Dell OpenSSL Cryptographic Library V2.1 FIPS 140-2 Non-Proprietary Security Policy Document Revision 1.0 03/26/2015 © 2015 Dell Inc. All Rights Reserved. Dell, the Dell logo, and other Dell names and marks are trademarks of Dell Inc. in the US and worldwide. Dell disclaims proprietary interest in the marks and names of others. © 2015 Copyright Dell, Inc. Dell, Inc. grants permission to freely reproduce in entirety without revision. Revision History Revision Date Authors Summary 0.1 06/23/2014 Ed Morris Initial draft 0.2 07/22/2014 Ed Morris Revised draft 0.3 07/28/2014 Ed Morris Revised to include S5000 platform 0.4 08/04/2014 Ed Morris Updates based upon feedback 0.5 09/22/2014 Ed Morris Updated name 0.6 09/25/2014 Jan Provan Updated to Dell Document Standards 0.7 09/29/2014 Jan Provan Updated Product Names and aligned processor names throughout 0.8 10/10/2014 Ed Morris Updated to remove leftover Gossamer templating and to incorporate Cygnacom/Jonathan’s comments Updated based on Jonathan’s Comments 0.9 10/27/2014 Jan Provan 1.0 03/26/2105 Kevin Fowler Updated to address items from CMVP Review Dell OpenSSL Cryptographic Library Page 2 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. Table of Contents Revision History ........................................................................................................................................... 2 Introduction ................................................................................................................................................... 4 Dell Cryptographic Library........................................................................................................................... 4 Module Specification ................................................................................................................................ 4 Security Level ........................................................................................................................................ 5 FIPS Approved Mode of Operation ....................................................................................................... 6 Approved Cryptographic Algorithms .................................................................................................... 6 Non-Approved Cryptographic Algorithms ............................................................................................ 7 Module Interfaces ...................................................................................................................................... 7 Roles, Services and Authentication ........................................................................................................... 8 Finite State Model ..................................................................................................................................... 9 Physical Security ....................................................................................................................................... 9 Operational Environment .......................................................................................................................... 9 Key Management .................................................................................................................................... 10 Electromagnetic Interference and Compatibility..................................................................................... 12 Self-Tests................................................................................................................................................. 12 Guidance and Secure Operation .............................................................................................................. 13 Crypto-officer Guidance ...................................................................................................................... 13 User Guidance ..................................................................................................................................... 13 Mitigation of Other Attacks .................................................................................................................... 13 Dell OpenSSL Cryptographic Library Page 3 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. Introduction This non-proprietary FIPS 140-2 security policy for the Dell OpenSSL Cryptographic Library details the secure operation of the Dell OpenSSL Cryptographic Library as required in the Federal Information Processing Standards Publication 140-2 (FIPS 140-2) as published by the National Institute of Standards and Technology (NIST) of the United State Department of Commerce. This document, the Cryptographic Module Security Policy, also referred to as the Security Policy, specifies the security rules under which the Dell OpenSSL Cryptographic Library must operate. The Dell OpenSSL Cryptographic Library provides cryptography to Dell Networking’s Z-Series, S- Series, MXL and Dell PowerEdge M I/O Aggregator and PowerEdge FN I/O Aggregator switches and provides them with the protection afforded by industry-standard, government-approved algorithms to ensure secure, remote management. Dell Networking’s switches leverage the Dell OpenSSL Cryptographic Library to ensure use of FIPS 140-2 validated cryptography. Dell Cryptographic Library The following sections describe the Dell Cryptographic Library. Module Specification The Dell OpenSSL Cryptographic Library (Version v2.1) (hereinafter referred to as the “Library,” “cryptographic module,” or the “module”) is a software-only cryptographic module executing on a general-purpose computing system running Dell Networking operating system (OS) 9.6(0.0). Dell OpenSSL Cryptographic Library Page 4 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. The physical perimeter of the general-purpose computing system comprises the module’s physical cryptographic boundary, while the Dell OpenSSL Cryptographic Library constitutes the module’s logical cryptographic boundary. Physical Cryptographic Boundary (General Purpose Computing System) Dell Networking OS 9.6(0.0) Operating System Dell OpenSSL Linking Library Application Logical Cryptographic Boundary Figure 1 - Logical Diagram Security Level The Dell OpenSSL Cryptographic Library meets the overall requirements applicable to Level 1 security overall of FIPS 140-2 and the following specified section security levels. Table 1 - Module Security Level Specification # FIPS 140-2 Section Level 1 Cryptographic Module Specification 1 2 Cryptographic Module Ports and Interfaces 1 3 Roles, Services, and Authentication 1 4 Finite State Model 1 5 Physical Security N/A 6 Operational Environment 1 7 Cryptographic Key Management 1 8 EMI/EMC 1 9 Self-tests 1 10 Design Assurance 3 11 Mitigation of Other Attacks N/A Overall Level 1 Dell OpenSSL Cryptographic Library Page 5 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. FIPS Approved Mode of Operation The Dell OpenSSL Cryptographic Library provides both FIPS-Approved and non-FIPS-Approved services, and thus provides both a FIPS-Approved and non-Approved mode of operation. To use the Library in a FIPS-compliant mode of operation, the operator should following these rules: 1. As allowed by FIPS 140-2 overall Level 1 security, the module does not provide any indicator of its FIPS mode of operation. Thus, an operator (calling process) must ensure to follow each of the rules in this section (during the development of a calling application) to ensure that the module operates in its FIPS mode. 2. The module affords no persistent or permanent configuration to ensure use of its Approved mode or operation, rather the module, when in its operational state, alternates service by service between its Approved and non-Approved mode of operation (depending on what services the operator calls). 3. The list of services enumerated in the Roles, Services and Authentication section includes all security functions, roles, and services provided by the cryptographic module in both its Approved and non-Approved modes of operation. 4. An operator does not configure the module during power-up initialization to operate only in one mode or another mode. The module provides no such configuration, but instead requires the operator to only solicit Approved services and to not solicit non-Approved services. The following services are non-Approved services: a. Random Number Generation using Hash_DRBG, HMAC_DRBG, and X9.31 RNG (all non-compliant) b. ECDSA (non-compliant) c. Triple-DES CMAC (non-compliant) d. AES CMAC (non-compliant), AES-GCM (non-compliant, and AES-XTS (non- compliant) 5. An operator must avoid violating Approved-mode key generation and usage requirements by: a. Not generating keys in a non-Approved mode of operation and then switch to an Approved-mode of operation (for example, using the same keys for the ECDH and ECDSA algorithms) b. Not electronically importing keys in plaintext in a non-Approved mode of operation and then switch to an Approved-mode of operation and use those keys for Approved services c. Not generating keys in an Approved-mode of operation and then switching to a non- Approved mode of operation and using the generated keys for non-Approved services Approved Cryptographic Algorithms The module uses cryptographic algorithm implementations that have received the following certificate numbers from the Cryptographic Algorithm Validation Program. Dell OpenSSL Cryptographic Library Page 6 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. Table 2 – FIPS-Approved Algorithm Certificates Algorithm CAVP Certificate (Dell Networking OS 9.6(0.0) on FreeScale PowerPC e500, Intel Xeon, Intel Centerton and Broadcom XLP ) AES #2971 DRBG #565 DSA #884 HMAC #1883 RSA #1560 SHS #2497 Triple-DES #1760 Non-Approved Cryptographic Algorithms The module uses the following non-FIPS 140-2 approved, but allowed, algorithms.  RSA (encrypt/decrypt) – allowed for use as part of a key-establishment scheme.  Diffie-Hellman – allowed for use as part of a key-agreement scheme.  Elliptic Curve Diffie-Hellman – allowed for use as part of a key-agreement scheme. The module also provides the following non-Approved algorithms:  Hash_DRBG, HMAC_DRBG, and RNG (non-compliant)  ECDSA (non-compliant)  Triple-DES CMAC (non-compliant)  AES CMAC (non-compliant), AES-GCM (non-compliant, and AES-XTS (non-compliant) As described above, in order to utilize the Library in FIPS-compliant mode, a calling process cannot solicit non-Approved algorithms. Module Interfaces The module is classified as a multiple-chip standalone module for FIPS 140-2 purposes. As such, the module’s physical cryptographic boundary encompasses the general-purpose computing system running the Dell Networking OS and interfacing with the peripherals (through its console port, network (Ethernet and QSFP) ports, USB ports, and power adapter). However, the module provides only a logical interface via an application programming interface (API) and does not interface with or communicate across any of the physical ports of the computing system. This logical interface exposes services that operators (calling applications) may use directly. The module’s C-language API interface provided by the module is mapped onto the four FIPS 140-2 logical interfaces: data input, data output, control input, and status output. It is through this logical API Dell OpenSSL Cryptographic Library Page 7 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. that the module logically separates them into distinct and separate interfaces. The mapping of the module’s API to the four FIPS 140-2 interfaces is as follows:  Data input – API entry point data input stack parameters  Data output – API entry point data output stack parameters  Control input – API entry point and corresponding stack parameters  Status output – API entry point return values and status stack parameters Roles, Services and Authentication The module supports both of the FIPS 140-2 required roles, the Crypto-officer and the User role, and supports no additional roles. An operator implicitly selects the Crypto-officer role when loading (or causing loading of) the library and selects the User role when soliciting services from the module through its API. The module requires no operator authentication. The following table enumerates the module’s services. Table 3 - Service Descriptions for Crypto-officer and User Roles Service Description and CSP Access Crypto-Officer services Library Loading The process of loading the assembly Self-test Perform self-tests (FIPS_selftest) User services Show Status Fucntions that provide module status information  Version (an unsinged long or const char *)  FIPS Mode (Boolean)  FIPS POST Status (returns 1 if they failed) Does not access CSPs. Zeroize Functions that destroy CSPs:  fips_drbg_uninstantiate: for the CTR_DRBG context, overwrites CTR_DRBG CSPs All other services automatically overwrite CSPs stored in allocated memory. Stack cleanup is the responsibility of the calling application. Random number generation Used for random number generation.  Seed or reseed the CTR_DRBG instance  Determine security strength of the CTR_DRBG instance  Obtain random data Uses and updates the CTR_DRBG CSPs. Asymmetric key generation Used to generate RSA, DH, DSA, and EC keys: RSA SGK, RSA SVK, DH Private, DH Public, DSA SGK, DSA SVK, EC DH Private, EC DH Public There is one supported entropy strength for each mechanism and algorithm type, the maximum specified in SP 800-90A Dell OpenSSL Cryptographic Library Page 8 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. Service Description and CSP Access Symmetric encrypt/decrypt Used to encrypt or decrypt data. Message digest Used to generate a SHA-1 or SHA-2 message digest. Does not access CSPs. Keyed Hash Used to generate or verify data integrity with HMAC. Executes using HMAC Key (passed in by the calling process). Key transport1 primivites Used to encrypt or decrypt a key value on behalf of the calling process (does not establish keys into the module). Executes using RSA KDK, RSA KEK (passed in by the calling process). Key agreement primivites Used to perform key agreement primitives on behalf of the calling process (does not establish keys into the module). Executes using EC DH Private, DH Private, EC DH Public, DH Public (passed in by the calling process). Digital Signature Used to generat or verify RSA or DSA digital signatures. Executes using RSA SGK, RSA SVK; DSA SGK, DSA SVK (passed in by the calling process). Finite State Model The module has a finite state model (FSM) that descrbes the module’s behavior and transitions based on its current state and the command received. The module’s FSM was reviewed as part of the overall FIPS 140-2 validation. Physical Security The physical security requirements does not apply to the module. The module is a software-only module that executes on a general-purpose computing system. Operational Environment The Library executes on a general-purpose operating system (Dell Networking OS) running in single-user mode that segregates processes into separate process spaces. Thus, the operating system separates each process space from all others, implicitly satisfying the FIPS 140-2 requirement for a single-user mode of operation. Table 4 – Tested Operational Environments Dell Networking OS 9.6(0.0) (single-user mode) Executing on 1 Dell Networking S4810 High-performance 10/40GbE top-of-rack switch with FreeScale PowerPC e500 2 Dell Networking S4820T High-performance 10GBASE-T switch with FreeScale PowerPC e500 3 Dell Networking S5000 High-performance 10/40GbE top-of-rack switch with FreeScale PowerPC e500 1"Key transport" can refer to a) moving keys in and out of the module or b) the use of keys by an external application. The latter definition is the one that applies to the OpenSSL FIPS Object Module Dell OpenSSL Cryptographic Library Page 9 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. 4 Dell Networking S6000 High-performance 10/40GbE top-of-rack switch with Intel Centerton 5 Dell Networking Z9500 Ethernet Fabric Switch with Intel Centerton 6 Dell Networking Z9000 Core and Fabric Switch with Intel Xeon 7 Dell Networking MXL with Broadcom XLP 8 Dell PowerEdge M I/O Aggregator with Broadcom XLP 9 Dell PowerEdge FN I/O Aggregator with Broadcom XLP Key Management The module possesses its HMAC-SHA-1 self-integrity test key and power-up self-test known answer test keys. Beyond those keys, the module does not store any other keys persistently. It is the calling applications responsibility to appropriately manage keys. The module can generate keys (DSA, EC, and RSA asymmetric key pairs), can accept keys entered by an operator, and affords an operator the ability to zeroize keys held in RAM. Dell OpenSSL Cryptographic Library Page 10 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. The following table describes the module’s security-relevant data items (SRDI’s) including asymmetric and symmetric keys: Table 5 - Module Security-Relevant Data Items Key Type bitsize Description Origin Stored Zeroized RSA RSA 2048 or RSA PKCS#1, ANSI Entered or RAM / Clear SGK 3072 X9.31, or PSS signature Generated plaintext method generation key RSA RSA 2048- RSA key decryption Entered or RAM / Clear KDK 16384 (private key transport) Generated plaintext method key DSA DSA 2048 or DSA signature generation Entered or RAM / Clear SGK 3072 key Generated plaintext method DH DH 224-512 DH private key Entered or RAM / Clear Private agreement key Generated plaintext method EC DH EC DH 224-521 EC DH private key Entered or RAM / Clear Private agreement key Generated plaintext method AES AES 128-256 AES encrypt / decrypt Entered RAM / Clear EDK key plaintext method Triple- Triple- 168 Triple-DES encrypt / Entered RAM / Clear DES DES decrypt key plaintext method EDK HMAC HMAC 112+ Keyed hash key intended Entered RAM / Clear Key for data integrity plaintext method CTR_DR AES 256 AES-256 CTR_DRBG From RAM Clear BG Key internal state Key environment /plaintext method CTR_DR N/A 128 AES-256 CTR_DRBG From RAM Clear BG V internal state V (seed) environment /plaintext method (seed) Dell OpenSSL Cryptographic Library Page 11 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. The module also supports the following public/non-sensitive keys: Table 6 - Module Public Keys Key Type bitsize Description Origin Stored Zeroized RSA RSA 2048 or RSA PKCS#1, ANSI Entered or RAM / Clear SVK 3072 X9.31, or PSS signature Generated plaintext method verification key RSA RSA 2048- RSA key encryption Entered or RAM / Clear KEK 16384 (public key transport) key Generated plaintext method DSA DSA 2048 or DSA signature Entered or RAM / Clear SVK 3072 verification key Generated plaintext method DH DH 2048- DH public key agreement Entered or RAM / Clear Public 16384 key Generated plaintext method EC DH EC DH 224-521 EC DH public key Entered or RAM / Clear Public agreement key Generated plaintext method Self-tests All All Keys used for module Compiled Module N/A KAT Power-Up Known into the image (see 140-2 Keys Answer Self-Test module IG 7.4) Self-tests HMAC 256 bits HMAC-SHA-1 key used Compiled Module N/A by the module for it’s Integrity into the image / (see 140-2 Keys power up integrity test module plaintext & IG 7.4) obfuscated Electromagnetic Interference and Compatibility The module meets Level 1 security for FIPS 140-2 EMI/EMC requirements as the Dell OpenSSL Cryptographic Library passed validation executing on a general-purpose computing system that confirms to the EMI/EMC requirements specified by 47 Code of Federal Regulations, Part 15, Subpart B, Unintentional Radiators, Digital Devices, Class B (for example, for home use). Self-Tests The module provides the self-tests listed in Table 7. Table 7 – Self-tests FIPS Cryptographic Module Self-Tests Power-Up Self-Tests Integrity test (HMAC-SHA-1) DRBG KAT (CTR_DRBG - all applicable SP 800-90 Section 11 assurance tests) SHA KATs (SHA-1, -224, -256, -384, -512) HMAC-SHA KATs (SHA-1, -224, -256, -384, -512) CMAC KATs (CMAC is non-compliant) AES encrypt KAT and AES decrypt KAT AES CCM KATs AES GCM authenticated encryption KAT and AES GCM authenticated decryption KAT (GCM is non- compliant) AES XTS KATs (XTS is non-compliant) Dell OpenSSL Cryptographic Library Page 12 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved. Triple-DES encrypt KAT and Triple-DES decrypt KAT RSA sign KAT and RSA verify KAT DSA sign KAT and DSA verify KAT Conditional Self-tests: DSA Key Generation Pairwise Consistency Test RSA Key Generation Pairwise Consistency Test AES-256 CTR_DRBG Continuous Random Number Generator Test Seeding of CTR_DRBG Continuous Random Number Generator Test” The module automatically performs a complete set of power-up self-tests during library load to ensure proper operation, thus an operator has no access to cryptographic functionality unless the power-up self- tests passes and the library load succeeds. The power-up self-tests include an integrity check of the module’s software using an HMAC-SHA-1 value calculated over the object module’s in-memory image. Should the module fail a self-test, the module enters an Error state where it prohibits cryptographic services. Additionally, the module performs both power-up and conditional self-tests for its cryptographic algorithms. An operator may invoke the power-up self-tests at any time by calling the FIPS Mode function. Guidance and Secure Operation The Dell OpenSSL Cryptographic Library meets overall Level 1 requirements for FIPS PUB 140-2. The following sections describe the Crypto-officer and User guidance. Crypto-officer Guidance The Crypto-officer or operator responsible for configuring the operational environment on which the module runs must ensure FIPS-compliant operation (as described in the section, FIPS Approved Mode of Operation, of the Security Policy). Additionally, the Crypto-officer is defined to be the operator responsible for loading the library, thus when invoked by a calling application (either at library load or dynamically), the operating system loader loads the module, causing it to automatically perform its power-up self-tests. If the module fail its power- up self-tests, the module transitions into an Error state. User Guidance After the operating system has been properly configured by the Crypto-officer (if needed), the Dell OpenSSL Cryptographic Library requires the user to follow the rules of section FIPS Approved Mode of Operation in order to operate in a FIPS-compliant manner. Furthermore, the User must assume responsibility for managing all keys, as the module does not provide any persistent key storage. Mitigation of Other Attacks The Dell OpenSSL Cryptographic Library does not claim to mitigate any attacks beyond the FIPS 140-2 Level 1 requirements for validation. Dell OpenSSL Cryptographic Library Page 13 of 13 © 2015 Copyright Dell, Inc. Security Policy All rights reserved.