHA-1": 12,
"RSA 2048": 4,
"RSA 4096": 2,
"SHA 256": 1,
"SHA-1": 11,
"SHA2- 256": 2,
"SHA2- 384": 1,
"SHA2-256": 25,
"SHA2-384": 7,
"SHA2-512": 13,
"SHA2256": 1
}
},
"fips_security_level": {
"Level": {
"Level 2": 3,
"level 2": 1
}
},
"hash_function": {
"SHA": {
"SHA1": {
"SHA-1": 11
}
}
},
"ic_data_group": {},
"javacard_api_const": {},
"javacard_packages": {},
"javacard_version": {},
"os_name": {},
"pq_crypto": {},
"randomness": {
"PRNG": {
"DRBG": 53
},
"RNG": {
"RBG": 2
}
},
"side_channel_analysis": {},
"standard_id": {
"FIPS": {
"FIPS 140-3": 63,
"FIPS 180-4": 9,
"FIPS 186-5": 9,
"FIPS 198-1": 6,
"FIPS PUB 140-3": 1,
"FIPS186-5": 32
},
"ISO": {
"ISO/IEC 19790:2012": 1
},
"NIST": {
"SP 800-133": 1,
"SP 800-135": 1,
"SP 800-38A": 2,
"SP 800-56A": 2,
"SP 800-90A": 1,
"SP 800-90B": 1
}
},
"symmetric_crypto": {
"AES_competition": {
"AES": {
"AES": 2,
"AES-": 3,
"AES-128": 1,
"AES-192": 1,
"AES-256": 1
},
"CAST": {
"CAST": 66
}
},
"constructions": {
"MAC": {
"CBC-MAC": 2,
"HMAC": 40
}
}
},
"tee_name": {
"AMD": {
"PSP": 7
},
"IBM": {
"SSC": 5
}
},
"tls_cipher_suite": {},
"vendor": {},
"vulnerability": {}
},
"module_algorithms": {
"_type": "Set",
"elements": [
"SHA2-384A6736",
"ECDSA SigVer (FIPS186-5)A6736",
"AES-CBCA6736",
"HMAC-SHA-1A6736",
"HMAC-SHA2-512A6736",
"SHA-1A6736",
"SHA2-256A6736",
"KDF SSHA6736",
"Conditioning Component AES-CBC-MAC SP800-90BA2518",
"HMAC-SHA2-256A6736",
"ECDSA KeyGen (FIPS186-5)A6736",
"AES-CTRA6736",
"RSA SigGen (FIPS186-5)A6736",
"RSA SigVer (FIPS186-5)A6736",
"ECDSA KeyVer (FIPS186-5)A6736",
"HMAC DRBGA5108",
"SHA2-512A6736",
"RSA KeyGen (FIPS186-5)A6736",
"KAS-ECC-SSC Sp800-56Ar3A6736",
"ECDSA SigGen (FIPS186-5)A6736"
]
},
"policy_algorithms": {
"_type": "Set",
"elements": [
"#A5633",
"#A6736",
"#A2518",
"#A5107",
"#A5108"
]
},
"policy_metadata": {
"/CreationDate": "D:20260706090635-04\u002700\u0027",
"/Creator": "Microsoft\u00ae Word for Microsoft 365",
"/ModDate": "D:20260706090635-04\u002700\u0027",
"/Producer": "Microsoft\u00ae Word for Microsoft 365",
"pdf_file_size_bytes": 1589674,
"pdf_hyperlinks": {
"_type": "Set",
"elements": [
"https://csrc.nist.gov/projects/cryptographic-module-validation-program/entropy-validations/certificate/141",
"http://www.teronlabs.com/"
]
},
"pdf_is_encrypted": false,
"pdf_number_of_pages": 53
}
},
"state": {
"_type": "sec_certs.sample.fips.InternalState",
"module": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": null,
"source_hash": null,
"txt_hash": null
},
"policy": {
"_type": "sec_certs.sample.document_state.DocumentState",
"convert_ok": true,
"download_ok": true,
"extract_ok": true,
"json_hash": "93544986c2d187cffa8649fe289674262d902939422707e4a264e04bc5b0b7df",
"source_hash": "61cb770cf6cd3cb8fa3f43315952ddf2cf646425ac2630f50c10ad111129610a",
"txt_hash": "eaae315ace49c2669b95bc76420f884d08c5601af1c5fce6184b582fcb23eeca"
}
},
"web_data": {
"_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
"caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy",
"certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
"date_sunset": "2031-07-11",
"description": "The SRX1600 Service Gateway offers outstanding protection, performance, scalability, availability, and integrated security services. Designed for high-performance security services architecture, and seamless integration of networking and security in a single platform, the SRX1600 is best suited for campuses, regional headquarters and enterprise data centers with a focus on application visibility and control, intrusion prevention, advanced threat protection, authentication, confidentiality of information, and integrated cloud-based security.",
"embodiment": "MultiChipStand",
"exceptions": [
"Operational environment: N/A",
"Non-invasive security: N/A",
"Mitigation of other attacks: N/A"
],
"fw_versions": null,
"historical_reason": null,
"hw_versions": null,
"level": 2,
"mentioned_certs": {},
"module_name": "HPE Juniper Networking SRX1600 Service Gateway",
"module_type": "Hardware",
"revoked_link": null,
"revoked_reason": null,
"standard": "FIPS 140-3",
"status": "active",
"sw_versions": null,
"tested_conf": null,
"validation_history": [
{
"_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
"date": "2026-07-12",
"lab": "Teron Labs",
"validation_type": "Initial"
}
],
"vendor": "HPE Juniper Networking",
"vendor_url": "http://www.juniper.net"
}
}