Nokia 1830 Photonic Service Switch (PSS) & Nokia 1830 Photonic Service Interconnect- Line (PSI-L)

Certificate

Approved Algorithms (45)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Nokia 1830 Photonic Service Switch (PSS) & Nokia 1830 Photonic Service Interconnect- Line (PSI-L)
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Upgrade<br/>Firmware Load<br/>update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-test<br/>unauthenticated<br/>Status Output</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IPSEC</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Nokia 1830 Photonic Service Switch (PSS) & Nokia 1830 Photonic Service Interconnect- Line (PSI-L)
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Upgrade<br/>Firmware Load<br/>update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-test<br/>unauthenticated<br/>Status Output</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IPSEC</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Nokia 1830 Photonic Service Switch (PSS) & Nokia 1830 Photonic Service Interconnect- Line (PSI-L) FIPS Security Level: 1 Document Version: 1.3 Last saved October 28, 2024 11:20

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table of Contents

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy List of Tables List of Figures

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy This document describes the non-proprietary Cryptographic Module Security Policy for the Nokia 1830 Photonic Service Switch (PSS) & Nokia 1830 Photonic Service Interconnect- Line (PSI-L) for multishelf configurations. These are referenced in the document as PSS and PSI-8L. This security policy provides the details for configuring and running these products in a FIPS-140-3 mode of operation and describes how the module meets the level 1 requirements of FIPS 140-3. Please see the references section for a full list of FIPS 140-3 requirements. The security level of the individual areas is shown in the table below. Table 1 - Security Levels

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

For the purposes of FIPS 140-3, the 1830 is designated as a multi-chip standalone hardware cryptographic module.

The following platforms were tested for running the module in approved mode. They all share the same CPU, the Marvell MV78460, which does not contain a Processor Algorithm Accelerator (PAA). Use of circuit packs not tested under this validation will invalidate the FIPS certification. Table 2 – PSS-32 Cryptographic Module Test Configuration Table 3 - PSS-16II Cryptographic Module Test Configuration

Table 4 - PSS-8 Cryptographic Module Test Configuration Table 5 - PSS-24x Cryptographic Module Test Configuration Table 6 – PSS-8x Cryptographic Module Test Configuration

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 7 - PSI-8L Cryptographic Module Test Configuration

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia PSS-32/16II/8/24x PSI-8L SNMP-Engine Table 8 - Approved Algorithms (Nokia SNMP-Engine) The use of truncated HMAC-SHA-1-96 in SNMP protocol is compliant with IG.C.D. Nokia openSSL

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 9 - Approved Algorithms (Nokia openSSL)

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Nokia Jitter Entropy (JENT) Table 10 – Approved Algorithms (Nokia Jitter Entropy (JENT)) Rijndael AES256 CTR/GCM (Nokia Crypto-OTU2 Engine 11QPEN4) Table 11 - Approved Algorithms (11QPEN4)

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy CRYPOTN (Nokia 100G using Microsemi, S13X100E, 2UC400E) Table 12 - Approved Algorithms (S13X100E, 2UC400E) CRYPOTN (Nokia 100G using Microsemi) uses HMAC-SHA256 (and the underlying SHA-256) for the authentication of the pack serial number, which is used to distinguish the two ends of the encryption section (certificate C1545). CRYPOTN (Nokia 100G using Microsemi) uses AES-256-CTR combined with AES-GMAC to form a proprietary authenticated encryption function (GMAC+CTR). The authentication key is derived from the encryption key in exactly the same way that AES-GCM does and also all calculations are done in a GCM like manner. The only difference is that the length of the authentication and cipher text fields are transposed. For CRYPOTN, the IV generation follows the rules of [FIPS 140-3 IG] section C.H (case 4): The probability that the proprietary GMAC+CTR authenticated encryption function ever will be invoked with the same IV and the same key on two (or more) distinct sets of input data shall be no greater than 2-32 for 1830 PSS S13X100E and 2UC400E. The following rules ensure that the construction of the IV, the keys and the Fixed Field used satisfy the above requirement. i.) By implementation, the Fixed Field for AtoZ direction is always different than the ZtoA direction. ii.) By implementation, the IV is composed of a Fixed Field and a running counter (Invocation Field) that starts at zero iii.) By implementation, authentication stops and new keys are required from the key management system if: a. The modules power is lost and then restored (which would cause the IV to be reset) b. Running counter reaches its maximum iv.) Therefore, since IV are only reused with different keys, as long as the probability of new keys being different than any previous used keys exceeds 2-32, then the concatenation of the keys with the IV will also exceed 2-32.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy v.) By Policy, the key management system (external to the module) always generates random 256-bit keys and the probability of the key manager ever generating the same key again shall be no greater than 2-32 during the system lifetime across all keys generated. vi.) By Policy, the key management system uses one newly generated key on one circuit per one key session time period. The key is used for both the AtoZ and the ZtoA directions of that circuit for that key session time period. Table 13 - Non-Approved Algorithms Not Allowed in the Approved Mode of Operation

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

The 1830 PSS is a scalable, next-generation Dense Wave Division Multiplexer (DWDM) platform that supports data center aggregation for Ethernet, Fiber Channel (FC) and other protocols. Multiprotocol services can then be dynamically and flexibly transported over metro and long-haul spans, using Tunable and Reconfigurable Optical Add-Drop Multiplexers (T-ROADMs) for optical wavelengths. The 1830 PSS enables transparent L2 Ethernet or FC and L3 IP services over the optical link. The Nokia 1830 PSS-32 shelves provide increased network flexibility and operational automation through zero-touch, transparent photonic networking. Photonic networks use simplified and accelerated operations to transform wavelength division multiplexing (WDM) into true transport networking with advanced flexibility, performance, automation, and integration. Several Optical Add-Drop multiplexing (OADM) configurations are supported by components that provide optical filter routing, optical amplification, and support for interworking with optical signals originating on non-1830 PSS hardware. The Nokia 1830 PSS-32s are closely related shelves that compose the Nokia 1830 PSS-32 multi-service multi-reach solution. They are scalable optical transport platforms that implement a converged platform solution for multi-service DWDM metro-area, long-haul, and Optical Transport Network (OTN) switching, and leading-edge flexibility with next generation optical and OTN capabilities. Figure 1 - PSS-32 Shelf The Nokia 1830 PSS-32 Central Office Shelf provides a 32-slot primarily DWDM platform. The Nokia 1830 PSS-8 and PSS-16II are the new generation in the 1830 portfolio; it is future-oriented product to provide high capacity, high flexibility and high scalability. Integrated together with existing network management systems and engineering tools, both shelves provide operational automation through zero-touch, transparent photonic networking. These two new products are based on the platform that converges Lambda switching, OTN switching and packet switching in metro aggregation and core layers for service grooming and aggregation. Figure 2 - PSS-16II Shelf

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Figure 3 - PSS-8 Shelf The 1830 PSS-24x is designed to address multilayer, multiservice, optical network scale and efficiency by delivering an industry leading level of optical transport network (OTN) and Ethernet switching. Capable of supporting up to 48 Tbps of OTN/Ethernet switching capacity in a single rack, terabit capable card slots and low system power utilization, the 1830 PSS-24x takes OTN/Ethernet grooming and protection to the next level of scale required to support efficient 100G, 200G, 400G, 500G and beyond wavelength transport. Figure 4 - PSS-24x Shelf The 1830 PSS-8x is optimized for both metro aggregation and metro core switching applications in optical transport networks (OTNs). It provides the flexibility and efficiency required to support an evolution to higher capacity services, enabling continued revenue streams as customers demand more bandwidth and enterprises move toward 10G, 100G, 200G and 400G connectivity. With initial support for 1.6 Tb/s of electrical switching capacity and up to 4 Tb/s with latest switch fabric in a single 10RU shelf, 6.4 Tb/s per 300 mm rack the 1830 PSS-8x provides a small form factor high-capacity metro aggregation point. Figure 5 - PSS-8x Shelf

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

1830 PSI-8L is a scalable and modular shelf that provides a DataCenter form factor compatible option

to deploy Photonic Line configuration. As the industry has transitioned to data center-based applications, the shift has created a tremendous need for optical networks and bandwidth to interconnect data centers, as well as connect local data caching sites to their respective metro point-of-presence locations. While initial focus of data center solutions was on transponder shelves, need for flexibility and scalability of Photonic layer developed a need for appropriate photonic shelf. PSI-8L offers full compatibility to 1830 PSS current and future photonic cards. Figure 6 - PSI-8L Shelf The approved configurations of 1830 PSS must meet stringent Physical, Logical and Operational requirements that are more restrictive than typical telecom or data center deployments. This use of 1830 PSS includes many different multi-shelf configurations with many different circuit pack types. The approved configurations of 1830 PSS consist of secured single shelf entities equipped with equipment controller cards and other cards (like 11QPEN4, S13X100E, 2UC400E) that are coupled into a multishelf system. The multi-shelf system is controlled by a dedicated main shelf. The main shelf provides all the interfaces of the cryptographic boundary. Figure 7 - Multi-Shelf Configuration Each shelf type (PSS-32, PSS-16II, PSS-8, PSS-24x, PSS-8x and PSI-8L) can be used as main shelf or subtending shelf.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Figure 8 - 1830 PSS, 1830 PSI-8L Block Diagram

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

FIPS Configurations of 1830 PSS must meet stringent Physical, Logical and Operational requirements that are more restrictive than typical telecom or data center deployments. While the generalized use of

1830 PSS may normally include many different multi-shelf configurations with many different circuit

pack types, the approved mode configurations of 1830 PSS consist of physically secured single shelf entities equipped with equipment controller cards and 11QPEN4, S13X100E, 2UC400E cards. The cryptographic module is based on the encryption card 11QPEN4 and/or S13X100E or 2UC400E installed on a single shelf version of an 1830 PSS with an Equipment Controller (32EC2E, 8EC2E or CEC2). The cryptographic modules are intended to be deployed at both ends of a transmit/receive pair of external optical fibers between two data centers to provide encryption of 10GE, 8G/10GFC and ODU2 client traffic (for 11QPEN4) and 10x 10GE/ODU2, 2x 40GE or 100GE/ODU4 (for S13X100E) and 4x ODU4 (for 2UC400E) while in flight between data centers. Figure 9 - Network Configuration of 1830 PSS-32/16II/8/24x/8x, PSI-8L

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

The logical interface Control Output is not used by the module. The module does not output any command or control data used to control another module. Table 14 - PSS-32 Ports and Interfaces Figure 10 - PSS32 User Panel - front view

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 15 - PSS-32 User Panel - Ports and Interfaces Table 16 - PSS-16II Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Figure 11 - PSS-16II User Panel - Ports and Interfaces Table 17 - PSS-16II User Panel - Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 18 - PSS-8 Ports and Interfaces

Figure 12 - PSS-8 Shelf Panel – Ports and Interfaces Table 19 - PSS-8 Shelf Panel - Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 20 - PSS-24x Ports and Interfaces

Figure 13 - PSS-24x MFC24X - Ports and Interfaces Table 21 - MFC24x - Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 22 - PSS-8x - Ports and Interfaces

Figure 14

• XMFC - Ports and Interfaces Table 23
• XMFC - Ports and Interfaces n.a. n.a. n.a.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 24 – PSI-8L Ports and Interfaces

Figure 15

• PSI-8L Chassis (Front) - Ports and Interfaces Table 25
• PSI-8L Chassis - Ports and Interfaces

Figure 16 - PSI-8L PSILMFC - Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 26 - PSI-8L PSILMFC - Ports and Interfaces

Figure 17 - 32EC2 - Ports and Interfaces (#6,7) Table 27 - 32EC2 - Ports and Interfaces

Figure 18 - 8EC2 - Ports and Interfaces Table 28 - 8EC2 - Ports and Interfaces

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Figure 19 - CEC2 - Ports and Interfaces (1) Table 29 - CEC2 - Ports and Interfaces

Figure 20 – XCEC8 - Ports and Interfaces (1)

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 30 - XCEC8 – Ports and Interfaces

The 11QPEN4 has four pluggable client interfaces (C1, C2, C3, and C4), four pluggable line interfaces Figure 10. The client and line interfaces are equipped with XFP transceivers. Each transceiver provides an optical fiber interface for receive and an optical fiber interface for transmit. Each line-client pair (L1-C1, L2-C2, L3-C3, L4-C4) provides an encrypted line port and the associated unencrypted client port. In the transmit direction, unencrypted data in the form of Fibre Channel, Ethernet or OTU2 signals enter a client port and are encrypted and then transmitted out the associated line port. In the receive direction, encrypted data is received on the Line Port and then decrypted and sent out the associated client port. The VOA sockets provide a means to optically attenuate the Line port signals- (They do not access or modify the content of the line port signals). Figure 21 - 11QPEN4 - Ports and Interfaces Table 31 - 11QPEN4 - Ports and Interfaces

The S13X100E has

• thirteen pluggable client interfaces
• C1 … C10: SFP+ transceivers
• C21: CFP4 transceiver
• C31, C32: QSFP transceivers
• one fixed line interface
• a status LEDs for the card
• fourteen status LEDs (one for each interface) Each pluggable client interface transceiver and the fixed line side transceiver provides an optical fiber interface for receive and an optical fiber interface for transmit. In the transmit direction, unencrypted data in the form of Ethernet, OTU2 or OTU4 signals enters the client ports, are multiplexed into one ODU4 signal and then encrypted and transmitted out the line port. In the receive direction, encrypted data is received on the Line Port and then decrypted and de-multiplexed and sent out the client ports.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Figure 22 - S13X100E - Ports and Interfaces Table 32 - S13X100E - Ports and Interfaces

The 8P20 has

• a status LEDs for the card
• eight status LEDs (one for each interface) 8P20 is a single-slot, half-height card supported in 1830 PSS-8/PSS-16II/PSS-32 shelves. It has six SFP and two SFP+ ports. It supports 8 sub-10G any-rate client ports in client/line configurations as a client tributary card in PSS-8/PSS-16II shelves, and it supports 6 sub-10G anyrate client ports with two line OTU2 SFP+ ports in the standalone muxponder configuration. Figure 23
• 8P20 - Ports and Interfaces Table 33
• 8P20 - Ports and Interfaces

The 2UC400E has

• two fixed line interfaces (1, 2)
• a status LEDs for the card
• two status LEDs (one for each interface) The fixed line side transceivers provide an optical fiber interface for receive and an optical fiber interface for transmit. This card is used in a switching system, where the client-side signals are received from a backplane interface by the card. In the backplane-to-line direction, unencrypted data in the form of 100GE signals enters the client ports, is multiplexed into one ODU4 signal and then encrypted and transmitted out the line port. In the line-to-backplane direction, encrypted data is received on the Line Port and then decrypted and de-multiplexed and sent out the client ports.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Figure 24

• 2UC400E - Ports and Interfaces Table 34
• 2UC400E - Ports and Interfaces

The MEC2L has no interfaces. All needed interfaces (e.g. for OAMP) are accessible at the PSI-8L Chassis or PSILMFC. Table 35 – MEC2L - Ports and Interfaces

The Filler Card has no transmission functionality. Its main purpose is to guarantee the proper airflow for the cooling of the NE. Figure 25 – PSS32-16II/8 Filler Card - Ports and Interfaces Table 36 - Filler Card - Ports and Interfaces Note: there are different physical filler cards for PSS-32/16II/8, for PSS-24x and for PSI-8L, but the properties of those cards are the same and are reflected in the table above.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy The module supports identity-based authentication and the module supports two roles:

• Crypto Officer Role which is referred to as ‘Admin’
• User Role which is referred to as ‘Crypto’ WebUI. This role provides all services that are necessary for initial installation of the module and provides all services that are necessary for the provisioning and supervision of the transmission encryption function of the module for S13X100E, 11QPEN4 and 2UC400E. Those transmission encryption functions cannot be provisioned by other roles. These services are all Approved services. Table 37 - Roles, Service Commands, Input and Output

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 38 - Approved Services G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 39 - Roles and Authentication The cryptographic module only provides access to a user that assumes a role (Administrator or Crypto) and has a specific identity (username and a password). Users are required to follow password

! (exclamation mark) @ (at sign) $ (dollar sign) ” (double quotation mark) & (ampersand) ' (apostrophe) ( (left parenthesis) ) (right parenthesis) (asterisk) . (period) The first character of the password can be any alphabetic, numeric, or a valid special character. The New Password cannot be the same as or the reverse of the associated username and the password must not have three consecutive identical characters.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 40 - Strengths of Authentication Mechanisms

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

A Nokia-Generic is the means to store software and firmware for a PSS-8/16II/32/24x/8x or PSI-8L system. The Nokia-Generic consists of a number of RPMs and each RPM contains a number of files.

Each RPM is protected in integrity and authentication (proof of origin) using a digital signature based on:

• SHA-512 [FIPS 180-4] for the hash function
• RSA-PSS [FIPS 186-4] with 4096-bits asymmetrical key for the signature calculation using a 512-bit salt (random value) An RPM is checked when it is brought onto the module.

Each file is protected in integrity using an integrity check based on • SHA-256 for the hash function All files are checked a start-up of the module.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

The operational environment is non-modifiable.

For the used Operating Systems and Hardware Platforms, please refer to chapter 2 “Cryptographic module specification”.

6.2 Provision 1830 PSS and 1830 PSI-8L for FIPS 140-3 Secure Mode of Operation

To put the 1830 PSS or 1830 PSI-8L into the secure mode of operation use the procedure described in the respective “Installation and System Turn-Up Guide”, in chapter “Security hardening guidelines for approved configurations” according to the following table: Table 41 - Operational Environment - document reference for secure mode of operation The steps needed to put the module in the secure mode of operation are shown in chapter 16.1.1 “Procedure: Provision for Approved Mode of Operation”.

When configured as specified in Section 16.1 of the Security Policy, the module supports only one mode of operation: the Approved mode.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Physical security is provided compliant to FIPS 140-3 security level 1.

The cryptographic boundary of the 1830 PSS shelves is

• PSS-8: Shelf and Shelf Cover and Shelf Panel
• PSS-16II, PSS-32: Shelf and Shelf Cover and User Panel
• PSS-24x (ETSI version): Rack (shelf is inside the rack)
• PSS-24x (ANSI variant): Shelf and Shelf Cover
• PSS-8x (ANSI variant): Shelf (can be with Shelf Cover)
• PSI-8L: Shelf

The multi-chip standalone cryptographic module includes the following physical security mechanisms:

• Production-grade components and production-grade opaque enclosure with tamper-evident labels.
• Provision the cryptographic module to operate in approved mode: refer to chapter 6.1 “Operating System and Hardware Platforms
• For the used Operating Systems and Hardware Platforms, please refer to chapter 2 “Cryptographic module specification”.
• Provision 1830 PSS and 1830 PSI-8L for FIPS 140-3 Secure Mode of Operation” for detailed instructions.
• all unpopulated slots are equipped with filler cards

The module claims no non-invasive security techniques.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy d n

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy n

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy n n

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy d Table 42 - SSPs Note: The AES-GCM IV is used in the TLS and SSH protocol. For TLS, the AES-GCM IV is internally generated deterministically in compliance with TLSv1.2 GCM cipher suites as specified in RFC 5288 and Section 8.2.1 of NIST SP 800-38D. Per RFC 5246, when the nonce_explicit part of the IV exhausts the maximum number of possible values for a given session key, the module will trigger a handshake to ciphersuites from Section 3.3.1 of SP 800- 52 Rev 2. For SSH, the AES GCM IV is constructed in compliance with the SSHv2 specification (RFCs 4252, 4253 and 5647) and only for use within the SSHv2 protocol.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 43 - Non-Deterministic Random Number Generation Specification

The 1830 PSS-32/PSS-16II/PSS-8/24x and PSI-8L perform known answer tests and critical functions tests at power up. Table 44 - Self-tests Pre-Operational Self-Tests

• OpenSSL Integrity Test
• using HMAC-SHA2-256
• Application Firmware Integrity Test
• using error detection code (SHA2-256) Conditional Cryptographic Algorithm Self-Tests (performed at power-up)
• OpenSSL library
• CTR-based DRBG KAT
• HMAC-SHA1, HMAC-SHA2-256, HMAC-SHA2-384, HMAC-SHA2-512 KAT
• ECDSA signature generation KAT OR ECDSA signature verification KAT
• RSA signature generation KAT
• RSA signature verification KAT
• SNMPv3 KDF KAT
• SSHv2 KDF KAT
• TLS 1.2 KDF KAT
• FFC DH shared secret KAT (2048)
• ECDH shared secret KAT (P-256)
• SHA3-256 (entropy conditioning component)

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy HMAC KATs with SHA-1, SHA2-256, SHA2-384, and SHA2-512 utilize (and thus test) the full functionality of the SHA-1, SHA2-256, SHA2-384, and SHA2-512 algorithms; therefore, no independent KATs for SHA-1, SHA2-256, SHA2-384, and SHA2-512 implementations are required. Conditional Self-Tests

• Firmware Load Test using RSA 4096 digital signature verification with SHA2-512
• Entropy RCT/APT
• ECDSA PCT
• RSA PCT
• DH/ECDH Key Assurances Critical Functions Tests
• DRBG Health Checks (performed at power-up)

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

Nokia delivers the module both physically and electronically. The hardware is delivered physically via a trusted carrier. The box is sealed by PVC adhesive tape with identification labels. A tamper free tape is also applied. The box is then belted if required. The software and guidance documentation are retrieved electronically from a web site. Hardware and software items associated with the module are itemized by a unique Nokia Part Number (APN). In addition, each 1830 PSS or 1830 PSI-8L shelf can be ordered as a kit with the minimum required equipment for approved operation. The kit is also specified by a unique APN. Final versions of 1830 PSS customer documentation are posted on the Nokia Support portal, a Nokia Extranet site for internal users and external customers with entitlement. If a customer document is reissued, the re-issue is then posted on Nokia Support portal and the previous issue of the document removed.

The approved mode of operation has to be prepared by the Crypto Officer (Admin) by following the instructions in chapter 15 and chapter 16. If the module starts up successfully, then the module has passed all self-tests (described in chapter 10) and is operating in the approved mode of operation

When a zeroization of all SSPs is needed, because the module shall be decommissioned or taken out of the secured mode of operation, then the Return-to-Factory procedure can be used. Please note, that this erases also all Firmware and thus leads to a need to send the equipment back to the factory before the next use. For details refer to chapter 16.4.

The module has not been designed to mitigate any specific attacks beyond the scope of FIPS 140-3 requirements.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy Table 45 - Acronyms

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

15 Appendix A – Installing Tamper-evident labels

Installing tamper labels is not needed for FIPS 140-3 security level 1.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

16 Guidance – System Configuration Procedures

This procedure describes how to configure the NE in order to comply with the Federal Information Processing Standards (FIPS) Publication 140-3 (Security Requirements for Cryptographic Modules), detailing the U.S and Canadian governments' requirements for cryptographic modules.

Important! Until the NE is secured by performing the steps described up to and including chapter Error! Reference source not found., it must not be connected to a LAN in order to avoid vulnerabilities. For approved configuration, the NE must run an ECN software load. When the NE is operational, the NE, along with the whole communication network, must be under restricted access. Internet access must be disabled, and access within the customer DCN must be restricted to selected systems, for example the NMS and computers of administrators. The Gateway NE (GNE) does have a rudimentary firewall, but the PSS network should also be protected from network attacks, such as Denial of Service attacks or rogue packets. This protection is typically implemented at the DCN router that connects to the GNE. Additionally, IPSec tunneling between the DCN router and the management system(s) is recommended.

The NE is properly installed and running: The NE is physically assembled, and the software is installed. The NE has booted and can be accessed via CIT.

Any equipment used to access the NE must be secured through the current state of the art security measures. This applies to computers that the 1830 PSS WebUI user interface or WS-NOC run on, but also, to the use of input devices for such computers. Note: A cordless mouse or keyboard cannot be considered secure. The OWASP (Open Web Application Security Project) community, among others, can provide the best practices in regard to this topic.

All communication from/to the Management System(s) can be secured using an IPSec tunnel. This is an additional security measure that is not required for most communication channels. The communication channels where this is mandatory, are explicitly shown in the respective chapters. Irrespective of the use of IPSec tunnel, secure protocols (SSH, SNMPv3, HTTPS, etc.) should be used to connect to the NE. The IPSec tunnel is set up between the management system(s) and a DCN router placed next to the NE. From the DCN router to the NE, there is no IPSec tunnel possible, so this physical connection must be physically secured. Note: The approved configuration allows secure communication protocols at the OAMP interface only.

Refer to the 1830 Photonic Service Switch (PSS) Release 22.12 Command Line Interface Guide for more detailed information regarding the CLI commands used in this chapter.

When the NE is connected to a DCN while the default user account passwords were not yet changed or ZTP enabled, and keys not set, the NE might be compromised. Required steps:

1. Disconnect the NE from DCN, if the NE was connected to the DCN before.
2. If the security was already compromised (e.g., illegitimate user accounts were created), the system shall be reset to an initial status wiping out all configuration data. After this, restart the system turn-up procedure.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy The following command resets the system: config admin factory-reset

2. From the serial console of the active EC cryptographic module, access CLI as the default administrator 'admin’. Set the NE TID.”
3. From the serial console of the active EC, login to CLI as default administrator ‘admin’. Execute the following CLI command to set the OAMP IP address. config interface usrpnl oamp ip <ipaddress/mask>

Required steps must be executed using a locally connected Craft Interface Terminal (CIT) in order to avoid interference from DCN before the NE is secured.

NE keys and certificates must be generated. Required steps:

1. Generate an SSH key. crypto key generate all
2. Generate an SSL key (note: SSL means really TLS). crypto sslkey generate keytype rsa keylen 2048
3. Get and install a signed TLS X.509v3 certificate. Refer to chapter 16.1.1.13 for more detailed information. Note: When the NE is security hardened it can be connected to the LAN. Note: Please refer to the User Provisioning Guide for more information.

In section Error! Reference source not found., an SSL/TLS key was generated. Create a signed X.509v3 certificate for the NE based on this SSL/TLS key. Required steps: Create a signed X.509v3 certificate and load it onto the NE. Use the following commands:

1. Generate a CSR (Certificate Signing Request): config sslcsr generate
2. Provision Subject Alternative Names (SAN) if SAN authentication/server authentication is required on the peer. config sslcsr san {add | delete} {<ip-address> |<domain>}
3. Upload the CSR to a file server: config software server transfer < ip address of server: example 135.104.252.100> config software server transfer protocol sftp config software server transfer userid < user-id-forserver> config software server transfer root <example path: /home/sw1/ SAN8CSR.csr> config software server transfer detail config software server transfer load sslnecsr
4. Create the certificate by signing the CSR by an external CA (Certificate Authority).
5. Download the signed certificate to the NE: config software server transfer protocol sftp config software server transfer userid < user-id-forserver> config software server transfer root <example path: /home/sw1/ SAN8certificate.pem>

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy config software server transfer load sslomscsr 6. Install downloaded certificate: config sslcert yes Be sure to install the NE root certificate on any clients connecting to the WebUI Note: Please refer to the User Provisioning Guide for more information.

In order to enforce secure (encrypted) protocols, the NE must be set to secure mode. Required step: 1. Set NE to secure mode via CLI: config admin ui mode encrypted

System security settings The following settings are required to help enforce better security. config admin session maxfailedlogins 5 config admin authentication local password minlength 12 config admin session timeout 15 config admin maxsession 1 config admin minwaitlogin 15 Default local accounts At the time of NE deployment, there are two default accounts: admin and service. admin: The admin account is used to initially configure the NE. This includes creation of additional accounts to manage the NE. service: The service account is used by Nokia service personnel to install the NE and perform maintenance activities. Required steps:

1. Change the default admin password. config admin users edit admin passwd
2. Create a non-default account with administrative privileges to be used instead of the default admin account. For example, to create a user named “adminjoe” with administrative privileges, use the following command: config admin users add adminjoe administrator Note: Should you lose the new password, or disable the users, no maintenance access to the system will be available in case of emergency. It is recommended to always create new users with Administrative privilege for periodic work, and to disable the default user permanently. Recommended steps:
3. Disable the default admin account. config admin users edit admin status disabled
4. Disable the default service account. config admin users edit service status disabled

The following steps must be executed regardless if the NE is to be managed using SNMP or not. Accounts for SNMP are maintained by the NE. Internal accounts Important! The SNMP user accounts v3IntComDefUser is used for internal purposes. It must not be changed or removed. Default accounts At the time of NE deployment, there are two default accounts: v3DefaultUser and v3DftAdvUser. Required steps: 1. Disable default accounts: config admin snmpusers edit v3DftAdvUser status disabled config admin snmpusers edit v3DefaultUser status disabled Other predefined accounts If the NE was connected to a DCN before it was secured, other accounts might have been created.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy If other accounts than the default accounts are present, then those accounts must be deleted unless there is a clear and acceptable reason for them to be there. Required step:

1. Check for additional accounts and delete all non-default accounts (unless they are legitimate). User-defined accounts Required steps:
2. Create SNMP accounts as needed for accessing management systems.
3. Configure security options and passwords in alignment with accessing management systems. WS-NOC related accounts WS-NOC connection is not required. If WS-NOC is used, one SNMP user account is needed for the WS-NOC to manage the NE. The WS-NOC account is an SNMPv3 user. Required steps:
4. Create an SNMPv3 user with the following commands: config admin snmpusers add newnfmuser120 admin aes256sha256 config admin snmpusers edit newnfmuser120 privpasswd

The Open Agent provides the NETCONF/gRPC interface and is disabled by default. If the Open Agent is enabled, disable it. Required step: 1. If it was enabled, use the following command to disable Open Agent: config general openagent disabled

By default, ZTP is enabled. Disable ZTP mode. Required step: 1. Disable ZTP via an Admin CLI account: config admin ztp disable

Enable fips-squelching mode. Required step: 1. In CLI, enter: config general fips-squelching enable

Accounts for maintenance are maintained by the NE. Those accounts are to be distinguished from TL1/CLI/WebUI, SNMP, or GMPLS CP accounts. Default accounts At the time of NE deployment, there are two default accounts: maint1 and maint2. The default status is that they are disabled. Required steps:

1. Disable remote access to maint1 if it is enabled. config admin system maint1 disable
2. Change the default passwords. Use an Admin CLI account to change the passwords of maint1 and maint2: config admin system maint1 <password> config admin system maint2 <password> Note: Passwords must available when required for action by service personnel and kept in a safe area. Recommended step:
3. Disable remote access to maint2 if it is enabled. maint2 has less access rights than maint1 and could be used for remote access while remote access for maint1is disabled. Still, the disabling of remote access to maint2 is recommended. To disable the remote access to maint2, use an Admin CLI account to execute:

16.1.1.22 config admin system maint2 disableDisable local serial console

The local serial console can be used for local maintenance actions. For the login the maint1 user

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy will be used. It is required that it is either managed by the autostate feature [see 16.1.1.28] or permanently disabled. To disable it, execute the following command: config admin system maint1 localdisableNote: If all management protocols at the OAMP interface and remote maintenance logins have failed or are disabled, then no maintenance access is possible anymore - neither remote nor local. If the local serial console is enabled, it will be notified by the standing condition MAINT-ALLOWEDLOCAL. The default severity is NR (not reported). It appears in the condition list and logs only. If the severity shall be increased to MJ (major), CR (critical) or WR (warning), then it is automatically present in the alarm list because the FIPS status of the NE is violated in case it is open.

The required steps described in the preceding sections of the security hardening guidelines were executed. This means that the NE is now hardened to a degree that it is safe to connect to a general network.

The next steps can be done using any management access type that has a secure connection. Configuration access via remote access is now safe, and you may connect to a LAN now. Note: The DCN is secured, using IP ACL throughout the DCN (see DCN Guide for concepts and instructions).

The NE must be in a secure network; see chapter 16.1.1.4. In addition, the communication channel in and out of the NE must be restricted.

16.1.1.28 Customer LAN ports, Embedded Communication Channel (ECC)

Recommended steps: 1. Assign IP Address to OAMP port of TOE: config interface mfc shelf/slot/oamp <ip address for the TOE> config cn routes default add <ip address for DHCP server>

The following services should only be enabled if they are used. If they are not used, they should be disabled. The following services are covered by this document: NTP, Radius, TACACS+, SWNE, Installation from USB Stick, SFTP Client, OSPF, Syslog, SNMP Traps, GMPLS CP, ZTP.

To authenticate the NTP server(s), a key must be provisioned per NTP server used. Required steps:

1. Establish an authentication key on each NTP server.
2. Provision each NE receiving time from that server with the authentication key. Note: The length of the NTP Key must be at least 12 characters and the NTP Key hash type must be SHA-1 (Secure Hash Algorithm 1), not MD5 (Message-digest algorithm).

For approved configuration, SWNE functionality must be disabled. NEs can be in a server or in a client role. Required step: Disable the SWNE functionality: 1. Execute the following command: config general ftpserver disable Note: In case of a software update, SWNE functionality must be enabled temporarily.

For approved configuration, use of USB ports is prohibited. The USB ports are therefore sealed and shall not be used.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

The NE can be accessed via bluetooth using a bluetooth dongle. For approved configuration, access via bluetooth must be disabled. Required step: 1. Execute the following command to disable it:

1. Provision key-based authentication which supports mutual authentication for SFTP file transfers. The following file transfers support this:

• SW download config software server
• Software dynamic download config software dynamic refreshserver
• Data backup & restore config database server ip <ip address of server: example 135.104.252.100> config database server protocol sftp config database server userid <user-id-for-server> config database path <example path: /home/sw1/ajayoka/DB>
• Log file transfer config transferlog server ip <ip address of server: example

config transferlog server protocol SFTP config transferlog server userid crypto prompted for <password> config transferlog server port 22 config transferlog path /home/crypto • • Syslog file transfer config admin transfersyslog server • System Trust anchor installation file transfer config keystore system trustanchor Note: The parameters are always the same, but the commands differ. The configuration must be done for all used services.

2. Provision the server and the user credentials on the server.[use server documentation]
3. Once the provisioning is complete, mutual authentication is available for SFTP. Required steps:
4. Enable SFTP only if needed.
5. The recommended password length for the password used for the SFTP server login as a client is 12 characters. Alternatively, use key based authentication.

Required step: 1. Set the SNMP trap destination(s) for 1830 SMS. config snmpserver trapdest add <snmp-server-name> <ip address of server> 1500 3 v3 0 smsuser256

1. Use TLS 1.2: config admin security tls tls-system version max 1.2 config admin security tls tls-system version min 1.2 config admin security commit

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

The NE stores information in various log files. This log files should be periodically checked. Recommended step: 1. Check log files periodically for anomalies. Show logs all

A FIPS self-test can be initiated by power cycling the system. (This action will impact service until system fully boots up.) After starting, verify the status of the self-test. FIPSSFMISMATCH or AESFIPSFAILURE conditions must not appear. show condition

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

This procedure describes how to zeroize all SSPs to comply with the Federal Information Processing Standards (FIPS) Publication 140-3 (Security Requirements for Cryptographic Modules), detailing the U.S and Canadian governments' requirements for cryptographic modules.

All SSPs are zeroized when the module executes the command to return it to factory. Administrator privilege is needed to execute this command. Required steps: 1. initiate Return-to-Factory: config admin return-to-factory

Zeroizing all SSPs in the module takes some time, so the operator must wait for the internal steps to complete. The Zeroization process is considered completed once all controllers show their LED in Solid Red. Required steps: 1. Wait for all controller card LEDs to show solid red.

Nokia 1830 PSS/PSI-8L R23.3 FIPS 140-3 Security Policy

In additional to direct guidance provided in this security policy, additional detailed guidance is available to registered customers from Nokia documentation web site at documentation.nokia.com. Note: the ITUG documents of R22.12 are valid for R23.3 as well.