Example: Configure FIPS Self-Tests
This example shows how to configure FIPS self-tests to run periodically.
Hardware and Software Requirements
-
You must have administrative privileges to configure FIPS self-tests.
-
The device must be running the evaluated version of Junos OS in FIPS mode software.
Overview
The FIPS self-test consists of the following suites of known answer tests (KATs):
-
kernel_kats—KAT for kernel cryptographic routines -
md_kats—KAT for libmd and libc -
quicksec_kats—KAT for QuickSec Toolkit cryptographic implementation -
openssl_kats—KAT for OpenSSL cryptographic implementation -
ssh_ipsec_kats—KAT for SSH IPsec Toolkit cryptographic implementation -
macsec_kats—KAT for MACsec cryptographic implementation
In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.
Instead of weekly tests, you can configure monthly tests by including the
month and day-of-month statements.
When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.
Configuration
CLI Quick Configuration
To quickly configure this example, copy the following commands, paste them into a
text file, remove any line breaks, change any details necessary to match your
network configuration, and then copy and paste the commands into the CLI at the
[edit] hierarchy level.
set system fips self-test periodic start-time 09:00 set system fips self-test periodic day-of-week 3
Step-by-Step Procedure
To configure the FIPS self-test, login to the device with crypto-officer credentials:
-
Configure the FIPS self-test to execute at 9:00 AM every Wednesday.
[edit system fips self-test] crypto-officer@hostname:fips# set periodic start-time 09:00 crypto-officer@hostname:fips# set periodic day-of-week 3
-
If you are done configuring the device, commit the configuration.
[edit system fips self-test] crypto-officer@hostname:fips# commit
Results
From configuration mode, confirm your configuration by issuing the show
system command. If the output does not display the intended
configuration, repeat the instructions in this example to correct the
configuration.
crypto-officer@hostname:fips# show system
fips {
self-test {
periodic {
start-time "09:00";
day-of-week 3;
}
}
}
Verification
Confirm that the configuration is working properly.
Verifying the FIPS Self-Test
Purpose
Verify that the FIPS self-test is enabled.
Action
Run the FIPS self-test manually by issuing the request system fips
self-test command or reboot the device.
After issuing the request system fips self-test command or reboot the device,
the system log file is updated to display the KATs that are executed. To
view the system log file, issue the file show
/var/log/messages command.
user@host# file show /var/log/messages mgd: Running FIPS Self-tests mgd: Testing kernel KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-384 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: AES128-CMAC Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: Testing MACSec KATS: mgd: AES128-CMAC Known Answer Test: Passed mgd: AES256-CMAC Known Answer Test: Passed mgd: AES-ECB Known Answer Test: Passed mgd: AES-KEYWRAP Known Answer Test: Passed mgd: KBKDF Known Answer Test: Passed mgd: Testing libmd KATS: mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: SHA-2-512 Known Answer Test: Passed mgd: Testing OpenSSL KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: FIPS ECDSA Known Answer Test: Passed mgd: FIPS ECDH Known Answer Test: Passed mgd: FIPS RSA Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-SSH-SHA256 Known Answer Test: Passed mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed mgd: Testing QuickSec 7.0 KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: SSH-ECDSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing QuickSec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-224 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: HMAC-SHA2-384 Known Answer Test: Passed mgd: HMAC-SHA2-512 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: AES-GCM Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: KDF-IKE-V2 Known Answer Test: Passed mgd: Testing SSH IPsec KATS: mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed mgd: DES3-CBC Known Answer Test: Passed mgd: HMAC-SHA1 Known Answer Test: Passed mgd: HMAC-SHA2-256 Known Answer Test: Passed mgd: AES-CBC Known Answer Test: Passed mgd: SSH-RSA-ENC Known Answer Test: Passed mgd: SSH-RSA-SIGN Known Answer Test: Passed mgd: KDF-IKE-V1 Known Answer Test: Passed mgd: Testing file integrity: mgd: File integrity Known Answer Test: Passed mgd: Testing crypto integrity: mgd: Crypto integrity Known Answer Test: Passed mgd: Expect an exec Authentication error... veriexec: no fingerprint for file='/sbin/kats/cannot-exec' fsid=204 fileid=49356 gen=1 uid=0 pid=7047 mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error mgd: FIPS Self-tests Passed
Meaning
The system log file displays the date and the time at which the KATs were executed and their status.