Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Understanding FIPS Self-Tests

 

The cryptographic module enforces security rules to ensure that a device running the Juniper Networks Junos operating system (Junos OS) in FIPS mode of operation meets the security requirements of FIPS 140-2 Level 1. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:

  • md_kats—KAT for libmd and libc

  • quicksec_7_0_kats—KAT for Quicksec_7_0 Toolkit cryptographic implementation

  • openssl_kats—KAT for OpenSSL cryptographic implementation

  • kernel_kats——KAT for kernel cryptographic routines

Although KAT self-tests are performed for all four cryptographic libraries, only algorithms from the md, openssl, and kernel libraries are invoked in the NDcPP v2.1 configuration. No algorithms from quicksec are used for NDcPP v2.1 conformance.

The KAT self-tests are performed automatically at startup, regardless of whether FIPS mode of operation is enabled on the device. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and DSA key pairs, and manually entered keys.

If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.

If one of the KATs fail, the device panics and reboot continuously. The device can be recovered using USB install.

The file show /var/log/messages command displays the system log.

Performing Power-On Self-Tests on the Device

Each time the cryptographic module is powered on, the module tests that the cryptographic algorithms still operate correctly and that sensitive data has not been damaged.

The module displays the following status output while running the power-on self-tests:

Note

The module implements cryptographic libraries and algorithms that are not utilized in the approved mode of operation.

The self-test output for non-FIPS mode: