HEWLETT-PACKARD TIPPINGPOINT FIPS 140-2 NON-PROPRIETARY SECURITY POLICY HP TippingPoint Security Management System Level 1 Validation Firmware Version: 3.2.0.8312.3 Document Version: 1.03 HP TippingPoint SMS Non-Proprietary Security Policy Page 1 of 31 FIPS 140-2 Non-Proprietary Security Policy HP TippingPoint Security Management System Contents 1. Introduction ................................................................................................................. 4 1.1 Purpose................................................................................................................ 4 1.2 References ........................................................................................................... 4 1.3 Definitions and Acronyms .................................................................................. 4 2 Module Specifications ................................................................................................ 6 2.1 Overview ............................................................................................................. 6 2.2 Test Configuration .............................................................................................. 7 2.2 Cryptographic Boundary..................................................................................... 8 2.3 Ports and Interfaces ............................................................................................. 9 3 Roles, Services and Authentication .......................................................................... 10 3.1 Roles ................................................................................................................. 10 3.2 Services ............................................................................................................. 11 3.3 Unauthenticated Services .................................................................................. 14 3.4 Authentication Mechanisms and Strength ........................................................ 14 4 Secure Operation and Security Rules ....................................................................... 16 4.1 Secure Operation ............................................................................................... 16 4.2 Self-Tests .......................................................................................................... 18 4.3 Security Rules ................................................................................................... 19 4.4 Secure Setup and Installation ............................................................................ 21 4.5 Crypto-Officer Guidance .................................................................................. 22 4.6 User Guidance ................................................................................................... 23 4.7 Physical Security Rules..................................................................................... 23 5 Security Relevant Data Items and Access Control ................................................... 24 5.1 Cryptographic Algorithms ................................................................................ 24 5.2 Cryptographic Keys, CSPs, and SRDIs ............................................................ 25 5.3 Access Control Policy ....................................................................................... 30 6 Mitigation of Other Attacks ...................................................................................... 31 List of Figures Figure 1: SMS Module in HP TippingPoint Architecture .................................................. 6 Figure 2: Cryptographic Boundary ..................................................................................... 8 Figure 3: Hardware used for testing.................................................................................... 8 List of Tables Table 1: Test Configuration ................................................................................................ 7 Table 2: SMS Module Security Level Specification .......................................................... 7 HP TippingPoint SMS Non-Proprietary Security Policy Page 2 of 31 Table 3: Ports and Interfaces............................................................................................... 9 Table 4: SMS User Roles .................................................................................................. 10 Table 5: Services ............................................................................................................... 11 Table 6: Unauthenticated Service ..................................................................................... 14 Table 7: FIPS-Mode Cryptographic Algorithms .............................................................. 24 Table 8: Non-FIPS Mode Cryptographic Algorithms ...................................................... 24 Table 9: SRDI Information ............................................................................................... 25 Table 10: Access Control Policy....................................................................................... 30 HP TippingPoint SMS Non-Proprietary Security Policy Page 3 of 31 1. Introduction This document is a non-proprietary Cryptographic Module Security Policy for the HP TippingPoint Security Management System Firmware version 3.2.0.8312.3. Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules, specifies the U.S. and Canadian Governments‟ requirements for cryptographic modules. The following pages describe how HP TippingPoint‟s SMS meets these requirements and how to use the SMS in a mode of operation compliant with FIPS 140-2. This policy was prepared as part of the Level 1 FIPS 140-2 validation of the HP TippingPoint Security Management System. More information about FIPS 140-2 and the Cryptographic Module Validation Program (CMVP) is available at the website of the National Institute of Standards and Technology (NIST): http://csrc.nist.gov/groups/STM/cmvp/index.html. In this document, the HP TippingPoint Security Management System is referred to as the SMS, TippingPoint SMS, the module, the firmware or the SMS module. 1.1 Purpose This document covers the secure operation of the HP TippingPoint SMS firmware module including the initialization, roles, and responsibilities of operating the product in a secure, FIPS-compliant manner. 1.2 References This Security Policy deals specifically with the operation and implementation of the module in the technical terms of the FIPS 140-2 standard. Additional information on the module can be found on the HP TippingPoint website. 1.3 Definitions and Acronyms Table 2: Definitions and Acronyms Term/Acronym Description AES Advanced Encryption Standard CLI Command Line Interface CSP Critical Security Parameter DES Data Encryption Standard DH Diffie Hellman DRNG Deterministic Random Number Generator FIPS Federal Information Processing Standard GUI Graphical User Interface HMAC Hash-based Message Authentication Code HTTP Hypertext Transfer Protocol HTTPS Hypertext Transfer Protocol Secure HP TippingPoint SMS Non-Proprietary Security Policy Page 4 of 31 IPS Intrusion Prevention System MD5 Message Digest 5 RNG Random Number Generator RSA Public Key encryption developed by RSA Data Security, Inc. (Rivest, Shamir and Adleman) SHA Secure Hash Algorithm SMS Security Management System SRDI Security Relevant Data Item SSH Secure Shell SSL Secure Sockets Layer TDES Triple Data Encryption Standard TLS Transport Layer Security TP TippingPoint HP TippingPoint SMS Non-Proprietary Security Policy Page 5 of 31 2 Module Specifications 2.1 Overview The TippingPoint SMS serves as the control center where one can configure, monitor, and report on multiple TippingPoint devices in your network. Each SMS can manage up to 150 TippingPoint devices (based on environmental conditions). The TippingPoint SMS module is a centralized management solution for managing and monitoring a deployment of TippingPoint security devices. The SMS module provides cryptographic services for communicating with the security devices and user interfaces. For FIPS 140-2 purposes, the TippingPoint SMS is considered a cryptographic firmware module. The physical embodiment is multi-chip standalone. A typical network-wide TippingPoint deployment consisting of a centralized TippingPoint Security Management System (SMS) managing multiple TippingPoint systems is depicted in Figure 1. SMS Module (See Figure 3 for close-up) Figure 1: SMS Module in HP TippingPoint Architecture HP TippingPoint SMS Non-Proprietary Security Policy Page 6 of 31 2.2 Test Configuration The TippingPoint SMS firmware module was tested for FIPS 140-2 overall Level 1 compliance using the following configuration: Table 1: Test Configuration SMS Firmware Version Processor Hardware 3.2.0.8312.3 Intel Xeon HP ProLiant DL320 G6 Server The SMS module can be operated in FIPS-approved mode as well as in non-FIPS mode. The module offers the option of three FIPS modes: Disable, Crypto and Full. Only the „Full‟ FIPS mode is considered the FIPS-approved mode of operation. The other two „Disable‟ and „Crypto‟ modes are considered non-FIPS approved modes of operation. For all FIPS 140-2 purposes, all instances of „FIPS-mode‟ or „FIPS-approved mode‟ refer only to „Full‟ FIPS mode on the module. The SMS module allows updates only with packages that are signed by TippingPoint‟s private key, so it has a limited operational environment. When operated in FIPS mode, the TippingPoint SMS Cryptographic module meets the overall requirements applicable to Level 1 security of FIPS 140-2. Table 2 shows each of the FIPS 140-2 sections and the corresponding levels that the SMS module meets the requirements for. Table 2: SMS Module Security Level Specification Security Requirements Section Level Cryptographic Module Specification 1 Cryptographic Module Ports and Interfaces 1 Roles, Services and Authentication 3 Finite State Model 1 Physical Security 1 Operational Environment N/A Cryptographic Key Management 1 EMI/EMC 1 Self Tests 1 Design Assurance 2 Mitigation of Other Attacks N/A HP TippingPoint SMS Non-Proprietary Security Policy Page 7 of 31 2.2 Cryptographic Boundary The logical cryptographic boundary is the SMS firmware binary comprising of all the logical components within the firmware. None of the logical components within the firmware are excluded from the FIPS 140-2 security requirements. The module‟s physical cryptographic boundary is the entire physical enclosure of the test appliance used as the SMS Server i.e. the platform where the SMS firmware and the Operating System reside. Figure 2: Cryptographic Boundary The below figure shows the hardware used for testing the SMS firmware module against the FIPS 140-2 security requirements. The entire outer enclosure of this appliance (encompassing the top, bottom, left, right, front and rear faces) represents the physical cryptographic boundary of the module. Figure 3: Hardware used for testing HP TippingPoint SMS Non-Proprietary Security Policy Page 8 of 31 2.3 Ports and Interfaces Table 3 lists the ports and interfaces of the module and their mapping to the corresponding FIPS 140-2 logical interfaces. The physical ports correspond to the physical ports of the test appliance that executes the SMS firmware module, and the module interfaces correspond to the logical functions or APIs of the module. The mouse port provided on the test appliance used to execute the SMS firmware is unused and has no use in FIPS or in Non-FIPS mode. The System Identification (UID) button has a LED integrated in the button and there is one such button on the front and the back side of the appliance used for testing. When one of these buttons is pressed, the blue LED in both of these buttons turns on and only serves the purpose of helping in locating the appliance when placed in an appliance rack. The following table describes the module ports and interfaces. Table 3: Ports and Interfaces FIPS 140-2 Physical Ports of the test appliance (HP Logical Module Interfaces ProLiant DL320 G6 Server) Interfaces Input parameters of Ethernet Management Port, Auxiliary Ethernet Data Input module‟s function Management Port, RS-232 Serial Port, calls. Keyboard Connector, USB port Output parameters Ethernet Management Port, Auxiliary Ethernet Data Output of module‟s Management Port, RS-232 Serial Port, VGA function calls. Monitor port Ethernet Management Port, RS-232 Serial Module‟s function Control Input Port, USB Ports, Keyboard Connector, calls Power/Reset Button, CD-ROM port Ethernet Management Port, RS-232 Serial Return codes of Port, VGA Monitor port, Ethernet port LEDs, module‟s function Status Output Power LED, System Identification (UID) calls Button Power Input N/A Power Port HP TippingPoint SMS Non-Proprietary Security Policy Page 9 of 31 3 Roles, Services and Authentication 3.1 Roles The SMS module can be accessed in any one of the following ways: CLI over the Server appliance‟s serial port. CLI using the Server appliance‟s Monitor and Keyboard port. CLI using SSH over Server appliance‟s Ethernet Management port CLI using Telnet over Server appliance‟s Ethernet Management port SMS Client GUI using TLS over Server appliance‟s Ethernet Management port. SMS Web GUI using TLS over Server appliance‟s Ethernet Management port. When configured to not require passwords, the SMS Web GUI allows non-cryptography relevant services such as downloading of the SMS Client software, downloading SMS User Guide without requiring operator authentication. This TLS GUI always requires operator authentication for viewing system logs or other reports generated on the module. No other management or configuration task is possible over this web GUI. Remote authentication using RADIUS or Active Directory Server. Before remote authentication can be used, it is required that this service be enabled on the module and the username be added in the User List (without the password) and be assigned one of the roles. Without this procedure, the module will not authenticate an operator even if correct username and password are entered for remote authentication. Telnet and HTTP are not allowed to be used in FIPS mode. For each of the above access methods, the TippingPoint SMS supports identity-based authentication, where each user has a name and password. An access level is associated with each user. There are 3 user access levels as shown in the table below. Table 4: SMS User Roles User Access Level Description FIPS Role Can only perform cryptographic services over TLS using SMS Homepage and SMS Client. Operator primarily has read-only access to the Operator User configuration settings. An operator can modify his own password and load a new TLS RSA key pair signed with the TippingPoint‟s private key. Can only perform cryptographic services over TLS using SMS Homepage and SMS Client. Administrator can modify some configuration Administrator User settings. An administrator can modify his own password and load a new TLS RSA key pair signed with the TippingPoint‟s private key. HP TippingPoint SMS Non-Proprietary Security Policy Page 10 of 31 Can access Console CLI, SSH CLI, TLS (SMS Homepage and SMS Client) and modify all configuration settings. Only a super-user can add and delete users and modify any user‟s password Crypto- Super-User and access level. Also, only a super-user can Officer configure the box for FIPS mode and disable FIPS mode. Only a Super-User can perform software updates. 3.2 Services The table below shows the services provided by the SMS and the access level required to perform them for each of the roles supported by the module. Table 5: Services Super Service Service Operator Admin Service Notes User Inputs Outputs Enable/disable FIPS- GUI option Module Y approved select reboot „Full-FIPS‟ mode CLI Only Super- View FIPS command or FIPS mode Y Y Y User has access Mode status GUI option status to CLI select fips-selftest- View self-test SMS Client Y failure.log failure log file GUI option file New Success or Only Super- Configure password Y Y Y failure User has access own password over CLI or notification to CLI SMS Client Username and new Configure any password Success or operator‟s Y and new failure password and access level notification access level over CLI or SMS Client CLI Add/delete command or Y None users GUI option select Y Configure CLI Success or HP TippingPoint SMS Non-Proprietary Security Policy Page 11 of 31 „password command failure security level‟ and level notification for usernames desired and passwords New Success or Install new package and failure Y firmware or SMS Client notification software patch GUI option and reboot select Packages are associated with Import or New IPS rules and download package and traffic filtering non- Success or SMS Client and are non- Y Y cryptography failure GUI option cryptography relevant notification or SSH CLI relevant. software command Only Super- package User has access to CLI. Activate or SMS Client delete non- GUI option cryptography Y select or None relevant SSH CLI software command package Ctrl+Alt+Del Only Super- at CLI or User has access reboot CLI to CLI. Reboot command or can also be Y Y Reboot reboot SMS None done Client GUI unauthenticated option or via by power SMS cycling the test Homepage appliance. Success indicator if all tests pass. Performed Perform FIPS If any test automatically Y Y Y power-up self- None fails, error during tests message is initialization at logged and every boot-up. module reboots. Install new Vendor- Success or This upload is Y Y Y TLS RSA key supplied and failure possible only pair during signed TLS notification during FIPS- HP TippingPoint SMS Non-Proprietary Security Policy Page 12 of 31 transition to RSA key and reboot on mode enabling FIPS mode pair input success procedure. using SMS Homepage Login to CLI CLI prompt if and perform Username successful. Y services over and Login prompt console or password if SSH unsuccessful Login to SMS SMS Homepage Homepage if Username and view successful. Y Y Y and System logs Login screen password and reports if over TLS unsuccessful SMS Client Login to SMS GUI if Client GUI Username successful. Y Y Y and perform and Login screen services over password if TLS unsuccessful CLI Configure command or Only Super- non-FIPS Y Y SMS Client None User has access related admin GUI option to CLI level settings select Configure CLI non-FIPS command or Y related super- SMS Client None user level GUI option settings select CLI View non- command or Only Super- Configuration Y Y Y FIPS related SMS Client User has access values configuration GUI option to CLI select CLI View non- command or Only Super- Y Y Y FIPS related SMS Client Status User has access status GUI option to CLI select HP TippingPoint SMS Non-Proprietary Security Policy Page 13 of 31 3.3 Unauthenticated Services The SMS modules allow the following unauthenticated services: Table 6: Unauthenticated Service Service Service Procedure Service Outputs Inputs Power cycle or reboot using power button on Power-up or Reboot the test appliance or None None the module using Ctrl+Alt+Del on module‟s console CLI Power cycle or reboot using power button on Perform power-up Success or failure status the test appliance or None self-tests indicator using Ctrl+Alt+Del on module‟s console CLI Power cycle or reboot Zeroize and regenerate using power button on ephemeral keys and the test appliance or None None CSPs using Ctrl+Alt+Del on module‟s console CLI Non-FIPS relevant data Module automatically such as alerts, IPS sends alert notifications SNMP None network statistics. No key if SNMP has been or CSP information is configured output by SNMP. No output. This Disable FIPS- Selecting the option procedure disables FIPS approved (Full FIPS) during module boot-up None mode, zeroizes all keys, mode sequence CSPs and security- relevant data. 3.4 Authentication Mechanisms and Strength The TippingPoint SMS supports password authentication for users. A user must specify a name and password when authenticating over the CLI or SMS Client GUI or SMS Homepage. The SMS module offers different levels for defining the required strength of usernames and passwords. These levels vary from 0 to 2, ranging from minimum to maximum restrictions on the usernames and passwords. Level 0 places no restrictions on the usernames and passwords. This level can be configured by the Super-User Crypto-Officer HP TippingPoint SMS Non-Proprietary Security Policy Page 14 of 31 to be anywhere between 0 and 2. This configurable level option on the module is referenced throughout this document as the „password security level‟ and should not be confused with the FIPS 140-2 Level. In Full FIPS mode, it is the Crypto-Officer‟s responsibility to make sure that the module is configured to use „password security level‟ of 1 or above for usernames and passwords. Thus, considering the lowest level 1, the password must be at least 8 characters. In the default configuration there is no restriction on what characters can be in the password. There are 95^8 possible passwords of the minimum length from the set of all displayable ASCII characters including space. The odds of randomly guessing a password of the minimum length would thus be 1 in 95^8 which is much less than 1 in 1,000,000. The „password security level‟ of 2 on the module requires level 1 restriction of 8- character passwords and additionally requires all passwords to have at least 2 letters, 1 number, and 1 non-alphanumeric character. This would reduce the number of possible passwords from the default settings. However, even with fixed values and positions for the required character classes, there would still be 95^4 possible passwords of the minimum length. The odds of randomly guessing the password for this fixed scenario would be 1 in 95^4, which is less than 1 in 1,000,000. Since the values and positions of the required character classes are not fixed, the number of possible passwords of the minimum length is larger. Thus the actual odds are even lower. In the default configuration, a user account is locked for 5 minutes after 5 failed login attempts for that user. Thus the odds of randomly guessing a password with retries within one minute is 5 times the odds discussed above. That does not result in any odds larger than 1 in 100,000. The maximum number of retries can be configured up to 10, which would result in 10 times the odds discussed above, but this would still not result in odds larger than 1 in 100,000. To maintain FIPS compliance, the Crypto-Officer must not disable the configuration for account lockout on login failure or configure the lockout attempts to more than 5. HP TippingPoint SMS Non-Proprietary Security Policy Page 15 of 31 4 Secure Operation and Security Rules In order to operate the TippingPoint SMS securely, the user should be aware of the security rules enforced by the module and should adhere to the physical security rules and secure operation rules and procedure. 4.1 Secure Operation 4.1.1 Enabling FIPS Mode Before enabling FIPS mode („Full‟ FIPS mode) on the module, the following should be verified: Verify that the SMS Client software has been downloaded on a computer in the same subnet as the appliance executing the SMS firmware. If the SMS Client has not been downloaded : On a computer in the same subnet as the appliance executing the SMS firmware, access the SMS Homepage (https://) and download the SMS Client from the SMS Homepage. Verify that the version and patch level of the SMS module is FIPS compliant by accessing the SMS Client GUI and accessing „Admin‟ category  „General‟ tab. To ensure FIPS 140-2 compliance of the module, verify that the version listed in „SMS Software‟ field is 3.2.0.8312 and the „SMS Patches‟ field lists 3.2.0.8312.3 as the version currently installed. Only version number 3.2.0.8312.3 is a part of this validation. Contact HP TippingPoint and create an account on the Threat Management Center (TMC) website (https://tmc.tippingpoint.com) which will be required for installing vendor-signed FIPS keys onto the module. Verify the browsers and SSH clients used to connect to the SMS server support the Transport Layer Security (TLS) 1.0 protocol, sometimes referred to as SSL 3.1. TLS 1.0 support is required to connect to an SMS server running in FIPS mode. The Super-User should create BIOS password for the test appliance being used and maintain the security of this BIOS password to prevent unauthorized access. After following the above steps and verifying all the above requirements, the SMS module should be placed in FIPS mode (denoted as „Full‟ FIPS mode on the module) by a Crypto-officer by following the below procedure: Login to the SMS Client GUI with the Crypto-Officer authentication data created on the module. In the SMS Client GUI, access the „Admin‟ Navigation menu and then select „Server Properties‟. If RADIUS or Active Directory servers were configured, then access the Authentication tab and under RADIUS, click on ‘Reset’. Also, under Active Directory, click on ‘Edit’ and set all fields (except Port and Timeout) to „0000‟, click on ‘OK’. Under Authentication Source, select ‘Edit’ and then select ‘Use local authentication’ and click OK. HP TippingPoint SMS Non-Proprietary Security Policy Page 16 of 31 Under the „Management‟ tab, in the „Services‟ section, make sure that HTTP and Telnet are unselected to disable these services. Then click Apply. As an alternative to this, the SMS CLI can be used to disable HTTP and Telnet by executing the following commands: “set svc.http-enable=no” “set svc.telnet-enable=no” In the „FIPS Mode‟ section, click Edit. Select „Full-FIPS‟ as the Requested State. On the same page, enter authentication information for a new SMS Crypto- Officer account with „password security level‟ of 1 or above, which will be the only active account after the transition to Full-FIPS mode. This Crypto-Officer account and password should NOT match the credentials of any SMS account that existed prior to enabling Full-FIPS mode. Click OK. This will cause the module to reboot. Using a web browser, download FIPS keys for the SMS module from the Threat Management Center (TMC) website (https://tmc.tippingpoint.com) after a successful authentication and save this on the computer being used. This is an official TLS RSA key pair signed by TippingPoint. These FIPS keys are required to be imported into the module as part of the transition to Full-FIPS mode. Contact HP TippingPoint for any issues regarding this or for creating an account at the TMC website. After the SMS has rebooted, Crypto-Officer should access the SMS homepage or website (https://) from any computer in the same subnet as the SMS and upload the official TLS key package to the SMS module. No other console operation should be performed at this stage. This FIPS key package has to be downloaded from the TMC website as explained in the above step. The above procedure causes the SMS to do the following: Reboot Zeroize all keys and CSPs Generate new keys Perform FIPS power-up self tests Regenerate SSH and temporary TLS keys and certificates with associated conditional self-tests. Use the generated temporary TLS keys. SMS Client connections are not allowed at this stage. SMS web homepage only shows the option to upload the official TLS key pair at this stage. Reboot again after the official TLS key pair is imported via SMS Homepage using temporary TLS keys and the key package passes the associated conditional self-tests. Perform FIPS power-up self tests. Enter approved Full FIPS mode. Start using the new official TLS key pair. These steps ensure that the FIPS requirements are met for doing self tests, not using the same keys and users in FIPS and non-FIPS modes, not allowing output during power-up HP TippingPoint SMS Non-Proprietary Security Policy Page 17 of 31 self tests, using only FIPS-approved cryptographic algorithms, etc. The SMS should now be operating in a FIPS compliant manner. 4.1.2 Current FIPS Mode The current FIPS mode can be seen on the SMS GUI by accessing „Admin‟ Navigation menu  „Server Properties‟  „Management‟ tab  „FIPS Mode‟ section. This FIPS mode status can be seen by all operators of all roles. 4.1.3 Other FIPS-related procedures To force the FIPS power-up self tests to be rerun, an operator must reboot the SMS module. To zeroize and regenerate all cryptographic keys in the module, a Crypto-Officer can disable and then re-enable FIPS mode through the GUI by following the procedure provided in Section 4.1.4 and 4.1.1 respectively. 4.1.4 Disabling FIPS mode In order to disable the Full-FIPS mode, the following procedure should be followed. This is allowed only to the Crypto-Officer role. In the SMS Client GUI, access the „Admin‟ Navigation menu and then select „Server Properties‟. If RADIUS or Active Directory servers were configured, then access the Authentication tab and under RADIUS, click on ‘Reset’. Also, under Active Directory, click on ‘Edit’ and set all fields (except Port and Timeout) to „0000‟, click on ‘OK’. Under Authentication Source, select ‘Edit’ and then select ‘Use local authentication’ and click OK. Select the „Management‟ tab. In the „FIPS Mode‟ section, click Edit. Select „Disabled‟ as the Requested State. When prompted, create a new SuperUser account. All user accounts that existed prior to disabling FIPS mode will be deleted. This procedure causes the SMS to perform the same steps as done when going into Full FIPS mode except that the module is put into disabled FIPS mode, the FIPS self-tests are no longer performed, and the module may use cryptographic algorithms not allowed by FIPS. 4.2 Self-Tests The SMS Module performs the following power-up self-tests every time the module boots-up: Firmware Integrity Test using MD5 AES KATs DRBG KAT and Health Tests DSA Sign/Verify HMAC-SHA KATs HP TippingPoint SMS Non-Proprietary Security Policy Page 18 of 31 RNG ANSI X9.31 KAT RSA Sign/Verify SHA KATs Triple-DES KATs The SMS module performs the following conditional self-tests every time the associated service is invoked: Continuous Random Number Generator Test for ANSI X9.31 RNG Continuous Random Number Generator Test for DRBG Pair-wise consistency tests for RSA (sign/verify, encrypt/decrypt) Pair-wise consistency test for DSA (sign/verify) Software Load Test : When a user attempts to update the firmware/software, verify that the new software file was signed by the TippingPoint‟s private key. If the signature check fails, the software update is aborted with no changes to the existing installed software. This validation is also done when FIPS mode is disabled. On failing any of the power-up or conditional self-tests, the module logs the error message in the log file “fips-selftest-failure.log”. The Crypto-Officer can access this failure log file by logging in to the module using the SMS Client and then accessing Tools  Diagnostics  Log Utils  sms-server  Create Logs Zip File. Then a filename and location on the local computer can be specified, where the zip file will be stored. This zip file will contain the fips-selftest-failure.log file which logs the self-test error message and the timestamp of the failure. For all power-up and conditional self-test failures, except for the power-up firmware integrity test and the conditional software load test, the module immediately reboots itself. In case of the power-up firmware integrity self-test failure, the module halts the boot process and an operator must then manually reboot the module. If case of a software load test failure, the module will reject and not install the incorrect file. 4.3 Security Rules The security rules enforced by the TippingPoint SMS include both the security rules that TippingPoint has imposed and the security rules that result from the security requirements of FIPS 140-2. 4.3.1 FIPS 140-2 Security Rules The following are the security rules derived from the FIPS 140-2 requirements when in full FIPS mode: The TippingPoint SMS module supports identity-based user authentication, access levels, and services as discussed in section 3. The TippingPoint SMS module supports CSPs and controls access to them as discussed in section 5. HP TippingPoint SMS Non-Proprietary Security Policy Page 19 of 31 The TippingPoint SMS module has support for changing into or out of full FIPS mode, zeroizing/generating keys, etc. See section 4.1 for more information. When in full FIPS mode, only cryptographic algorithms allowed by FIPS are used. See section 5.1 for the list of algorithms. The TippingPoint SMS module performs the self tests as listed in Section 4.2. There is no data output from the SMS during the power-up self tests. The users do not have direct access to the internal storage on the SMS where the CSPs and installed software images are stored. All external entry of CSPs is encrypted with the exception of passwords entered over the console. The user is not allowed to configure the password settings for less than 8 characters. Telnet and HTTP are disabled/disallowed in Full FIPS mode. SSL 2.0 and SSL 3.0 support is disabled in Full FIPS mode. Only TLS 1.0/SSL 3.1 is allowed in this FIPS-approved mode. On enabling FIPS-approved mode, the module deletes the existing user database and adds the new default Super-User account as per the login information specified in the SMS GUI. It also removes all SMS backups and device snapshots stored on the SMS server and deletes all custom responder actions. 4.3.2 TippingPoint Security Rules The following are the security rules that are enforced by TippingPoint when the SMS is in Full FIPS mode: For enabling FIPS mode, the SMS module should be placed in „Full‟ FIPS mode. The external database replication feature cannot be enabled in FIPS-mode. The failed-lockout attempts counter must remain activated for all users and configured at incorrect attempts threshold of 5 or below. The „password security level‟ setting for each SMS user should remain at or above Level 1. In Full FIPS mode, the SSH terminal will negotiate connections using only FIPS 140-2 approved algorithms. Restoring SMS backups that were created when SMS was not in Full-FIPS mode is not permitted by the module. Importing or executing custom Responder Actions is not allowed by the module. The use of custom web security SSL certificates is not permitted by the module. The SMS hardware appliance must have a BIOS password enabled and set. BIOS boot settings should not be edited while the module is operating in FIPS- approved mode and the appliance should boot only from the main hard drive. HTTP and Telnet are not allowed to be used in FIPS-approved mode of operation. While using RADIUS or Active Directory server for remote authentication to the SMS module, the operator is responsible for using a minimum of 8-character password and 8-character shared secret. The software patches and the FIPS key (TLS RSA key pair) packages must be obtained by the Crypto-Officer only via the secure TMC website HP TippingPoint SMS Non-Proprietary Security Policy Page 20 of 31 (https://tmc.tippingpoint.com) using TLS and the access will require an appropriate module owner‟s authentication. The SMS firmware module will be shipped already installed in a compatible appliance by HP TippingPoint. The firmware version 3.2.0.8312.3 is the only FIPS-validated version. Thus, the patch should not be rolled back after installation and no other firmware versions or patch versions should be installed into the module. The module allows the Crypto-Officer to select the option of not requiring authentication on the SMS Homepage (Web UI). This option, if selected, allows an operator to not login for downloading the SMS Client software (which is outside the module‟s cryptographic boundary) and SMS module documentation. The SMS Homepage still requires operator authentication in order to view and download module‟s reports and logs. 4.4 Secure Setup and Installation The Crypto-Officer is responsible for successful and accurate first-time installation and initialization of the module upon delivery by following the below procedure: a) The Crypto-Officer will receive the SMS firmware module version 3.2.0.8312 already installed in the test appliance from HP TippingPoint. b) Upon reception of the appliance with the firmware module installed, the Crypto- Officer will place the appliance in a rack, if desired and connect the Ethernet port of the appliance to the network, and power port to a power outlet. c) Then, access the module‟s console CLI using a directly attached monitor and a keyboard. d) Power-on the appliance using the power button on the front side of the appliance. e) After a successful start-up, the module will show a login prompt to the Crypto- Officer, where the username should be entered as “SuperUser” with no associated password. This would initiate the setup wizard, with the help of which, the Crypto- Officer will set the networking and management options for the module. The module always assumes the Crypto-Officer to perform the installation and thus, allows the Crypto-Officer services to this authenticated identity. f) Now, using the console CLI, the Crypto-Officer must create operator accounts with usernames and corresponding passwords using the CLI command “users” and then by typing “A” for adding the username, “P” for entering the password corresponding to the newly created username, “R” for associating the newly added user with one of the available roles on the module and “E” for enabling this user account. The Crypto- Officer must create at least one Super-User Crypto-Officer account by following these steps, this login information for the Crypto-Officer will be used in the remaining steps. g) The Crypto-Officer must then access the SMS Homepage (https://) from another computer in the same subnet and login using the Super- User username and password established in the previous step and then download the SMS Client software from this webpage to the computer. h) Then the Crypto-Officer will be required to start the SMS Client GUI on the same subnet computer and login using the Super-User Crypto-Officer login credentials. HP TippingPoint SMS Non-Proprietary Security Policy Page 21 of 31 The Crypto-Officer must then access Admin  General  „SMS Patches‟ section  click „Update‟. When the SMS Patch wizard opens up, select “Download from TMC” and click i) „Next‟. The GUI will then show the available patches on TMC which can be downloaded and imported into the module. Select the SMS Patch #3 file for this firmware version (SMS_Patch-3.2.0_8312.3.pkg) from the list. Click „Download‟ and then click „Install‟. j) The SMS module will now perform the necessary software load test on the patch file. If the patch file fails the self-test, the SMS Client GUI will show an error message and the incorrect patch file will be ignored and will not be installed into the module. k) If the patch file passes the self-test, the SMS module will import the patch and will reboot automatically. l) After the module reboots, if the SMS Client software will require an update for compatibility with the firmware version, a pop-up message will be shown and the Crypto-Officer must update the Client software for continuing access to perform module services. m) The Crypto-Officer must ensure the current installed version in the SMS Client (Admin  General  SMS Patches) listed under „Currently Installed‟ is 3.2.0.8312.3. n) This procedure completes the initial setup configuration of the module. The Crypto- Officer should follow the procedure in section 4.1.1 for enabling FIPS-mode on the module. 4.5 Crypto-Officer Guidance In order to maintain FIPS compliance of the module, the Crypto-Officer must follow the below guidance and rules: The Crypto-Officer must perform secure setup and installation of the module by following the instructions in Section 4.4. The Crypto-Officer must disable HTTP and Telnet using CLI commands “set svc.http-enable=no” and “set svc.telnet-enable=no”. The Crypto-Officer must never enable HTTP and Telnet while the module operates in Full FIPS mode. The Crypto-Officer must ensure that the CLI commands “get svc.http-enable” and “get svc.telnet-enable” return “no”. Alternatively, this can be ensured using the SMS Client GUI by accessing Admin  Server Properties  „Services‟ section and making sure that HTTP and Telnet are always unchecked. The Crypto-Officer is required to maintain the BIOS password-locked and to not release the password information to any other operator while the module operates in FIPS-mode to avoid unauthorized access. Do not edit boot options in the BIOS for the test appliance used while the module is operating in Full FIPS mode. The Crypto-Officer must ensure that the „password security level‟ for usernames and passwords is maintained at Level 1 or above at all times in FIPS-approved mode by accessing the CLI and executing the command “get pwd.level” or by using the SMS Client GUI and accessing Edit  Preferences  System  Password Preferences. Since the module allows only the Crypto-Officer to have HP TippingPoint SMS Non-Proprietary Security Policy Page 22 of 31 access to the CLI and to these specific Client options, no other users can edit this setting and the Crypto-Officer must never change the level to Level 0 while the module is running in Full FIPS mode. The Crypto-Officer must ensure that failed attempts threshold for locking out a user is always enabled and is configured at or above the value of 5 incorrect attempts, while the module is operating in the Full FIPS Mode. The module allows only the Super-User Crypto-Officer to access and modify this option. The Crypto-Officer must ensure this setting using the SMS Client GUI and accessing Edit  Preferences  System  Password Preferences. While using RADIUS or Active Directory server for remote authentication to the SMS module, a minimum of 8-character password and 8-character shared secret must be used. The Crypto-Officer must add users, configure their passwords and roles and enable the usernames as and when required. Follow the steps in the section 4.1 for enabling/disabling FIPS mode, generating/zeroizing keys, etc. to ensure the SMS operates in a FIPS-compliant manner. 4.6 User Guidance In order to maintain FIPS compliance of the module, the User must follow the below guidance and rules: While using RADIUS or Active Directory server for remote authentication to the SMS module, a minimum of 8-character password and 8-character shared secret must be used. 4.7 Physical Security Rules The TippingPoint SMS module was tested on the HP ProLiant DL320 G6 Server appliance which satisfies the requirements for FIPS 140-2 Level 1 Physical Security. The test platform uses production-grade enclosures and components. No other specific physical security mechanisms are required. HP TippingPoint SMS Non-Proprietary Security Policy Page 23 of 31 5 Security Relevant Data Items and Access Control This section specifies the TippingPoint SMS Security Relevant Data Items (SRDIs) as well as the access control policy enforced by the SMS. 5.1 Cryptographic Algorithms When in Full FIPS mode, the SMS uses only the cryptographic algorithms listed in Table 7 below. Table 7: FIPS-Mode Cryptographic Algorithms Algorithm Type/Name Options FIPS Certificate # Asymmetric Algorithms RSA 1024-bit, 2048-bit modulus #805, #806 DSA 1024 bit modulus #513 Symmetric Algorithms AES 128, 192, 256 bit #1631, #1632 Triple-DES 2-key and 3-key #1067, #1068 Hashing Algorithms SHA SHA-1, 224, 256, 384, 512 #1436, #1437 HMAC-SHA SHA-1, 224, 256, 384, 512 #958, #959 Random Number Generators ANSI X9.31 AES-128, 192, 256 bit. Used #874 wherever random numbers are required in SSH operations. SP800-90 DRBG Hash DRBG using SHA-256. Used #87 wherever random numbers are required in TLS operations. Key Agreement / Key Establishment Algorithms Diffie-Hellman Key Provides between 80 and 112 bits of Not FIPS-approved Agreement (used with encryption strength but allowed in FIPS SSH and TLS) mode. RSA Key Transport (used Provides between 80 and 112 bits of Not FIPS-approved with TLS) encryption strength but allowed in FIPS mode. The SMS supports the following non-FIPS approved cryptographic algorithms in the FIPS-approved „Full‟ mode: Table 8: Non-FIPS Mode Cryptographic Algorithms Algorithm Type/Name FIPS-approved DES No RC2 No RC4 No RC5 No SEED No HP TippingPoint SMS Non-Proprietary Security Policy Page 24 of 31 CAMELLIA No MD2 No MD5 No CAST No IDEA No Blowfish No 5.2 Cryptographic Keys, CSPs, and SRDIs While operating in a FIPS-compliant manner, the TippingPoint SMS module contains the following security relevant data items: Table 9: SRDI Information Security SRDI Size or Generation/ Relevant Storage Output Zeroization Description Modulus Entry Data Item Not entered. Generated Ephemeral: Zeroized Seed for the using an Plaintext in on reboot RNG seed ANSI X9.31 128 bit internal No RAM or power RNG entropy cycle. data collection method. Not entered. Generated Ephemeral: Zeroized AES seed key using an RNG seed 128, 192 Plaintext in on reboot for the ANSI internal No key or 256 bit RAM or power X9.31 RNG entropy cycle. data collection method. Not entered. Generated Ephemeral: Zeroized using an Hash_DRBG Entropy for Plaintext in on reboot 880 bit internal No Entropy Hash_DRBG RAM or power entropy cycle. data collection method Not entered. Ephemeral: Zeroized Value of V Hash_DRBG Generated Plaintext in on reboot for 440 bit No V value using an RAM or power Hash_DRBG internal cycle. entropy HP TippingPoint SMS Non-Proprietary Security Policy Page 25 of 31 data collection method Not entered. Generated Ephemeral: Zeroized using an Hash_DRBG Value of C for Plaintext in on reboot 440 bit internal No C value Hash_DRBG RAM or power entropy cycle. data collection method Not generated. PKCS#1 RSA Entered Persistent: A public public key encrypted Software/ Stored in key so no used to verify with TLS Firmware 2048 bit plaintext No need to all software session key load test key on hard zeroize. updates to the during drive. module. software package install Not Zeroized generated. while Entered by entering or an operator exiting the Persistent: encrypted approved Hashed with TLS Full FIPS using Operator 8-32 or SSH mode. Also Password SHA256 No password characters session key overwritten and stored or in with new on hard plaintext passwords drive. (serial port while or directly changing using a passwords. keyboard). Output in Not Zeroized Shared secret plaintext to generated. while used by the Persistent: enable the Entered by entering or RADIUS module to Minimum Plaintext module to an operator exiting the Shared authenticate 8 and stored authenticate encrypted approved Secret to the characters on hard to the with TLS Full FIPS RADIUS drive. RADIUS using SMS mode. server server Client Shared secret Not Output in Zeroized Persistent: Active used by the generated. plaintext to while Minimum Plaintext Directory module to Entered by enable the entering or 8 and stored Shared authenticate an operator module to exiting the characters on hard Secret to the Active encrypted authenticate approved drive. Directory with TLS to the Full FIPS HP TippingPoint SMS Non-Proprietary Security Policy Page 26 of 31 server using SMS Active mode. Client Directory server RSA public/private Zeroized keys used for Not when new TLS. This can entered. Public key signed key only be used Generated is output to pair is for importing by the Persistent: its peer as installed or Temporary the official module Plaintext part of TLS when TLS RSA key pair. No 1024 bits using the and stored negotiation. entering or key pair services are approved on hard Private key exiting the accessible DRBG drive. is never approved over SMS when FIPS outputted. Full FIPS Homepage mode is mode. and SMS enabled. Client using this key pair Not generated. Public key Zeroized Imported is output to Vendor- while by an Persistent: its peer as signed RSA entering or Official TLS operator Plaintext part of TLS public/private exiting the RSA key 2048 bits over a TLS and stored negotiation. key pair used approved pair session on hard Private key for TLS in Full FIPS using the drive. is never FIPS-mode mode. temporary output. TLS RSA key pair. Not entered. Diffie- Generated Ephemeral: Zeroized Hellman TLS Diffie- 1024, by the Plaintext in on reboot public and Hellman No 2048 bits module RAM or power private Key Pair using the cycle. parameters approved DRBG May enter 48 bytes Shared secret encrypted if RSA exchanged with the Zeroized key using RSA module‟s on reboot transport May be Key Transport RSA public or power is used. Ephemeral: outputted or established TLS Pre- key or can cycle or 1024 or Plaintext in encrypted using Diffie- Master be when the 2048 bits RAM with the Hellman key Secret generated ongoing peer‟s RSA if Diffie- exchange. internally TLS Hellman public key. This is used to using session key derive the DRBG or ends. exchange Master Secret can be is used established HP TippingPoint SMS Non-Proprietary Security Policy Page 27 of 31 using Diffie- Hellman parameters. Not entered. Computed Zeroized Master Secret as part of on reboot used to derive SSL or power Ephemeral: the encryption negotiation cycle or TLS master Plaintext in and MAC 48 Bytes according No when the secret RAM keys for both to TLS 1.0 ongoing ends of an standard TLS SSL session using the session pre-master ends. secret and nonces. Zeroized AES: Not on reboot AES/Triple- 128, 192, entered. or power DES or 256 Derived Ephemeral: TLS cycle or symmetric Bits; from Plaintext in encryption No when the key for SSL Triple- master RAM key ongoing encryption in DES: 112 secret as TLS one direction or 168 part of SSL session Bits negotiation. ends. Zeroized Not on reboot entered. or power Derived Ephemeral: MAC key for cycle or TLS from Plaintext in integrity in 160 Bits No when the integrity key master RAM one direction ongoing secret as TLS part of SSL session negotiation. ends. Module‟s private exponent is generated Zeroized Public value during SSH on reboot and private negotiation or power Ephemeral: SSH Diffie- exponent used using cycle or 1024, Plaintext in Hellman key for SSH ANSI No when the 2048 bits RAM pair DiffieHellman X9.31 ongoing Key RNG. The SSH Exchange public session value is ends. derived from the private HP TippingPoint SMS Non-Proprietary Security Policy Page 28 of 31 exponent and the Diffie- Hellman group. The peer‟s Diffie- Hellman public value enters the module according to SSH Standard. Not Public key Zeroized entered. is output to while Generated Persistent: its peer as entering or RSA public using Plaintext part of SSH SSH RSA exiting the and private 2048 Bits ANSI and stored negotiation. key pair approved key pair X9.31 on hard Private key Full FIPS RNG drive. is never mode. during key outputted. generation. Not Public key Zeroized entered. is output to while Generated Persistent: its peer as entering or DSA public using Plaintext part of SSH SSH DSA exiting the and private 1024 bits ANSI and stored negotiation. key pair approved key pair X9.31 on hard Private key Full FIPS RNG drive. is never mode. during key outputted. generation. Shared secret used to derive Zeroized client/server on reboot IVs, Not or power Ephemeral: client/server SSH Diffie- entered. cycle or 1024, Plaintext in encryption Hellman Derived No when the 2048 bits RAM keys and shared secret during SSH ongoing client/server negotiation. SSH integrity keys session for an SSH ends. session AES/Triple- AES: Zeroized Not DES 128, 192, Ephemeral: on reboot entered. SSH session symmetric or 256 Plaintext in or power Derived No key key for SSH Bits; RAM cycle or during SSH encryption in Triple- when the negotiation. one direction DES: 112 ongoing HP TippingPoint SMS Non-Proprietary Security Policy Page 29 of 31 or 168 SSH Bits session ends. Zeroized on reboot Not or power Ephemeral: MAC key for entered. cycle or SSH Plaintext in integrity in 160 Bits Derived No when the integrity key RAM one direction during SSH ongoing negotiation. SSH session ends. 5.3 Access Control Policy The SMS allows controlled access to the SRDIs contained within it. The following table defines the access that the SMS services have to the SRDIs (i.e. R=read, W=write, Z=zeroize, D=delete). If no access is listed, the service does not use that SRDI. Table 10: Access Control Policy SSH DH pair, DH shared DRBG Entropy Input, C Directory Shared Secret SSH RSA and DSA key RNG seed and seed key Firmware load test key secret, session key, and TLS DH pair, master Operator passwords RADIUS and Active secret, session key, TLS RSA key pair Service / CSPs value, V value integrity key integrity key pair Enable/disable Full WZ WZ W Z WZ RZ WZ RZ FIPS mode Z View FIPS mode R R status View self-test R failure log file Configure own W R R password Configure any W R R operator‟s password and access level Add or delete users D R R W HP TippingPoint SMS Non-Proprietary Security Policy Page 30 of 31 Configure R R „password security level‟ and account lockout settings Install new WZ WZ R RZ Z firmware or W software patch Import or download R R non-cryptography relevant software package Activate or delete R R non-cryptography relevant software package Reboot WZ WZ RZ RZ Perform FIPS power-up self-tests Install new TLS RW R RSA key pair Login to CLI RW RW R R R RW (console and SSH) Login to SMS RW RW R R R RW Homepage Login to SMS RW RW R R R RW Client Configure non-FIPS R R related admin level settings Configure non-FIPS R R related super-user level settings View non-FIPS R R related configuration View non-FIPS R R related status 6 Mitigation of Other Attacks The cryptographic module does not claim to mitigate any other attacks in a FIPS- approved mode of operation. HP TippingPoint SMS Non-Proprietary Security Policy Page 31 of 31