FIPS 140-2 Non-Proprietary Security Policy: IBM Security XGS 3100, XGS 4100, XGS 5100, and XGS 7100
Document Version 0.6
© IBM Security
Page 33 of 50
2.10 Self-Tests
The modules include an array of self-tests that are run during startup and periodically during operations to prevent any secure data from being
released and to ensure all components are functioning correctly. In the event of any self-test failure, the modules will output an error dialog and
will shut down. When a module is in an error state, no keys or CSPs will be output and the module will not perform cryptographic functions.
The module does not support a bypass function.
The following sections discuss the modules' self-tests in more detail.
2.10.1 Power-On Self-Tests
Power-on self-tests are run upon every initialization of each module and do not require operator intervention to run. If any of the tests fail, the
module will not initialize. The module will enter an error state and no services can be accessed by the users. Each module implements the
following power-on self-tests:
·
Critical functions test: Checks, identifies, and initializes system devices such as the CPU, RAM, interrupt and DMA controllers and other
parts of the chipset, BIOS FW integrity, video display memory, Storage drive, PCIe bus, network cards. System high-level POST issues are
reported to the BMC, where the events are logged into the SEL.
·
Module integrity check for OpenSSL and components other than GSKit are by digital signature verification based on a 3072-bit CAVS-
validated RSA public key using SHA-256 hashing. The signatures are created when the modules are created by IBM. Signature verification
is done performed before module initialization (part of system load procedure).
·
Module integrity check for the GSKit cryptographic library is via 2048-bit CAVS-validated RSA public key (PKCS#1.5) and a single HMAC
SHA-1 digest calculated over the module at the time it is created. This RSA public key is stored inside the static stub and relies on the
operating system for protection. Self-test and library verification is performed at library load by hooking the shared library's `call on load'
entry points.
OpenSSL Implementation
Algorithm
Type
Description