Copyright Juniper, 2018 Version 1.1 Page 1 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Juniper Networks MX240, MX480, MX960, MX2010, and
MX2020 3D Universal Edge Routers with RE1800 Routing
Engine and Multiservices MPC
Firmware: Junos OS 17.4R1-S1
Non-Proprietary FIPS 140-2 Cryptographic Module Security
Policy
Version: 1.1
Date: February 6, 2019
Juniper Networks, Inc.
1133 Innovation Way
Sunnyvale, California 94089
USA
408.745.2000
1.888 JUNIPER
www.juniper.net
Copyright Juniper, 2018 Version 1.1 Page 2 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Contents
1 Introduction ..........................................................................................................................................4
1.1 Hardware and Physical Cryptographic Boundary ...............................................................................7
Modes of Operation......................................................................................................................8
1.2.1 FIPS ApprovedModes ..................................................................................................................8
1.2.2 Non-ApprovedMode ...................................................................................................................9
2 Cryptographic Functionality ................................................................................................................10
Allowed Algorithms and Protocols..............................................................................................10
DisallowedAlgorithms and Protocols .........................................................................................14
Critical Security Parameters........................................................................................................15
3 Roles, Authentication and Services .....................................................................................................17
3.1 Roles and Authentication of Operators to Roles................................................................................17
Authentication Methods .............................................................................................................17
Services .......................................................................................................................................18
Non-Approved Services...............................................................................................................21
4 Self-tests..............................................................................................................................................23
5 Physical Security Policy........................................................................................................................24
6 Security Rules and Guidance...............................................................................................................20
6.1 Security Rules....................................................................................................................................20
Crypto-Officer Guidance .............................................................................................................20
6.2.2 Zeroize........................................................................................................................................22
User Guidance.............................................................................................................................22
7 References and Definitions .................................................................................................................23
Copyright Juniper, 2018 Version 1.1 Page 3 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
List of Tables
Table 1 – Cryptographic Module Hardware Configurations .......................................................................5
Table 2 – Security Level of Security Requirements.....................................................................................6
Table 3 – Ports and Interfaces .....................................................................................................................8
Table 4 – Kernel Approved Cryptographic Functions................................................................................10
Table 5 – LibMD Approved Cryptographic Functions................................................................................10
Table 6 – OpenSSL Approved Cryptographic Functions............................................................................11
Table 7 – QuickSec Approved Cryptographic Functions ...........................................................................12
Table 8 – XLP (MS-MPC) Approved Cryptographic Functions...................................................................13
Table 9 – Allowed Cryptographic Functions..............................................................................................13
Table 10 – Protocols Allowed in FIPS Mode..............................................................................................13
Table 11 – Critical Security Parameters (CSPs)..........................................................................................15
Table 12 – Public Keys................................................................................................................................16
Table 13 – Standard and Reduced Throughput Mode Authenticated Services .......................................18
Table 14 – Recovery Mode Authenticated Services..................................................................................18
Table 15 – Unauthenticated Services ........................................................................................................19
Table 16 – CSP Access Rights within Services............................................................................................19
Table 17-- Non-Approved Standard and Reduced Throughput Mode Authenticated Services ..............21
Table 18 -- Non-Approved Recovery Mode Authenticated Services........................................................21
Table 19 -- Non-Approved Unauthenticated Services ..............................................................................22
Table 20 – References ................................................................................................................................23
Table 21 – Acronyms and Definitions........................................................................................................23
Table 22 - Datasheets.................................................................................................................................24
List of Figures
Figure 1 – Physical Cryptographic Boundary (Left to Right: MX240, MX480, MX960, MX2010, MX2020)
......................................................................................................................................................................7
Copyright Juniper, 2018 Version 1.1 Page 4 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
1 Introduction
This is a non-proprietary Cryptographic Module Security Policy for the Juniper Networks MX Series 3D
Universal Edge Routers with the Multiservices Modular PIC Concentrator (MS-MPC). The MX series provides
dedicated high-performance processing for flows and sessions and integrates advanced security
capabilities that protect the network infrastructure as well as user data.
This MX Series validation includes five models: the MX240, MX480, MX960, MX2010 and MX2020, each
loaded with the MS-MPC, which provides hardware acceleration for an array of packet processing-
intensive services such as Session Border Control functions, stateful firewall, NAT, flow monitoring, and
anomaly detection. This integration allows customers to eliminate external firewalls that consume router
ports and additional management resources. The FIPS validated version of firmware is Junos OS 17.4R1-
S1.
The cryptographic boundary for the MX Series is defined as follows for the validation:
• the outer edge of the chassis and including the Routing Engine (RE), the MS-MPC, Switch Control
Board/Switch Fabric Board (SCB)/(SFB) and slot covers in the following configurations:
o For MX240 (2 available RE slots, 2 additional slots): 1 SCB, 1 RE, and at least 1 MS-MPC. All
empty module bays must have a slot cover installed for proper cooling air circulation.
o For MX480 (2 available RE slots, 6 additional slots):1 SCB, 1 RE, at least 1 MS- MPC. All empty
module bays must have a slot cover installed for proper cooling air circulation.
o For MX960 (2 available RE slots, 12 additional slots): 1 SCB, 1 RE, at least 1 MS-MPC. All
empty module bays must have a slot cover installed for proper cooling air circulation.
o For MX2010 (2 available RE slots, 10 additional slots): 1 SFB, 1 RE, at least 1 MS-MPC. All
empty module bays must have a slot cover installed for proper cooling air circulation.
o For MX2020 (2 available RE slots, 20 additional slots): 1 SCB, 1 RE, at least 1 MS-MPC. All
empty module bays must have a slot cover installed for proper cooling air circulation.
• includes the inverse three-dimensional space where non-crypto-relevant line cards fit, with the
backplane port serving as the physical interface.
• excluding the power distribution module on the rear of the device.
The cryptographicmodule is defined as a multiple-chipstandalone module that executes Junos OS 17.4R1-
S1 firmware on any of the Juniper Networks MX 3D Universal Edge Routers listed in Table 1 below.
Copyright Juniper, 2018 Version 1.1 Page 5 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Table 1 – Cryptographic Module Hardware Configurations
Chassis PN Power PN SCB PN RE PN MS PN
MX240
PWR-MX480-2400-DC
PWR-MX480-2520-AC
SCB-MX960
RE-S-1800X4-XXG
Note: XX = 8, 16, or
32 GB memory
MS-MPC
MX480
PWR-MX480-2400-DC
PWR-MX480-2520-AC
SCB-MX960
RE-S-1800X4-XXG
Note: XX = 8, 16, or
32 GB memory
MS-MPC
MX960
PWR-MX960-4100-DC
PWR-MX960-DC
PWR-MX960-4100-AC
PWR-MX960-AC
SCB-MX960
RE-S-1800X4-XXG
Note: XX = 8, 16, or
32 GB memory
MS-MPC
MX2010
MX2K-PDM-OP-DC
MX2000-PDM-DC
MX2K-PDM-AC-1PH
MX2K-PDM-OP-AC
MX2000-PDM-DC
MX2K-SFB
RE-S-1800X4-XXG
Note: XX = 8, 16, or
32 GB memory
MS-MPC
MX2020
MX2K-PDM-OP-DC
MX2000-PDM-DC
MX2K-PDM-AC-1PH
MX2K-PDM-OP-AC
MX2K-SFB
RE-S-1800X4-XXG
Note: XX = 8, 16, or
32 GB memory
MS-MPC
Copyright Juniper, 2018 Version 1.1 Page 6 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
The module is designed to meet FIPS 140-2 Level 1 overall:
Table 2 – Security Level of Security Requirements
Area Description Level
1 Module Specification 1
2 Ports and Interfaces 1
3
Roles, Services, and
Authentication
3
4 Finite State Model 1
5 Physical Security 1
6 Operational Environment N/A
7 Key Management 1
8 EMI/EMC 1
9 Self-test 1
10 Design Assurance 3
11 Mitigation of Other Attacks N/A
Overall 1
The module has a limited operational environment as per the FIPS 140-2 definitions. It includes a firmware
load service to support necessary updates. New firmware versions within the scope of this validation must
be validated through the FIPS 140-2 CMVP. Any other firmware loaded into this module is out of the scope
of this validation and require a separate FIPS 140-2 validation.
The module does not implement any mitigations of other attacks as defined by FIPS 140-2.
Copyright Juniper, 2018 Version 1.1 Page 7 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
1.1 Hardware and Physical Cryptographic Boundary
The cryptographic modules’ operational environment is a limited operational environment.
The image below depicts the physical boundary of the modules. The boundary includes the Routing Engine,
MS-MPC, and SCB/SFB. The boundary excludes the non-crypto-relevant line cards included in the figure.
Figure 1 – Physical Cryptographic Boundary (Left to Right: MX240, MX480, MX960, MX2010, MX2020)
Copyright Juniper, 2018 Version 1.1 Page 8 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Table 3 – Ports and Interfaces
Port Description Logical Interface Type
Ethernet (data) LAN Communications Control in, Data in, Status out Data out
Ethernet (mgmt.) Remote Management Control in, Data in, Status out, Data out
Serial Console serial port Control in, Data in, Status out, Data out
Power Power connector Power
Reset Button Reset Control in
LED Status indicator lighting Status out
USB Load Junos OS image Control in, Data in
Backplane Line card backplane interfaces Control in, Data in, Status out, Data out
Chassis Cluster
Control
Disabled N/A
Aux Disabled N/A
Modes of Operation
The module supports three FIPS Approved modes of operation and one non-Approved mode of
operation. The three FIPS Approved modes are identified as FIPS Standard, FIPS Reduced Throughput, and
FIPS Recovery. The module must always be zeroized when switching between a FIPS Approved mode of
operation and the non-Approved mode of operation and vice versa.
1.2.1 FIPS Approved Modes
The Crypto-Officer places the module in an Approved mode of operation by following the instructions in
section 6.2.1 and 6.2.2.
No further configurationis necessary for the purpose of placing the module in one of the Approved modes
of operation.
The Crypto-Officer should also ensure that the backup image of the firmware is also Junos 17.4R1-S1 by
issuing the ‘request system snapshot’ command.
The Crypto-Officer can verify that the cryptographic module is in an Approved mode by observing the
console prompt and running the “show version” command. When operating in FIPS mode, the prompt will
read “<user>@<device name>: fips#” (e.g. crypto-officer@mx240: fips#) and the output of the “show
version” command will include “JUNOS Packet Forwarding Engine Support (fips) [17.4R1-S1]”.
In the Standard and Reduced Throughput Approved modes, the module supports the Approved and
Copyright Juniper, 2018 Version 1.1 Page 9 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
allowed algorithms, functions and protocols identified in Tables 4 - 10. The services available in these
modes are described in Table 13, Table 14 and Table 15.
The Reduced Throughput mode is automatically selected by the module at power-up when the RE self-
tests pass, at least one PIC (each MS-MPC contains 4 PIC) passes its self-tests, and at least one PIC fails its
self-tests. In this mode, the module offers reduced throughput VPN services.
In the Recovery Approved mode, the module supports the OpenSSL, SSH, and LibMD algorithms in Table
4 and Table 5, and the SSH protocol in Table 6. The Recovery mode is automatically selected by the module
at power-upif all of the MS-MPC cards fail their power-up self-tests but the RE self-tests pass. In this mode,
the module does not offer VPN services. The services available in the Recovery mode are described in Table
14 and Table 15.
1.2.2 Non-Approved Mode
The cryptographic module supports a non-Approved mode of operation. When operated in the non-
Approved mode of operation, the module supports the algorithms identified in Section 2.2 as well as the
algorithms supported in the Approved mode of operation.
The Crypto-Officer can place the module into a non-approved mode of operation by following the
instructions for zeroizing the module found in section 6.2.2.
Copyright Juniper, 2018 Version 1.1 Page 10 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
2 Cryptographic Functionality
Allowed Algorithms and Protocols
The module implements the FIPS Approved and Non-Approved but Allowed cryptographic functions listed
in Tables 4, 5, 6, 7, 8 and 9 below. The Allowed Protocols in Table 10 summarizes the high-level protocol
algorithm support. There are some algorithm modes that were tested but not implemented by the
module. Only the algorithms, modes, and key sizes that are implemented by the module are shown in
this/these table(s).
Table 4 – Kernel Approved Cryptographic Functions
CAVP
Cert. Algorithm Standard Mode Description Functions
2168 DRBG SP 800-90A HMAC SHA-256 Random Bit Generation
3648 HMAC PUB 198
SHA-1 Key size: 160 bits, λ = 96
Message Authentication,
DRBG Primitive
SHA-256
Key size: 256 bits, λ = 128,
256
4407 SHS PUB 180-4
SHA-1
SHA-256
SHA-384
SHA-512
Message Digest
Generation
Table 5 – LibMD Approved Cryptographic Functions
CAVP
Cert. Algorithm Standard Mode Description Functions
3649 HMAC
PUB 198
SHA-1 Key size: 160 bits, λ = 96
Message Authentication
SHA-256
Key size: 256 bits,
λ = 128, 256
4408 SHS PUB 180-4
SHA-1
SHA-256
SHA-512
Message Digest
Generation
Copyright Juniper, 2018 Version 1.1 Page 11 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Table 6 – OpenSSL Approved Cryptographic Functions
CAVP
Cert. Algorithm Standard Mode Description Functions
5499 AES PUB 197-38A
CBC, ECB,
CTR
Key Sizes: 128, 192,
256
Encrypt, Decrypt
N/A1
CKG SP 800-133
Section 6.1
Section 6.2
Asymmetric key
generation using
unmodified DRBG
output
1949 CVL SP 800 135 SSH SHA 1, 256, 384, 512 Key Derivation
2169 DRBG SP 800-90A HMAC SHA-256 Random Bit Generation
1478 ECDSA PUB 186-4
P-256 (SHA 256)
P-384 (SHA 384)
P-521 (SHA 512)
SigGen, KeyGen, SigVer
3650 HMAC PUB 198
SHA-1
Key size: 160 bits, λ =
160 Message Authentication
SHA-512
Key size: 512 bits, λ =
512
SHA-256 Key size: 256, λ = 256
Message Authentication,
DRBG Primitive
N/A KTS
AES Cert. #5499 and HMAC Cert.
#3650
Key establishment
methodology provides
between 128 and 256
bits of encryption
strength
Triple-DES Cert. #2766 and HMAC
Cert. #3650
Key establishment
methodology provides
112 bits of encryption
strength
2950 RSA PUB 186-4
n=2048 (SHA 256, 512)
n=3072 (SHA 256, 512)
KeyGen2
, SigGen, SigVer3
1
Vendor Affirmed
2
RSA 4096 KeyGen was not tested by the CAVP; however, it is Approved for use per CMVP guidance, because RSA
2048 KeyGen was tested and testing for RSA 4096 KeyGen is not available.
3
RSA 4096 SigVer was not tested by the CAVP; however, it is Approved for use per CMVP guidance, because RSA
2048 SigVer was tested and testing for RSA 4096 SigVer is not available.
Copyright Juniper, 2018 Version 1.1 Page 12 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
n=4096 (SHA 256, 512)
4409 SHS PUB 180-4
SHA-1
SHA-256
SHA-384
SHA-512
Message Digest
Generation,
KDF Primitive
2766
Triple-
DES
SP 800-67
TCBC Key Size: 192 Encrypt, Decrypt
Table 7 – QuickSec Approved Cryptographic Functions
CAVP
Cert. Algorithm Standard Mode Description Functions
5501 AES PUB 197-38A CBC Key Sizes: 128, 192, 256 Encrypt, Decrypt
2170 DRBG
SP 800-90A
HMAC SHA-256
Random Bit
Generation
N/A4
CKG
SP 800-133
Section 6.1
Section 6.2
Asymmetric key
generation using
unmodified DRBG
output
1950 CVL
SP 800-135 IKEv1 SHA-1, SHA-256, SHA-384
Key Derivation
IKEv2 SHA-1, SHA-256, SHA-384
3652 HMAC
PUB 198 SHA-1
SHA-256
SHA-384
Key size: 160 bits, λ = 160
Message
authentication
Key size: 256 bits, λ = 256
Key size: 384 bits,
λ = 192, 384
N/A KTS
AES Cert. #5501 and HMAC Cert. #3652
Key establishment
methodology
provides between 128
and 256 bits of
encryption strength
Triple-DES Cert. #2768 and HMAC Cert.
#3652
Key establishment
methodology
provides 112 bits of
encryption strength
4411 SHS PUB 180-4
SHA-1
SHA-256
SHA-384
Message Digest
Generation, KDF
Primitive
2768 Triple-DES SP 800-67 TCBC Key Size: 192 Encrypt, Decrypt
4
Vendor Affirmed
Copyright Juniper, 2018 Version 1.1 Page 13 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Table 8 – XLP (MS-MPC) Approved Cryptographic Functions
CAVP
Cert. Algorithm Standard Mode Description Functions
5500 AES
PUB 197-38A CBC Key Sizes: 128, 192, 256 Encrypt, Decrypt
SP 800-38D GCM Key Sizes: 128,192, 256 Encrypt, Decrypt
1475 ECDSA PUB 186-4
P-256 (SHA 256)
P-384 (SHA 384)
SigGen, SigVer
3651 HMAC
PUB 198
SHA-256 Key size: 256, λ = 128
Message
authentication.
2951 RSA
PUB 186-4
n=2048 (SHA 256)
n=3072 (SHA 256)
n=4096 (SHA 256)
SigGen, SigVer5
4410 SHS PUB 180-4 SHA-256
Message Digest ESP
Generation
2767 Triple-DES SP 800-67 TCBC Key Size: 192 Encrypt, Decrypt
Table 9 – Allowed Cryptographic Functions
Algorithm Caveat Use
Diffie-Hellman [IG] D.8 Provides 112 bits of encryption strength. key agreement; key establishment
Elliptic Curve Diffie-
Hellman [IG] D.8
Provides between 128 and 256 bits of
encryption strength.
key agreement; key establishment
NDRNG [IG] 7.14
Scenario 1a
The module generates a minimum of 256
bits of entropy for key generation.
Seeding the DRBG
Table 10 – Protocols Allowed in FIPS Mode
Protocol Key Exchange Auth Cipher Integrity
IKEv16
Diffie-Hellman (L = 2048, N = 256)
EC Diffie-Hellman P-256, P-384
RSA 2048
RSA 4096
Pre-Shared
3 Key Triple-DES CBC
AES CBC
128/192/256
HMAC-SHA-1
HMAC-SHA-256
HMAC-SHA-384
5
RSA 4096 SigVer was not tested by the CAVP; however, it is Approved for use per CMVP guidance, because RSA
2048 SigVer was tested and testing for RSA 4096 SigVer is not available.
6
RFC 2409 governs the generation of the Triple-DES encryption key for use with the IKEv1 protocol
Copyright Juniper, 2018 Version 1.1 Page 14 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Secret
ECDSA P-256
ECDSA P-384
IKEv27
Diffie-Hellman (L = 2048, N = 256)
EC Diffie-Hellman P-256, P-384
RSA 2048
RSA 4096
Pre-Shared
Secret
ECDSA P-256
ECDSA P-384
3 Key Triple-DES CBC
AES CBC
128/192/256
HMAC-SHA-1
HMAC-SHA-256
HMAC-SHA-384
IPsec ESP
IKEv1 with optional:
• Diffie-Hellman (L = 2048, N = 256)
• EC Diffie-Hellman P-256, P-384
IKEv1
3 Key Triple-DES CBC
AES CBC
128/192/256
AES GCM8
128/192/256
HMAC-SHA-256
IKEv2 with optional:
• Diffie-Hellman (L = 2048, N = 256)
• EC Diffie-Hellman P-256, P-384
IKEv2
3 Key Triple-DES CBC
AES CBC
128/192/256
AES GCM9
128/192/256
SSHv210
EC Diffie-Hellman P-256, P-384, P-
521
RSA 2048
ECDSA P-256
3 Key Triple-DES CBC
AES CBC
128/192/256
AES CTR
128/192/256
HMAC-SHA-1
HMAC-SHA-256
HMAC-SHA-512
No part of these protocols, other than the KDF, have been tested by the CAVP and CMVP. The IKE and SSH
algorithms allow independent selection of key exchange, authentication, cipher and integrity. In Table 6
above, each column of options for a given protocol is independent and may be used in any viable
combination.
Disallowed Algorithms and Protocols
These algorithms and protocols are non-Approved algorithms and protocols that are disabled when the
module is operated in an Approved mode of operation. The algorithms are available as part of the SSH
connect service when the module is operated in the non-Approvedmode.
7
IKEv2 generates the SKEYSEED according to RFC7296, from which all keys are derived to include Triple-DES keys.
8
The AES GCM IV is generated according to RFC4106 and is used only in the context of the IPSec protocol as
allowed in IG A.5. Rekeying is triggered after (.8 * 232
) AES GCM transformations
9
The AES GCM IV is generated according to RFC4106 and is used only in the context of the IPSec protocol as
allowed in IG A.5. Rekeying is triggered after (.8 * 232
) AES GCM transformations
10
RFC 4253 governs the generation of the Triple-DES encryption key for use with the SSHv2 protocol
Copyright Juniper, 2018 Version 1.1 Page 15 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Algorithms
• RSA with key size less than 2048
• ECDSA with ed25519 curve
• ECDH with ed25519 curve
• ARCFOUR
• Blowfish
• CAST
• DSA (SigGen, SigVer; non-compliant)
• HMAC-MD5
• HMAC-RIPEMD160
• UMAC
Protocols
• Finger
• ftp
• rlogin
• telnet
• tftp
• xnm-clear-text
Critical Security Parameters
All CSPs and public keys used by the module are described in this section.
Table 11 – Critical Security Parameters (CSPs)
Name Description and usage
DRBG_Seed Seed material used to seed or reseed the DRBG
DRBG_State Values V and Key which comprise the HMAC_DRBG state
Entropy Input
String
256 bits entropy (min) input used to instantiate the DRBG
DH Shared Secret The shared secret used in Diffie Hellman (DH) key exchange. 256 bits. Established per
the Diffie-Hellman key agreement.
ECDH Shared
Secret
The shared secret used in Elliptic Curve Diffie Hellman (ECDH) key exchange. 256, 384
or 521 bits. Established per the Elliptic Curve Diffie-Hellman key agreement.
SSH PHK
SSH Private host key. 1st
time SSH is configured, the keys are generated. ECDSA P-256.
RSA2048
Used to identify the host.
SSH ECDH Ephemeral EC Diffie-Hellman private key used in SSH. ECDH P-256, P-384, or P-521
SSH-SEK
SSH SessionKeys: SSH Session Encryption Key: 3-Key Triple-DES or AES (128,192,256);
SSH Session Integrity Key: HMAC.
ESP-SEK IPSec ESP Session Keys: ESP Session Encryption Key: 3-Key Triple-DES or AES (128,
192, 256); Session Integrity Key: HMAC. ESP Session Integrity Key: HMAC
IKE-PSK Pre-Shared Key used to authenticate IKE connections.
IKE-Priv IKE Private Key. RSA 2048.
Copyright Juniper, 2018 Version 1.1 Page 16 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
IKE-SKEYID IKE SKEYID. IKE secret used to derive IKE and IPsec ESP session keys.
IKE-SEK
IKE Session Keys: IKE Session Encryption Key: 3-Key Triple-DES or AES (128,192,256);
IKE Session Integrity Key: HMAC
IKE-DH-PRI
Ephemeral Diffie-Hellman or EC Diffie-Hellman private key used in IKE. DH (L = 2048,
N = 256), ECDH P-256, or ECDH P-384
HMAC key The LibMD HMAC keys: message digest for hashing password and critical function test.
User Password Passwords used to authenticate Users to the module.
CO Password Passwords used to authenticate COs to the module.
Table 12 – Public Keys
Name
D
Description and usage
SSH-PUB SSH Public Host Key used to identify the host. ECDSA P-256, RSA 2048, RSA 3072 or RSA 4096
SSH-DH-PUB
Ephemeral EC Diffie-Hellman public key used in SSH key establishment. ECDH P-256, P-384, or
P-521
IKE-PUB IKE Public Key ECDSA P-256, ECDSA P-384, RSA 2048.
IKE-DH-PUB
Ephemeral Diffie-Hellman or EC Diffie-Hellman public key used in IKE key establishment. DH
2048 modp, ECDH P-256, or ECDH P-384
Auth-User Pub
User Authentication Public Keys. Used to authenticate users to the module. ECDSA P-256, P-
384, P-521, RSA 2048, RSA 3072 or RSA 4096
Auth-CO Pub
CO AuthenticationPublic Keys. Used to authenticate CO to the module. ECDSA P-256, P-384,
P-521, RSA 2048, RSA 3072 or RSA 4096
Root CA
ECDSA P-256 X.509 Certificate; Used to verify the validity of the Juniper Package CA at software
load and also at runtime for integrity.
Package CA
ECDSA P-256 X.509 Certificate; Used to verify the validity the Juniper Image at software load and
also at runtime for integrity.
Copyright Juniper, 2018 Version 1.1 Page 17 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
3 Roles, Authentication and Services
3.1 Roles and Authentication of Operators to Roles
The module supports two roles: Cryptographic Officer (CO) and User. The module supports concurrent
operators, but does not support a maintenance role and/or bypass capability. The module enforces the
separation of roles using identity-based operator authentication.
The Cryptographic Officer role configures and monitors the module via a console or SSH connection. As
root or super-user, the Cryptographic Officer has permission to view and edit secrets within the module
and establish VPN tunnels.
The User role monitors the router via the console or SSH. The User role cannot change the configuration.
Authentication Methods
The module implements two forms of Identity-Based authentication, Username and password over the
Console and SSH as well as Username and ECDSA or RSA public key over SSH.
Password authentication: The module enforces 10-character passwords (at minimum) chosen from the
96 human readable ASCII characters. The maximum password length is 20-characters; thus the probability
of a successful random attempt is 1/9610
, which is less than 1/1,000,000.
The module enforces a timed access mechanism as follows: For the first two failed attempts (assuming 0
time to process), no timed access is enforced. Upon the third attempt, the module enforces a 5-second
delay. Each failed attempt thereafter results in an additional 5-second delay above the previous (e.g. 4th
failed attempt = 10-second delay, 5th
failed attempt = 15-second delay, 6th
failed attempt = 20-second
delay, 7th
failed attempt = 25-second delay).
This leads to a maximum of 7 possible attempts in a one-minute period for each getty. The best approach
for the attacker would be to disconnect after 4 failed attempts, and wait for a new getty to be spawned.
This would allow the attacker to perform roughly 9.6 attempts per minute (576 attempts per hour/60
mins); this would be rounded down to 9 per minute, because there is no such thing as 0.6 attempts. The
probability of a success with multiple consecutiveattempts in a one-minute period is 9/ (9610
), which is less
than 1/100,000.
ECDSA signature verification: SSH public-key authentication. Processing constraints allow for a maximum
of 5.6e7 ECDSA attempts per minute. The module supports ECDSA (P-256, P-384, and P-521), which has a
minimum equivalent computational resistance to attack of either 2128
depending on the curve. The
probability of a successful random attempt is 1/ (2128
), which is less than 1/1,000,000. Processing speed
(partial establishment of an SSH session) limits the number of failed authentication attempts in a one-
minute period to 5.6e7 attempts. The probability of a success with multiple consecutive attempts in a
one-minute period is 5.6e7/ (2128
), which is less than 1/100,000.
RSA signature verification: SSH public-key authentication. Processing constraints allow for a maximum of
5.6e7 RSA attempts per minute. The module supports RSA (2048, 4096), which has a minimum equivalent
computational resistance to attack of 2112
(2048). Thus, the probability of a successful random attempt is
1/ (2112
), which is less than 1/1,000,000. Processing speed (partial establishment of an SSH session) limits
Copyright Juniper, 2018 Version 1.1 Page 18 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
the number of failed authentication attempts in a one-minute period to 5.6e7 attempts. The probability
of a success with multiple consecutive attempts in a one-minute period is 5.6e7/(2112
), which is less than
1/100,000.
Services
All services implemented by the module are listed in the tables below. Table 12 lists the access to CSPs by
each service.
Table 13 – Standard and Reduced Throughput Mode Authenticated Services
Service Description CO User
Configure security
Security relevant configuration x
Configure Non-security relevant configuration x
Secure Traffic IPsec protected routing x
Status Show status x x
Zeroize Destroy all CSPs x
SSH connect
Initiate SSH connection for SSH monitoring and
control (CLI)
x x
IPsec connect Initiate IPsec connection (IKE) x
Console access Console monitoring and control (CLI) x x
Remote reset Software initiated reset conducted over SSH connection
to the management port. The remote reset service is
used to perform self-tests on demand
x
Load image Verification and loading of a validated firmware image into
the router.
x
Table 14 – Recovery Mode Authenticated Services
Service
D
Description CO
U
User
Configure security
Security relevant configuration x
Configure Non-security relevant configuration x
Status Show status x x
Zeroize Destroy all CSPs x
SSH connect
Initiate SSH connection for SSH monitoring and
control (CLI)
x x
Console access Console monitoring and control (CLI) x x
Remote reset Software initiated reset conducted over SSH connection
to the management port. The remote reset service is
used to perform self-tests on demand
x
Copyright Juniper, 2018 Version 1.1 Page 19 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Load image Verification and loading of a validated firmware image into
the router.
x
Table 15 – Unauthenticated Services
Service
D
Description
Local reset Hardware reset or power cycle
Traffic Traffic requiring no cryptographic services (e.g. OSPF, BGP)
LED status Basic
Table 16 – CSP Access Rights within Services
Service
CSPs
DRBG_Seed
DRBG_State
Entropy
Input
String
DH
Shared
Secret
ECDH
Shared
Secret
SSH
PHK
SSH
DH
SSH-SEK
ESP-SEK
IKE-PSK
IKE-Priv
IKE-SKEYID
IKE-SEK
IKE-DH-PRI
HMAC
Key
CO-PW
User-PW
Configure
security
-- E --
GW
R
GW
R
GW
R
-- -- -- WR
GW
R
-- -- -- G W W
Configure -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
Secure
traffic
-- -- -- -- -- -- -- -- E -- -- -- E -- -- -- --
Status -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
Zeroize Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z Z
SSH
connect
-- E -- -- E E GE GE -- -- -- -- -- -- -- E E
IPsec
connect
-- E -- E E -- -- -- G E E GE G GE -- -- --
Console
access
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- E E
Remote
reset
GEZ GZ GZ Z Z -- Z Z Z -- -- Z Z Z Z -- --
Load Image -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
Local reset GEZ GZ GZ Z Z -- Z Z Z -- -- Z Z Z -- -- --
Traffic -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
G = Generate: The module generates the CSP
R = Read: The CSP is read from the module (e.g. the CSP is output)
E = Execute: The module executes using the CSP
Copyright Juniper, 2018 Version 1.1 Page 20 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
W = Write: The CSP is updated or written to the module (persistent storage)
Z = Zeroize: The module zeroizes the CSP.
Copyright Juniper, 2018 Version 1.1 Page 21 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Non-Approved Services
The following services are available in the non-Approved mode of operation. The security functions
provided by the non-Approved services are identical to the Approved counterparts with the exception of
SSH Connect (non-compliant) which supports the security functions and protocols identified in Section
2.2 and the SSHv2 row of Table 10.
Table 17-- Non-Approved Standard and Reduced Throughput Mode Authenticated Services
Service Description CO User
Configure security
(non-compliant)
Security relevant configuration x
Configure (non-
compliant)
Non-security relevant configuration x
Secure Traffic
(non-compliant)
IPsec protected routing x
Status (non-
compliant)
Show status x x
Zeroize (non-
compliant)
Destroy all CSPs x
SSH connect (non-
compliant)
Initiate SSH connection for SSH monitoring and
control (CLI)
x x
IPsec connect
(non-compliant)
Initiate IPsec connection (IKE) x
Console access
(non-compliant)
Console monitoring and control (CLI) x x
Remote reset (non-
compliant)
Software initiated reset, perform self-tests on demand x
Load image (non-
compliant)
Verification and loading of a validated firmware image into
the router.
x
Table 18 -- Non-Approved Recovery Mode Authenticated Services
Service
D
Description CO
U
User
Configure security
(non-compliant)
Security relevant configuration x
Configure (non-
compliant)
Non-security relevant configuration x
Status (non-
compliant)
Show status x x
Zeroize (non-
compliant)
Destroy all CSPs x
Copyright Juniper, 2018 Version 1.1 Page 22 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
SSH connect (non-
compliant)
Initiate SSH connection for SSH monitoring and
control (CLI)
x x
Console access
(non-compliant)
Console monitoring and control (CLI) x x
Remote reset (non-
compliant)
Software initiated reset, perform self-tests on demand x
Load image (non-
compliant)
Verification and loading of a validated firmware image into
the router.
x
Table 19 -- Non-Approved Unauthenticated Services
Service
D
Description
Local reset (non-
compliant)
Hardware reset or power cycle
Traffic (non-
compliant)
Traffic requiring no cryptographic services (e.g. OSPF, BGP)
LED status (non-
compliant)
Basic
Copyright Juniper, 2018 Version 1.1 Page 23 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
4Self-tests
Each time the module is powered up it tests that the cryptographic algorithms still operate correctly and
that sensitive data have not been damaged.Power-upself–tests are available on demand by power cycling
the module (Remote reset service).
On power up or reset, the module performs the self-tests described below. All KATs for the selected
Approvedmode of operation must be completedsuccessfully prior to any other use of cryptographyby the
module. If one of the Routing Engine KATs fails, the module enters the Error state. If one or more of the
Multiservices MPC KATs fails, the module selects the Reduced Throughput or Recover Approved mode of
operation.
The module performs the following power-up self-tests:
Routing Engine:
• Firmware Integrity check using ECDSA P-256 with SHA-256
• Critical Function Test
o The cryptographic module performs a verification of a limited operational environment,
and verification of optional non-critical packages.
• Kernel KATs
o SP 800-90A HMAC DRBG KAT
▪ Health-tests initialize, re-seed, and generate
o HMAC-SHA-1 KAT
o HMAC-SHA-256 KAT
o SHA-384 KAT
o SHA-512 KAT
• QuickSec KATs
o AES-CBC (128/192/256) Encrypt KAT
o AES-CBC (128/192/256) Decrypt KAT
o SP 800-90A HMAC DRBG KAT
▪ Health-tests initialize, re-seed, and generate
o HMAC-SHA-1 KAT
o HMAC-SHA-256 KAT
o HMAC-SHA-384 KAT
o KDF-IKE-V1 KAT
o KDF-IKE-V2 KAT
o Triple-DES-CBC Encrypt KAT
o Triple-DES-CBC Decrypt KAT
• OpenSSL KATs
o AES-CBC (128/192/256) Encrypt KAT
o AES-CBC (128/192/256) Decrypt KAT
o SP 800-90A HMAC DRBG KAT
▪ Health-tests initialize, re-seed, and generate
o ECDSA P-256 Sign/Verify
o ECDH P-256 KAT
▪ Derivation of the expected shared secret.
o HMAC-SHA-1 KAT
Copyright Juniper, 2018 Version 1.1 Page 24 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
o HMAC-SHA-256 KAT
o HMAC-SHA-512 KAT
o KDF-SSH KAT
o RSA 2048 w/ SHA-256 Sign KAT
o RSA 2048 w/ SHA-256 Verify KAT
o SHA-384 KAT
o Triple-DES-CBC Encrypt KAT
o Triple-DES-CBC Decrypt KAT
• LibMD KATs
o HMAC SHA-1 KAT
o HMAC SHA-256 KAT
o SHA-512 KAT
MS-MPC
• XLP (MS MPC) KATs
o AES-CBC (128/192/256) Encrypt KAT
o AES-CBC (128/192/256) Decrypt KAT
o AES-GCM (128/256) Encrypt KAT
o AES-GCM (128/256) Decrypt KAT
o ECDSA P-256 Sign/Verify
o HMAC-SHA-256 KAT
o RSA 2048 w/ SHA-256 Sign KAT
o RSA 2048 w/ SHA-256 Verify KAT
o Triple-DES-CBC Encrypt KAT
o Triple-DES-CBC Decrypt KAT
The module also performs the following conditional self-tests:
• Continuous RNG Test on the OpenSSL and QuickSec SP 800-90A HMAC-DRBG
• Continuous RNG test on the NDRNG
• Pairwise consistency test when generating ECDSA, and RSA key pairs.
• Firmware Load Test (ECDSA signature verification)
5 Physical Security Policy
The modules physical embodiment is that of a multi-chip standalone device that meets Level 1 Physical
Security requirements. The module is completely enclosed in a rectangular nickel or clear zinc coated, cold
rolled steel, plated steel and brushed aluminum enclosure.
Copyright Juniper, 2018 Version 1.1 Page 20 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
6 Security Rules and Guidance
6.1 Security Rules
The module designcorrespondsto the security rules below. The term must in this context specifically refers
to a requirement for correct usage of the module in the Approved mode; all other statements indicate a
security rule implementedby the module.
1. The module clears previous authentications on power cycle.
2. When the module has not been placed in a valid role, the operator does not have access to any
cryptographic services.
3. Power up self-tests do not require any operator action.
4. Data output is inhibited during key generation, self-tests, zeroization, and error states.
5. Status information does not contain CSPs or sensitive data that if misused could lead to a compromise
of the module.
6. There are no restrictions on which keys or CSPs are zeroized by the zeroization service.
7. The module does not support a maintenance interface or role.
8. The module does not support manual key entry.
9. The module does not output intermediate key values.
10. The module requires two independent internal actions to be performed prior to outputting plaintext
CSPs.
11. The cryptographic officer must verify that the firmware image to be loaded on the module is a FIPS
validated image. If any other non-validated image is loaded the module will no longer be a FIPS
validated module.
12. The cryptographic officer must retain control of the module while zeroization is in process.
13. If the module loses power and then it is restored, then a new key shall be established for use with the
AES GCM encryption/decryption processes.
14. The operator is required to ensure that Triple-DES keys used in IPsec and SSH do not perform more
than 2^20 encryptions.
15. Virtual Chassis is not supported in FIPS mode and shall not be configured on the modules.
16. RSA key generated shall only be 2048 bits or greater.
Crypto-Officer Guidance
6.2.1 Enabling FIPS Mode
When Junos OS is installed on a router and the router is powered on, it is ready to be configured.
Initially, you log in as the user root with no password. When you log in as root, your SSH connection
is enabled by default.
As Crypto Officer, you must establish a root password conforming to the FIPS password requirements:
1. Passwords must contain between 10 and 20 characters.
2. Passwords must contain at least three of the following five defined character sets:
a. Uppercase letters
b. Lowercase letters
Copyright Juniper, 2018 Version 1.1 Page 21 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
c. Digits
d. Punctuation marks
e. Keyboard characters not included in the other four sets—such as the percent sign (%)
and the ampersand (&)
3. Authentication requirements. All passwords and keys used to authenticate peers must contain
at least 10 characters, and in some cases the number of characters must match the digest size.
When you enable FIPS mode in Junos OS on the router , you cannot configure passwords unless they
meet this standard.
To enable FIPS mode in Junos OS on the device:
1. Zeroize the device to delete all CSPs before entering FIPS mode. See section 6.2.2
2. After the device comes up in ’Amnesiac mode’, login using username root and password "" (blank).
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: root
-- JUNOS 17.4R1-S1.9 Kernel 64-bit JNPR-11.0-20180127.fdc8dfc_buil
root@:~# cli
root>
3. Configure root authentication.
root> edit
Entering configuration mode
[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# commit
commit complete
4. Load configuration onto device and commit new configuration.
5. Install fips-mode package needed for Routing Engine KATS.
root@hostname> request system software add optional://fips-mode.tgz
Verified fips-mode signed by PackageDevelopmentEc_2017 method ECDSA256+SHA256
6. Install jpfe-fips package needed for MS-MPC KATS.
root@hostname> request system software add optional://jpfe-fips.tgz
Verified jpfe-fips signed by PackageDevelopmentEc_2017 method ECDSA256+SHA256
7. Configure chassis boundary fips by setting set system fips level 1 and commit.
8. After deleting and reconfiguring CSPs, commit will go through and device needs reboot
to enter FIPS mode.
Copyright Juniper, 2018 Version 1.1 Page 22 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
6.2.2 Zeroize
1. From the CLI, enter:
root@router> request system zeroize
warning: System will be rebooted and may not boot without configuration
2. To initiate the zeroization process, type yes at the prompt:
Erase all data, including configuration and log files? [yes,no] (no) yes
re0:
--------------------------------------------------------------------------
warning: zeroizing re0
...
...
The entire operation can take considerable time depending on the size of the media, but all critical
security parameters (CSPs) are removed within a few seconds. The physical environment must remain
secure until the zeroization process is complete.
User Guidance
All FIPS users, including the Crypto Officer, must observe security guidelines at all times.
All FIPS users must:
• Keep all passwords confidential.
• Store router and documentation in a secure area.
• Deploy router or switches in secure areas.
• Check audit files periodically.
• Conform to all other FIPS 140-2 security rules.
• Follow these guidelines:
• Users are trusted.
• Users abide by all security guidelines.
• Users do not deliberately compromise security.
• Users behave responsibly at all times.
Copyright Juniper, 2018 Version 1.1 Page 23 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
7 References and Definitions
The following standards are referred to in this Security Policy.
Table 20 – References
Abbreviation Full Specification Name
[FIPS140-2] Security Requirements for Cryptographic Modules, May 25, 2001
[SP800-131A] Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and
Key Lengths, January 2011
[IG] Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation
Program
Table 21 – Acronyms and Definitions
Acronym Definition
AES Advanced Encryption Standard
DH Diffie-Hellman
DSA Digital Signature Algorithm
ECDH Elliptic Curve Diffie-Hellman
ECDSA Elliptic Curve Digital Signature Algorithm
EMC Electromagnetic Compatibility
ESP Encapsulating Security Payload
FIPS Federal Information Processing Standard
HMAC Keyed-Hash Message Authentication Code
IKE Internet Key Exchange Protocol
IPsec Internet Protocol Security
MD5 Message Digest 5
MIC Modular Interface Card
MPC Modular PIC Concentrator
MS Multiservices
PIC Port Interface Card
RE Routing Engine
RSA Public-key encryption technology developed by RSA Data Security, Inc.
SCB Switch Control Board
SHA Secure Hash Algorithms
SSH Secure Shell
Triple-DES Triple - Data Encryption Standard
Copyright Juniper, 2018 Version 1.1 Page 24 of 22
Juniper Networks Public Material – May be reproduced only in its original entirety (without revision).
Table 22 - Datasheets
Model Title URL
MX240
MX480
MX960
MX240, MX480, MX960 3D
Universal Edge Routers
https://www.juniper.net/assets/us/en/local/pdf/datasheet
s/1000597-en.pdf
MX2010
MX2020
MX2000 3D
Universal Edge Routers
https://www.juniper.net/assets/us/en/local/pdf/datasheet
s/1000417-en.pdf
MS-MPC
MX Series MS-MPC and MS-MIC
Service Cards
http://www.juniper.net/documentation/en_US/junos15.
1/topics/concept/ms-mic-and-mpc-overview.html