HP StorageWorks 1606 Brocade Fabric OS Administrator's Guide v6.3.0 (53-100133 - Page 565

FIPS support Appendix D In this appendix •FIPS overview 523 •Zeroization functions 523 •FIPS mode configuration 525 •Preparing the switch for FIPS 529 FIPS overview Federal information processing standards (FIPS) specify the security standards to be satisfied by a cryptographic module utilized in Fabric OS v6.0.0 and later to protect sensitive information in the switch. As part of FIPS 140-2 level 2 compliance passwords, shared secrets and the private keys used in SSL, TLS, and system login need to be cleared out or zeroized. Power-up self tests are executed when the switch is powered on to check for the consistency of the algorithms implemented in the switch. Known-answer-tests (KATs) are used to exercise various features of the algorithm and their results are displayed on the console for your reference. Conditional tests are performed whenever an RSA key pair is generated. These tests verify the randomness of the deterministic and non-deterministic random number generator (DRNG and non-DRNG). They also verify the consistency of RSA keys with regard to signing and verification and encryption and decryption. ATTENTION When FIPS mode is enabled, this is a chassis-wide setting and affects all logical switches. Zeroization functions Explicit zeroization can be done at the discretion of the security administrator. These functions clear the passwords and the shared secrets. The following table lists the various keys used in the system that will be zeroized in a FIPS-compliant Fabric OS module. TABLE 97 Zeroization Behavior Keys Zeroization CLI Description DH Private keys No CLI required FCSP Challenge Handshake Authentication Protocol (CHAP) Secret secauthsecret --remove value | --all Keys will be zeroized within code before they are released from memory. The secAuthSecret --remove value is used to remove the specified keys from the database. When the secAuthSecret command is used with --remove --all option then the entire key database is deleted. Fabric OS Administrator's Guide 523 53-1001336-01