FIPS Self-Tests Overview
The cryptographic module enforces security rules to ensure that the Juniper Networks Junos operating system (Junos OS) in FIPS mode meets the security requirements of FIPS 140-3 Level 1. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:
-
kernel_kats—KAT for kernel cryptographic routines -
macsec_kats—KAT for MACsec cryptographic implementation -
md_kats—KAT for libmd and libc -
openssl_kats—KAT for OpenSSL cryptographic implementation -
quicksec_kats—KAT for QuickSec Toolkit cryptographic implementation
For MACsec qualifications, the LC KATs has to perform on AES-GCM-128 and AES-GCM-256.
The KAT self-tests are performed automatically at startup. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and ECDSA key pairs, and manually entered keys.
If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.
During bootup entropy health test is performed. The system software integrity check is done during bootup. Each software module is verified before being loaded. The messages pertaining to the entropy health check and software integrity checks can be viewed on the console during system bootup.
If one of the self-tests fail, the device panics and reboot continuously. The device can be recovered using USB install.
The request system fips
self-test command displays the
system log:
user@host> request system fips self-test Testing kernel KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed SHA-2-384 Known Answer Test: Passed SHA-2-512 Known Answer Test: Passed AES128-CMAC Known Answer Test: Passed AES-CBC Known Answer Test: Passed Testing MACSec KATS: AES128-CMAC Known Answer Test: Passed AES256-CMAC Known Answer Test: Passed AES-ECB Known Answer Test: Passed AES-KEYWRAP Known Answer Test: Passed KBKDF Known Answer Test: Passed Testing libmd KATS: HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed SHA-2-512 Known Answer Test: Passed Testing OpenSSL v1.0.2 KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed FIPS ECDSA Known Answer Test: Passed FIPS ECDH Known Answer Test: Passed FIPS RSA Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed ECDSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-SSH-SHA256 Known Answer Test: Passed KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed KAS-FFC-EPHEM-NOKC Known Answer Test: Passed Testing OpenSSL KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed FIPS ECDSA Known Answer Test: Passed FIPS ECDH Known Answer Test: Passed FIPS RSA Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed ECDSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-SSH-SHA256 Known Answer Test: Passed KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed KAS-FFC-EPHEM-NOKC Known Answer Test: Passed Testing QuickSec 7.0 KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed SSH-ECDSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-IKE-V2 Known Answer Test: Passed Testing QuickSec KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-IKE-V2 Known Answer Test: Passed Testing SSH IPsec KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed AES-CBC Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed Testing file integrity: File integrity Known Answer Test: Passed Testing crypto integrity: Crypto integrity Known Answer Test: Passed Expect an exec Authentication error... /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error