FIPSセルフテストの理解
暗号化モジュールは、ジュニパーネットワークスのJunosオペレーティングシステム(Junos OS)をFIPS動作モードで実行しているデバイスが、FIPS 140-3 レベル2のセキュリティ要件を満たしていることを確認するためのセキュリティルールを適用します。FIPS で承認された暗号化アルゴリズムの出力を検証し、一部のシステム モジュールの整合性をテストするために、デバイスは次の一連の既知の応答テスト(KAT)セルフテストを実行します。
md_kats—libmd と libc の KAT-
quicksec_7_0_kats—KAT for Quicksec_7_0 Toolkit 暗号化実装 openssl_kats—OpenSSL暗号化実装のためのKAT-
openssl-102_kats- KAT for OpenSSL v1.0.2 暗号化情報 kernel_kats—カーネル暗号化ルーチンの KATsrxpfe_kats— SRXパケット転送エンジン用KAT
KAT セルフテストは、起動時に自動的に実行され、デバイスで FIPS 動作モードが有効になっている場合は再起動時に実行されます。条件付きセルフテストも自動的に実行され、デジタル署名されたソフトウェアパッケージ、生成された乱数、RSAとECDSAのキーペア、および手動で入力されたキーを検証します。
KAT が正常に完了すると、システム ログ(syslog)ファイルが更新され、実行されたテストが表示されます。
デバイスがKATに失敗した場合、デバイスは詳細をシステムログファイルに書き込み、FIPSエラー状態(パニック)になり、再起動します。
デバイスが正しく起動しない場合があります。これは、POSTテストの失敗、またはその他の結果である可能性があります。管理者は、このガイダンスドキュメントを参照して解決策を探し、問題が解決しない場合はサポートチームに連絡することをお勧めします。
コマンドは file show /var/log/messages 、システムログを表示します。
DRBGは設定を必要とせず、起動時に初期化されます。
デバイスでの電源投入時の自己診断テストの実行
暗号化モジュールの電源がオンになるたびに、モジュールは暗号化アルゴリズムが正しく動作し、機密データが破損していないことをテストします。電源投入時の自己診断テストは、モジュールの電源を入れ直すことにより、オンデマンドで実行されます。
デバイスの電源投入時またはリセット時に、モジュールは次のセルフテストを実行します。モジュールが暗号化を他の方法で使用する前に、すべての KAT を正常に完了する必要があります。KAT の 1 つに障害が発生すると、モジュールは重大な障害エラー状態になります。
モジュールは、電源投入時のセルフテストの実行中に、vSRX3.0 デバイスに対して以下のステータス出力を表示します。
<118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - Initializing Verified Exec: <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: randomdev_wait_until_seeded unblock wait <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: Entropy start-up health tests performed on 1024 samples passed. <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: unblocking device. <118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - FIPS veriexec ECDSA Verify Known Answer Test: Passed <118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - Verified os-kernel-prd-x86-64-20220607 signed by PackageProductionECP256_2022 method ECDSA256+SHA256 <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Running FIPS Self-tests <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing kernel KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES128-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing MACSec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES128-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES256-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-ECB Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-KEYWRAP Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KBKDF Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing libmd KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing OpenSSL v1.0.2 KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDH Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS RSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-SSH-SHA256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing OpenSSL KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDH Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS RSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-SSH-SHA256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing QuickSec 7.0 KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V2 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing QuickSec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V2 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing SSH IPsec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing file integrity: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: File integrity Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing crypto integrity: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Crypto integrity Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Expect an exec Authentication error... <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS Self-tests Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: commit complete
手記：
このモジュールは、承認された操作モードで使用されていない暗号化ライブラリとアルゴリズムを実装しています。