Understanding the Operational Environment for Junos OS in FIPS Mode

Hardware Environment for Junos OS in FIPS Mode

Junos OS in FIPS mode establishes a cryptographic boundary in the router that no critical security parameters (CSPs) can cross using plain text. Each hardware component of the router that requires a cryptographic boundary for FIPS 140-2 compliance is a separate cryptographic module.

For more information about the cryptographic boundary on your router, see Understanding Junos OS in FIPS Mode.

Communications involving CSPs between these secure environments must take place using encryption.

Cryptographic methods are not a substitute for physical security. The hardware must be located in a secure physical environment. Users of all types must not reveal keys or passwords, or allow written records or notes to be seen by unauthorized personnel.

Software Environment for Junos OS in FIPS Mode

A Juniper Networks device running Junos OS in FIPS mode forms a special type of non-modifiable operational environment. To achieve this environment on the router, the system prevents the execution of any binary file that was not part of the certified Junos OS distribution. When a router is in FIPS mode, it can run only Junos OS.

The Junos OS in FIPS mode software environment is established after the Crypto Officer successfully enables FIPS mode on a device. The Junos OS image that includes FIPS package is available on the Juniper Networks website and can be installed on functioning device. See Downloading Software Packages from Juniper Networks for more information on image names.

For FIPS 140-2 compliance, we recommend deleting all user-created files and data from (zeroizing) the system immediately after enabling FIPS mode.

Enabling FIPS mode disables many of the usual Junos OS protocols and services. In particular, you cannot configure the following services in Junos OS in FIPS mode:

• finger

• ftp

• rlogin

• telnet

• tftp

• xnm-clear-text

Attempts to configure these services, or load configurations with these services configured, result in a configuration syntax error. You can use only SSHv2 as a remote access service.

All passwords established for users after upgrading to Junos OS in FIPS mode must conform to Junos OS in FIPS mode specifications. Passwords must be between 10 and 20 characters in length and require the use of at least three of the five defined character sets (uppercase and lowercase letters, digits, punctuation marks, and keyboard characters, such as % and &, not included in the other four categories). Attempts to configure passwords that do not conform to these rules result in an error. All passwords and keys used to authenticate peers must be at least 10 characters in length, and in some cases the length must match the digest size.

Critical Security Parameters

Critical security parameters (CSPs) are security-related information such as cryptographic keys and passwords that can compromise the security of the cryptographic module or the security of the information protected by the module if they are disclosed or modified.

Zeroization of the system erases all traces of CSPs in preparation for operating the router or Routing Engine as a cryptographic module.

Table 1 lists CSPs on routers running Junos OS.

In Junos OS in FIPS mode, all CSPs must enter and leave the cryptographic module in encrypted form. Any CSP encrypted with a non-approved algorithm is considered plain text by FIPS. .

Local passwords are hashed with the secure hash algorithm SHA-256, or SHA-512. Password recovery is not possible in Junos OS in FIPS mode. Junos OS in FIPS mode cannot boot into single-user mode without the correct root password.