Non-Proprietary Security Policy, Version 1.0
June 29, 2006
Secure Computing SafeWord SecureWire 500 and SafeWord SecureWire 2500 Identity and
Access Management Appliances
Page 16 of 30
© 2006 Secure Computing Corporation This document may be freely reproduced and distributed whole and intact including
this copyright notice.
Service
Description
Input
Output
CSP and Type of
Access
IPSec
Establish an IPSec
session and
authenticate an
operator with digital
certificates or pre-
shared, if configured.
IPSec handshake
parameters, IPSec
inputs
IPSec outputs
IPSec session keys -
Read/Write
Pre-shared keys -
Read
DSA/RSA private
keys - Read
DSA/RSA public
keys - Read/Write
1.3.4
Authentication Mechanisms
The Crypto-Officers are able to access the module over a TLS or SSH session, or through a directly connected
console port. On top of these protocols, Crypto-Officers authenticate using user IDs (UIDs) and passwords. The
Users are able to access the module over a TLS session or through an IPSec tunnel. On top of these mechanisms,
Users authenticate using user IDs (UIDs) and passwords, and the authentication may be performed internally using a
local database or via a 3rd party authentication mechanism, such as Radius 3rd party. Network Users authenticate
during IPSec via pre-shared keys or digital certificates.
Table 7 - Authentication Mechanisms
Authentication Type
Strength
Passwords
Considering a case sensitive alphanumeric password with repetition, the total
possible combinations for the password are 62^6. The probability for a random
attempt to succeed is 1:62^6 or 1:56800235584, and, since this authentication
attempt is additionally piped over an encrypted session, it is not possible to
perform enough authentication attempts to reduce the 1:62^6 chance per
attempt to 1:100,000 over a minute.
Pre-shared Keys
Considering a case sensitive alphanumeric pre-shared key with repetition, the
total possible combinations for the pre-shared key are 62^16. The probability
for a random attempt to succeed is 1:62^16 or 1:
47672401706823533450263330816, and it is not possible for an operator to
perform enough authentication attempts to reduce the 1: 62^16 chance per
attempt to 1:100,000 over a minute.
Public key certificates
Using conservative estimates equating a 1024 bit DSA/RSA key to an 80 bit
symmetric key, the probability for a random attempt to succeed is 1:2^80 or
1:1208925819614629174706176, and it is not possible for an operator to
perform enough authentication attempts to reduce the 1: 2^80 chance per
attempt to 1:100,000 over a minute
1.3.5
Unauthenticated Services
The module has a limited set of unauthenticated services, which are only available through local access to the
module using the SDM. (Although a password can be configured for authentication through the SDM during boot,
this is not required nor deemed security-relevant as the services provided by the SDM are meant to be
unauthenticated and FIPS 140-2 does not require a password to be entered for booting a module.)