Junos® OS Evolved Kernel Cryptographic Module

Certificate

Approved Algorithms (75)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Junos® OS Evolved Kernel Cryptographic Module
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>update<br/>Recovery<br/>upgrade</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>UnAuth</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>HTTPS<br/>library named: openssl<br/>library named: nss</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Junos® OS Evolved Kernel Cryptographic Module
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>update<br/>Recovery<br/>upgrade</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>UnAuth</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>HTTPS<br/>library named: openssl<br/>library named: nss</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>linux<br/>kernel</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Juniper Networks, Inc. Junos OS Evolved Kernel Cryptographic Module Document Version: 1.1 Last update: 08-28-2024 Prepared by: Prepared for: atsec information security corporation Juniper Networks, Inc.

Austin, TX 78759 Sunnyvale, CA 94089 www.atsec.com www.juniper.net Juniper Networks, Inc. o +1 408 745 2000 1

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table of Contents Juniper Networks, Inc. o +1 408 745 2000 2

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 3

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 4

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. List of Tables Table 2: Tested Module Identification – Software, Firmware, Hybrid (Executable Code Sets) . 8 List of Figures Juniper Networks, Inc. o +1 408 745 2000 5

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

This document is the non-proprietary FIPS 140-3 Security Policy for version 2.0 of the Junos OS Evolved Kernel Cryptographic Module module. It contains the security rules under which the module must operate and describes how this module meets the requirements as specified in FIPS PUB 140-3 (Federal Information Processing Standards Publication 140-3) for an overall Security Level 1 module. intact and including this notice. Other documentation is proprietary to their authors.

In preparing the Security Policy document, the laboratory formatted the vendor-supplied documentation for consolidation without altering the technical statements therein contained. The further refining of the Security Policy document was conducted iteratively throughout the conformance testing, wherein the Security Policy was submitted to the vendor, who would then edit, modify, and add technical contents. The vendor would also supply additional documentation, which the laboratory formatted into the existing Security Policy, and resubmitted to the vendor for their final editing.

1 1

2 1

3 1

4 1

5 1

6 1

7 N/A

8 N/A

9 1

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Purpose and Use: The Junos OS Evolved Kernel Cryptographic Module (hereafter referred to as “the module”) is a software module running as part of the operating system kernel that provides general purpose cryptographic services. It is bound to the Junos OS Evolved OpenSSL Cryptographic Module Version 3.0.8 validated under FIPS certificate #4775 to check the integrity of its static kernel binary file. Module Type: Software Module Embodiment: MultiChipStand Module Characteristics: Cryptographic Boundary: The cryptographic boundary of the module is defined as the kernel binary and the fips_chk_hmac binary, which verifies the integrity of the static kernel binary using the bound OpenSSL module HMAC service. In addition, the cryptographic boundary contains the .hmac files which store the expected integrity values for each of the software components. Tested Operational Environment’s Physical Perimeter (TOEPP) [O]: The TOEPP of the module is defined as the general-purpose computer on which the module is installed. Figure 1: Block Diagram Juniper Networks, Inc. o +1 408 745 2000 7

Sunnyvale, CA 94089 www.juniper.net

Tested Module Identification

• Hardware: N/A for this module. Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets): Table 2: Tested Module Identification
• Software, Firmware, Hybrid (Executable Code Sets) Tested Module Identification
• Hybrid Disjoint Hardware: N/A for this module. Tested Operational Environments - Software, Firmware, Hybrid: Table 3: Tested Operational Environments - Software, Firmware, Hybrid Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. The module is not tested in any vendor-affirmed operational environment.

There are no components within the cryptographic boundary excluded from the FIPS 140-3 requirements.

Modes List and Description: Juniper Networks, Inc. o +1 408 745 2000 8

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 4: Modes List and Description After passing all pre-operational self-tests and cryptographic algorithm self-tests executed on start-up, the module automatically transitions to the approved mode. Mode Change Instructions and Status [O]: The module automatically switches between the approved and non-approved modes depending on the services requested by the operator. The status indicator of the mode of The module does not implement a degraded mode of operation.

Approved Algorithms: Juniper Networks, Inc. o +1 408 745 2000 9

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 10

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 5: Approved Algorithms Vendor-Affirmed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms: N/A for this module. Non-Approved, Allowed Algorithms with No Security Claimed: N/A for this module. Non-Approved, Not Allowed Algorithms: Table 6: Non-Approved, Not Allowed Algorithms

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 12

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 13

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 14

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 15

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Table 7: Security Function Implementations

The length of a single data unit encrypted or decrypted with AES XTS shall not exceed 220 AES blocks, that is 16MB, of data per XTS instance. An XTS instance is defined in Section 4 of SP 800-38E. To meet the requirement stated in IG C.I, the module implements a check to ensure that the two AES keys used in AES XTS mode are not identical. The XTS mode shall only be used for the cryptographic protection of data on storage devices. It shall not be used for other purposes, such as the encryption of data in transit.

Table 8: Entropy Certificates Table 9: Entropy Sources The module employs the Deterministic Random Bit Generator (DRBG) based on [SP80090Arev1] for the random number generation. The DRBG supports the Hash_DRBG, HMAC_DRBG and CTR_DRBG mechanisms. The module obtains an entropy input string from the SP800-90B compliant ENT(NP), whose length depends on each DRBG mechanism, meeting the requirements of SP800-90Arev1 (128 to 384 bits). The module loads by default the DRBG using the HMAC_DRBG mechanism with SHA2-256 without prediction resistance. When instantiated, these DRBGs can be used to generate random numbers for external usage. The module uses the Kernel CPU Time Jitter RNG as an entropy source to seed the DRBG.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. The module does not provide key generation.

The module does not provide key establishment.

The module does not claim cipher suites in compliance to industry protocols.

Table 10: Ports and Interfaces The logical interfaces are the API through which kernel components request services, and the AF_ALG type socket that allows the applications running in the user space to request cryptographic services from the module. These logical interfaces are logically separated from each other by the API design. Juniper Networks, Inc. o +1 408 745 2000 17

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

The module does not implement a trusted channel.

The module does not implement a control output interface.

N/A for this module. The module does not implement authentication.

Table 11: Roles The module supports the Crypto Officer role only. This sole role is implicitly and always assumed by the operator of the module. No support is provided for multiple concurrent operators.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. r W,E r : W,E G,E (V, G,W,E (V, C): G,W,E Juniper Networks, Inc. o +1 408 745 2000 19

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. W,E W,E W,E W,E W,E s r Juniper Networks, Inc. o +1 408 745 2000 20

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. r Z Z :Z (V, Z Juniper Networks, Inc. o +1 408 745 2000 21

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. (V, C): Z Z Table 12: Approved Services The table above lists the approved services. The following convention is used to specify access rights to SSPs:

• Generate (G): The module generates or derives the SSP.
• Read (R): The SSP is read from the module (e.g. the SSP is output).
• Write (W): The SSP is updated, imported, or written to the module.
• Execute (E): The module uses the SSP in performing a cryptographic operation.

Table 13: Non-Approved Services

The module does not load external software or firmware.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. The module does not implement a bypass capability.

The module does not implement a self-initiated cryptographic output capability.

The module verifies its integrity through the following mechanisms:

• The integrity of the static kernel binary is ensured with the HMAC-SHA2-256 value stored in the corresponding .hmac file that is computed at kernel build time. During Pre-Operational Self-Tests, the module invokes the fips_chk_hmac utility to calculate the HMAC value of the static kernel binary file (relying on the HMAC service provided by the bound OpenSSL module), and then compares it with the pre-stored one. If the two HMAC values do not match, the kernel panics to indicate that the test fails and the module enters the error state.
• The integrity of the fips_chk_hmac utility itself is performed before the integrity tests of the static kernel binary, and ensured with the HMAC-SHA2-256 value stored in the corresponding .hmac file that is computed at the utility build time. The utility makes use of OpenSSL’s HMAC service to calculate the HMAC value, and then compares it with the pre-stored one. If the two HMAC values do not match, the kernel panics to indicate that the test fails and the module enters the error state.

Integrity tests are performed as part of the pre-operational self-tests, which are executed when the module is initialized. The integrity tests can be invoked on demand by unloading and subsequently re-initializing the module, which will perform (among others) the software integrity tests.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Type of Operational Environment: Modifiable How Requirements are Satisfied [O]: The operating system provides process isolation and memory protection mechanisms that ensure appropriate separation for memory access among the processes on the system. Each process has control over its own data and uncontrolled access to the data of other processes is prevented.

The module shall be installed as stated in Section 11.1. Instrumentation tools like the ptrace system call, gdb and strace, as well as other tracing mechanisms offered by the Linux environment such as ftrace or systemtap, shall not be used in the operational environments. The use of any of these tools implies that the cryptographic module is running in a non-validated operational environment.

N/A for this module. The module is comprised of software only and therefore this section is not applicable.

Sunnyvale, CA 94089 www.juniper.net

Temp/Voltage Type LowTemperature HighTemperature LowVoltage HighVoltage

Temperature or Voltage

EFP or EFT

Result

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 14: EFP/EFT Information Not applicable.

Table 15: Hardness Testing Temperatures Not applicable.

This module does not implement any non-invasive security mechanism and therefore this section is not applicable.

Sunnyvale, CA 94089 www.juniper.net

Name API input parameter s AF_ALG type sockets (input)

From Operator calling applicatio n (TOEPP) Operator calling applicatio n (TOEPP)

To Cryptographi c module Cryptographi c module

Format Type Plaintex t Plaintex t

Distributio n Type Manual Manual

Entry Type Electroni c Electroni c

SFI or Algorith m

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 16: Storage Areas the RAM in plaintext form. SSPs are provided to the module by the calling process and are

m Table 17: SSP Input-Output Methods Table 18: SSP Zeroization Methods All data output is inhibited during zeroization. Juniper Networks, Inc. o +1 408 745 2000 26

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. y Table 19: SSP Table 1 Juniper Networks, Inc. o +1 408 745 2000 28

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 20: SSP Table 2

The SHA-1 algorithm as implemented by the module will be non-approved for all purposes except signature verification, starting January 1, 2031.

Table 21: Pre-Operational Self-Tests The pre-operational software integrity tests are performed automatically when the module is powered on, before the module transitions into the operational state. The algorithms used for the integrity test (i.e., HMAC-SHA2-256) run their CASTs before the integrity test is performed. While the module is executing the self-tests, services are not available, and data output (via the data output interface) is inhibited until the pre-operational software integrity Juniper Networks, Inc. o +1 408 745 2000 29

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. self-tests are successfully completed. The module transitions to the operational state only after the pre-operational self-tests are passed successfully.

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 31

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 32

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 33

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 34

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 35

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 36

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 37

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 22: Conditional Self-Tests The module performs self-tests on all approved cryptographic algorithms as part of the approved services supported in the approved mode of operation, using the tests shown in the table above. Services are not available, and data output (via the data output interface) is inhibited during the conditional self-tests. If any of these tests fails, the module transitions to the Error State. Juniper Networks, Inc. o +1 408 745 2000 38

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

Table 23: Pre-Operational Periodic Information Juniper Networks, Inc. o +1 408 745 2000 39

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 40

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Juniper Networks, Inc. o +1 408 745 2000 41

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Table 24: Conditional Periodic Information

Table 25: Error States In the Error State, the output interface is inhibited, and the module accepts no more inputs or requests (as the module is no longer running). The error can be recovered by a restart (i.e., powering off and powering on) of the module. Further details on how to recover from error state can be found in the evo-backup-snapshot documentation1.

1 URL: https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade-

evo/topics/topic-map/evo-backup-snapshot.html Juniper Networks, Inc. o +1 408 745 2000 42

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

All self-tests, with the exception of the continuous health tests, can be invoked on demand by unloading and subsequently re-initializing the module.

The module is pre-installed in the junos-evo-install-ptx-fixed-x86-64-22.4R2.11-S1-EVO.iso image. The procedures on how to mount and install the image are listed in the softwareinstall-and-upgrade-overview-evo documentation2. The Crypto Officer shall follow this Security Policy to configure the operational environment and to operate the module as a FIPS 140-3 validated module. To configure the operating environment to run in the approved mode, the following shall be performed with the root privilege:

1. Enter CLI configuration mode.
2. Configure FIPS level to 1: set system fips level 1
3. Commit changes: commit
4. Exit configuration mode to enter operational mode: exit
5. Reboot the system with the new settings (answer yes to prompt): request system reboot The Crypto Officer should check the existence of the file, /proc/sys/crypto/fips_enabled, and that it contains “1”. If the file does not exist or does not contain “1”, the operating environment is not configured to operate properly in the approved mode.

In order to run in the Approved mode, the module must be operated using the approved services, with their corresponding approved and allowed cryptographic algorithms provided in this Security Policy. In addition, key sizes must comply with [SP800-131Ar2]. Once the OE is properly configured, the operator is responsible to verify that the installation and configuration is completed. For such purpose, the following command “cat /proc/sys/fips_version” must return: Junos OS Evolved Kernel Cryptographic Module 2.0

2 URL: https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade-

evo/topics/concept/software-install-and-upgrade-overview-evo.html Juniper Networks, Inc. o +1 408 745 2000 43

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc.

There is no non-administrator guidance.

Not applicable for this module.

There are no maintenance requirements.

As a first step for the secure sanitization, the module needs to be powered off which will erase the SSPs in the volatile memory. Then, the files listed related to the static kernel binary and fips_chk_hmac utility must be deleted using the command “shred -zu <file_name>”. Then, for the actual deprecation, the module will be upgraded to a newer version that is approved.

The module does not offer mitigation of other attacks and therefore this section is not applicable.

Not applicable. Juniper Networks, Inc. o +1 408 745 2000 44

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Appendix A. Glossary and Abbreviations AES                     Advanced Encryption Standard API                     Application Programming Interface CAST                    Cryptographic Algorithm Self-Test CAVP                    Cryptographic Algorithm Validation Program CBC                     Cipher Block Chaining CMAC                    Cipher-based Message Authentication Code CMVP                    Cryptographic Module Validation Program CSP                     Critical Security Parameter CTR                     Counter DRBG                    Deterministic Random Bit Generator ECB                     Electronic Code Book ENT (NP)                Non-physical Entropy Source FIPS                    Federal Information Processing Standards GCM                     Galois Counter Mode HMAC                    Keyed-Hash Message Authentication Code KAT                     Known Answer Test MAC                     Message Authentication Code NIST                    National Institute of Science and Technology PAA                     Processor Algorithm Acceleration PKCS                    Public-Key Cryptography Standards RSA                     Rivest, Shamir, Addleman SHA                     Secure Hash Algorithm SSP                     Sensitive Security Parameter XTS                     XEX-based Tweaked-codebook mode with cipher text Stealing Juniper Networks, Inc.      o +1 408 745 2000                                        45

Sunnyvale, CA 94089 www.juniper.net

Junos OS Evolved Kernel Cryptographic Module Juniper Networks, Inc. Appendix B. References FIPS 140-3 FIPS PUB 140-3 - Security Requirements For Cryptographic Modules March 2019 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf FIPS 140-3 IG Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips140-3-ig-announcements FIPS 180-4 Secure Hash Standard (SHS) March 2012 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf FIPS 198-1 The Keyed Hash Message Authentication Code (HMAC) July 2008 https://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf PKCS#1 Public Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1 February 2003 https://www.ietf.org/rfc/rfc3447.txt SP 800-38A Recommendation for Block Cipher Modes of Operation Methods and Techniques December 2001 https://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf SP 800-38B Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication May 2005 https://csrc.nist.gov/publications/nistpubs/800-38B/SP_800-38B.pdf SP 800-38E Recommendation for Block Cipher Modes of Operation: The XTS AES Mode for Confidentiality on Storage Devices January 2010 https://csrc.nist.gov/publications/nistpubs/800-38E/nist-sp-800-38E.pdf SP 800-90Ar1 Recommendation for Random Number Generation Using Deterministic Random Bit Generators June 2015 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation January 2018 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90B.pdf SP 800- Transitioning the Use of Cryptographic Algorithms and Key 131Ar2 Lengths March 2019 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800131Ar2.pdf Juniper Networks, Inc. o +1 408 745 2000 46

Sunnyvale, CA 94089 www.juniper.net