NetScaler MPX

Certificate

Approved Algorithms (74)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for NetScaler MPX
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Firmware load<br/>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Status Output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for NetScaler MPX
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Firmware load<br/>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Status Output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Cloud Software Group NetScaler MPX Hardware Models: 8900 FIPS, 9100 FIPS, 15000-50G FIPS series Part numbers: 8905 FIPS, 8910 FIPS, 8920 FIPS, 9120 FIPS, 9130 FIPS, 9140 FIPS, 9160 FIPS, 9180 FIPS, 9195 FIPS, 15030-50G FIPS, 15040-50G FIPS, 15060-50G FIPS, 1508050G FIPS, 15100-50G FIPS, 15120-50G FIPS Firmware Version: 13.1.FIPS FIPS Security Level: 2 Document Version: 0.4 Prepared for: Prepared by: Cloud Software Group Corsec Security, Inc.

851 Cypress Creek Road 12600 Fair Lakes Circle, Suite 210

Fort Lauderdale, FL 33309 Fairfax, VA 22033 United States of America United States of America Phone: +1 954 267 3000 Phone: +1 703 267 6050 www.cloud.com www.corsec.com

Abstract This is a non-proprietary Cryptographic Module Security Policy for the NetScaler MPX (version: 13.1.FIPS) from Cloud Software Group (Cloud). This Security Policy describes how the NetScaler MPX meets the security requirements of Federal Information Processing Standards (FIPS) Publication 140-3, which details the U.S. and Canadian government requirements for cryptographic modules. More information about the FIPS 140-3 standard and validation program is available on the National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS) Cryptographic Module Validation Program (CMVP) website at http://csrc.nist.gov/groups/STM/cmvp. This document also describes how to run the module in a secure Approved mode of operation. This policy was prepared as part of the Level 2 FIPS 140-3 validation of the module. The NetScaler MPX is referred to in this document as NetScaler MPX or the module. References This document deals only with operations and capabilities of the module in the technical terms of a FIPS 140-3 cryptographic module security policy. More information is available on the module from the following sources:

• The Cloud Software Group website (www.cloud.com) contains information on the full line of services and solutions from Cloud.
• The search page on the CMVP website (https://csrc.nist.gov/Projects/cryptographic-module-validationprogram/Validated-Modules/Search) can be used to locate and obtain vendor contact information for technical or sales-related questions about the module. Document Organization ISO/IEC 19790 Annex B uses the same section naming convention as ISO/IEC 19790 section 7 - Security requirements. For example, Annex B section B.2.1 is named “General” and B.2.2 is named “Cryptographic module specification,” which is the same as ISO/IEC 19790 section 7.1 and section 7.2, respectively. Therefore, the format of this Security Policy is presented in the same order as indicated in Annex B, starting with “General” and ending with “Mitigation of other attacks.” If sections are not applicable, they have been marked as such in this document. NetScaler MPX ©2024 Cloud Software Group

List of Tables NetScaler MPX ©2024 Cloud Software Group

1. General The Netscaler product line optimizes delivery of applications over the Internet and private networks. It is an Application Delivery Controller (ADC) that performs application-specific traffic analysis to intelligently distribute, optimize, and secure L4-L71 network traffic for web-applications. All these capabilities are combined into a single, integrated appliance for increased productivity, with lower overall total cost of ownership. These hardware-based appliances employ a multi-core processor design and are available in a wide range of appliance configurations, from sub gigabit throughput to 50 Gbps2. Each leverages a fully hardened and secure operating system. These appliances are installed in the data center between the clients and the internal customer network. All client requests and server responses pass through it. The internal customer network hosts all load-balancing and authentication services, such as LDAP 3 , Kerberos, and SAML 4 . The module’s features are enabled, and the configured policies are then applied to incoming and outgoing traffic. Figure 1 is an illustration of a typical deployment.

1 L4-L7

• Layer 4
• Layer 7

2 Gbps – Gigabits per second

LDAP – Lightweight Directory Access Protocol

4 SAML – Security Assurance Markup Language

NetScaler MPX ©2024 Cloud Software Group

Client Internet Netscaler Internal Customer Network Authentication Services Server 1 Server 2 Kerberos LDAP Server 3 SAML/DFA/ Oauth/OpenID Figure 1

• Typical NetScaler MPX Deployment The feature set can be broadly categorized as consisting of switching features, security and protection features, and server-farm optimization features:
• Switching features
• When deployed in front of application servers, the NetScaler MPX ensures optimal distribution of traffic by the way in which it directs client requests. Administrators can segment application traffic according to information in the body of an HTTP5 or TCP6 request, and on the basis of L4–L7 header information such as URL 7 , application data type, or cookie. Numerous load balancing algorithms and extensive server health checks improve application availability by ensuring that client requests are directed to the appropriate servers.
• Security and protection features
• NetScaler MPX security and protection features protect web applications from Application Layer attacks. The MPX allows legitimate client requests and can block

5 HTTP – Hypertext Transfer Protocol

TCP – Transmission Control Protocol

7 URL – Uniform Resource Locator

NetScaler MPX ©2024 Cloud Software Group

malicious requests. It provides built-in defenses against denial-of-service (DoS) attacks and supports features that protect against legitimate surges in application traffic that would otherwise overwhelm the servers. An available built-in firewall protects web applications from Application Layer attacks, including buffer overflow exploits, SQL8 injection attempts, cross-site scripting attacks, and more. In addition, the firewall provides identity theft protection by securing confidential corporate information and sensitive customer data.

• Optimization features
• Optimization features offload resource-intensive operations, such as SSL 9 processing, data compression, client keep-alive, TCP buffering, and the caching of static and dynamic content from servers. This improves the performance of the servers in the server farm and therefore speeds up applications. The MPX supports several transparent TCP optimizations, which mitigate problems caused by high latency and congested network links, accelerating the delivery of applications while requiring no configuration changes to clients or servers. The NetScaler MPX hardware platform consists of a Control Plane processing function (providing all configuration and management processing functions) and one to seven Data Plane(s), which provide data packet processing functions. All configuration and management activities are performed at the workstation through the web-based GUI 10 , REST 11 ful Nitro API 12 , and CLI 13 interfaces. The GUI includes a configuration utility for configuring the appliance and a statistical utility called Dashboard. NetScaler MPX is validated at the FIPS 140-3 section levels shown in Table 1. SQL
• Structured Query Language

9 SSL – Secure Sockets Layer

10 GUI – Graphical User Interface

11 REST – Representational State Transfer

12 API – Application Programming Interface

CLI – Command Line Interface

14 N/A – Not applicable

NetScaler MPX ©2024 Cloud Software Group

2. Cryptographic Module Specification NetScaler MPX is a hardware module with a multiple-chip standalone embodiment.

The module was tested and found to be compliant with FIPS 140-3 requirements using the hardware models listed in Table 2. Note that all models within a model family employ the same chassis, ports/interfaces, and memory/storage devices. All models across all families run the same operating system and application firmware. Table 2

• Cryptographic Module Tested Configurations SME
• Small and Medium Enterprise

16 MLE – Medium and Large Enterprise

NetScaler MPX ©2024 Cloud Software Group

Model

Hardware (Part Number and Version) 15060-50G FIPS 15080-50G FIPS 15100-50G FIPS 15120-50G FIPS

Firmware Version 13.1.FIPS 13.1.FIPS 13.1.FIPS 13.1.FIPS

Distinguishing Features

• Intel Xeon E5-2620 v4 (Broadwell)
• 60Gbps L4/L7 throughput for MLE
• Intel Xeon E5-2620 v4 (Broadwell)
• 80Gbps L4/L7 throughput for MLE
• Intel Xeon E5-2620 v4 (Broadwell)
• 100Gbps L4/L7 throughput for MLE
• Intel Xeon E5-2620 v4 (Broadwell)
• 120Gbps L4/L7 throughput for MLE

The module includes the following cryptographic libraries that provide basic cryptographic functionalities and support secure networking protocols:

• Netscaler Control Plane Cryptographic Library v1.0 (Cert. A3942)
• Netscaler Data Plane Cryptographic Library v1.0 (Cert. A3943)
• Intel hardware cryptographic accelerator v1.0 (Cert. A3944)
• NetScaler CPU Jitter Entropy Source v.3.4.0 (Cert. A3513)

Table 3 lists the Approved algorithms implemented in the Netscaler Control Plane Cryptographic Library. Table 3 – Approved Algorithms (Netscaler Control Plane Cryptographic Library) This table includes vendor-affirmed algorithms that are approved but CAVP testing is not yet available.

18 PUB – Publication

19 CBC – Cipher Block Chaining

20 CTR – Counter

21 CFB – Cipher FeedBack

GCM – Galois Counter Mode NetScaler MPX ©2024 Cloud Software Group

24 CVL – Component Validation List

25 IKE – Internet Key Exchange

26 SSH – Secure Shell

SNMP – Simple Network Management Protocol

28 TLS – Transport Layer Security

29 RFC – Request for Comments

30 DRBG – Deterministic Random Bit Generator

31 ECDSA – Elliptic Curve Digital Signature Algorithm

HMAC – (keyed-) Hashed Message Authentication Code NetScaler MPX ©2024 Cloud Software Group

34 RFC – Request for Comments

37 KTS-IFC – Key Transport Scheme - Integer Factorization Cryptography

39 RSA – Rivest Shamir Adleman

NetScaler MPX ©2024 Cloud Software Group

The Netscaler Control Plane Cryptographic Library uses PBKDF option 1a for PEM41 key establishment. The PBKDF takes an input salt that is 128 bits in length with a password/passphrase containing at least 8 characters and produces a random value of 256 bits for AES keys. A password length of 8 characters is enforced by the module (see section 11.2.2 Configure the Passphrase Requirements). In addition, the function has an iteration count of 2,048. The underlying pseudorandom function used in this derivation is HMAC SHA-1. The keys derived from these PBKDF functions are only used for storage applications. The vendor affirms the following cryptographic security methods implemented by the Netscaler Control Plane Cryptographic Library:

• Cryptographic key generation
• As per NIST SP 800-133, the module uses its Approved DRBG to generate cryptographic keys and seeds used for the generation of cryptographic keys. The resulting symmetric key or generated seed is an unmodified output from the DRBG. The module’s DRBG is seeded via entropy generated from CPU Jitter. The module requests a minimum number of 256 bits of entropy per call, and generates symmetric SSPs with up to 256 bits of size and security strength and asymmetric SSPs with up to 6144 bits of size and 178 bits of security strength. The module does not implement any non-approved algorithms allowed in the Approved mode of operation. The Netscaler Control Plane Cryptographic Library, Netscaler Data Plane Cryptographic Library, and Intel Hardware Cryptographic Accelerator implement the non-Approved algorithms shown in Table 4. These algorithms are allowed for use in the Approved mode of operation, as there is no security claimed on their use. Table 4
• Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed The Netscaler Control Plane Cryptographic Library does not include any non-Approved algorithms not allowed in the Approved mode of operation.

Table 5 lists the Approved algorithms implemented in the Netscaler Data Plane Cryptographic Library.

40 SHS – Secure Hash Standard

PEM – Privacy-Enhanced Mail

42 Per FIPS 140-3 Implementation Guidance 2.4.A, this hashing technique with TLS 1.0/1.1 is allowed in the Approved mode with no security claimed.

NetScaler MPX ©2024 Cloud Software Group

Table 5 – Approved Algorithms (Netscaler Data Plane Cryptographic Library)

43 This table includes vendor-affirmed algorithms that are approved but CAVP testing is not yet available.

NetScaler MPX ©2024 Cloud Software Group

*Not all tested algorithms/modes are used by the module. The vendor affirms the following cryptographic security methods implemented by the Netscaler Data Plane Cryptographic Library:

• Cryptographic key generation
• As per NIST SP 800-133, the module uses its Approved DRBG to generate cryptographic keys and seeds used for the generation of cryptographic keys. The resulting symmetric key or generated seed is an unmodified output from the DRBG. The module’s DRBG is seeded via entropy generated from CPU Jitter. The module requests a minimum number of 256 bits of entropy per call, and generates symmetric SSPs with up to 256 bits of size and security strength, and asymmetric SSPs with a The Netscaler Data Plane Cryptographic Library does not include any non-Approved algorithms allowed in the Approved mode of operations. Please see Table 4 above and the preceding paragraph that specifies the non-Approved algorithms allowed in the Approved mode of operation with no security claimed for the Netscaler Data Plane Cryptographic Library. The Netscaler Data Plane Cryptographic Library does not include any non-Approved algorithms not allowed in the Approved mode of operations.

Table 6 lists the Approved algorithms implemented in the module’s Intel Communication Chipset 8955 hardware cryptographic accelerator. Random values are provided by the NetScaler Data Plane Cryptographic Library to cryptographic functions requiring it. NetScaler MPX ©2024 Cloud Software Group

Table 6 – Approved Algorithms (Intel Hardware Cryptographic Accelerator) *Not all tested algorithms/modes are used by the module. The Intel Hardware Cryptographic Accelerator does not include any non-Approved algorithms allowed in the Approved mode of operations. Please see Table 4 above and the preceding paragraph that specifies the non-Approved algorithms allowed in the Approved mode of operation with no security claimed non-Approved algorithms allowed in the Approved mode of operation with no security claimed for the Intel Hardware Cryptographic Accelerator. The Intel Hardware Cryptographic Accelerator does not include any non-Approved algorithms not allowed in the Approved mode of operations. NetScaler MPX ©2024 Cloud Software Group

Table 6 lists the Approved algorithms implemented in the module’s CPU Jitter Entropy Source. Table 7 – Approved Algorithms (NetScaler CPU Jitter Entropy Source) The NetScaler CPU Jitter Entropy Source does not include any non-Approved algorithms allowed in the Approved mode of operations. The NetScaler CPU Jitter Entropy Source does not include any non-Approved algorithms allowed in the Approved mode of operation with no security claimed. The NetScaler CPU Jitter Entropy Source does not include any non-Approved algorithms not allowed in the Approved mode of operations.

The cryptographic boundary of the module is defined by the enclosure of each NetScaler MPX appliance chassis. This includes all ports, physical interfaces, and removable covers. The NetScaler MPX 89xx FIPS appliance is illustrated in Figure 2 and Figure 3. Figure 2 – NetScaler MPX 89xx FIPS Front Panel NetScaler MPX ©2024 Cloud Software Group

Figure 3 – NetScaler MPX 89xx FIPS Rear Panel The NetScaler MPX 91xx FIPS appliance is illustrated in Figure 4 and Figure

5. Figure 4 – NetScaler MPX 91xx FIPS Front Panel Figure 5 – NetScaler MPX 91xx FIPS Rear Panel The NetScaler MPX 15xxx-50G FIPS appliance is illustrated in Figure 6 and Figure
6. Figure 6 – NetScaler MPX 15xxx-50G FIPS Front Panel NetScaler MPX ©2024 Cloud Software Group

Figure 7 – NetScaler MPX 15xxx-50G FIPS Rear Panel

There are no excluded components.

When installed, configured, and operated according to this Security Policy, the module supports the Approved mode of operation only; non-Approved operations are not supported. NetScaler MPX ©2024 Cloud Software Group

3. Cryptographic Module Interfaces FIPS 140-3 defines the following logical interfaces for cryptographic modules: As a hardware appliance, the module’s physical perimeter includes the physical ports, manual controls, physical indicators, and physical, logical, and electrical characteristics of the device. Each of the module’s physical ports and manual controls maps to one of the defined FIPS 140-3 logical interfaces. A mapping of the interfaces, the host device’s physical interfaces, and the module’s logical interfaces can be found in Table
4. Table 8 – Ports and Interfaces The LOM Port is disabled by default, the operator shall not enable this port. For more information see section 11.4.4 Additional Administrator Policies and Guidance. NetScaler MPX ©2024 Cloud Software Group

*1G copper transceivers are supported in 10G slots; 1G fiber transceivers are not supported. **The Disable Alarm button is functional only if a second power supply is installed.

45 NMI – Non-Maskable Interrupt

NetScaler MPX ©2024 Cloud Software Group

4. Roles, Services, and Authentication The sections below describe the module’s authorized roles, services, and operator authentication methods.

The module supports a Crypto Officer (CO) that authorized operators can assume. The CO role performs administrative services on the module, such as initialization, configuration, and monitoring of the module. The CO role includes the privileges listed under the read-only, operator, network, and sysadmin command policies. The module also supports the following role(s):

• User
• The User role can view the current status of the module and employ the services of the module (including IPsec46, TLS, SSH, and SNMPv3 services). The User role includes the privileges listed under the read-only command policy. Table 9 below lists the supported roles, along with the services (including input and output) available to each role. Table 9
• Roles, Service Commands, Input and Output

46 IPsec – Internet Protocol Security

48 NTP – Network Time Protocol

NetScaler MPX ©2024 Cloud Software Group

The module supports up to 10 concurrent connections. Operators connect to the module via an SSH connection (using the CLI or REST API) of via a TLS connection (using the Web GUI). Each operator authenticates using a username/password or a certificate associated with the correct protocol in order to set up secure communication channels. Each secure session for simultaneous operators is distinguished and kept separate by unique session information, which is provided by the session protocol and protected by the OS. Each session remains active (logged in) and secured until the operator logs out or is automatically logged out from inactivity (inactivity default is 900 seconds).

The module supports identity-based authentication; operators explicitly assume their role based on the authentication credentials used. Each role determines the functionality available to the operator within the module. Operators authenticate to the module using either: • a username and password. Password complexity policies can be configured by an operator with the Crypto Officer role and are enforced by the module. All operators are required to follow the password policies. NetScaler MPX ©2024 Cloud Software Group

• certificates associated with the selected protocol. The module supports RSA digital certificate authentication of users during Web GUI/HTTPS (TLS) access. The strength objectives of the authentication mechanisms are as follows: To meet these objectives, the password policies shall be configured by the Crypto Officer such that all passwords shall require:
• At least one lowercase letter
• At least one uppercase letter
• At least one digit The strength calculations for each of the authentication mechanisms are provided in Table 10 below. NetScaler MPX ©2024 Cloud Software Group

Descriptions of the services available are provided in Table 11 below. As allowed per section 2.4.C of FIPS 140-3 Implementation Guidance, the module provides indicators for the use of Approved services through a combination of an explicit indication (via a global Approved mode indicator) and an implicit indication (via the successful completion of the service). Please note that the keys and Sensitive Security Parameters (SSPs) listed in the table indicate the access rights required using the following notation:

• G = Generate: The module generates or derives the SSP.
• R = Read: The SSP is read from the module (e.g., the SSP is output).
• W = Write: The SSP is updated, imported, or written to the module.
• E = Execute: The module uses the SSP in performing a cryptographic operation.
• Z = Zeroize: The module zeroizes the SSP. Table 11
• Approved Services HA
• High Availability

50 NTP – Network Time Protocol

NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

52 DNS – Domain Name System

53 GSLB – Global Server Load Balancing

54 CA – Certificate Authority

55 KSK – Key Signing Key

ZSK – Zone Signing Key

57 IV – Initialization Vector

NetScaler MPX ©2024 Cloud Software Group

58 AAA – Authentication, Authorization, Accounting

59 RDP – Remote Desktop Protocol

60 LDAP – Lightweight Directory Access Protocol

61 DFA – Delegated Form Authentication

SAML – Security Assertion Markup Language

63 IV – Initialization Vector

NetScaler MPX ©2024 Cloud Software Group

The module does not provide any non-Approved services.

64 ID – Identifier

66 The operator shall be aware the new firmware version may not be a FIPS validated version.

NetScaler MPX ©2024 Cloud Software Group

5. Software/Firmware Security All firmware within the cryptographic boundary is verified using an approved integrity technique implemented within the cryptographic module itself. The module implements a 2048-bit RSA digital signature verification with a SHA-512 hash to ensure the integrity of its firmware components. The module’s pre-operational integrity check is performed automatically at module power-up. This integrity check can also be performed on demand by the module operator by performing a reboot. NetScaler MPX ©2024 Cloud Software Group

6. Operational Environment The module employs a limited operational environment. The module does not provide access to a general-purpose operating system (OS). All services provided by the module are provided by the module’s firmware and external interfaces. All firmware upgrades are digitally signed, and a conditional self-test (RSA signature verification) is performed with each upgrade. Therefore, per ISO/IEC 19790:2021 section 7.6.1, requirements for this section are not applicable. NetScaler MPX ©2024 Cloud Software Group

As a multi-chip standalone hardware module, the module includes an enclosure composed of hard, productiongrade, metal components necessary to meet FIPS 140-3 level 2 physical security requirements. The module enclosure completely encloses all of its internal components, and all integrated circuits are coated with commercial standard passivation. The MPX enclosure has removable front and back covers. Each cover is secured with screws and serialized tamperevident seals. Tamper-evident seals are applied at the factory to the modules to protect against unauthorized access to the module. When the module is received, the operator must confirm placement of all tamper-evident seals. Table 12 – Physical Security Inspection Guidelines If there is an attempt to remove a cover, evidence of the attempt will be observable via the residue remaining from the torn label. For additional guidance regarding the inspection of the seals upon receipt, please refer to section 11.1.1 of this document. NetScaler MPX ©2024 Cloud Software Group

8. Non-Invasive Security This section is not applicable. There are currently no approved non-invasive mitigation techniques references in ISO/IEC 19790:2021 Annex F. NetScaler MPX ©2024 Cloud Software Group

9. Sensitive Security Parameter Management The module supports the keys and other SSPs listed in Table 13 and Table 14 below. Table 13 – SSPs

NetScaler MPX ©2024 Cloud Software Group

68 NetScaler MPX detects modification of Public Security Parameters listed in this table.

NetScaler MPX ©2024 Cloud Software Group

69 RBA – Role-based Authentication

NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

*Keys derived from the PBKDF function are only used for storage applications. Table 14 – Other SSPs

70 The indicators provided by zeroization methods specified in this column are implicit as the normal, non-error, status output of the function performing

71 In compliance with TLS 1.2 GCM Cipher Suites for TLS and Section 8.2.1 of NIST SP 800-38D

NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

All RSA and ECDSA keys at 2048 and 3072-bit modulus size are generated internally by the Netscaler Control Plane Cryptographic Library. All RSA and ECDSA keys at the 4096-bit modulus size are generated outside of the module

72 IDP – Identity Provider

NetScaler MPX ©2024 Cloud Software Group

AES GCM encryption is used in the context of the TLS 1.2 protocol. The module supports acceptable AES GCM cipher suites from section 3.3.1 of NIST SP 800-52r2 and meets the (key/IV) pair uniqueness requirements from NIST SP 800-38D. The mechanism for IV generation is compliant with RFC 5288 per scenario 1 in FIPS 140-3 IG C.H. The counter portion of the IV is strictly increasing. The nonce explicit part of the IV does not exhaust the maximum number of possible values for a given session key. This condition is implicitly ensured by the design of the TLS protocol, in which the nonce_explicit is denied exhaustion by the control exerted by the protocol’s (and hence also the module’s) management logic (wherein the nonce_explicit is incremented per each TLS record). This management logic also implies that the probability of an exhaustion of all 264 - 1 values of the nonce_explicit for the same TLS session in a realistic time frame is not significant.

The following table specifies the module’s entropy sources. Table 15 – Non-Deterministic Random Number Generation Specification

10. Self-Tests Both pre-operational and conditional self-tests are performed by the module. Pre-operational tests are performed between the time the cryptographic module is powered up and before the module transitions to the operational state. Conditional self-tests are performed by the module during module operation when certain conditions exist. The following sections list the self-tests performed by the module, their expected error status, and the error resolutions.

The module performs the following pre-operational self-test(s): • Firmware integrity test (using RSA 2048 digital signature verification with SHA-512)

The module performs the following conditional self-tests:

• Conditional cryptographic algorithm self-tests (CASTs)
• Netscaler Control Plane Cryptographic Library
• AES encrypt KAT73
• AES decrypt KAT
• AES GCM encrypt KAT
• AES GCM decrypt KAT
• CTR DRBG KAT
• CTR DRBG instantiate/generate/reseed KAT
• DH primitive “Z” computation test
• ECDH primitive “Z” computation test
• ECDSA sign KAT (P-256)
• ECDSA verify KAT (P-256)
• HMAC KATs (SHA-1, SHA2-256, SHA2-512)
• PBKDF2 KAT (SHA-1)
• RSA sign KAT
• RSA verify KAT
• SHA KATs (SHA-1, SHA2-256, SHA2-512, SHA3-256)
• IKE KDF KAT
• SSH KDF KAT
• TLS v1.0/1.1 KDF KAT
• TLS v1.2 KDF KAT
• Netscaler Data Plane Cryptographic Library
• AES encrypt KAT
• AES decrypt KAT

73 KAT – Known Answer Test

NetScaler MPX ©2024 Cloud Software Group

• AES GCM encrypt KAT
• AES GCM decrypt KAT
• ECDH Primitive “Z” computation test
• ECDSA sign KAT (P-256)
• ECDSA verify KAT (P-256)
• Hash DRBG KAT
• Hash DRBG instantiate/generate/reseed KAT (AES, 256-bit, with derivation function)
• HMAC KATs (SHA-1, SHA2-256, SHA2-512)
• KBKDF KAT
• RSA sign KAT
• RSA verify KAT
• SHA KATs (SHA-1, SHA2-256, SHA2-512)
• TLS v1.0/1.1 KDF KAT
• TLS v1.2 KDF KAT
• TLS v1.3 KDF KAT
• Intel Hardware Cryptographic Accelerator
• AES encrypt KAT
• AES decrypt KAT
• AES GCM encrypt KAT
• AES GCM decrypt KAT
• ECDH Primitive “Z” computation test
• ECDSA sign KAT (P-256)
• ECDSA verify KAT (P-256)
• HMAC KATs (SHA-1, SHA2-256, SHA2-512)
• RSA sign KAT
• RSA verify KAT
• SHA KATs (SHA-1, SHA2-256, SHA2-512)
• TLS v1.0/1.1 KDF KAT
• TLS v1.2 KDF KAT
• Continuous Health Tests on the entropy source:
• Adaptive Proportion Test on entropy source
• Repetition Count Test on entropy source To ensure all conditional CASTs are performed prior to the first operational use of the associated algorithm, all CASTs are performed during the module’s initial power-up sequence. The CASTs for algorithms used in the pre-operational firmware integrity test are performed prior to the integrity test itself; all other CASTs are executed immediately after the successful completion of the firmware integrity test.
• Conditional pair-wise consistency tests (PCTs)
• Netscaler Control Plane Cryptographic Library
• ECDSA sign/verify PCT (upon generation of a key pair for ECDSA signature functions)
• KAS-FFC PCT (upon generation of a key pair for DH Key Agreement functions)
• RSA sign/verify PCT (upon generation of a key pair for RSA signature functions)
• RSA encrypt/decrypt PCT (upon generation of a key pair for RSA key transport functions)
• Other conditional self-tests
• Firmware Load Test (using RSA 2048 digital signature verification with SHA-256) NetScaler MPX ©2024 Cloud Software Group

If the module fails the pre-operational integrity test, the module enters a critical error state and logs an error message. In this state, the boot sequence and entire system is halted. The only action available from this state is to reboot the module to trigger the re-execution of the integrity test. The error condition is considered to have been cleared if the module successfully passes the pre-operational integrity test. If the module continues to return to a halted state, the module is considered to be malfunctioning or compromised, and Cloud Customer Support must be contacted. If the module enters the critical error state due to a failure of any of the conditional CASTs, cryptographic operations are halted, and the module inhibits all data output from the module. The module logs an error message and automatically reboots to clear the error state. The CO must contact Cloud Software Group if this error occurs. The successful completion or failure of the pre-operational self-tests and conditional CASTs can be verified by checking the log files.

• Netscaler Control Plane Cryptographic Library
• Successful completion of the self-tests is indicated by “POST Success” in /var/log/FIPS-post.log. Failure is indicated by “POST Failed” in /var/log/FIPS-post.log.
• Netscaler Data Plane Cryptographic Library
• Successful completion of the self-tests is indicated by “FIPS POST Successful” in /var/log/ns.log. Failure is indicated by “FIPS Post Failed” in /var/log/ns.log. Intel Hardware Cryptographic Accelerator
• Successful completion of the self-tests is indicated by “FIPS POST Successful” in /var/log/ns.log. Failure is indicated by “FIPS Post Failed” in /var/log/ns.log. If any of the remaining conditional self-tests fail, the module goes through a soft error state and the following message is displayed: “Internal failure in SSL cert/key generation tool” For these failures, the module returns to an operational state once the message is displayed (and the error is logged). The user may retry the service (which calls the conditional self-test again) or move to other operations. Successful completion of the conditional self-test is indicated by the absence of an error message. NetScaler MPX ©2024 Cloud Software Group

11. Life-Cycle Assurance The sections below describe how to ensure the module is operating in its validated configuration, including the following:

Operating the module without following the guidance herein (including the use of undocumented services) will result in non-compliant behavior and is outside the scope of this Security Policy.

The module is shipped to the customer in a non-configured state. The CO is responsible for all initial setup activities, including installing and configuring the module firmware. Prior to the installation, the CO should read the document entries within the Citrix ADC 13.1 – Getting Started with Citrix ADC webpage on Citrix’s online product documentation portal. The following sections provide references to step-by-step instructions for the setup and installation of the module, as well as the steps necessary to configure the module for its Approved mode of operation.

Tamper-evident seals are applied at the factory to the modules to protect against unauthorized access to the module. When the module is received, the operator must confirm placement of all tamper-evident seals. The MPX 89xx FIPS will have a total of four (4) tamper-evident seals installed.

• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 8).
• One seal is placed on the back of the enclosure, connecting the back to the top. (Figure 9).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 10).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 11). Figure 8
• Front Cover of the MPX 89xx FIPS NetScaler MPX ©2024 Cloud Software Group

Figure 9

• Back Panel of the MPX 89xx FIPS Figure 10
• Left Side of the MPX 89xx FIPS Figure 11
• Right Side of the MPX 89xx FIPS The MPX 91xx FIPS will have a total of four (4) tamper-evident seals installed.
• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 12).
• One seal is placed on the back of the enclosure, connecting the back to the top. (Figure 9).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 14).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 15). Figure 12
• Front Cover of the MPX 91xx FIPS NetScaler MPX ©2024 Cloud Software Group

Figure 13

• Back Panel of the MPX 91xx FIPS Figure 14
• Left Side of the MPX 91xx FIPS Figure 15
• Right Side of the MPX 91xx FIPS The MPX 15xxx-50G FIPS will have a total of four (4) tamper-evident seals installed.
• One seal is placed on the front cover, connecting the front and top of the enclosure (Figure 16).
• One seal is placed on the back of the enclosure, connecting the back to the top. (Figure 17).
• One seal is placed on the left rear side of the enclosure, connecting the side to the top (Figure 18).
• One seal is placed on the right rear side of the enclosure, connecting the side to the top (Figure 19). Figure 16
• Front Cover of the MPX 15xxx-50G FIPS NetScaler MPX ©2024 Cloud Software Group

Figure 17

• Back Panel of the MPX 15xxx-50G FIPS Figure 18
• Left Side of the MPX 15xxx-50G FIPS Figure 19
• Right Side of the MPX 15xxx-50G FIPS All tamper-evident seals are required for the module to be considered operating in a Approved mode of operation. If any seals show signs of tampering, the CO must contact Cloud Customer Support immediately.

For detailed guidance regarding the installation of the module, please see the Citrix ADC 13.1

• Getting Started with Citrix ADC webpage on the online product documentation portal and refer to the following entries in that document:
• Citrix ADC MPX hardware-software compatibility matrix
• Prepare for Installation
• Install the Hardware The above entries include the MPX support matrix and usage guidelines, prerequisites for setting up the appliance, and installation instructions. To install the required license files, the CO must follow the instructions on the Citrix NetScaler MPX ©2024 Cloud Software Group

ADC licensing overview webpage on Citrix’s online product documentation portal. Once the license files are installed, reboot the module so all licenses are applied.

After the appliance has been setup, the CO is responsible for the general configuration of the module. The Web GUI or CLI can be used for the general configuration of the module. All general configuration must be complete before performing configuration necessary to place the module in a Approved mode of operation. The general configuration requirements and instructions are described in the “Quick Start Installation and Configuration” section of the Citrix ADC Deployment Guide found on Citrix’s online product documentation portal.

The CO is responsible for the security-relevant configuration of the module. To initialize the module for Approved mode of operation, the CO must:

• Configure the passphrase requirements
• Replace the default TLS certificate
• Disable HTTP access to the Web GUI
• Disable local authentication after initial configuration To accomplish these tasks, the CO must follow the procedures detailed in the sections below (for more information, please see the “Configuration Guidelines” section of the document entry Citrix ADC Deployment Guide.

Passphrases are used to derive keys using PBKDF. The CO must configure strong passphrase requirements. This is accomplished with the following steps from the Web GUI:

1. In the Configuration navigation pane, go to System and click the Settings node.
2. In the Settings section, click the Change Global System Settings link.
3. In the Strong Password field, select Enable All.
4. In the Min Password Length field, type “8”.
5. Click OK.

By default, the module includes a factory-provisioned RSA certificate for TLS connections (ns-server.cert and ns-server.key). This certificate is not intended for use in production deployments and must be replaced. The CO must replace the default certificate with a newly-generated certificate after the initial installation. To replace the default TLS certificate, the CO must follow these steps:

1. Run the following CLI command to set the hostname of the module: set ns hostName [hostname]
2. From the Web GUI, complete the following procedure to create a Certificate Signing Request (CSR): • In the Configuration navigation pane, go to Traffic Management and click the SSL node. NetScaler MPX ©2024 Cloud Software Group

In the SSL Certificates section, click the Create Certificate Request link.

Make sure to provide values for all the required fields marked with an “*” and then click Create. Note

that the Common Name field will contain the value of hostname created in step 1 above.

Submit the CSR file to a trusted CA. The CSR file is available in the /nsconfig/ssl directory.

After receiving the certificate from the trusted CA, copy the file to the /nsconfig/ssl directory.

From the

Click Update.

In the Certificate File Name field, choose the certificate file that was received from the CA. Use

the Browse option to choose the file that you have received from CA after signing. Choose

the Browse > Local option if the file is saved on your workstation/local drive.

In the Private Key File Name field, specify the default private key file name (ns-server.key).

Select the No Domain Check option.

Click OK.

For more information, please refer to the Citrix Support Knowledge Center article CTX122521) on Citrix’s online product documentation portal.

configuration. During initial configuration, the CO shall disable local system authentication to block access to all local accounts (including the nsroot account), and the CO must ensure that superuser privileges are not assigned to any user account. To disable local system authentication and enable external system authentication, the CO set system parameter -localauth disabled

Once the module is configured in Approved mode and the nsroot account is disabled, then external authentication must be configured. Follow the instructions on the Citrix ADC 13.1

• Configuring external user authentication webpage found on the Cloud online product documentation portal to configure external system authentication. The CO must ensure the following before enabling external authentication:
• A secure connection is established with the external authentication service.
• Shell access is disabled for all profiles on the external authentication service.

74 HTTPS – Hypertext Transfer Protocol Secure

NetScaler MPX ©2024 Cloud Software Group

No additional startup steps are required to be performed by end-users.

Once installed and configured, the Crypto Officer is responsible for maintaining and monitoring the status of the module to ensure that it is running in its Approved mode. Please refer to this section for guidance that the Crypto Officer must follow to ensure that the module is operating in a Approved manner.

Although pre-operational self-tests are performed automatically during module power up, they can also be manually launched on demand. Self-tests can be executed by:

• power-cycling the module
• using the reset button on the platform (if applicable)
• the reboot CLI command
• the reboot API method
• via the Web GUI by navigating to Configuration > System > System Information and clicking the Reboot button

There are many CSPs within the module’s cryptographic boundary including symmetric keys, private keys, public keys, and passphrases. CSPs reside in multiple storage media including the RAM and system memory. All ephemeral keys are zeroized on module reboot, power removal, or session termination. The KEK is stored as plaintext in non-volatile memory. Zeroizing the KEK renders all passphrases and passwords stored in the non-volatile memory unrecoverable, effectively zeroizing them. The KEK is zeroized via the following CLI command: rm system csps -type KEK SSH private keys are stored as plaintext in non-volatile memory. SSH private keys are zeroized via the following CLI command: rm system csps -type SSH_HOST_KEYS The output (indicator) of both zeroization commands above is successful return from the command line without any error showing on the console. If the commands fails, an error will show on the console before returning control to the user. After the module’s integrity test is complete the firmware clears out all values when the signature verification operation is complete (zeroizes temporary values used in the integrity test). NetScaler MPX ©2024 Cloud Software Group

• Upon successful bootup of the module, the module is configured by default to use only NIST SP 800-52rev2

recommended cipher suites for TLS connections. If modified, the CO must ensure that only Approved

cipher suites are configured while in the Approved mode. It is recommended to use the list of approved

TLS cipher suites in section 3.3 of NIST SP 800-52rev2 as guidance.

• The module must be configured to use PSK-based authentication for IPsec connections. The CO must

provide a PSK value when configuring IPsec profiles via the GUI, CLI, or API. Configuring digital certificate-

based authentication for IPsec connections is prohibited while in the Approved mode of operation.

An operator can view the versioning information by:

• using the following CLI commands: show ns info shows details about the firmware, including firmware version, enabled and disabled features, and configured network information show ns version shows version and build number of the appliance show ns hardware shows details of the appliance hardware and information such as the host ID75 and serial number
• using the RESTful Nitro API with the GET method: https://module-ip-address>/nitro/v5/config/nshardware https://module-ip-address>/nitro/v5/config/nsversion
• using the Web GUI by navigating to Configuration > System > System Information This will display general system and hardware information about the device, including the platform version, CPU information, and appliance serial number. Additionally, the Web GUI’s dashboard includes a system overview section with information such as system HA state, system master state, and system uptime. If any irregular activity is noticed or the module is consistently reporting errors, then Cloud Customer Support should be contacted.

This section notes additional policies below that must be followed by COs: • All private keys (except for SSH private keys) must be stored as PEM files in encrypted format using one of the Approved encryption algorithms listed in Table 3 or Table 5.

75 ID – Identifier

NetScaler MPX ©2024 Cloud Software Group

• Kerberos traffic management/SSO shall not be configured or used in the Approved mode of operation.

• The module supports clustering, and it may act as either the cluster coordinator or the cluster node. Once

appliances are clustered together, all configuration is done on the cluster coordinator and pushed to

nodes within the cluster. For details on configuring clusters, refer to Citrix ADC 13.1 – Clustering.

• The CO must ensure that the “Key” and “AutoKey” authentication parameters are not set when adding

NTP servers via the GUI, CLI, or API.

• If the module’s power is lost and then restored, the CO shall establish a new key for AES GCM encryption.
• The module has built-in CA tools used to create self-signed certificates for testing purposes. While the feature does include the generation of keys, those keys are not considered CSPs (as they are not being used for production purposes). The CO must ensure that all certificates are signed using a trusted CA and not by a self-signed certificate.
• When performing a firmware update the following steps must be performed:
• Load firmware load integrity key
• Load firmware package
• Zeroize SSH keys using rm system csps -type SSH_HOST_KEYS
• Run the installation script
• The operator shall perform the zeroization commands as specified in section 11.4.2 Zeroization prior to invoking the “Firmware Load” service.

Operators with the User role do not have the ability to configure sensitive information on the module. They must be diligent to select strong passwords and must not reveal their password to anyone. Additionally, they must be careful to protect any secret or private keys in their possession. NetScaler MPX ©2024 Cloud Software Group

12. Mitigation of Other Attacks The module does not claim to mitigate any attacks beyond the FIPS 140-3 Level 2 requirements for this validation. Therefore, per ISO/IEC 19790:2021 section 7.12, requirements for this section are not applicable. NetScaler MPX ©2024 Cloud Software Group

Appendix A. Acronyms and Abbreviations Table 16 provides definitions for the acronyms and abbreviations used in this document. Table 16 – Acronyms and Abbreviations NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

NetScaler MPX ©2024 Cloud Software Group

Prepared by: Corsec Security, Inc.

12600 Fair Lakes Circle, Suite 210

Fairfax, VA 22033 United States of America Phone: +1 703 267 6050 Email: info@corsec.com http://www.corsec.com