Understanding FIPS Error States and System Panic
An NFX device operating Junos OS in FIPS mode has certain operational restrictions such as the ability to load only integrity-checked software files and use only FIPS-approved cryptographic algorithms. To ensure correct operation, the NFX device performs a series of FIPS self-tests.
The NFX device performs additional tests as needed—for example, to ensure that randomly generated numbers are truly random and to verify manually entered keys (passwords).
If it fails a test, the NFX device enters a FIPS error state known as system panic.
FIPS errors that occur early in the boot cycle can prevent the system from successfully starting up. For this reason, keep alternate boot media up to date.
FIPS System Panic
If an NFX device fails a FIPS self-test, the NFX device enters a FIPS error state known as system panic. The panic condition halts all cryptographic processing and stops all data output from the NFX device. To clear the FIPS error, NFX device reboots, runs the FIPS self-tests, and if it passes all the tests, returns to normal operation.
If NFX device fails a self-test during a reboot from panic mode, the system stops booting and attempts to reboot. If the reboot is unsuccessful, the NFX device attempts again to reboot, this time from available boot media.
During a system panic, only status messages are displayed on the console. For example, a FIPS error is logged as follows:
panic: pid 5090 (fips-error), uid 0, FIPS error 5: cannot verify certificate PackageCA
The reboot after panic displays the following error message on the console:
savecore: reboot after panic: pid 5090 (fips-error), uid 0, FIPS error 5: cannot verify certificate PackageCA
The following error states create a system panic:
These errors have only an extremely small chance of occurring.
The NFX device failed a known answer test (KAT).
The random number is not random.
Signature generation failed.
Signature verification failed.
Certificate verification failed.
Encryption or decryption failed.
An environment error occurred.
An error occurred in a pair-wise conditional test.
Error Recovery from Alternate Boot Media
An NFX Network Services Platform running Junos OS in FIPS mode performs KATs self-tests at startup. If the NFX device fails a KAT, the boot process stops and the NFX device attempts to reboot. If the reboot is unsuccessful, the NFX device attempts again to reboot, this time from available boot media.
However, if the seal is broken, the NFX device is no longer a FIPS cryptographic module. You as Crypto Officer must zeroize, reinstall and reconfigure Junos OS and enable FIPS mode.