Table of Contents

FIPS Operation

This chapter describes how to use the Secure Content Accelerator in FIPS Mode for FIPS 140-2-compliant operation. This chapter contains the following sections:

• FIPS Capabilities
  
  
• Using FIPS Mode
  
  
• Command Changes
  
  
• Returning to Normal Operation
  
  
• More Information
  
  

FIPS Capabilities

The Secure Content Accelerator configuration manager is used in FIPS-Compliant Mode ("FIPS Mode") to create and configure FIPS-compliant servers. When operating in FIPS Mode, the Secure Content Accelerator supports FIPS-compliant security. Among the FIPS-compliant features of the Secure Content Accelerator are the following:

• Only FIPS-approved algorithms are supported (DES and 3DES with SHA).
  
  
• A server using any other algorithms is disabled in FIPS Mode and cannot be used or configured.
  
  
• Only FIPS-compliant servers can be used when the device is operated in FIPS Mode. Non-FIPS 104-2-compliant servers can be configured for compliance.
  
  
• Management is available only via a serial connection.
  
  
• Passwords at least eight characters in length are required at both access and configuration levels.
  
  
• Commands that do not support FIPS-compliant security measures are disabled in FIPS Mode.
  
  
• The command prompt contains the text "[FIPS]" to indicate the device is operating in FIPS Mode.
  
  

Caution   To ensure the security of SSL sessions, you must use your own keys and certificates. The default keys and certificates preloaded on the device are intended for testing purposes only.

Using FIPS Mode

FIPS Mode acts as a filtering system, allowing only FIPS Level 2-compliant SSL objects to be used for data transfer. Entering FIPS Mode is a two-step process: starting the FIPS Mode process and rebooting the device in FIPS Mode.

SCA> enable
SCA#
 

SCA# fips enable
 

Enabling FIPS mode will cause a restart of the device.
Entering FIPS mode will also change the behavior of the device.
	Only FIPS-approved algorithms are supported.
	Only FIPS-compliant servers can be used.
	Management is available only via the serial console.
	Passwords must be at least eight characters long.
	Firmware signature verification is enabled.
	Some commands are not supported.
Are you sure you want to do this? (y/n) [n]
 

4. The Secure Content Accelerator checks access- and enable-level passwords previously set, if any. The display reflects the state of current passwords:

---

Note   FIPS Mode passwords must be at least eight characters in length and are limited to a character set containing the alphabet, Arabic numerals, period (.), hyphen (-), underscore (_), and !@#$%^&*+=[]{};:<>?~ .

---

a. If no passwords had been set previously, this text is displayed:

You need to provide an access-level password of at least 8 characters.
Enter new password:
Confirm password:
You need to provide an enable-level password of at least 8 characters.
Enter new password:
Confirm new password:
 

---

Note   Passwords are not echoed to the screen. These passwords are not FIPS-specific and are prompted for when the device is used in normal operation.

---

b. If the previously set access-level password is not appropriate for FIPS Mode operation, the following text is displayed:

Your current access-level password is not valid for FIPS mode.
You need to provide an access-level password of at least 8 characters.
Enter new password:
Confirm password:
 

c. If the previously set enable-level password is not appropriate for FIPS Mode operation, the following text is displayed:

Your current enable-level password is not valid for FIPS mode.
You need to provide an access-level password of at least 8 characters.
Enter new password:
Confirm password:
 

d. If both the previously set access- and enable-level passwords are valid for FIPS Mode operation, no additional text is displayed.

5. The device reboots and enters FIPS Mode. Enter the access-level password to control the device.

Enter the access-level password:
 

Caution   If you cannot remember the passwords, you will not be able to view device status and statistics or configure the device. The only option is to use the "FailSafe" password as described in "Factory Default Reset Password" section. All configuration will be lost!

Enter the enable-level password:
 

Creating a Server in FIPS Mode

Creating and configuring server operations in FIPS Mode are nearly identical to those in normal operational modes. The differences are the following:

• Only the FIPS security policy and security policies containing FIPS-approved algorithms can be used
  
  
• Only FIPS-compliant servers can be used for data transfer (non-FIPS-compliant servers can be edited for FIPS compliance)
  
  

Follow the steps below to create a FIPS-compliant server.

[FIPS] SCA> enable
[FIPS] SCA# config
[FIPS] config[SCA]# ssl
[FIPS] ssl-config[SCA]# server mySecServ create
[FIPS] ssl-server[mySecServ]#>
 

[FIPS] ssl-server[mySecServ]#> ip address 10.1.114.30
[FIPS] ssl-server[mySecServ]#> key myOwnKey
[FIPS] ssl-server[mySecServ]#> cert myOwnCert
[FIPS] ssl-server[mySecServ]#> secpolicy fips
[FIPS] ssl-server[mySecServ]#> 
 

[FIPS] ssl-server[mySecServ]#> finished
[FIPS] SCA#
 

You can create a security policy containing only the FIPS-approved algorithm you want to use. The following example demonstrates creating a security policy containing on the 3DES/SHA algorithm and editing a secure server to use the new user-defined security policy rather than the FIPS security policy.

[FIPS] SCA> enable
[FIPS] SCA# config
[FIPS] config[SCA]# ssl
[FIPS] ssl-config[SCA]# secpolicy myFIPS create
[FIPS] ssl-secpolicy[myFIPS]#>
 

[FIPS] ssl-secpolicy[myFIPS]#> crypto DES-CBC3-SHA
[FIPS] ssl-secpolicy[myFIPS]#> exit
[FIPS] ssl-config[SCA]#>
 

[FIPS] ssl-config[SCA]#> server mySecServ
[FIPS] ssl-server[mySecServ]#> secpolicy myFIPS
[FIPS] ssl-server[mySecServ]#> 
 

[FIPS] ssl-server[mySecServ]# finished
[FIPS] SCA#
 

Command Changes

When the device is operated in FIPS Mode, some commands are unavailable or behave differently than in normal operating modes.

Unavailable Commands

Commands are unavailable in FIPS Mode are shown in Table 6-1, below.

Differing Command Behaviors

Some commands behave differently while the Secure Content Accelerator is in FIPS Mode. These commands and notes about their usage are presented in Table 6-2, below.

Returning to Normal Operation

Follow these steps to return the Secure Content Accelerator to normal operation.

[FIPS] SCA> enable
[FIPS] SCA#
 

[FIPS] SCA# no fips enable
 

More Information

For more information about the NIST Cryptographic Module Validation Program, see http://csrc.nist.gov/cryptval/cmvp.htm .