Northrop Grumman M5 Network Security SCS Linux Kernel Cryptographic Services FIPS Security Policy Version 2.42 www.northropgrumman.com/m5/ Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. SCS Linux Kernel Cryptographic Services – Security Policy Version 2.42 20 March 2014 Modification History Version 1.0 15 May 2012 Initial Version Version 1.1 14 Dec 2012 Revised version Version 2.0 7 Feb 2013 Major revisions Version 2.1 13 may 2013 Post VOR Version 2.2 26 June 2013 Revised after input from BAE Detica Version 2.3 6 August 2013 Revised after input from BAE Detica Version 2.3.2 17 August 2013 Revised after input from BAE Detica Version 2.3.3 22 October2013 Revised after input from BAE Detica Version 2.3.4 11 November 2013 Added cross reference to software list Version 2.4 27 February 2014 Changes required by VOR CP-12025-VOR-003 18 February 2014 Version 2.4.1 8 March 2014 Minor changes Version Version 2.4.2 20 March 2014 remove AES GCM from approved security functions Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. Table of Contents Contents Table of Contents .............................................................................................................................. 3 1. References................................................................................................................................. 5 2. Introduction .............................................................................................................................. 5 SCS-100 ......................................................................................................................................... 6 SCS-200 ......................................................................................................................................... 6 3. Kernel Module Specification .......................................................................................................... 7 3.1 Version .................................................................................................................................... 7 3.2 Overview ................................................................................................................................. 7 4 Detailed Kernel Module specification......................................................................................... 9 5. Roles and Services ......................................................................................................................... 9 5.1 Description......................................................................................................................... 9 5.1.1 Approved allowed services ....................................................................................... 10 5.1.2 Non Approved services ........................................................................................ 11 6 Ports and Interfaces ...................................................................................................................... 12 6.1 Description ............................................................................................................................ 12 7 Self-tests ...................................................................................................................................... 13 7.1 Algorithm Self-tests ............................................................................................................... 13 7.2 Software Integrity Self-tests ................................................................................................... 13 7.3 Software Continuous Self-tests .............................................................................................. 14 7.4 Power-on Self-tests ................................................................................................................ 14 8 Mitigation of Other Attacks .......................................................................................................... 14 9 Physical Security ........................................................................................................................... 15 10 Operational Environment ........................................................................................................... 15 11. Cryptographic Key Management ................................................................................................ 15 11.1 Key Generation .................................................................................................................... 15 11.2 Key Storage .......................................................................................................................... 15 11.3 Key Zeroisation .................................................................................................................... 15 11.4 Key Usage ............................................................................................................................ 15 12. Guidance ................................................................................................................................... 15 12.1 User Guidance ..................................................................................................................... 15 Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 12.2 Crypto Officer Guidance ....................................................................................................... 16 13 Cryptographic Algorithms ........................................................................................................... 16 14 Electromagnetic Interference / Electromagnetic Compatibility (EMI/EMC) compliance ............ 17 Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 1. References The following documents are relevant to the security policy: a. SCS Linux Kernel Cryptographic Services - FIPS User Guide, version 2.4, dated 11 November 2013 b. The SCS Linux Kernel Cryptographic Services Software List V1.1, dated 11 November 2013 2. Introduction This document is the Security Policy for the M5 Networks SCS Kernel Cryptographic Services module version kernel-PAE-2.6.32.14-127.scs.fips.fc12.i686. This document was prepared as part of the Federal Information Processing standard (FIPS) 140-2 Level 1 validation process. Northrop Grumman M5 Network Security is a fully owned subsidiary of Northrop Grumman Corporation. FIPS 140-2, Security Requirements for Cryptographic Modules, describes the requirements for cryptographic modules. For more information about the FIPS 140-2 standard and the cryptographic module validation process see http://csrc.nist.gov/cryptval/. The claimed validation levels for each section of the FIPS 140-2 standard are as follows FIPS 140-2 Section Title Validation Level Cryptographic Module Specification 1 Cryptographic Module Ports and Interfaces 1 Roles, Services, and Authentication 1 Finite State Model 1 Physical Security N/A Operational Environment 1 Cryptographic Key Management 1 Electromagnetic Interference / Electromagnetic Compatibility 1 Self-Tests 1 Design Assurance 1 Mitigation of Other Attacks N/A Table 1 Claimed validation levels for each section of the FIPS 140-2 standard . Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. The SCS family of products is as follows. SCS-100 The SCS-100’s small and lightweight form factor is designed to allow a single user access to highly secure, classified and unclassified networks simultaneously from anywhere in the world. To ensure highly reliable communications, the SCS-100 establishes simultaneous connections via Wi-Fi, 3G/4G, BGAN satellite, Ethernet and ADSL. The user can direct the SCS-100 to select the best performing, the cheapest or load balance multiple communications bearers. An intuitive touch screen interface, with pre-saved scenarios, allows the end user to easily configure the system on-site without the need to travel with technical specialists SCS-200 The SCS-200 is a break-through in highly secure mobile environments, allowing mobile users to connect to secure networks using any IP network for transport. Its small and lightweight form factor is designed to allow one to four users access to highly secure, classified and unclassified networks simultaneously from anywhere in the world. To ensure highly reliable communications, the SCS-200 supports multiple concurrent networks via Wi- Fi, 3G, Satellite, Ethernet and ADSL. Two intuitive touch screen interfaces allow the end user to easily configure the system on-site without the need for expensive technical specialists. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 3. Kernel Module Specification 3.1 Version The SCS Linux Kernel Cryptographic Services module evaluated version is kernel-PAE-2.6.32.14- 127.scs.fips.fc12.i686 3.2 Overview The SCS Linux Kernel Cryptographic Services module is a software only, cryptographic module, running on a multi-chip standalone platform. It has been evaluated to FIPS level 1 certification. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 3.2.1 Hardware Block Diagram Crypto Boundary Real Time RAM Clock a,b Ethernet Network I/O ROM CPU Compact Flash c Power supply Power Interface b,c LEGEND a Data in b Data out c Status Out Display Figure 1: Hardware Security boundaries 3.2.2 Software Block Diagram Control Control API Call response Control API call Status Data Memory Logical Cryptographic Boundary Network IPSEC,ESP(CT),PT ` CT,PT TCP/ IP Kernel Crypto Library stack PT,CT Network PT, IPSEC-ESP(CT) Data Figure 2: Security boundaries Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 4 Detailed Kernel Module specification The SCS Linux Kernel Cryptographic Services (hereafter referred to as the Kernel Module) is a software library supporting FIPS-approved cryptographic algorithms. This module provides a C- language application program interface (API) for use by other processes that require cryptographic functionality. The data structures used by the API logically separate the control and data components. A HMAC SHA-256 based integrity check ‘fipscheck’ also forms part of the cryptographic module. It is invoked automatically at boot time and uses the OpenSSL FIPS Object Module V2.0 (cert #1747) to perform the HMAC SHA-256 operation. The SCS Linux Kernel Module (Version kernel-PAE-2.6.32.14-127.scs.fips.fc12.i686) is based on the Fedora 12 (Linux 2.6.32 kernel) on Intel X86 based hardware. The hardware provides at least 2 Ethernet interfaces and optionally WiFi, 3G/4G and ADSL network interfaces. For FIPS 140-2 purposes the Kernel Module is classified as a multi-chip standalone module. The hardware Kernel module boundary is indicated in figure1. The Kernel module provides an API to allow other Kernel based consumers to utilise its services. The physical cryptographic boundary of the Kernel Module is the enclosure of the computer system on which it is executing i.e. the SCS-100 and SCS-200. If the contents of the virtual file /proc/sys/crypto/fips_enabled equals 1 the Kernel module is operating in a FIPS approved mode. The contents of this file cannot be changed, it reflects the value of the internal kernel parameter ‘fips_enabled’ which is set by the presence of the fips=1 flag as a kernel argument at boot time. The Kernel module has been tested in the following systems  The M5 Network security model SCS-100  The M5 Network security model SCS-200 5. Roles and Services 5.1 Description The Kernel Module meets all FIPS 140-2 level 1 requirements for Roles and Services, implementing both Crypto-User and Crypto-Officer roles. As allowed by FIPS 140-2, the Kernel Module does not support user authentication for those roles. Only one role may be active at a time and the Kernel Module does not allow concurrent operators. The User and Crypto Officer roles are implicitly assumed by the entity accessing services implemented by the Kernel Module. The Crypto Officer can install and initialize the Kernel Module. The Crypto Officer role is implicitly entered when installing the Kernel Module or performing system administration functions on the host operating system. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved.  User Role o symmetric encryption and decryption o encode /decode o random number generation o Keyed Hash (HMAC) o Hash o zeroise  Crypto-Officer Role: o Integrity check o Show status o Initiate self-tests 5.1.1 Approved allowed services Service Role CSP / Alg / Mode API Call Access Symmetric User Key All API functions with the prefix Read / encryption/decryption of crypto_cipher_, write / Triple DES crypto_ablkcipher_ and execute crypto_blkcipher_ ECB,CBC crypto_free_ablkcipher crypto_has_ablkcipher ablkcipher_request_set_tfm ablkcipher_request_free ablkcipher_request_set_callback ablkcipher_request_set_crypt crypto_free_blkcipher crypto_has_blkcipher Encode/decode User Key All API functions with the prefix Read / of crypto_cipher_, write / AES 128/192/256 crypto_ablkcipher_ and execute crypto_blkcipher_ ECB, CBC, CTR, crypto_free_ablkcipher RFC3686, CCM crypto_has_ablkcipher ablkcipher_request_set_tfm ablkcipher_request_free ablkcipher_request_set_callback ablkcipher_request_set_crypt crypto_free_blkcipher crypto_has_blkcipher Keyed Hash (HMAC) User HMAC key All API functions with the prefix of Read / crypto_hmac_ write / HMAC-SHA-1 crypto_free_hash execute HMAC SHA-224, HMAC SHA-256, HMAC SHA-384, HMAC SHA-512 Hash User NA All API functions with the prefix of Read / crypto_has write / Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. SHA-1 crypto_free_hash execute SHA-224, SHA-256, SHA-384, SHA-512 Random number User Seed, key All API functions with the prefix Read / generation of crypto_rng_ write / ANSI X9.31, crypto_alloc_rng execute AES-128 crypto_free_rng NB if the RNG is initialised with an identical key and seed, the seed is XOR’d with a fixed 16 byte value. Zeroise User Seed, key All API functions with the prefix of Read / crypto_free_ write Integrity Check Crypto HMAC Key fipscheck userspace program. It uses the Read / Officer OpenSSL FIPS Kernel Module to check: execute  The Kernel Module binary and HMAC SHA-256 library  The Kernel binary (containing the self-check code for the ‘Linux Kernel Cryptographic services Module’). This is run at boot time. Self-test Crypto See section 12.2 execute Officer Show Status Crypto Global status variable fips_enabled read Officer See section 12.2 Table 2: Approved services Kernel Module 5.1.2 Non Approved services Service Role CSP / Alg / Mode API Call Access Symmetric User Key All API functions with the prefix Read / of crypto_cipher_, encryption/decryption write / crypto_ablkcipher_ and DES execute crypto_blkcipher_ crypto_free_ablkcipher CTR, ECB,CBC crypto_has_ablkcipher ablkcipher_request_set_tfm ablkcipher_request_free ablkcipher_request_set_callback ablkcipher_request_set_crypt crypto_free_blkcipher crypto_has_blkcipher Symmetric User Key All API functions with the prefix Read / encryption/decryption of crypto_cipher_, write / Triple DES crypto_ablkcipher_ and execute crypto_blkcipher_ Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. CTR crypto_free_ablkcipher (non-compliant) crypto_has_ablkcipher ablkcipher_request_set_tfm ablkcipher_request_free ablkcipher_request_set_callback ablkcipher_request_set_crypt crypto_free_blkcipher crypto_has_blkcipher Encode/decode User Key All API functions with the prefix Read / of crypto_cipher_, write / AES 128/192/256 crypto_ablkcipher_ and execute crypto_blkcipher_ GCM (Non- crypto_free_ablkcipher compliant) crypto_has_ablkcipher ablkcipher_request_set_tfm ablkcipher_request_free ablkcipher_request_set_callback ablkcipher_request_set_crypt crypto_free_blkcipher crypto_has_blkcipher Note that while these functions are provided by the API they should not be used. 6 Ports and Interfaces 6.1 Description The physical ports of the Kernel Module are the same as the computer system on which it is executing. The logical interface is a C-language application program interface (API). The Data Input interface consists of the input parameters of the API functions. The Data Output interface consists of the output parameters of the API functions. The Control Input interface consists of the actual API functions and the Kernel command line. The Status Output interface includes the return values of the API functions. FIPS Interface Module Interface Data Input API input parameters Data Output API output parameters Control Input API function calls Kernel command line Status Output API return codes Kernel log Table 3 Kernel Module Ports and interfaces Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 7 Self-tests The Module performs both power-up self-tests at module initialization and continuous condition tests during operation. If a self test fails, a kernel panic will be triggered. This results in a simple message on the screen and no further operation without a restart. 7.1 Algorithm Self-tests Whenever a crypto algorithm is loaded into memory the algorithm is tested by the core code of the cryptographic service module. If any of the tests fail a kernel panic is triggered. This can only be recovered by the user by resetting the system. The Kernel Module self-tests are listed in Table 4. Algorithm Test AES (128,192,256) ECB, CBC, CTR, RFC3686, CCM KAT (encrypt and decrypt) Triple-DES ECB,CBC KAT(encrypt and decrypt) ANSI X9.31 Cryptographic PRNG (AES128) KAT HMAC-SHA-1 KAT HMAC-SHA-224 KAT HMAC-SHA-256 KAT HMAC-SHA-384 KAT HMAC-SHA-512 KAT SHA-1 KAT SHA-224 KAT SHA-256 KAT SHA-384 KAT SHA-512 KAT Table 4: Algorithm self-tests (NB: KAT= Known Answer Test) 7.2 Software Integrity Self-tests During boot a software integrity test is performed on the main kernel binary. Once the main kernel binary is checked, each algorithm module has its integrity verified before being loaded into the running kernel, thus triggering its known answer tests. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. The integrity tests are a HMAC SHA-256 initiated with the tool fipscheck. If the fipscheck program returns an error then the boot process will trigger a kernel panic. The only method to proceed is to reboot the device. The HMAC SHA-256 is performed using the FIPS certified OpenSSL FIPS Object Module V2 (cert #1747) built in accordance with the instructions in the security policy. When the OpenSSL FIPS Object Module is initialised, it will run its own self checks. These include a HMAC SHA-1 integrity check of the software and a known answer test of the HMAC SHA-256 algorithm. If the OpenSSL checks pass then the fipscheck program start its own integrity checks with a HMAC SHA-256. First it checks its library file, then it checks its own binary, finally it checks the kernel binary or module it was invoked to check. If any of these checks fail the program will return an error. That error will in turn trigger a kernel panic and the only way to proceed is to reboot the device. Subject Algorithm fipscheck library HMAC SHA 256 (from OpenSSL Library) fipscheck program HMAC SHA 256 (from OpenSSL Library) Linux Kernel binary HMAC SHA 256 (from OpenSSL Library) Table 5: Software verification self-tests 7.3 Software Continuous Self-tests Each 128 bit block of generated random data is compared against the previous block to ensure that the generator is not repeating. On error the Kernel will panic and the only way to proceed is to restart the Kernel module. 7.4 Power-on Self-tests Whenever the computer boots the power-on self-test will be run without any further intervention from the user. The start-up process will first determine the kernel binary file. Next it will run the software integrity self-tests described at 7.2 on the kernel binary. If those tests do not pass a ‘kernel panic’ will be triggered. If the software integrity self-tests pass, then the start-up process will then load each algorithm module in turn. As each module is loaded, its associated algorithm self test will be performed. If an algorithm self test fails a ‘kernel panic’ will be triggered. 8 Mitigation of Other Attacks The Kernel Module does not contain additional security mechanisms beyond the requirements for FIPS 140-2 level 1 cryptographic modules. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. 9 Physical Security The Kernel Module is comprised of software only and thus does not claim any physical security. 10 Operational Environment No debugging tools should be used in the operating environment while in FIPS mode. The Kernel Module requires that the operating system is restricted to a single operator mode and that the kernel component making the calls to the cryptographic module is the only user of that module. 11. Cryptographic Key Management 11.1 Key Generation The module performs no key generation, however it does provide a Cryptographic PRNG that implements ANSI X9.31 Appendix A.2.4 using AES-128 that users can utilise for key generation. 11.2 Key Storage Keys are not stored by the Kernel Module. The operating system and memory management features of the X86 CPUs protect keys in memory from unauthorised access. Setting of keys is a distinct API call, separate to encrypt/decrypt operations ensuring that keys and data cannot be mixed. 11.3 Key Zeroisation When cryptographic objects are freed with the API calls, the memory locations are first overwritten with zeros before returning to the calling function. Note that the integrity check key used to verify the kernel binary is external to the Kernel Module and stored within the fipscheck binary. It cannot be zeroised in this fashion. 11.4 Key Usage Key usage is done by the calling program. There is no manual entry capability as key entry is done solely by the API. 12. Guidance 12.1 User Guidance The Kernel Module implements the Triple DES CTR (Non-compliant) and AES GCM (Non-compliant) algorithms but these should not be used. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. DES algorithm to support the 3DES cryptographic operations only. It is not to be used to support single DES encryption. All memory allocation and de-allocation of the crypto data structures shall be performed using the methods provided by the Kernel Module API. The content of these data structures should not be made available to user space using copy_to_user() or any other method. To use the two-key Triple-DES algorithm to encrypt data or wrap keys in an Approved mode of operation, the module operator shall ensure that the same two-key Triple-DES key is not used for encrypting data (or wrapping keys) with more than 220 plaintext data (or plaintext keys). 12.2 Crypto Officer Guidance The system operates in FIPS mode if the kernel is started with the command line flag ‘fips=1’. The presence of this flag at kernel start sets an internal variable ‘fips_enabled’ to the value 1. This variable cannot be changed. The current setting can be observed by reading a virtual file provide for this purpose with the command: cat /proc/sys/crypto/fips_enabled The crypto officer can change the value of this flag to be used in future boots but cannot change the current status. The full procedure for changing the flag and preparing the system to operate in FIPS mode is documented in the User Guide (Reference A). While the key step is adding the ‘fips=1’ flag to the command line, failure to follow all the steps will likely result in a device that fails the self-tests and does not boot. The crypto officer can also trigger a re-run of the Kernel Module algorithm self-tests listed in the table at 3 by running the command: modprobe tcrypt modprobe –r tcrypt If the tests fail then a ‘kernel panic’ will be triggered, and all operation will cease. A listing of expected output after a successful test can be found in Reference A. 13 Cryptographic Algorithms The Kernel Module supports the following FIPS approved or allowed algorithms: Algorithm Validation Certificate Usage AES #2604 encrypt/decrypt 3DES #1569 encrypt/decrypt RNG (ANSI #1232 random number X9.31 Appendix A.2.4 generation using AES) Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. SHA-1 #2188 hashing SHA-224 #2188 hashing SHA-256 #2188 hashing SHA-384 #2188 hashing SHA-512 #2188 hashing HMAC-SHA-1 #1612 message integrity HMAC-SHA224 #1612 message integrity HMAC-SHA256 #1612 message integrity HMAC-SHA384 #1612 message integrity HMAC-SHA512 #1612 message integrity Open SSL HMAC- #1126 message integrity SHA256 Table 6: Kernel Module approved Cryptographic algorithms The Kernel Module supports the following non-FIPS approved algorithms: Algorithm Usage Keys/CSPs DES Symmetric encryption DES key 56 bits 3DES CTR (Non Compliant) Symmetric encryption 2 or 3 DES keys 56 Bits AES GCM (Non Compliant) Symmetric encryption 128/192/256 bits Table 7: Kernel Module non-approved Cryptographic algorithms The Kernel Module supports the following non cryptographic functions: Function Usage Deflate Compression routine Null Compression Dummy Compression routine Table 8: Non cryptographic functions supported 14 Electromagnetic Interference / Electromagnetic Compatibility (EMI/EMC) compliance The SCS-100 and SCS-200 devices have been tested and certified as compliant with the requirements of CISPR22: 2008 Ed 6 (Accepted by the FCC as equivalent to 47 CFR, Part 15, Subpart B, Unintentional Radiators, Digital Devices, Class A. EMC Test report Number M121137 dated 3rd December 2012 for the SCS-100 and EMC report Number M130318-1 dated the 5th of June 2013 for the SCS-200 refer. Copyright © 2014 Northrop Grumman M5 Network Security. All rights reserved.