About FIPS
The FIPS 140–2 Publication, Security Requirements for Cryptographic Modules, describes U.S. government requirements for cryptographic modules. According to FIPS 140–2, a cryptographic module is a set of hardware, software, firmware, or a combination of these components that implements cryptographic functions and is contained within a defined boundary. These modules provide cryptographic algorithms and, optionally, key generation.
FIPS specifies certain cryptographic algorithms as secure, and it identifies which algorithms should be used if a cryptographic module is to be called FIPS compliant.
FIPS Self-Tests
A cryptographic module must perform power-up self-tests and conditional self-tests to ensure that it is functioning properly.
Power-up self-tests run automatically after the device powers up. A device goes into FIPS mode only after all self-tests are successfully completed. If any self-test fails, the device logs a system message and moves into an error state.
Generate the "crypto key generate rsa label test exportable modulus" with a minimum modulus size of 2048. A key size less than 2048 is categorized as a “FIPS Self-Test” or results in a "FIPS Error State".
The device uses a cryptographic algorithm known-answer test (KAT) for each FIPS 140- 2 -approved cryptographic function (encryption, decryption, authentication, and random number generation) implemented on the device. The device applies the algorithm to data for which the correct output is already known, and then compares the calculated output to this known answer. If the calculated output does not match the known answer, the KAT fails.
Conditional self-tests include these tests:
-
Pair-wise consistency test: This test runs when a public or private key-pair is generated.
-
Continuous random number generator test: This test runs when a random number is generated.
The Cisco TrustSec manager also runs a bypass test to ensure that encrypted text is never sent as plain text.
 Note |
A bypass test failure on CTS-enabled ports causes only those corresponding ports to be shut down. The bypass test might fail because of packet drops caused by data path congestion. In such cases, we recommend that you try bringing up the port again. |
FIPS Error State
When the system is booted up in FIPS mode, the FIPS power-up self-tests run on the supervisor and line card modules. If any of these bootup tests fail, the whole system is moved to the FIPS error state. In this state, the system deletes all cryptographic keys and shuts down all line cards as required by FIPS. This mode is exclusively meant for debugging purposes.
After the switch is in the FIPS error state, any reload of a line card moves it to the failure state. To move the switch back to FIPS mode, it has to be rebooted. However, once the switch is in FIPS mode, a power-up self-test failure during a line card reload or insertion affects only that line card, and only the corresponding line card is moved to the failure state.
Feedback