FIPS 140-2 Security Policy BlackBerry Cryptographic Kernel Version 3.8.5.42, 3.8.5.48 & 3.8.5.50a Document Version 2.7 Security Certifications Team Research In Motion (RIM) © 2009 Research In Motion Limited. All rights reserved. www.blackberry.com This document may be freely reproduced and distributed whole and intact including this Copyright Notice. BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a Document and Contact Information Version Date Description 1.0 22 August 2008 Document creation. Inclusion of algorithm certificate numbers and 1.1 29 September 2008 Wipe Handheld service 2.0 10 December 2008 Revised policy with various minor modifications. 2.1 16 December 2008 Revised policy with various minor modifications. Minor edits and inclusion of 2009 to copyright 2.2 07 January 2009 notice. 2.3 08 January 2009 Removal of extraneous material. Minor edits. 2.4 15 January 2009 Addition of 3.8.5.50a to Security Policy 2.5 16 January 2009 Addition of BlackBerry OS 4.6.1 2.6 23 February 2009 Updated certificate numbers 2.7 24 February 2009 Updated certificate numbers to include RSA. Contact Corporate Office Security Certifications Team Research In Motion certifications@rim.com 295 Phillip Street (519) 888-7465 ext. 72921 Waterloo, Ontario Canada N2L 3W8 www.rim.com www.blackberry.com © 2009 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a Contents Introduction ...................................................................................................................................... 1 Cryptographic Module Specification ............................................................................................... 2 Cryptographic Module Ports and Interfaces ..................................................................................... 5 Roles, Services, and Authentication ................................................................................................. 6 Physical Security .............................................................................................................................. 8 Cryptographic Keys and Critical Security Parameters ..................................................................... 9 Self-Tests ........................................................................................................................................ 10 Mitigation of Other Attacks............................................................................................................ 11 Glossary .......................................................................................................................................... 12 © 2009 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a List of Tables Table 1. Implementation of FIPS 140-2 Interfaces........................................................................................ 5 Table 2. Module Services .............................................................................................................................. 6 Table 3. Role Selection by Module Service .................................................................................................. 7 Table 4. Cryptographic Keys and CSPs ........................................................................................................ 9 Table 5. Module Self-Tests ......................................................................................................................... 10 Table 6. Attack Types.................................................................................................................................. 11 © 2009 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a List of Figures Figure 1. BlackBerry Solution Architecture .................................................................................................. 1 Figure 2. Physical Boundary ......................................................................................................................... 4 © 2009 Research In Motion Limited. All rights reserved. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 1 Introduction BlackBerry® is the leading wireless solution that allows users to stay connected to a full suite of applications, including email, phone, enterprise applications, Internet, SMS, and organiser information. BlackBerry is a totally integrated package that includes innovative software, advanced BlackBerry wireless devices and wireless network service, providing a seamless solution. The BlackBerry architecture is shown in the following figure. Figure 1. BlackBerry Solution Architecture BlackBerry devices are built on industry-leading wireless technology, allowing users to receive email and information automatically with no need to request for delivery. Additionally, users are notified when new information arrives, making it easier to stay informed. BlackBerry devices also provide an intuitive user experience. Users simply click on an email address, telephone number, or URL inside a message to automatically begin composing the new email, make the call, or link to the web page. BlackBerry device users can also easily navigate through icons, menus, and options with the roll-and-click trackwheel or trackball, and quickly compose messages or enter data using the device keyboard. Each BlackBerry device1 contains the BlackBerry Cryptographic Kernel, a firmware module that provides the cryptographic functionality required for basic operation of the device. The BlackBerry Cryptographic Module meets the requirements of the FIPS 140-2 Security Level 1. The BlackBerry Cryptographic Kernel, hereafter referred to as cryptographic module or module, provides the following cryptographic services: · Data encryption and decryption · Message digest and authentication code generation · Random data generation · Digital signature verification · Elliptic curve key agreement More information on the BlackBerry solution is available from http://www.blackberry.com/. 1 Excludes RIM 850TM, RIM 950TM, RIM 857TM, and RIM 957TM wireless handheld devices. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 2 Cryptographic Module Specification Security Functions The cryptographic module is a firmware module that implements the following FIPS-Approved security functions2: Algorithm Description Operating Version Certificate System Number AES-256 ASM Encrypt and Decrypt, as specified in 4.6 3.8.5.42 #875 Code FIPS 197. The implementation supports the CBC and CTR modes of operation. 3.8.5.48 #874 3.8.5.50a #915 4.6.1 3.8.5.50a #915 AES-256 Native Encrypt and Decrypt, as specified in 4.6 3.8.5.42 #876 Code FIPS 197. The implementation supports the CBC and CTR modes of operation. 3.8.5.48 #873 3.8.5.50a #924 4.6.1 3.8.5.50a #924 Triple DES Encrypt and Decrypt, as specified in 4.6 3.8.5.42 #718 FIPS 46-3. The implementation supports the CBC mode of 3.8.5.48 #717 operation. 3.8.5.50a #739 4.6.1 3.8.5.50a #739 SHA-1, SHA-256, as specified in FIPS 180-3. 4.6 3.8.5.42 #868 and SHA-512 3.8.5.48 #867 3.8.5.50a #902 4.6.1 3.8.5.50a #902 2 A security function is FIPS-Approved if it is explicitly listed in FIPS 140-2 Annex A: Approved Security Functions for FIPS PUB 140-2. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 3 HMAC-SHA-1, as specified in FIPS 180-3. 4.6 3.8.5.42 #490 HMAC-SHA-256 & HMAC-SHA- 3.8.5.48 #489 512 3.8.5.50a #511 4.6.1 3.8.5.50a #511 FIPS 186-2 RNG as specified in FIPS 186-2. The 4.6 3.8.5.42 #502 implementation uses SHA-1 as the function G 3.8.5.48 #501 3.8.5.50a #525 4.6.1 3.8.5.50a #525 RSA PKCS#1 Signature verification, as specified 4.6 3.8.5.42 #423 in PKCS #1, version 2.1 3.8.5.48 #422 3.8.5.50a #445 4.61 3.8.5.50a #445 ECDSA Signature verification, as specified 4.6 3.8.5.42 #109 in FIPS 186-2 and ANSI X9.62. The implementation supports elliptic curve K-571. 3.8.5.48 #108 3.8.5.50a #113 4.6.1 3.8.5.50a #113 The module implements the following non-Approved security functions that, per FIPS 140-2 Annex D: Approved Key Establishment Techniques for FIPS PUB 140-2, may presently be used in a FIPS-Approved mode of operation: · EC Diffie-Hellman (key agreement, key establishment methodology provides 256 bits of encryption strength), as specified in IEEE P1363 Draft 13. The implementation supports elliptic curves P-521 and K-571. · ECMQV (key agreement, key establishment methodology provides 256 bits of encryption strength), as specified in IEEE P1363 Draft 13. The implementation supports elliptic curves P- 521 and K-571. Modes of Operation The module does not have a non-Approved mode of operation and, consequently, always operates in a FIPS-Approved mode of operation. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 4 Conformance Testing and FIPS-Compliance For the purposes of FIPS 140-2 conformance testing, the module was executed on the BlackBerry Bold 9000 & the BlackBerry Curve 8900, per FIPS 140-2 Implementation Guidance G.5, remains FIPS- compliant when executed on other BlackBerry devices. Conformance testing was performed using BlackBerry OS version 4.6 and BlackBerry OS Version 4.6.1 In order for the module to remain validated on a specific handheld device, both the module and the tested operating platform shall be ported to any device unchanged. Cryptographic Boundary The physical boundary of the module is the physical boundary of the BlackBerry device that executes the module and is shown in the following figure. Consequently, the embodiment of the module is multiple- chip standalone. Application Module Operating System Device Physical Boundary Figure 2. Physical Boundary Determining the Module Version The operator may determine the version of the module on a BlackBerry device by performing the following operations: 1. Navigate to the Options list. 2. Click the About item. 3. The About screen appears and displays the module version, either "Cryptographic Kernel v3.8.5.42", "Cryptographic Kernel v3.8.5.48", or "Cryptographic Kernel v3.8.5.50a", www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 5 Cryptographic Module Ports and Interfaces The module ports correspond to the physical ports of the BlackBerry device executing the module, and the module interfaces correspond to the logical interfaces to the module. The following table describes the module ports and interfaces. Table 1. Implementation of FIPS 140-2 Interfaces FIPS 140-2 Module Ports Module Interfaces Interface Keyboard, microphone, USB port, headset jack, Data Input Input parameters of module function calls wireless modem, Bluetooth® wireless radio Speaker, USB port, headset jack, wireless Data Output Output parameters of module function calls modem, Bluetooth wireless radio Keyboard, USB port, trackwheel, trackball, Control Input Module function calls escape button, backlight button, phone button Status Output USB port, Primary LCD screen, LED Return codes of module function calls Power Input USB port Not supported Maintenance Not supported Not supported www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 6 Roles, Services, and Authentication Roles The module supports a User and Crypto Officer role. The module does not support a maintenance role. The module does not support multiple or concurrent operators and is intended for use by a single operator, thus it always operates in a single-user mode of operation. Services The services described in the following table are available to the operator. Table 2. Module Services Service Description Resets the module. The module may be reset by pressing the Alt + Right Shift + Backspace key Reset combination or power cycling the module. View Status Displays the status of the module. Replaces the existing Master Key with a new Master Key. The new Master Key is created outside Inject Master Key the cryptographic boundary for this service. Creates a new Master Key and uses it to replace the existing Master Key. The new Master Key is Perform Key Agreement created cooperatively by performing key agreement with the BlackBerry Enterprise ServerTM. Replaces the existing PIN Master Key with a new PIN Master Key. The new PIN Master Key is Inject PIN Master Key created outside the cryptographic boundary and is encrypted for input into the module for this service. Generates a Session Key or a PIN Session Key. This service is performed automatically on behalf Generate Session Key of the operator during the Encrypt Data service. Encrypts data that is to be sent from the device. A Session Key is automatically generated via the Encrypt Data Generate Session Key service and used to encrypt the data. The Session Key is encrypted with the Master Key and then the encrypted data and encrypted Session Key are ready for transmission. Decrypts data that has been received by the device. The encrypted Session Key is decrypted with Decrypt Data the Master Key and is then used to decrypt the data. This service is performed automatically on behalf of the operator. Generate HMAC Generates a message authentication code. Perform Self-Tests Executes the module self-tests. Verifies the digital signature of an IT policy received by the device. This service is performed Verify Signature automatically on behalf of the operator. Wipe Handheld Zeroizes all software device keys and user data present on device. Authentication The module does not support operator authentication. Roles are implicitly selected based on the service performed by the operator. Implicit role selection is summarised in the following table, as are the keys and critical security parameters (CSPs) that are affected by each service. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 7 Table 3. Role Selection by Module Service Role Implicitly Access to Keys and Service Affected Keys and CSPs Selected CSPs Reset User N/A N/A View Status User N/A N/A Inject Master Key Crypto Officer Master Key Write ECC Key Pair Execute Perform Key Agreement Crypto Officer Master Key Write Inject PIN Master Key Crypto Officer PIN Master Key Write Session Key / Generate Session Key User Write PIN Session Key Master Key / Execute PIN Master Key Encrypt Data User Session Key / Execute PIN Session Key Master Key / Execute PIN Master Key Decrypt Data User Session Key / Execute PIN Session Key Generate HMAC User HMAC Key Execute Perform Self-Tests User Software Integrity Key Execute Verify Signature User ECC Public Key Execute Wipe Handheld Crypto Officer All Software Keys Write www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 8 Physical Security The BlackBerry device that executes the module is manufactured using industry standard integrated circuits and meets the FIPS 140-2 Level 1 physical security requirements. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 9 Cryptographic Keys and Critical Security Parameters The following table describes the cryptographic keys, key components, and CSPs utilised by the module. Table 4. Cryptographic Keys and CSPs Key / CSP Description A Triple DES or AES-256 key used to encrypt and decrypt Session Keys. The Master Key is always generated outside the cryptographic boundary. The Key may be input into the module: Master Key · in plaintext as parameters to an API call when connected directly to the USB port of a workstation operating BlackBerry Desktop Manager, or · encrypted by the current Master Key if utilizing key agreement with the BlackBerry Enterprise Server. A Triple DES or AES-256 key used to encrypt and decrypt data. The module Session Key generates Session Keys using the implemented FIPS 186-2 RNG. A Master Key that is specifically a Triple DES key used to encrypt and decrypt PIN Session Keys. The PIN Master Key is generated outside the cryptographic boundary The Key may be input into the module: PIN Master Key · in plaintext as parameters to an API call when connected directly to the USB port of a workstation operating BlackBerry Desktop Manager, or · encrypted by the current Master Key if utilizing key agreement with the BlackBerry Enterprise Server. A Session Key that is specifically a Triple DES key used to encrypt and decrypt data PIN Session Key for PIN messaging. The module generates PIN Session Keys using the implemented FIPS 186-2 RNG. Software Integrity Key A RSA public key used to verify the integrity of the module software. ECC Key Pair A key pair used to perform key agreement over elliptic curves. ECC Public Key A public key used to verify digital signatures over elliptic curves HMAC Key A key used to calculate a message authentication code using the HMAC algorithm. Key Zeroization The BlackBerry security solution provides multiple protective features to ensure algorithmic keys and key components are protected. Similarly, data, and specifically key, removal through zeroization is built in as an integral part of the BlackBerry security solution. A user may also request a zeroization at anytime by navigating to the Options list and selecting "Wipe Handheld" via the Security Options General Settings. The BlackBerry Enterprise Server administrator may also zeroize the device remotely to wipe all device data and keys. Furthermore, session keys that are created per datagram are destroyed after each data fragment is sent. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 10 Self-Tests The module implements the self-tests described in the following table. Table 5. Module Self-Tests Test Description The module implements an integrity test for the module software by verifying its Software Integrity Test 1024-bit RSA signature. The software integrity test passes if and only if the signature verifies successfully using the Software Integrity Key. The module implements a compare answer test (CAT) for the AES-256 variants. The AES-256 CAT test passes if and only if the calculated output of each variant is compared and confirmed as congruent. The module implements a KAT for Triple DES in the CBC mode of operation. The Triple DES CBC KAT test passes if and only if the calculated output equals the expected output. The module implements a KAT for SHA-1. The KAT passes if and only if the SHA-1 KAT calculated output equals the expected output. The module implements a KAT for SHA-256. The KAT passes if and only if the SHA-256 KAT calculated output equals the expected output. The module implements a KAT for SHA-512. The KAT passes if and only if the SHA-512 KAT calculated output equals the expected output. The module implements a KAT for HMAC SHA-1. The KAT passes if and only if HMAC SHA-1 KAT the calculated output equals the expected output. The module implements a KAT for HMAC SHA-256. The KAT passes if and only if HMAC SHA-256 KAT the calculated output equals the expected output. The module implements a KAT for HMAC SHA-512. The KAT passes if and only if HMAC SHA-512 KAT the calculated output equals the expected output. The module implements a KAT for RSA signature verification. The test passes if RSA Verify KAT and only if the calculated output equals the expected output. The module implements a KAT for ECDSA signature verification. The test passes if ECDSA Verify KAT and only if the calculated output equals the expected output. The module implements a KAT for the FIPS 186-2 RNG. The KAT passes if and FIPS 186-2 RNG KAT only if the calculated output equals the expected output. The module implements a continuous RNG test, as specified in FIPS 140-2, for the Continuous RNG Test implemented FIPS 186-2 RNG. All self-tests, except the Continuous RNG Test, are executed during power-up without requiring operator input or action. The Software Integrity Test is the first self-test executed during power-up. Invoking the Self-Tests The operator may invoke the power-up self-tests by resetting the module via the Reset service. The operator may also invoke all of the self-tests with the exception of the Software Integrity Test and Continuous RNG test by performing the following operations: 1. Navigate to the Security options screen. 2. Click the General Settings option item. 3. Depending on the handheld model, click the trackwheel or trackball to open the General Settings options menu. 4. In the menu, click Verify Security Software. When the self-tests are executed in this manner, the module displays the list of self-tests that are being executed and a pass/fail status upon completion. www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 11 Mitigation of Other Attacks The module is designed to mitigate multiple side-channel attacks specific to the AES algorithm. Mitigation of these attacks is accomplished through the execution of table masking, splitting, and stirring manoeuvres designed to aid in the protection of cryptographic keys and plain text data at all points during the encryption, decryption, and self-test operations. The following table describes the types of attacks the module mitigates. Table 6. Attack Types Attack type Description Side-Channel · attempts to exploit physical properties of the algorithm implementation using Power Analysis (for example, SPA and DPA) and Electro-Magnetic Analysis (for example, SEMA and DEMA) · attempts to determine the encryption keys that a device uses by measuring and analyzing the power consumption, or electro-magnetic radiation, emitted by the device during cryptographic operations www.blackberry.com BlackBerry Cryptographic Kernel version 3.8.5.42, 3.8.5.48 & 3.8.5.50a 12 Glossary AES Advanced Encryption Standard ANSI American National Standards Institute CBC Cipher block chaining CSP Critical security parameter DES Data Encryption Standard EC Elliptic curve ECC Elliptic curve cryptography ECDSA Elliptic curve Digital Signature Algorithm ECMQV Elliptic curve Menezes, Qu, Vanstone FIPS Federal Information Processing Standard HMAC Keyed-hashed message authentication code IEEE Institute of Electrical and Electronics Engineers KAT Known answer test LCD Liquid crystal display LED Light emitting diode PIN Personal identification number PKCS Public Key Cryptography Standard PUB Publication RIM Research In Motion RNG Random number generator RSA Rivest, Shamir, Adleman SHA Secure Hash Algorithm SHS Secure Hash Standard SMS Short Messaging Service URL Uniform resource locator USB Universal serial bus www.blackberry.com