Verifying That FIPS Self-Tests Are Taking Place
Purpose
Verify that FIPS self-tests are taking place on the NFX device.
Action
You can run FIPS self-tests manually by issuing the request system fips self-test command.
root@hostname:fips> request system fips self-test Testing kernel KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed SHA-2-384 Known Answer Test: Passed SHA-2-512 Known Answer Test: Passed AES128-CMAC Known Answer Test: Passed AES-CBC Known Answer Test: Passed Testing MACSec KATS: AES128-CMAC Known Answer Test: Passed AES256-CMAC Known Answer Test: Passed AES-ECB Known Answer Test: Passed AES-KEYWRAP Known Answer Test: Passed KBKDF Known Answer Test: Passed Testing libmd KATS: HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed SHA-2-512 Known Answer Test: Passed Testing OpenSSL v1.0.2 KATS: FIPS ECDSA Known Answer Test: Passed FIPS ECDH Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed RSA-ENC Known Answer Test: Passed RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-SSH-SHA256 Known Answer Test: Passed KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed KAS-FFC-EPHEM-NOKC Known Answer Test: Passed Testing OpenSSL KATS: FIPS ECDSA Known Answer Test: Passed FIPS ECDH Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed RSA-ENC Known Answer Test: Passed RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-SSH-SHA256 Known Answer Test: Passed KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed KAS-FFC-EPHEM-NOKC Known Answer Test: Passed Testing QuickSec 7.0 KATS: DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed SSH-ECDSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-IKE-V2 Known Answer Test: Passed Testing QuickSec KATS: DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-224 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed HMAC-SHA2-384 Known Answer Test: Passed HMAC-SHA2-512 Known Answer Test: Passed AES-CBC Known Answer Test: Passed AES-GCM Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed KDF-IKE-V2 Known Answer Test: Passed Testing SSH IPsec KATS: NIST 800-90 HMAC DRBG Known Answer Test: Passed DES3-CBC Known Answer Test: Passed HMAC-SHA1 Known Answer Test: Passed HMAC-SHA2-256 Known Answer Test: Passed AES-CBC Known Answer Test: Passed SSH-RSA-ENC Known Answer Test: Passed SSH-RSA-SIGN Known Answer Test: Passed KDF-IKE-V1 Known Answer Test: Passed Testing file integrity: File integrity Known Answer Test: Passed Testing crypto integrity: Crypto integrity Known Answer Test: Passed Expect an exec Authentication error... /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error
After a self-test is run on the NFX device, the system log (syslog) file is updated to display
the known answer tests (KATs) that are executed. To view the system log file, issue
the command file show /var/log/messages. The system log file
displays the date and time at which each KAT was executed, the name of the test, and
its status.