Understanding Junos OS in FIPS Mode of Operation
Federal Information Processing Standards (FIPS) 140-2 defines security levels for hardware and software that perform cryptographic functions. Junos FIPS mode is a version of the Junos operating system (Junos OS) that complies with Federal Information Processing Standard (FIPS) 140-2.
Operating SRX Series devices in a FIPS 140-2 Level 2 environment requires enabling and configuring FIPS mode of operation on the device from the Junos OS command-line interface (CLI).
In Junos OS Release 20.2 SRX345 and SRX380 devices are in progress for certification for FIPS 140-2 Level 2.
The Cryptographic Officer enables FIPS mode of operation in Junos OS Release 20.2 and sets up keys and passwords for the system and other FIPS users who can view the configuration. Both user types can also perform normal configuration tasks on the device (such as modify interface types) as individual user configuration allows.
Be sure to verify the secure delivery of your device and apply tamper-evident seals to its vulnerable ports.
About the Cryptographic Boundary on Your Device
FIPS 140-2 compliance requires a defined cryptographic boundary around each cryptographic module on a device. Junos OS in FIPS mode of operation prevents the cryptographic module from running any software that is not part of the FIPS-certified distribution, and allows only FIPS-approved cryptographic algorithms to be used. No critical security parameters (CSPs), such as passwords and keys, can cross the cryptographic boundary of the module by, for example, being displayed on a console or written to an external log file.
Virtual Chassis features are not supported in FIPS mode of operation—they have not been tested by Juniper Networks. Do not configure a Virtual Chassis in FIPS mode of operation.
To physically secure the cryptographic module, all Juniper Networks devices require a tamper-evident seal on the USB and mini-USB ports.
How FIPS Mode of Operation Differs from Non-FIPS Mode of Operation
Unlike Junos OS in non-FIPS mode of operation, Junos OS in FIPS mode of operation is a nonmodifiable operational environment. In addition, Junos OS in FIPS mode of operation differs in the following ways from Junos OS in non-FIPS mode of operation:
Self-tests of all cryptographic algorithms are performed at startup in both FIPS mode and non FIPS mode. But the results are displayed on console only in FIPS mode.
Self-tests of random number and key generation are performed continuously.
Weak cryptographic algorithms such as Data Encryption Standard (DES) and MD5 are disabled.
FIPS Mode uses the HMAC-DRBG Random Number Generator, while Non-FIPS mode uses the Junos default yarrow Random Number Generator.
Pairwise consistency test when a module generates a public and private key pair is performed only in FIPS Mode.
DH and ECDH public key validation during generation is performed only in FIPS Mode
Weak or unencrypted management connections must not be configured.
Junos-FIPS administrator passwords must be at least 10 characters long.
Cryptographic keys must be encrypted before transmission.
The FIPS 140-2 standard is available for download from the National Institute of Standards and Technology (NIST) at https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf.
Validated Version of Junos OS in FIPS Mode of Operation
To determine whether a Junos OS release is NIST-validated, see the compliance page on the Juniper Networks Web site (https://apps.juniper.net/compliance/fips.html).