Nortel Networks 7.11, 7.05 manual Cryptographic Support, Fips Validated Modules

Page 45

Security Target, Version 3.9

March 18, 2008

 

 

6.1.2 Cryptographic Support

The TOE’s cryptographic functionality is provided by a FIPS 140-2-validated cryptographic module. All modules have received either a Level 1 or Level 2 FIPS 140-2 validation. Table 8 below indicates the modules and the validation levels achieved.

Table 8 - FIPS Validated Modules

 

Validation

 

Modules

 

FIPS 140-2 Certificate #

 

 

 

 

 

 

 

 

 

 

 

 

VPN Router 1750, 2700, 2750 and 5000 with Hardware

1068

 

 

 

Accelerator

 

Hardware modules

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FIPS 140-2 validated

 

VPN Router 1750, 2700, 2750 and 5000 with VPN Router Security

1073

 

at level 2

 

Accelerator

 

 

 

 

 

 

 

 

 

 

 

 

Nortel VPN Router 600, 1750, 2700, 2750 and 5000

1066

 

 

 

 

 

 

 

Hardware modules

 

 

 

 

 

FIPS 140-2 validated

 

Nortel VPN Router 1010, 1050 and 1100

1067

 

at level 1

 

 

 

 

 

 

 

 

 

 

 

Software module

 

 

 

 

 

being validated at

 

VPN Client Software

1032

 

level 1 of FIPS 140-2:

 

 

 

 

 

 

 

 

 

 

The TOE’s cryptographic module implements and utilizes the following FIPS-validated cryptographic algorithms:

Table 9 - FIPS-Validated Cryptographic Algorithms

 

Algorithm

 

Key Size(s) (bits)

 

Validated Against

 

FIPS Certificate #

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

3DES

168

 

FIPS 46-3

641, 642, 644

 

 

 

 

 

 

 

 

AES

128,

256

 

FIPS 197

718, 719, 721

 

 

 

 

 

 

 

 

RSA5

1024,

2048

 

FIPS 186-2

338, 339

 

 

 

 

 

 

 

 

SHA-1

 

N/A

 

FIPS 180-2

738, 739, 740

 

 

 

 

 

 

 

HMAC-SHA-1

160

 

FIPS 1986

387, 388, 389

 

 

 

 

 

 

 

 

 

The TOE generates RSA keys for signature generation and verification. During the key generation process, all weak keys are discarded. The resultant strong RSA keys are used to perform key agreement and authentication in accordance with the Diffie-Hellman and IKE protocols.

The TOE performs encryption and decryption using the 3DES and AES algorithms. The TOE implements the HMAC-SHA-1 algorithm in order to perform data origin authentication and data integrity checks upon encrypted packets entering the TOE. The TOE implements SHA-1 algorithm in order to perform data integrity checks upon encrypted packets entering the TOE.

The TOE destroys keys when they are no longer needed by “zeroizing” them. Zeroization is performed by overwriting the memory location containing the keys with zeros before marking the memory location as being free

5

Via the RSA BSAFE library.

 

6

FIPS 198 is equivalent to RFC 2104.

 

 

 

Nortel VPN Router v7.05 and Client Workstation v7.11

Page 45 of 67

 

© 2008 Nortel Networks

 

Page 44 Page 46
Image 45
Page 44 Page 46
Contents Nortel Networks Corsec Security, Inc Version Modification Date Modified By Description of Changes Revision HistoryTable of Contents Table of Tables Table of FiguresProtection Profile Claims RationalePurpose Security Target IntroductionSecurity Target, TOE and CC Identification and Conformance ST, TOE, and CC Identification and ConformanceConventions Conventions, Acronyms, and TerminologyTerminology TerminologyPrimary Admin password TOE Description Product TypeProduct Description Branch Office Deployment Configuration of the TOE Physical Boundary TOE Boundaries and ScopeTOE Environment Logical BoundaryEnterprise WorldSecurity Audit Cryptographic SupportUser Data Protection Security Management Identification and AuthenticationProtection of the TOE Security Functions Trusted Path/ChannelsExcluded TOE Functionality TOE Security Environment AssumptionsThreats to Security Threats Addressed by the TOE Environment Threats Addressed by the TOESecurity Objectives for the TOE Security ObjectivesIT Security Objectives Security Objectives for the EnvironmentNon-IT Security Objectives OE.TIMETOE Security Functional Requirements IT Security RequirementsTOE Security Functional Requirements ST OperationDescription ST Operation FAUGEN.1 Audit Data Generation Class FAU Security AuditFAUSAR.1 Audit review Auditable EventsDependencies FAUGEN.1 Audit data generation FCSCKM.1a Cryptographic key generation Diffie-Hellman Class FCS Cryptographic SupportFCSCKM.1b Cryptographic key generation RSA FCSCKM.4 Cryptographic key destructionFCSCOP.1b Cryptographic operation authentication FCSCOP.1d Cryptographic operation random number generationFCSCOP.1e Cryptographic operation hashing Security Target, Version March 18 FDPACF.1 Security attribute based access control FDPACC.2 Complete access controlClass FDP User Data Protection FDPIFC.2a Complete information flow control VPNFDPIFF.1a Simple security attributes VPN FDPIFC.2b Complete information flow control FirewallFDPIFF.1b Simple security attributes Firewall FDPUIT.1 Data exchange integrity FDPUCT.1 Basic data exchange confidentialityFDPUCT.1.1 FDPUIT.1.1FIAUAU.1 Timing of authentication Class FIA Identification and AuthenticationFIAUAU.5 Multiple authentication mechanisms FIAUID.2 User identification before any actionDependencies No dependencies FMTMOF.1a Management of security functions behaviour Class FMT Security ManagementFMTMOF.1b Management of security functions behaviour FMTMSA.1a Management of security attributesFMTMSA.2 Secure security attributes FMTMSA.1c Management of security attributesFMTMSA.3a Static attribute initialisation FMTMSA.2.1FMTMSA.3b Static attribute initialisation FMTSMF.1 Specification of Management FunctionsFMTMSA.3c Static attribute initialisation FMTSMR.1 Security rolesFMTSMR.1.2 FPTTST.1 TSF testing FPTAMT.1 Abstract machine testingClass FPT Protection of the TSF FPTRPL.1 Replay detectionFTPTRP.1 Trusted path Class FTP Trusted Path/ChannelsFTPTRP.1.1 FTPTRP.1.2FPTRVM.1 Non-bypassability of the TSP Security Functional Requirements on the IT EnvironmentFPTSEP.1 TSF domain separation FPTSTM.1 Reliable time stampsSecurity Target, Version 3.9March 18 Assurance Requirements Assurance ComponentsAssurance Requirements TOE Security Functions TOE Summary SpecificationTOE Security Description FunctionSecurity Audit Configuration LogAccounting Logs Security LogEvent Log System LogFips Validated Modules Cryptographic SupportFIPS-Validated Cryptographic Algorithms Validation Modules Fips 140-2 Certificate #User Data Protection Security Management Identification and AuthenticationPower-Up Self-Tests Protection of the TOE Security FunctionsConditional Self-Tests Trusted Path/Channels TOE Security Assurance MeasuresTOE Security Functional Requirements Satisfied FTPTRP.1 Assurance Assurance Measure ComponentAugmentation to EAL 4+ assurance level Protection Profile Reference Protection Profile ClaimsSecurity Objectives Rationale RationaleRelationship of Security Threats to Objectives TOE Objectives Environmental Objectives Non-ITHack Certificate OE.CERTIFICATE Security Functional Requirements RationaleObjectives Requirements Relationship of Security Requirements to ObjectivesEnv Functions and dataFMTMSA.3a,b,c Able to access such functionalityIntegrity Reject packets based on their attributesRationale for Strength of Function Security Assurance Requirements RationaleDependency Rationale Functional Requirements DependenciesFCSCOP.1 TOE Summary Specification Rationale Configuration Management Secure Delivery and OperationDevelopment Guidance Documentation Life Cycle Support DocumentsTests Vulnerability and TOE Strength of Function Analyses Strength of FunctionAcronyms AcronymsAcronym Definition DoDSHA
Top Page Image Contents