FIPS 140-2 Security Policy v0.5 FireEye HX Series: HX 4400, HX 4400D, HX 4402, HX 9402 FireEye, Inc. FIPS 140-2 Non-Proprietary Security Policy Document Version: 1.0 Prepared By: Acumen Security 18504 Office Park Dr Montgomery Village, MD 20886 www.acumensecurity.net Phone: +1 (703) 375-9820 1 FIPS 140-2 Security Policy v1.0 Table of Contents 1. Introduction ........................................................................................................................4 1.1 Purpose.........................................................................................................................4 1.2 Document Organization ................................................................................................4 1.3 Notices ..........................................................................................................................4 2. FireEye HX Series: HX 4400, HX 4400D, HX 4402, HX 9402 ...................................................5 2.1 Cryptographic Module Specification..............................................................................6 2.1.1 Cryptographic Boundary ........................................................................................6 2.2 Cryptographic Module Ports and Interfaces ..................................................................7 2.3 Roles, Services, and Authentication...............................................................................8 2.3.1 Authorized Roles ....................................................................................................8 2.3.2 Authentication Mechanisms ..................................................................................8 2.3.3 Services ..................................................................................................................9 2.4 Physical Security .........................................................................................................13 2.5 Cryptographic Key Management .................................................................................14 2.6 Cryptographic Algorithm .............................................................................................17 2.6.1 FIPS-approved Algorithms ....................................................................................17 2.6.2 Non-Approved Algorithms Allowed for Use With FIPS-approved services ............19 2.6.3 Non-Approved Algorithms ...................................................................................19 2.7 Electromagnetic Interference / Electromagnetic Compatibility (EMI/EMC) .................21 2.8 Self-Tests ....................................................................................................................22 2.8.1 Power-On Self-Tests .............................................................................................22 2.8.2 Conditional Self-Tests ..........................................................................................22 2.8.3 Self-Tests Error Handling ......................................................................................22 2.9 Mitigation of Other Attacks .........................................................................................23 3. Secure Operation ..............................................................................................................24 3.1 Secure Distribution .....................................................................................................24 3.1.1 Firmware Distribution ..........................................................................................24 3.1.2 Hardware Distribution .........................................................................................24 3.2 Installation ..................................................................................................................24 3.3 Initialization ................................................................................................................24 3.3.1 Entering New Authentication Credentials ............................................................24 2 FIPS 140-2 Security Policy v1.0 3.3.2 Enable Trusted Platform Module .........................................................................24 3.3.3 Enable compliance configuration options ............................................................24 3.3.4 Enable FIPS 140-2 compliance ..............................................................................25 3.4 Management ..............................................................................................................25 3.4.1 SSH Usage ............................................................................................................25 3.4.2 TLS Usage.............................................................................................................26 3.5 Additional Information ................................................................................................26 Appendix A: Acronyms ..............................................................................................................27 3 FIPS 140-2 Security Policy v1.0 1. Introduction This is a non-proprietary FIPS 140-2 Security Policy for the FireEye HX Series: HX 4400, HX 4400D, HX 4402, and HX 9402. Below are the details of the product validated: Hardware Version: HX 4400, HX 4400D, HX 4402, HX 9402 Software Version #: 3.1.0 FIPS 140-2 Security Level: 1 1.1 Purpose This document was prepared as Federal Information Processing Standard (FIPS) 140-2 validation evidence. The document describes how the FireEye HX Series: HX 4400, HX 4400D, HX 4402, and HX 9402 meets the security requirements of FIPS 140-2. It also provides instructions to individuals and organizations on how to deploy the product in a secure FIPS- approved mode of operation. Target audience of this document is anyone who wishes to use or integrate this product into a solution that is meant to comply with FIPS 140-2 requirements. 1.2 Document Organization The Security Policy document is one document in a FIPS 140-2 Submission Package. In addition to this document, the Submission Package contains:  Vendor Evidence document  Finite State Machine  Other supporting documentation as additional references This Security Policy and the other validation submission documentation were produced by Acumen Security, LLC. under contract to FireEye, Inc. With the exception of this Non- Proprietary Security Policy, the FIPS 140-2 Submission Package is proprietary to FireEye, Inc. and is releasable only under appropriate non-disclosure agreements. 1.3 Notices This document may be freely reproduced and distributed in its entirety without modification. 4 FIPS 140-2 Security Policy v1.0 2. FireEye HX Series: HX 4400, HX 4400D, HX 4402, HX 9402 The FireEye HX Series: HX 4400, HX 4400D, HX 4402, and HX 9402 (the module) is a multi-chip standalone module validated at FIPS 140-2 Security Level 1. Specifically, the module meets the following security levels for individual sections in the FIPS 140-2 standard: Table 1 - Security Level for Each FIPS 140-2 Section # Section Title Security Level 1 Cryptographic Module Specification 1 2 Cryptographic Module Ports and Interfaces 1 3 Roles, Services, and Authentication 3 4 Finite State Model 1 5 Physical Security 1 6 Operational Environment N/A 7 Cryptographic Key Management 1 8 EMI/EMC 1 9 Self-Tests 1 10 Design Assurances 3 11 Mitigation Of Other Attacks N/A 5 FIPS 140-2 Security Policy v1.0 2.1 Cryptographic Module Specification The FireEye HX series appliances enable security operations teams to correlate network and endpoint activity. Organizations can automatically investigate alerts generated by FireEye Threat Prevention Platforms, log management, and network security products, apply intelligence from FireEye to continuously validate Indicators of Compromises on the endpoints and identify if a compromise has occurred and assess the potential risk. Further, organizations can quickly triage the incident to understand the details and contain compromised endpoints with a single click and contain compromised devices within a single click workflow. 2.1.1 Cryptographic Boundary The cryptographic boundary for the module is defined as encompassing the "top," "front," "left," "right," and "bottom" surfaces of the case and all portions of the "backplane" of the case. The following figures provide a physical depiction of the cryptographic module. Figure 1: FireEye HX 4400/4400D/4402 (top) and 9402 (bottom) 6 FIPS 140-2 Security Policy v1.0 2.2 Cryptographic Module Ports and Interfaces The module provides a number of physical and logical interfaces to the device, and the physical interfaces provided by the module are mapped to four FIPS 140-2 defined logical interfaces: data input, data output, control input, and status output. The logical interfaces and their mapping are described in the following table: Table 2 - Module Interface Mapping – HX 4400/HX 4400D/HX 4402/HX 9402 FIPS Interface Physical Interface Data Input (2x) 10/100/1000 BASE-T Ports (Network Monitoring) (2x) 10/100/1000 BASE-T Ports (Management) PS/2 Keyboard and Mouse Ports (2x) USB Ports Serial Port Data Output (2x) 10/100/1000 BASE-T Ports (Network Monitoring) (2x) 10/100/1000 BASE-T Ports (Management) DB15 VGA Port (2x) USB Ports Serial Port Control Input (2x) 10/100/1000 BASE-T Ports (Network Monitoring) (2x) 10/100/1000 BASE-T Ports (Management) PS/2 Keyboard and Mouse Ports (2x) USB Ports Serial Port Status Output (2x) 10/100/1000 BASE-T Ports (Network Monitoring) (2x) 10/100/1000 BASE-T Ports (Management) DB15 VGA Port (2x) USB Ports Serial Port Power Interface Power Port 7 FIPS 140-2 Security Policy v1.0 2.3 Roles, Services, and Authentication The following sections provide details about roles supported by the module, how these roles are authenticated and the services the roles are authorized to access. 2.3.1 Authorized Roles The module supports several different roles, including multiple Cryptographic Officer roles and a User role. Configuration of the module can occur over several interfaces and at different levels depending upon the role assigned to the user. There are multiple types of Cryptographic Officers that may configure the module, as follows:  Admin: The system administrator is a “super user” who has all capabilities. The primary function of this role is to configure the system.  Monitor: The system monitor has read-only access to some things the admin role can change or configure.  Operator: The system operator has a subset of the capabilities associated with the admin role. Its primary function is configuring and monitoring the system.  Analyst: The system analyst focuses on data plane analysis and possesses several capabilities, including setting up alerts and reports.  Auditor: The system auditor reviews audit logs and performs forensic analysis to trace how events occurred.  SNMP: The SNMP role provides system monitoring through SNMPv3. The Users of the module are the remote IT devices and remote management clients accessing the module via cryptographic protocols. These protocols include, SSH, TLS, and SNMPv3. 2.3.2 Authentication Mechanisms The module supports identity-based authentication. Module operators must authenticate to the module before being allowed access to services, which require the assumption of an authorized role. The module employs the authentication methods described in the table below to authenticate Crypto-Officers and Users. Unauthenticated users are only able to access the module LEDs and power cycle the module. Table 3 - Authentication Mechanism Details Role Type Of Authentication Authentication Strength Admin Password/Username All passwords must be between 8 and 32 characters. If (8) integers are used for an eight digit password, Monitor the probability of randomly guessing the correct Operator sequence is one (1) in 100,000,000 (this calculation is Analyst based on the assumption that the typical standard Auditor 8 FIPS 140-2 Security Policy v1.0 Role Type Of Authentication Authentication Strength SNMP American QWERTY computer keyboard has 10 integer digits. The calculation should be 10 ^ 8 = 100,000,000). Therefore, the associated probability of a successful random attempt is approximately 1 in 100,000,000, which is less than 1 in 1,000,000 required by FIPS 140-2. In order to successfully guess the sequence in one minute would require the ability to make over 1,666,666 guesses per second, which far exceeds the operational capabilities of the module. User Password/Username or RSA All passwords must be between 8 and 32 characters. Asymmetric Authentication If (8) integers are used for an eight digit password, the probability of randomly guessing the correct sequence is one (1) in 100,000,000 (this calculation is based on the assumption that the typical standard American QWERTY computer keyboard has 10 integer digits. The calculation should be 10 ^ 8 = 100,000,000). Therefore, the associated probability of a successful random attempt is approximately 1 in 100,000,000, which is less than 1 in 1,000,000 required by FIPS 140-2. In order to successfully guess the sequence in one minute would require the ability to make over 1,666,666 guesses per second, which far exceeds the operational capabilities of the module. When using RSA based authentication, RSA key pair has modulus size of 2048 bit, thus providing 112 bits of strength. Therefore, an attacker would have a 1 in 2^112 chance of randomly obtaining the key, which is much stronger than the one in a million chance required by FIPS 140-2. For RSA-based authentication, to exceed a 1 in 100,000 probability of a successful random key guess in one minute, an attacker would have to be capable of approximately 3.25X10^32 attempts per minute, which far exceeds the operational capabilities of the modules to support. 2.3.3 Services The services that are available to unauthenticated entities and the services that require operators to assume an authorized role (Crypto-Officer or User) are listed in the table below. 9 FIPS 140-2 Security Policy v1.0 Please note that the keys and Critical Security Parameters (CSPs) listed below use the following indicators to show the type of access required:  R (Read): The CSP is read  W (Write): The CSP is established, generated, or modified  Z (Zeroize): The CSP is zeroized Table 4 - Services Service Description Role Key/CSP and Type of Access  SSH to external Secure User DRBG entropy input (R)  DRBG Seed (R) IT device connection  DRBG V (R/W/Z) between an HX  DRBG Key (R/W/Z) and other  Diffie-Hellman Shared Secret (R/W/Z) FireEye  Diffie Hellman private key (R/W/Z) appliances using  Diffie Hellman public key (R/W/Z) SSH.  SSH Private Key (R/W/Z)  SSH Public Key (R/W/Z)  SSH Session Key (R/W/Z)  SSH Integrity Key (R/W/Z)  Administrative Secure remote Admin, Admin Password (R/W/Z)  Monitor Password (R/W/Z) access over SSH command line Monitor,  Operator Password (R/W/Z) appliance Operator,  Analyst Password (R/W/Z) administration Analyst,  Auditor Password (R/W/Z) over an SSH Auditor  DRBG entropy input (R) tunnel.  DRBG Seed (R)  DRBG V (R/W/Z)  DRBG Key (R/W/Z)  Diffie-Hellman Shared Secret (R/W/Z)  Diffie Hellman private key (R/W/Z)  Diffie Hellman public key (R/W/Z)  SSH Private Key (R/W/Z)  SSH Public Key (R/W/Z)  SSH Session Key (R/W/Z)  SSH Integrity Key (R/W/Z)  Administrative Secure remote Admin, Admin Password (R/W/Z)  Monitor Password (R/W/Z) access over GUI appliance Monitor,  Operator Password (R/W/Z) webGUI administration Operator,  Analyst Password (R/W/Z) over a TLS Analyst,  Auditor Password (R/W/Z) tunnel. Auditor  DRBG entropy input (R)  DRBG Seed (R)  DRBG V (R/W/Z) 10 FIPS 140-2 Security Policy v1.0 Service Description Role Key/CSP and Type of Access  DRBG Key (R/W/Z)  Diffie-Hellman Shared Secret (R/W/Z)  Diffie Hellman private key (R/W/Z)  Diffie Hellman public key (R/W/Z)  TLS Private Key (R/W/Z)  TLS Public Key (R/W/Z)  TLS Pre-Master Secret (R/W/Z)  TLS Session Encryption Key (R/W/Z)  Administrative Directly Admin, Admin Password (R/W/Z)  Monitor Password (R/W/Z) access over connected Monitor,  Operator Password (R/W/Z) serial console command line Operator,  Analyst Password (R/W/Z) and VGA appliance Analyst,  Auditor Password (R/W/Z) administration. Auditor  SNMPv3 Secure remote SNMP SNMP Session Key (R/W/Z)  SNMPv3 password (R/W/Z) SNMPv3-based system monitoring.  LDAP over TLS Secure remote User Admin Password (R/W/Z)  Monitor Password (R/W/Z) authentication  Operator Password (R/W/Z) via TLS protected  Analyst Password (R/W/Z) LDAP  Auditor Password (R/W/Z)  DRBG entropy input (R)  DRBG Seed (R)  DRBG V (R/W/Z)  DRBG Key (R/W/Z)  Diffie-Hellman Shared Secret (R/W/Z)  Diffie Hellman private key (R/W/Z)  Diffie Hellman public key (R/W/Z)  TLS Private Key (R/W/Z)  TLS Public Key (R/W/Z)  TLS Pre-Master Secret (R/W/Z)  TLS Session Encryption Key (R/W/Z)  Secure log TLS-based User DRBG entropy input (R)  DRBG Seed (R) transfer connection with  DRBG V (R/W/Z) a remote audit  DRBG Key (R/W/Z) server.  Diffie-Hellman Shared Secret (R/W/Z)  Diffie Hellman private key (R/W/Z)  Diffie Hellman public key (R/W/Z)  TLS Private Key (R/W/Z)  TLS Public Key (R/W/Z) 11 FIPS 140-2 Security Policy v1.0 Service Description Role Key/CSP and Type of Access  TLS Pre-Master Secret (R/W/Z)  TLS Session Encryption Key (R/W/Z)  Load Firmware Load new Admin Firmware Load public key (R/W/Z) firmware image  Zeroization via Perform Admin Admin Password (Z)  Monitor Password (Z) “compliance zeroization of all  Operator Password (Z) declassify persistent CSPs  Analyst Password (Z) zeroize” within the  Auditor Password (Z) Command module  SSH Private Key (Z)  SSH Public Key (Z)  SNMPv3 password (Z)  TLS Private Key (Z)  TLS Public Key (Z)  Show Status View the Admin, N/A operational Monitor, status of the Operator, module Analyst, Auditor  Status LED View status via Un-auth N/A Output the Modules LEDs.  Cycle Power/ Reboot of Admin, DRBG entropy input (Z)  DRBG Seed (Z) Perform Self- appliance. Monitor,  DRBG V (Z) Tests Operator,  DRBG Key (Z) Analyst,  Diffie-Hellman Shared Secret (Z) Auditor,  Diffie Hellman private key (Z) Un-auth  Diffie Hellman public key (Z)  SSH Session Key (Z)  SSH Integrity Key (Z)  SNMPv3 session key (Z)  TLS Pre-Master Secret (Z)  TLS Session Encryption Key (Z)  TLS Session Integrity Key (Z) R – Read, W – Write, Z – Zeroize 12 FIPS 140-2 Security Policy v1.0 2.4 Physical Security The modules are production grade multi-chip standalone cryptographic modules that meet Level 1 physical security requirements. 13 FIPS 140-2 Security Policy v0.5 2.5 Cryptographic Key Management The following table identifies each of the CSPs associated with the module. For each CSP, the following information is provided:  The name of the CSP/Key  The type of CSP and associated length  A description of the CSP/Key  Storage of the CSP/Key  The zeroization for the CSP/Key Table 5 - Details of Cryptographic Keys and CSPs Key/CSP Type Description Storage Zeroization DRBG entropy CTR 256-bit This is the entropy for SP 800-90 RNG. DRAM Device power cycle. input DRBG Seed CTR 256-bit This DRBG seed is collected from the onboard hardware DRAM Device power cycle. entropy source. DRBG V CTR 256-bit Internal V value used as part of SP DRAM Device power cycle. 800-90 CTR_DRBG. DRBG Key CTR 256-bit Internal Key value used as part of SP DRAM Device power cycle. 800-90 CTR_DRBG. Diffie-Hellman DH 2048 – 3072 The shared exponent used in Diffie-Hellman (DH) DRAM Device power cycle. Shared Secret bits exchange. Created per the Diffie-Hellman protocol. Diffie Hellman DH 2048 – 3072 The private exponent used in Diffie-Hellman (DH) DRAM Device power cycle. private key bits exchange. Diffie Hellman DH 2048 – 3072 The p used in Diffie-Hellman (DH) exchange. DRAM Device power cycle. public key bits SSH Private Key RSA (Private Key) The SSH private key for the module used for session NVRAM Overwritten w/ “00” 2048 – 3072 bits authentication. prior to replacement. SSH Public Key RSA (Public Key) The SSH public key for the module used for session NVRAM Overwritten w/ “00” 2048 – 3072 bits authentication. prior to replacement. SSH Session Key Triple-DES 192- The SSH session key. This key is created through SSH DRAM Device power cycle. bits key establishment. 14 FIPS 140-2 Security Policy v1.0 Key/CSP Type Description Storage Zeroization AES 128, 256 bits SSH Integrity Key HMAC-SHA1, The SSH data integrity key. This key is created through DRAM Device power cycle. HMAC-SHA-256 SSH key establishment. HMAC-512 SNMPv3 password Shared Secret, at This secret is used to derive HMAC-SHA1 key for NVRAM Overwritten w/ “00” least eight SNMPv3 Authentication. prior to replacement. characters SNMPv3 session AES 128 bits SNMP symmetric encryption key used to DRAM Device power cycle. key encrypt/decrypt SNMP traffic. TLS Private Key RSA (Private Key) This private key is used for TLS session authentication. NVRAM Overwritten w/ “00” 2048 – 3072 bits prior to replacement. ECDSA ( P-256 P- 384 P-521) TLS Public Key RSA (Private Key) This public key is used for TLS session authentication. NVRAM Overwritten w/ “00” 2048 – 3072 bits prior to replacement. ECDSA (P-256 P- 384 P-521) TLS Pre-Master Shared Secret, Shared Secret created using asymmetric cryptography DRAM Device power cycle. Secret 384 bits from which new TLS session keys can be created. TLS Session Triple-DES 192- Key used to encrypt/decrypt TLS session data. DRAM Device power cycle. Encryption Key bits AES 128, 256 bits TLS Session HMAC SHA-1 160 HMAC-SHA-1 used for TLS data integrity protection. DRAM Device power cycle. Integrity Key bits Firmware Load RSA 2048-bit RSA key used to validate the integrity of a downloaded NVRAM Overwritten w/ “00” Public Key firmware image. prior to replacement. Admin Password Shared Secret, Authentication password for the Admin user role. NVRAM Overwritten w/ “00” 15 FIPS 140-2 Security Policy v1.0 Key/CSP Type Description Storage Zeroization 8+ characters prior to replacement. Monitor Password Shared Secret, Authentication password for the Monitor user role. NVRAM Overwritten w/ “00” 8+ characters prior to replacement. Operator Password Shared Secret, Authentication password for the Operator user role. NVRAM Overwritten w/ “00” 8+ characters prior to replacement. Analyst Password Shared Secret, Authentication password for the Analyst user role. NVRAM Overwritten w/ “00” 8+ characters prior to replacement. Auditor Password Shared Secret, Authentication password for the Audit user role. NVRAM Overwritten w/ “00” 8+ characters prior to replacement. 16 FIPS 140-2 Security Policy v0.5 2.6 Cryptographic Algorithm 2.6.1 FIPS-approved Algorithms The following table identifies the FIPS-approved algorithms included in the module for use in the FIPS mode of operation. Table 6 – FIPS-approved Algorithms Cryptographic Algorithm CAVP Usage Cert. # Triple-DES 1941 Used for encryption of SSH and TLS sessions. TECB(KO 1 e/d, KO 2 d only); TCBC(KO 1 e/d, KO 2 d only); TCFB1(KO 1 e/d, KO 2 d only); (CAVP tested but not used by the module) TCFB8(KO 1 e/d, KO 2 d only); (CAVP tested but not used by the module) TCFB64(KO 1 e/d, KO 2 d only); (CAVP tested but not used by the module) TOFB(KO 1 e/d, KO 2 d only) (CAVP tested but not used by the module) AES 3447 Used for encryption of SSH, SNMP, and TLS sessions. Used in ECB (e/d; 128, 192, 256); support of FIPS-approved DRBG. CBC (e/d; 128, 192, 256); GCM (AES_128(e/d), AES_256(e/d)); Note: The module use of AES GCM (AES_192(e/d)); (CAVP tested but GCM complies with the not used by the module) Guidelines for the Selection, Configuration, and Use of CFB1 (e/d; 128, 192, 256); (CAVP tested Transport Layer Security (TLS) but not used by the module) Implementations defined in SP CFB8 (e/d; 128, 192, 256); (CAVP tested 800-52. but not used by the module) OFB (e/d; 128, 192, 256); (CAVP tested but not used by the module) CCM (KS: 128, 192, 256) (CAVP tested but not used by the module) HMAC-SHS 2195 Used for SSH and TLS traffic integrity. Used in support of SSH, HMAC-SHA1; SNMP, and TLS key derivation. HMAC-SHA224; HMAC-SHA256; 17 FIPS 140-2 Security Policy v1.0 HMAC-SHA384; HMAC-SHA512; SHS 2837, Used for SSH, SNMP, and TLS 2836 traffic integrity. Used in support SHA-1; of SSH, SNMP, and TLS key SHA-224; derivation. SHA-256; Firmware load test. SHA-384; SHA-512 RSA 1759, Used for SSH and TLS Session 1758 authentication. FIPS186-4: Firmware load test. 186-4 KEY(gen); ANSIX9.31 Sig(Gen): (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512)); ANSIX9.31 Sig(Ver): (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)); ANSIX9.31 Sig(Ver): (1024 SHA(1, 256, 384, 512)); (CAVP tested but not used by the module) RSASSA-PKCS1_V1_5: SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512)); RSASSA-PKCS1_V1_5: SIG(Ver) (2048 SHA(1, 224, 256, 384, 512)) (3072 SHA(1, 224, 256, 384, 512)) RSASSA-PKCS1_V1_5: SIG(Ver) (1024 SHA(1, 224, 256, 384, 512)) (CAVP tested but not used by the module) ECDSA 696 Used for TLS Session authentication. Supported curves FIPS186-4: include, P-256 P-384 P-521. PKG: CURVES(P-256 P-384 P-521 ExtraRandomBits TestingCandidates) PKV: CURVES(P-256 P-384 P-521) SigGen: CURVES(P-256: (SHA-224, 256, 384, 512) P-384: (SHA-224, 256, 384, 512) P-521: (SHA-224, 256, 384, 512) SigVer: CURVES(P-256: (SHA-1, 224, 256, 384, 512) P-384: (SHA-1, 224, 256, 384, 512) P-521: (SHA-1, 224, 256, 384, 512)) DRBG 843 Used in support of SSH and TLS sessions. Used to seed RSA key 18 FIPS 140-2 Security Policy v1.0 CTR_DRBG generation. CVL 533 SSH, TLS, and SNMP Key Derivation. TLS; Note: The TLS, SSH, and SNMP SSH; protocols have not been reviewed or SNMP; tested by the CAVP and CMVP. FFC Ephem: (KARole: Initiator/responder) 2.6.2 Non-Approved Algorithms Allowed for Use With FIPS-approved services The module implements the following non-Approved algorithms that are allowed for use with FIPS-approved services:  Diffie-Hellman – CVL Cert. #533, provides 112 or 128-bits of encryption strength. Diffie- Hellman with less than 112-bits of security strength is non-compliant and may not be used.  Elliptic Curve Diffie-Hellman – provides between 128 and 256-bits of encryption strength. Supported curves, include, P-256 P-384 P-521.  RSA Key Wrapping – provides 112 or 128 bits of encryption strength. RSA with less than 112-bits of security strength is non-compliant and may not be used.  Non-approved NDRNG for seeding the DRBG. 2.6.3 Non-Approved Algorithms The cryptographic module implements the following non-approved algorithms that are not permitted for use in FIPS 140-2 mode of operations: Table 7 – Non-Approved Algorithms Service Non-Approved Algorithm SSH* Hashing: MD5, MACing: HMAC MD5 Symmetric: DES Asymmetric: 1024-bit RSA, 1024-bit Diffie-Hellman TLS* Hashing: MD5, MACing: HMAC MD5 Symmetric: DES, RC4 Asymmetric: 1024-bit RSA, 1024-bit Diffie-Hellman SNMP* Hashing: MD5, MACing: HMAC MD5 Symmetric: DES, RC4 Asymmetric: 1024-bit RSA, 1024-bit Diffie-Hellman 19 FIPS 140-2 Security Policy v1.0 Note: Services marked with a single asterisk (*) may use non-compliant cryptographic algorithms. Use of these algorithms are prohibited in a FIPS-approved mode of operation. 20 FIPS 140-2 Security Policy v1.0 2.7 Electromagnetic Interference / Electromagnetic Compatibility (EMI/EMC) All HX appliances are FCC (Part 15 Class-A), CE (Class-A), CNS, AS/NZS, VCCI (Class A) certified. 21 FIPS 140-2 Security Policy v1.0 2.8 Self-Tests Self-tests are health checks that ensure that the cryptographic algorithms within the module are operating correctly. The self-tests identified in FIPS 140-2 broadly fall within two categories  Power-On Self-Tests  Conditional Self-Tests 2.8.1 Power-On Self-Tests The cryptographic module performs the following self-tests at Power-On:  Software integrity (SHA-256)  HMAC-SHA1 Known Answer Test  HMAC-SHA224 Known Answer Test  HMAC-SHA256 Known Answer Test  HMAC-SHA384 Known Answer Test  HMAC-SHA512 Known Answer Test  AES-128 ECB Encrypt Known Answer Test  AES-128 ECB Decrypt Known Answer Test  AES-GCM-256 Encrypt Known Answer Test  AES-GCM-256 Decrypt Known Answer Test  Triple-DES Encrypt Known Answer Test  Triple-DES Decrypt Known Answer Test  RSA Known Answer Test  ECDSA Known Answer Test  DRBG Known Answer Test 2.8.2 Conditional Self-Tests The cryptographic module performs the following conditional self-tests:  Continuous Random Number Generator Test (CRNGT) for FIPS-approved DRBG  Continuous Random Number Generator (CRNGT) for Entropy Source  Firmware Load Test (2048-bit RSA, SHA-256)  Pairwise Consistency Test (PWCT) for RSA  Pairwise Consistency Test (PWCT) for ECDSA 2.8.3 Self-Tests Error Handling If any of the identified POSTs fail, the module will not enter an operational state and will instead provide an error message and reboot. If either of the CRNGTs fail, the repeated random numbers are discarded and another random number is requested. If either of the PWCTs fail, the key pair or signature is discarded and another key pair or signature is generated. If the Firmware Load Test fails, the new firmware is not loaded. Both during execution of the self-tests and while in an error state, data output is inhibited. 22 FIPS 140-2 Security Policy v1.0 2.9 Mitigation of Other Attacks The module does not claim to mitigate any other attacks beyond those specified in FIPS 140. 23 FIPS 140-2 Security Policy v1.0 3. Secure Operation The following steps are required to put the module into a FIPS-approved mode of operation. 3.1 Secure Distribution The following activities ensure secure distribution and delivery of the module: 3.1.1 Firmware Distribution The module firmware is distributed via secure download from FireEye. When newly downloaded firmware is loaded, the module performs a firmware load test verifying the integrity of the image. 3.1.2 Hardware Distribution The module hardware is shipped in sealed boxes. This boxes will indicate any tampering during the delivery process. Upon delivery, the recipient must inspect the package the module is delivered in to verify that there has been no tampering. 3.2 Installation There are no FIPS 140 specific hardware installation steps required. 3.3 Initialization 3.3.1 Entering New Authentication Credentials The initial power on of the appliance, the CO will be prompted create a new “Admin” administrator with authentication credentials. 3.3.2 Enable Trusted Platform Module Enable the on board TPM which is used as an entropy source for the implemented FIPS- approved DRBG. 1. Enter the CLI configuration mode: hostname > enable hostname # configure terminal 2. Check if the TPM is present and enabled. hostname (config) # show tpm 3. Enable the TPM: hostname (config) # tpm enable 4. After reading the warning, select yes to continue. 5. Restart the appliance. 3.3.3 Enable compliance configuration options Perform the following steps to enable FIPS 140-2 configuration options on the webUI. 1. Enter the CLI configuration mode: hostname > enable hostname # configure terminal 24 FIPS 140-2 Security Policy v1.0 2. Enable the compliance configuration options on the webUI: compliance options webui enable 3.3.4 Enable FIPS 140-2 compliance There are two methods to enable FIPS 140-2 compliance on the appliance. Compliance may be enabled either through the webUI or through the CLI. Perform the following to enable FIPS 140- 2 compliance through the webUI. 1. On the Web UI, select the Settings tab. 2. Select Compliance on the sidebar. 3. Click Enable FIPS Compliance. 4. Click Save changes to continue. 5. Click Reboot Now Alternatively, perform the following to enable FIPS 140-2 compliance through the CLI. 1. Enable the CLI configuration mode: hostname > enable hostname # configure terminal 2. Bring the system into FIPS 140-2 compliance: hostname (config) # compliance apply standard fips 3. Save your changes: hostname (config) # write memory 4. Restart the appliance: hostname (config) # reload 5. Verify that the appliance is compliant: hostname (config) # show compliance standard fips 3.4 Management 3.4.1 SSH Usage When in FIPS 140-2 compliance mode, only the following algorithms may be used for SSH communications, 3.4.1.1 Symmetric Encryption Algorithms: 1. 3DES_CBC 2. AES_128_CBC 3. AES_128_GCM 4. AES_256_CBC 5. AES_256_GCM 3.4.1.2 KEX Algorithms: 1. diffie-hellman-group14-sha1 25 FIPS 140-2 Security Policy v1.0 3.4.1.3 Message Authentication Code (MAC) Algorithms: 1. hmac-sha1 2. hmac-sha2-256 3. hmac-sha2-512 3.4.2 TLS Usage When in FIPS 140-2 compliance mode, only the following ciphersuites may be used for TLS communications, 1. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 2. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 3. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 4. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 5. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 6. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 7. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 8. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 9. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 10. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 11. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 12. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 13. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 14. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 15. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 16. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 17. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 18. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 19. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 20. TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 21. TLS_RSA_WITH_AES_128_GCM_SHA256 22. TLS_RSA_WITH_AES_256_GCM_SHA384 23. TLS_RSA_WITH_AES_128_CBC_SHA256 24. TLS_RSA_WITH_AES_256_CBC_SHA256 25. TLS_RSA_WITH_AES_128_CBC_SHA 26. TLS_RSA_WITH_AES_256_CBC_SHA 27. TLS_RSA_WITH_3DES_EDE_CBC_SHA When the module’s power is lost and then restored, a new TLS key for use with the AES GCM encryption/decryption is established. 3.5 Additional Information For additional information regarding FIPS 140-2 compliance, see the “FireEye FIPS 140-2 and Common Criteria Addendum, Release 1.0.” 26 FIPS 140-2 Security Policy v1.0 Appendix A: Acronyms This section describes the acronyms used throughout the document. Table 8 - Acronyms Acronym Definition CMVP Cryptographic Module Validation Program CRNGT Continuous Random Number Generator Test CSE Communications Security Establishment CVL Component Validation List FIPS Federal Information Processing Standard KDF Key Derivation Function NIST National Institute of Standards and Technology NVRAM Non-Volatile Random Access Memory POST Power-On Self-Test PWCT Pairwise Consistency Test 27