Terminology and Supported Cryptographic Algorithms

Common Criteria for information technology is an international agreement signed by several countries that permits the evaluation of security products against a common set of standards.

Security-related information—for example, secret and private cryptographic keys and authentication data such as passwords and personal identification numbers (PINs)—whose disclosure or modification can compromise the security of a cryptographic module or the information it protects. For details, see Overview of Roles and Services for Junos OS Evolved in CC Evaluated Configuration.

The set of hardware, software, and firmware that implements approved security functions (including cryptographic algorithms and key generation) and is contained within the cryptographic boundary.

Federal Information Processing Standards. FIPS 140-3 specifies requirements for security and cryptographic modules. Junos OS Evolved in FIPS mode complies with FIPS 140-3 Level 1.

Known answer tests. System self-tests that validate the output of cryptographic algorithms approved for FIPS and test the integrity of Junos OS Evolved modules.

Person with appropriate permissions who is responsible for securely enabling, configuring, monitoring, and maintaining Junos OS Evolved in FIPS mode of operation on a device. For details, see Operational Environment for Junos OS Evolved in CC Evaluated Configuration.

A protocol that uses strong authentication and encryption for remote access across a nonsecure network. SSH provides remote login, remote program execution, file copy, and other functions. It is intended as a secure replacement for rlogin, rsh, and rcp in a UNIX environment. To secure the information sent over administrative connections, use SSHv2 for CLI configuration. In Junos OS Evolved, SSHv2 is enabled by default, and SSHv1, which is not considered secure, is disabled.

The Advanced Encryption Standard (AES), defined in FIPS PUB 197. The AES algorithm uses keys of 128 or 256 bits to encrypt and decrypt data in blocks of 128 or 256 bits.

Elliptic Curve Diffie-Hellman. A variant of the Diffie-Hellman key exchange algorithm that uses cryptography based on the algebraic structure of elliptic curves over finite fields. ECDH allows two parties, each having an elliptic curve public-private key pair, to establish a shared secret over an insecure channel. The shared secret can be used either as a key or to derive another key for encrypting subsequent communications using a symmetric key cipher.

Elliptic Curve Digital Signature Algorithm. A variant of the Digital Signature Algorithm (DSA) that uses cryptography based on the algebraic structure of elliptic curves over finite fields. The bit size of the elliptic curve determines the difficulty of decrypting the key. The public key believed to be needed for ECDSA is about twice the size of the security level, in bits. ECDSA using the P-256, P-384, and P-521 curves can be configured under SSHv2.

Defined as “Keyed-Hashing for Message Authentication” in RFC 2104, HMAC combines hashing algorithms with cryptographic keys for message authentication. For Junos OS Evolved in FIPS mode, HMAC uses the iterated cryptographic hash functions SHA-256 and SHA-512 along with a secret key.

Algorithm for public key cryptography that is based on the presumed difficulty of factoring large integers of up to 8192 bits. The RSA algorithm involves five steps: key generation, sign, verify signature, encryption, and decryption. FIPS provides the use of SSHv2 with RSA, but should use keys of 2048-bits or 3072-bits in length and no smaller. The RSA algorithm is used in the validation of Juniper Networks signed binaries and is also available and used with the ssh command.

Secure hash algorithms (SHA) belonging to the SHA-2 standard defined in FIPS PUB 180-2. SHA-1 produces a 160-bit hash digest. Developed by NIST, SHA-256 produces a 256-bit hash digest, SHA-384 produces a 384-bit hash digest, and SHA-512 produces a 512-bit hash digest.