Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Understanding FIPS Self-Tests

 

The cryptographic module enforces security rules to ensure that the Juniper Networks Junos operating system (Junos OS) in FIPS mode meets the security requirements of FIPS 140-2 Level 1. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the router performs the following series of known answer test (KAT) self-tests:

  • kernel_kats—KAT for kernel cryptographic routines

  • md_kats—KAT for libmd and libc

  • openssl_kats—KAT for OpenSSL cryptographic implementation

  • quicksec_kats—KAT for QuickSec Toolkit cryptographic implementation

  • xlp_kats—KAT for MS-MPC line card

The KAT self-tests are performed automatically at startup. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and ECDSA key pairs, and manually entered keys.

If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.

The file show /var/log/messages command displays the system log.

For MX Series routers with RE-S-1800X4, RE-MX2000-1800X4, and REMX2K-1800-32G:

user@host> file show /var/log/messages

For MX Series routers with MS-MPC:

user@host> file show /var/log/messages