Understanding FIPS Self-Tests
The cryptographic module enforces security rules to ensure that a device running the Juniper Networks Junos operating system (Junos OS) in FIPS mode of operation meets the security requirements of FIPS 140-3 Level 2. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:
md_kats—KAT for libmd and libc-
quicksec_7_0_kats—KAT for Quicksec_7_0 Toolkit cryptographic implementation openssl_kats—KAT for OpenSSL cryptographic implementation-
openssl-102_kats- KAT for OpenSSL v1.0.2 cryptographic information kernel_kats—KAT for kernel cryptographic routinessrxpfe_kats— KAT for SRX packet forwarding engine
The KAT self-tests are performed automatically at startup and reboot when FIPS mode of operation is enabled on the device. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and ECDSA key pairs, and manually entered keys.
If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.
If the device fails a KAT, the device writes the details to a system log file, enters FIPS error state (panic), and reboots.
There may be instances where the device ends up not booting correctly. It can be a result of a POST test failure, or other things. The administrators are advised to refer to this guidance document to look for solution and if the issues are not resolved, contact support team.
The file show /var/log/messages command displays
the system log.
DRBG does not require any configuration, and initialized on startup.
Performing Power-On Self-Tests on the Device
Each time the cryptographic module is powered on, the module tests that the cryptographic algorithms still operate correctly and that sensitive data has not been damaged. Power-on self-tests are performed on demand by power cycling the module.
On powering on or resetting the device, the module performs the following self-tests. All KATs must be completed successfully prior to any other use of cryptography by the module. If one of the KATs fail, the module enters the Critical Failure error state.
The module displays the following status output for vSRX3.0 devices while running the power-on self-tests:
<118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - Initializing Verified Exec: <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: randomdev_wait_until_seeded unblock wait <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: Entropy start-up health tests performed on 1024 samples passed. <2>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - random: unblocking device. <118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - FIPS veriexec ECDSA Verify Known Answer Test: Passed <118>1 2022-09-13T23:30:18.193-07:00 fipscc-vsrx3-g kernel - - - Verified os-kernel-prd-x86-64-20220607 signed by PackageProductionECP256_2022 method ECDSA256+SHA256 <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Running FIPS Self-tests <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing kernel KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES128-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing MACSec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES128-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES256-CMAC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-ECB Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-KEYWRAP Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KBKDF Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing libmd KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SHA-2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing OpenSSL v1.0.2 KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDH Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS RSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-SSH-SHA256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing OpenSSL KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS ECDH Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS RSA Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-SSH-SHA256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KAS-FFC-EPHEM-NOKC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing QuickSec 7.0 KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-ECDSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V2 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing QuickSec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-224 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-384 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-512 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-GCM Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V2 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing SSH IPsec KATS: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: NIST 800-90 HMAC DRBG Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: DES3-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: HMAC-SHA2-256 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: AES-CBC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-ENC Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: SSH-RSA-SIGN Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: KDF-IKE-V1 Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing file integrity: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: File integrity Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Testing crypto integrity: <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Crypto integrity Known Answer Test: Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: Expect an exec Authentication error... <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: FIPS Self-tests Passed <118>1 2022-09-13T23:30:18.194-07:00 fipscc-vsrx3-g kernel - - - mgd: commit complete
The module implements cryptographic libraries and algorithms that are not utilized in the approved mode of operation.