Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Understanding FIPS Self-Tests

The cryptographic module enforces security rules to ensure that a device running the Juniper Networks Junos Operating System (Junos OS) in FIPS mode of operation meets the security requirements of FIPS 140-3 Level 2. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:

  • md_kats—KAT for libmd and libc

  • quicksec_7_0_kats—KAT for Quicksec_7_0 Toolkit cryptographic implementation

  • openssl_kats—KAT for OpenSSL cryptographic implementation

  • openssl-102_kats—KAT for OpenSSL v1.0.2 cryptographic implementation

  • kernel_kats—KAT for kernel cryptographic routines

  • srxpfe_kats—KAT for SRX packet forwarding engine

The KAT self-tests are performed automatically at startup and reboot when FIPS mode of operation is enabled on the device. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and DSA key pairs, and manually entered keys.

If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.

If the device fails a KAT, the device writes the details to a system log file, enters FIPS error state (panic), and reboots.

The file show /var/log/messages command displays the system log.

Example: Configuring FIPS Self-Tests

This example shows how to configure FIPS self-tests to run periodically.

Hardware and Software Requirements

  • You must have administrative privileges to configure FIPS self-tests.

  • The device must be running the evaluated version of Junos OS in FIPS mode software.

Overview

The FIPS self-test consists of the following suites of known answer tests (KATs):

  • md_kats—KAT for libmd and libc

  • quicksec_7_0_kats—KAT for Quicksec_7_0 Toolkit cryptographic implementation

  • openssl_kats—KAT for OpenSSL cryptographic implementation

  • kernel_kats—KAT for kernel cryptographic routines

  • srxpfe_kats—KAT for SRX packet forwarding engine

In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.

Note:

Instead of weekly tests, you can configure monthly tests by including the month and day-of-month statements.

When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Procedure

Step-by-Step Procedure

To configure the FIPS self-test:

  1. Configure the FIPS self-test to execute at 9:00 AM every Wednesday.

  2. If you are done configuring the device, commit the configuration.

Results

From configuration mode, confirm your configuration by issuing the show system command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Performing Power-On Self-Tests on the Device

Each time the cryptographic module is powered on, the module tests that the cryptographic algorithms still operate correctly and that sensitive data has not been damaged. Power-on self-tests are performed on demand by power cycling the module.

On powering on or resetting the device, the module performs the following self-tests. All KATs must be completed successfully prior to any other use of cryptography by the module. If one of the KATs fail, the module enters the Critical Failure error state.

The module displays the following status output for SRX1500, SRX4100, SRX4200, and SRX4600 devices while running the power-on self-tests:

Note:

The module implements cryptographic libraries and algorithms that are not utilized in the approved mode of operation.