Page 1
Motorola Network Router (MNR)
S2500
Security
Policy
Document Version 1.3
Revision Date: 1/13/2009
Copyright © Motorola, Inc. 2009. May be reproduced only in its original entirety [without revision].
Page 2
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
TABLE OF CONTENTS
1. MODULE OVERVIEW .........................................................................................................................................3
2. SECURITY LEVEL................................................................................................................................................4
3. MODES OF OPERATION.....................................................................................................................................4
4. PORTS AND INTERFACES .................................................................................................................................8
5. IDENTIFICATION AND AUTHENTICATION POLICY.................................................................................8
6. ACCESS CONTROL POLICY............................................................................................................................10
AUTHENTICATED SERVICES.....................................................................................................................................10
UNAUTHENTICATED SERVICES:...............................................................................................................................10
ROLES AND SERVICES..............................................................................................................................................11
DEFINITION OF CRITICAL SECURITY PARAMETERS (CSPS)......................................................................................12
DEFINITION OF CSPS MODES OF ACCESS ................................................................................................................13
7. OPERATIONAL ENVIRONMENT....................................................................................................................15
8. SECURITY RULES..............................................................................................................................................15
9. CRYPTO OFFICER GUIDANCE.......................................................................................................................16
10. PHYSICAL SECURITY POLICY ....................................................................................................................17
PHYSICAL SECURITY MECHANISMS.........................................................................................................................17
11. MITIGATION OF OTHER ATTACKS POLICY...........................................................................................17
12. DEFINITIONS AND ACRONYMS...................................................................................................................17
Page 2
Page 3
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
1. Module Overview
The MNR S2500 router, also referred to as the S2500, is a multi-chip standalone cryptographic
module encased in a commercial grade metal case made of cold rolled steel. The module
cryptographic boundary is the routers enclosure which includes all components, including the
encryption module which is a separate part. Figure 1 illustrates the cryptographic boundary of
the MNR S2500 router. In the photo, blank plates cover slots that can hold optional network
interface cards. The FIPS validated firmware versions are XS-15.1.0.75, XS-15.1.0.76, XS-
15.2.0.20, and XS-15.4.0.60.
S2500 Base Unit S2500 Encryption Module Configurations
P/N Tanapa
Number
1 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.1.0.75
2 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.1.0.76
3 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.2.0.20
4 ST2500B CLN1713E B ST2516A CLN8262C C XS-15.4.0.60
Revision P/N Tanapa
Number
Revision
FW Version
Table 1. MNR S2500 Router Version Numbers
Optional Interface Cards
(not included in cryptographic module boundary)
Figure 1 – MNR S2500 Router Cryptographic Module Boundary
Page 3
Page 4
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
2. Security Level
The cryptographic module meets the overall requirements applicable to Level 1 security of
FIPS 140-2.
Security Requirements Section Level
Cryptographic Module Specification 1
Module Ports and Interfaces 1
Roles, Services and Authentication 1
Finite State Model 1
Physical Security 1
Operational Environment N/A
Cryptographic Key Management 1
EMI/EMC 3
Self-Tests 1
Design Assurance 1
Mitigation of Other Attacks N/A
Table 2 – Module Security Level Specification
3. Modes of Operation
Approved mode of operation
In FIPS mode, the cryptographic module supports the following FIPS-Approved algorithms as
follows:
Hardware Implementations
a. Triple-DES– CBC mode (112 or 168 bit) for IPsec and FRF.17 encryption (Cert. #588)
b. AES - CBC mode(128, 192, 256 bit) for IPsec and FRF.17 encryption (Cert. #625)
c. HMAC-SHA-1 for IPsec and FRF.17 authentication (Cert. #342)
d. SHA-1 for message hash (Cert. #693)
Page 4
Page 5
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
Firmware Implementations
a. Triple-DES– CBC mode (112 and 168 bit) for IKE and SSHv2 encryption (Cert. #581)
b. AES - CBC (128, 192, 256 bit), ECB (128), and CFB (128) modes for IKE and SSHv2
encryption (Cert. #611)
c. HMAC-SHA-1 for IKE and SSHv2 authentication (Cert. # 322)
d. SHA-1 for message hash (Cert. # 659)
e. RSA v1.5 1024 bit – for public/private key pair generation and digital signatures (Cert.
#283)
f. DSA 1024 bit – for public/private key pair generation and digital signatures (Cert. #237)
g. ANSI X9.31 Deterministic Random Number Generator (DRNG) (Cert .#349)
The MNR S2500 router supports the commercially available IKE and Diffie-Hellman protocols
for key establishment, IPsec (ESP) and FRF.17 protocols to provide data confidentiality using
FIPS-approved encryption and authentication algorithms and SSHv2 for secure remote access.
Allowed Algorithms
• Diffie-Hellman: (allowed for key agreement per Annex D, key agreement methodology
provides 80 to 112 bits of encryption strength)
• Hardware non-deterministic RNG: Provides seed for approved deterministic RNG
• MD5: for hashing (Provides interoperability within supported protocols)
• HMAC-MD5
Non-FIPS approved algorithms
In a Non FIPS mode of operation, the cryptographic module provides non-FIPS Approved
algorithms as follows:
• DES for encryption/decryption
• Non approved SW RNG
• Diffie-Hellman (Group 1 - 768 bit)
Page 5
Page 6
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
Entering FIPS Mode
To enter FIPS mode, the Crypto Officer must follow the procedure outlined in Table 3 below.
For details on individual router commands, use the online help facility or review the Enterprise
OS Software User Guide, version 15.4 and the Enterprise OS Software Reference Guide, version
15.4.
Step Description
Configure the parameters for the IKE negotiations using the IKEProfile command. For FIPS
1.
mode, only the following values are allowed: Diffie-Hellman Group (Group 2 or Group 5),
Encryption Algorithm (AES or 3DES), Hash Algorithm (SHA), and Authentication Method
(PreSharedKey).
Manually establish via the local console port the pre-shared key (PSK) to be used for the IKE
2.
protocol using:
ADD –CRYPTO FipsPreSharedKey <peer_ID> <pre-shared_key> <pre-shared_key>
The PSK must be at least 80 bits in length with at least 80 bits of entropy.
Configure Ipsec and FRF.17 selector lists using the command
3.
ADD –CRYPTO SelectorLIst
For FIPS mode, the selector list must be configured to encrypt all packets on an encrypted port,
e.g. ADD –CRYPTO SelectorLIst s1 1 Include ANY 0.0.0.0/0 0.0.0.0/0
If Ipsec is used, configure Ipsec transform lists using the ADD –CRYPTO TransformLIst
4.
command. For FIPS mode, only the following values are allowed: Encryption Transform (ESP3DES, or ESP-AES) and Authentication Transform (ESP-SHA).
If FRF.17 is used, configure FRF.17 transform lists using the ADD –CRYPTO
5.
TransformLIst command. For FIPS mode, only the following values are allowed: Encryption
Transform (FRF-3DES, or FRF-AES) and Authentication Transform (FRF-SHA).
For each port for which encrypted is required, bind a dynamic policy to the ports using
6.
ADD [!<portlist>] –CRYPTO DynamicPOLicy <policy_name> <priority>
<mode> <selctrlist_name> <xfrmlist_name> [<pfs>] [<lifetime>] [<preconnect>]
To be in FIPS mode, the selector list and transform list names must be defined as in previous
steps.
For each port for which encryption is required, enable encryption on that port using
7.
SETDefault [!<portlist>] –CRYPTO CONTrol = Enabled
FIPS-140-2 mode achieved
8.
Table 3 – FIPS Approved mode configuration
To review the cryptographic configuration of the router, use the following command:
Page 6
Page 7
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
SHOW –CRYPTO CONFiguration
This command shows a detailed summary of the cryptographic configuration and allows a user
to verify that encryption is enabled on user-determined ports and that only FIPS-Approved
algorithms are used for encryption and authentication.
Page 7
Page 8
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
4. Ports and Interfaces
Table 4 below provides a listing of the physical ports and logical interfaces for
the MNR S2500 router.
The MNR S2500 base unit provides a single 10/100 Mbps Ethernet interface and a console port.
The MNR S2500 router incorporates two I/O slots for WAN and LAN connectivity and one slot
for analog connectivity.
Physical Port Qty Logical interface definition Interface Card Comments
Ethernet 1 Data input, data output, status
output, control input
Console 1 Status output, control input Part of the S2500 Base
LAN/WAN 0, 1 or 2 Data input, data output, status
output, control input, power
output
Analog 0, 1 Data input, data output, status
output, control input, power
output
Power Plug 1 Power input N/A External Power input
LEDs 7 Status Output N.A Provides LED status
Table 4 – S2500 physical ports and logical interfaces
Part of the 2500 Base
system
system
Optional Ethernet and
WAN modules
Optional conventionalto-IP (E&M)
LAN port that provides
connection to Ethernet
LANs using either
10BASE-T or
100BASE-TX Ethernet
RS-232 interface
port
output
5. Identification and Authentication Policy
Assumption of roles
The MNR S2500 router supports five distinct operator roles: Crypto Officer (SuperUser),
Admin, Network Manager, User and Maintenance. The first four roles require user
authentication via user name and password when accessing the router via any interface. The
unauthenticated maintenance role is entered only via the router console port.
The MNR S2500 router enforces the separation of roles by providing specific services only to
users who have been authenticated to a role with the required privilege to access those services.
The role-based authentication capabilities will be described here, although the role basedauthentication is not required to comply with Level 1 requirements.
An operator must enter a username and its password to log in. Passwords are alphanumeric
Page 8
Page 9
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
strings consisting of 7 to 15 characters chosen from the 94 standard keyboard characters. Upon
correct authentication, the role is selected based on the username of the operator. At the end of a
session, the operator must log-out.
When a router power cycles, sessions are terminated. A user must reauthenticate to access the
router.
Multiple concurrent operators. Each operator has an independent session with the router, either
though Telnet, SSH, or via the console. Once authenticated to a role, each operator can access
only those services for that role. In this way, separation is maintained between the role and
services allowed for each operator.
The definition of all supported roles is shown in Table 5 below.
Role
Type of
Authentication
Authentication Data Description
Crypto Officer
(Super User)
Network
Manager
Admin Role-based operator
User Role-based operator
Maintenance None (see comment) N/A Maintenance role can be entered via
Role-based operator
authentication.
Role-based operator
authentication.
authentication
authentication
Table 5 – Roles and Required Identification and Authentication
Username and Password. The
module stores user identity
information internally or if
configured,
Username and Password. The
module stores user identity
information internally.
Username and Password. The
module stores user identity
information internally.
Username and Password. The
module stores user identity
information internally.
The owner of the cryptographic
module with full access to services of
the module.
A user of the cryptographic module
with almost full access to services of
the module.
An assistant to the Crypto Officer
that has read only access to a subset
of module configuration and status
indications.
A user of the cryptographic module
that has read only access to a subset
of module configuration and status
indications.
the external console port
(unauthenticated) or via EOS
software command (requires
Network Manager authentication)
Authentication Mechanism Strength of Mechanism
Username and Password The probability that a random attempt will succeed or
a false acceptance will occur is 1/94^7 which is less
than 1/1,000,000.
Table 6 – Strengths of Authentication Mechanisms
Page 9
Page 10
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
6. Access Control Policy
Authenticated Services
• Firmware Update: load firmware images digitally signed by RSA (1024 bit) algorithm.
• Key Entry: Enter Pre-Shared Keys (PSK)
• User Management: Add/Delete and manage passwords operators
• Reboot: force the module to power cycle via a command
• Zeroization: actively destroy all plaintext CSPs and keys
• Crypto Configuration: Configure IPsec and FRF.17 services
• IKE: Key establishment utilizing the IKE protocol
• IPsec tunnel establishment: IPsec protocol
• FRF.17 tunnel establishment: Frame Relay Privacy Protocol
• SSHv2 for remote access to the router
• Network configuration: Configure networking capabilities
• Enable Ports: Apply a security policy to a port
• File System: Access file system
• Authenticated Show status: Provide status to an authenticated operator
• Access Control: Provide access control for all operators
Unauthenticated Services:
• Unauthenticated Show status: provide the status of the cryptographic module – the status
is shown using the LEDs on the front panel.
• Power-up Self-tests: execute the suite of self-tests required by FIPS 140-2 during power-
up not requiring operator intervention.
• Monitor: Perform various hardware support services
Page 10
Page 11
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
Roles and Services
Service
Firmware Update X X
Key Entry X X
User Management X X
IKE X X
IPsec Tunnel Establishment X X
FRF.17 Tunnel Establishment X X
SSHv2 X X
Reboot X X
Zeroization X X
Crypto Configuration X X
Network Configuration X X
Enable Ports X X
File System X X
Crypto Officer
(SuperUser)
Network Manager
User
Admin
Maintenance
Authenticated Show Status X X X X
Unauthenticated Show Status X X X X X
Power-up Self-Tests X X X X
Monitor X X
Access Control X X
Table 7 – Services to Roles mapping
Page 11
Page 12
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
Definition of Critical Security Parameters (CSPs)
The following CSPs are contained within the module:
Key Description/Usage
KEK This is the master key that encrypts persistent CSPs stored within the module.
KEK-protected keys include PSK and passwords.
Encryption of keys uses AES128ECB
IKE Preshared Keys
SKEYID Generated for IKE Phase 1 by hashing preshared keys with responder/receiver
SKEYID_d Phase 1 key used to derive keying material for IKE SAs
SKEYID_a Key used for integrity and authentication of the phase 1 exchange
SKEYID_e Key used for TDES or AES data encryption of phase 1 exchange
Ephemeral DH Phase-1
private key (a)
Ephemeral DH Phase-2
private key (a)
IPSEC Session keys 128/192/256-bit AES-CBC and 168-bit TDES keys are used to encrypt and
FRF.17 Session Keys 168-bit TDES-CBC and 128/192/256-bit AES-CBC keys are used to encrypt
SSH-RSA Private Key Key used to authenticate oneself to peer
SSH-DSA Private Key Key used to authenticate oneself to peer
Used to authenticate peer to peer during IKE session
nonce
Generated for IKE Phase 1 key establishment
Phase 2 Diffie Hellman private keys used in PFS for key renewal
authenticate IPSEC ESP packets
and authenticate FRF.17 Mode 2
SSH Session Keys 168-bit TDES-CBC and 128/192/256-bit AES-CBC keys are used to encrypt
and authenticate SSH packets
SSH DH Private Key Generated for SSH key establishment
RNG Seed Initial seed for FIPS-approved deterministic RNG
Network Manager Password
(Root)
User(Admin) 7 (to 15) character password used to authenticate to the User Role
User Accounts 7 (to 15) character password used to authenticate accounts created on the
7 (to 15 ) character password used to authenticate to the CO Role
Officer
)
module
Table 8 – Critical Security Parameters (CSPs)
(Crypto
Page 12
Page 13
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
Definition of Public Keys:
The following public keys are contained within the module:
Key Description/Usage
RSA Firmware Load Key Distributed to module, for firmware authentication
SSH-RSA Key Distributed to peer, used for SSH authentication
SSH-DSA Key Distributed to peer, used for SSH authentication
SSH Known Host Keys Distributed to module, used to authenticate peer
IKE DH public key (g^a) Generated for IKE Phase 1 key establishment
IKE DH phase-2 public (g^a)
key
SSH DH Key Generated for SSH key establishment
Phase 2 Diffie Hellman public keys used in PFS for key renewal (if
configured)
Table 9 – Public Keys
Definition of CSPs Modes of Access
Table 10 defines the relationship between access to CSPs and the different module services. The
modes of access shown in the table are defined as follows:
• Read: the data item is read from memory.
• Write: the data item is written into memory.
• Zeroize: the data item is actively overwritten.
Page 13
Page 14
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
CSP
KEK
IKE Pre-shared
Key
SKEYID
SKEYID_d
SKEYID_a
SKEYID_e
Ephemeral DH
Phase-1 private
key
Ephemeral Phase-
2 DH private key
IPSEC Session
Keys
Firmware
Update
Key entry
User
Management
IKE
Ipsec tunnel
establishment
FRF.17 tunnel
establishment
SSH
Reboot
Zeroization
Crypto
Configuration
Network
Configuration
Enable Ports
File System
Authenticated
Show Status
Access Control
R R Z R
W R
RW Z Z
RW Z
RW Z
RW Z
RW Z
RW Z
RW R Z
Z W RW R
FRF.17 Session
Keys
SSH-RSA Private
Key
SSH-DSA Private
Key
SSH Session Keys
SSH DH Private
Key
Root Password
User(Admin)
User Accounts
RNG Seed
RW R Z
RW Z RW
RW Z RW
RW Z
RW Z
RW Z
RW Z
RW Z
RW Z
Table 10 – Services to CSP Access mapping
Page 14
Page 15
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
7. Operational Environment
The FIPS 140-2 Area 6 Operational Environment requirements are not applicable because the
MNR S2500 router does not contain a modifiable operational environment.
8. Security Rules
The example cryptographic module’s design corresponds to the example cryptographic module’s
security rules. This section documents the security rules enforced by the cryptographic module to
implement the security requirements of this FIPS 140-2 Level 1 module.
1. The MNR S2500 router provides five distinct operator roles: Crypto Officer (SuperUser),
Admin, Network Manager, User, and Maintenance. The Crypto Officer role uses the root
account.
2. The MNR S2500 router encrypts message traffic using the AES or TDES algorithm.
3. The MNR S2500 router performs the following tests:
A. Power up Self-Tests:
1. Cryptographic algorithm tests:
Hardware Implementation:
a. AES-CBC Known Answer Test
b. TDES-CBC Known Answer Test
c. HMAC-SHA-1 Known Answer Test (Includes SHA-1 KAT)
Firmware Implementation
a. AES-CBC Known Answer Test
b. TDES-CBC Known Answer Test
c. HMAC -SHA-1 Known Answer Test (Includes SHA-1 KAT)
d. ANSI X9.31 DRNG Known Answer Test
e. RSA Known Answer Test
f. DSA Known Answer Test
2. Firmware Integrity Test (16 bit CRC)
Page 15
Page 16
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
B. Conditional Self-Tests:
a. Continuous Random Number Generator (RNG) test on FIPS-approved
deterministic RNG and Hardware NDRNG.
b. Firmware load test – RSA signature verification of externally loaded code.
c. Alternating bypass tests – when enabling FRF.17 and IPsec encryption.
d. Pair-wise consistency test for public and private key establishment (RSA
and DSA)
e. Manual key entry test
4. At any time the MNR S2500 router is in an idle state, the operator can command the
router to perform the power-up self-test by power-cycling or rebooting the router.
5. Data output is inhibited during key generation, self-tests, zeroization, and error states.
6. Status information does not contain CSPs or sensitive data that if misused could lead to a
compromise of the module.
7. The operator shall not modify any IPsec selector lists.
9. Crypto Officer Guidance
On initial installation, perform the following steps:
1. Power on the module and verify successful completion of power-up self tests from
console port or inspection of log file.
2. Authenticate to the module using the default user acting as the Crypto Officer with the
default password and username.
3. Verify that the Hardware and Firmware P/Ns and version numbers of the module are the
FIPS approved versions.
4. Change the Network Manager (Crypto Officer) and User passwords using the
SysPassWord command.
5. Initialize the Key Encryption Key (KEK) with the KEKGenerate command. Account
passwords and certain keys are persistent across reboots and are encrypted with the Key
Encryption Key (KEK). This key can be reinitialized at any time.
The module supports a minimum password length of 7 characters and a maximum length of 15
characters. The Crypto Officer controls the minimum password length through the
PwMinLength parameter:
SETDefault -SYS PwMinLength = <length>, where <length> specifies the minimum length.
Before entering or exiting the Maintenance Role or non-FIPS mode, the operator shall use the
Zeroization Service to zeroize all CSPs. The Zeroization Service should also be invoked prior to
removing a router from service for repair.
Page 16
Page 17
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
10. Physical Security Policy
Physical Security Mechanisms
The MNR S2500 router is composed of industry standard production-grade components.
11. Mitigation of Other Attacks Policy
The module has not been designed to mitigate against other attacks outside the scope of FIPS
140-2.
12. Definitions and Acronyms
AES – Advanced Encryption Standard
CBC – Cipher Block Chaining
CLI – Command Line Interface
CSP – Critical Security Parameter
DH – Diffie-Hellman
DRNG – Deterministic Random Number Generator
FRF – Frame Relay Forum
FRF.17 – Frame Relay Privacy Implementation Agreement
FRPP – Frame Relay Privacy Protocol
HMAC – Hash Message Authentication Code
IKE – Internet Key Exchange
IP – Internet Protocol
IPsec – Internet Protocol Security
KAT – Known Answer Test
KDF – Key Derivation Function
KEK – Key Encrypting Key
MNR – Motorola Network Router
OSPF – Open Shortest Path First
Page 17
Page 18
MNR S2500 Security Policy
Version 1.3, Revision Date: 1/13/2009
PFS – Perfect Forward Secrecy
RNG – Random Number Generator
SHA – Secure Hash Algorithm
SSH – Secure Shell
SNMP – Simple Network Management Protocol
Tanapa - The part number that is built and stocked for customer orders.
Page 18
Loading...