FIPS 140-2 Non-Proprietary Security Policy for Aruba AP-92, AP-93, AP-105, AP-175 Dell WAP92, W-AP93, W-AP105 and W-AP175 Wireless Access Points Version 1.2 Feb. 2012 Aruba Networks™ 1322 Crossman Ave.
1 2 INTRODUCTION ..................................................................................................................................5 1.1 ARUBA DELL RELATIONSHIP ............................................................................................................. 5 1.2 ACRONYMS AND ABBREVIATIONS ..................................................................................................... 5 PRODUCT OVERVIEW .................................................................
3.2.5 3.2.5.1 To detect access to restricted ports: ...................................................................................23 3.2.5.2 To detect opening of the chassis cover: .............................................................................23 3.2.6 3.3 4 AP-175 TEL Placement ............................................................................................................23 Inspection/Testing of Physical Security Mechanisms ...........................................
1 Introduction This document constitutes the non-proprietary Cryptographic Module Security Policy for the AP-92, AP93, AP-105 and AP-175 Wireless Access Points with FIPS 140-2 Level 2 validation from Aruba Networks. This security policy describes how the AP meets the security requirements of FIPS 140-2 Level 2, and how to place and maintain the AP in a secure FIPS 140-2 mode. This policy was prepared as part of the FIPS 140-2 Level 2 validation of the product.
GE GHz HMAC Hz IKE IPSec KAT KEK L2TP LAN LED SHA SNMP SPOE TEL TFTP WLAN Gigabit Ethernet Gigahertz Hashed Message Authentication Code Hertz Internet Key Exchange Internet Protocol security Known Answer Test Key Encryption Key Layer-2 Tunneling Protocol Local Area Network Light Emitting Diode Secure Hash Algorithm Simple Network Management Protocol Serial & Power Over Ethernet Tamper-Evident Label Trivial File Transfer Protocol Wireless Local Area Network 6
2 Product Overview This section introduces the various Aruba Wireless Access Points, providing a brief overview and summary of the physical features of each model covered by this FIPS 140-2 security policy. 2.1 AP-92 This section introduces the Aruba AP-92 Wireless Access Point (AP) with FIPS 140-2 Level 2 validation. It describes the purpose of the AP, its physical attributes, and its interfaces. Figure 1 - AP-92 Wireless Access Point The Aruba AP-92 is robust-performance 802.
The exact firmware versions tested were: ArubaOS_6xx_6.1.2.3-FIPS Dell_PCW_6xx_6.1.2.3-FIPS 2.1.1.1 Dimensions/Weight The AP has the following physical dimensions: 2.1.1.2 120 mm x 130 mm x 35 mm (4.7" x 5.1" x 1.
Label 11a/n Function 5GHz Radio Status Action Status On – Green 2.4GHz radio enabled in 802.11n mode Flashing - Green 2.4GHz Air monitor or RF protect sensor Off 5GHz radio disabled On - Amber 5GHz radio enabled in WLAN mode On – Green 5GHz radio enabled in 802.11n mode Flashing - Green 5GHz Air monitor or RF protect sensor 2.2 AP-93 This section introduces the Aruba AP-93 Wireless Access Point (AP) with FIPS 140-2 Level 2 validation.
The plastic case physically encloses the complete set of hardware and software components and represents the cryptographic boundary of the module. The Access Point configuration tested during the cryptographic module testing included: Aruba Part Number Dell Corresponding Part Number AP-93-F1 W-AP93-F1 The exact firmware versions tested were: ArubaOS_6xx_6.1.2.3-FIPS Dell_PCW_6xx_6.1.2.3-FIPS 2.2.1.1 Dimensions/Weight The AP has the following physical dimensions: 2.2.1.
Label 11b/g/n 11a/n Function 2.4GHz Radio Status 5GHz Radio Status Action Status Flashing Ethernet link activity Off 2.4GHz radio disabled On – Amber 2.4GHz radio enabled in WLAN mode On – Green 2.4GHz radio enabled in 802.11n mode Flashing - Green 2.4GHz Air monitor or RF protect sensor Off 5GHz radio disabled On - Amber 5GHz radio enabled in WLAN mode On – Green 5GHz radio enabled in 802.11n mode Flashing - Green 5GHz Air monitor or RF protect sensor 2.
2.3.1 Physical Description The Aruba AP-105 Access Point is a multi-chip standalone cryptographic module consisting of hardware and software, all contained in a hard plastic case. The module contains two dual-band 2.4-GHz/5-GHz 802.11 a/b/g/n transceivers, and 4 x integrated, omni-directional antenna elements (supporting up to 2x2 MIMO with spatial diversity). The plastic case physically encloses the complete set of hardware and software components and represents the cryptographic boundary of the module.
ENET 11b/g/n 11a/n Ethernet Network Status / Activity 2.4GHz Radio Status 5GHz Radio Status Link Off Ethernet link unavailable On – Amber 10/100Mbs Ethernet link negotiated On – Green 1000Mbs Ethernet link negotiated Flashing Ethernet link activity Off 2.4GHz radio disabled On – Amber 2.4GHz radio enabled in WLAN mode On – Green 2.4GHz radio enabled in 802.11n mode Flashing - Green 2.
2.4.1 Physical Description The Aruba AP-175 Access Point is a multi-chip standalone cryptographic module consisting of hardware and software, all contained in a hard case. The module contains two 802.11 a/b/g/n transceivers, and 4 x Ntype female interfaces (2 x 2.4 GHz, 2 x 5 GHz) for external antenna support (supports MIMO) The hard case physically encloses the complete set of hardware and software components and represents the cryptographic boundary of the module.
2.4.1.
3 Module Objectives This section describes the assurance levels for each of the areas described in the FIPS 140-2 Standard. In addition, it provides information on placing the module in a FIPS 140-2 approved configuration. 3.
3.2.2 AP-92 TEL Placement This section displays all the TEL locations of the Aruba AP-92. The AP-92 requires a minimum of 3 TELs to be applied as follows: 3.2.2.1 1. 3.2.2.2 To detect access to restricted ports: Spanning the serial port To detect opening of the chassis cover: 2. Spanning the bottom and top chassis covers on the right side 3.
Figure7 - Aruba AP-92 Tel placement right view Figure 8 - Aruba AP-92 Tel placement top view 18
Figure 9 - Aruba AP-92 Tel placement bottom view 3.2.3 AP-93 TEL Placement This section displays all the TEL locations of the Aruba AP-93. The AP-93 requires a minimum of 3 TELs to be applied as follows: 3.2.3.1 To detect access to restricted ports: 1. 3.2.3.2 Spanning the serial port To detect opening of the chassis cover: 2. Spanning the bottom and top chassis covers on the left side 3.
Figure 11 - Aruba AP-93 Tel placement left view Figure 12 - Aruba AP-93 Tel placement right view Figure 13 - Aruba AP-93 Tel placement bottom view 20
Figure 14 - Aruba AP-93 Tel placement top view 3.2.4 AP-105 TEL Placement This section displays all the TEL locations of the Aruba AP-105. The AP-105 requires a minimum of 3 TELs to be applied as follows: 3.2.4.1 3.2.4.2 To detect opening of the chassis cover: 1. Spanning the bottom and top chassis covers on the left side 2. Spanning the bottom and top chassis covers on the right side To detect access to restricted ports: 3.
Figure 16 - Aruba AP-105 Tel placement left view Figure 17 - Aruba AP-105 Tel placement right view Power Input Inlet Figure 18 - Aruba AP-105 Tel placement top view 22
Figure 19 - Aruba AP-105 Tel placement bottom view 3.2.5 AP-175 TEL Placement This section displays all the TEL locations of the Aruba AP-175. The AP-175 requires a minimum of 6 TELs to be applied as follows: 3.2.5.1 3.2.5.2 To detect access to restricted ports: 1. Spanning the USB console port 2. Spanning the power connector plug (AP-175P only) 3. Spanning the hex screw To detect opening of the chassis cover: 4. Spanning the top and bottom chassis covers on the left side 5.
Figure 20 - Aruba AP-175 Tel placement back view Figure 21 - Aruba AP-175 Tel placement left view Figure 22 - Aruba AP-175 Tel placement right view 24
Figure 23 - Aruba AP-175 Tel placement top view Figure 24 - Aruba AP-175 Tel placement bottom view 3.2.6 Inspection/Testing of Physical Security Mechanisms Physical Security Mechanism Recommended Test Frequency Guidance Tamper-evident labels (TELs) Once per month Examine for any sign of removal, replacement, tearing, etc. See images above for locations of TELs Opaque module enclosure Once per month Examine module enclosure for any evidence of new openings or other access to the module internals.
3.3 Modes of Operation The module has the following FIPS approved modes of operations: • Remote AP (RAP) FIPS mode – When the module is configured as a Remote AP, it is intended to be deployed in a remote location (relative to the Mobility Controller). The module provides cryptographic processing in the form of IPSec for all traffic to and from the Mobility Controller.
6. If the staging controller does not provide PoE, either ensure the presence of a PoE injector for the LAN connection between the module and the controller, or ensure the presence of a DC power supply appropriate to the particular model of the module. 7. Connect the module via an Ethernet cable to the staging controller; note that this should be a direct connection, with no intervening network or devices; if PoE is being supplied by an injector, this represents the only exception.
7. Connect the module via an Ethernet cable to the staging controller; note that this should be a direct connection, with no intervening network or devices; if PoE is being supplied by an injector, this represents the only exception. That is, nothing other than a PoE injector should be present between the module and the staging controller. 8.
the AP as Remote Mesh Portal by filling in the form appropriately. Detailed steps are listed in Section “Provisioning an Individual AP” of Chapter “The Basic User-Centric Networks” of the Aruba OS User Guide. Click “Apply and Reboot” to complete the provisioning process. 9. a.
represents the only exception. That is, nothing other than a PoE injector should be present between the module and the staging controller. 8. 9. Once the module is connected to the controller by the Ethernet cable, navigate to the Configuration > Wireless > AP Installation page, where you should see an entry for the AP. Select that AP, click the “Provision” button, which will open the provisioning window. Now provision the AP as Remote Mesh Portal by filling in the form appropriately.
3.5 Logical Interfaces The physical interfaces are divided into logical interfaces defined by FIPS 140-2 as described in the following table. Table 6 - FIPS 140-2 Logical Interfaces FIPS 140-2 Logical Interface Module Physical Interface Data Input Interface 10/100/1000 Ethernet Ports 802.11a/b/g/n Radio Transceiver Data Output Interface 10/100/1000 Ethernet Ports 802.
4 Roles, Authentication and Services 4.1 Roles The module supports the roles of Crypto Officer, User, and Wireless Client; no additional roles (e.g., Maintenance) are supported. Administrative operations carried out by the Aruba Mobility Controller map to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of CSPs.
4.1.2 User Authentication Authentication for the User role depends on the module configuration. When the module is configured as a Remote Mesh Portal FIPS mode and Remote Mesh Point FIPS mode, the User role is authenticated via the WPA2 pre-shared key. When the module is configured as a Remote AP FIPS mode and CPSec protected AP FIPS mode, the User role is authenticated via the same IKEv1/IKEv2 pre-shared key/RSA certificate that is used by the Crypto Officer 4.1.
Authentication Mechanism Mechanism Strength Wireless Client WPA2-PSK (Wireless Client role) For WPA2-PSK there are at least 95^16 (=4.4 x 10^31) possible combinations. In order to test a guessed key, the attacker must complete the 4-way handshake with the AP. Prior to completing the 4-way handshake, the attacker must complete the 802.11 association process.
4.2 Services The module provides various services depending on role. These are described below. 4.2.1 Crypto Officer Services The CO role in each of FIPS modes defined in section 3.3 has the same services Service Description CSPs Accessed (see section 6 below for complete description of CSPs) FIPS mode enable/disable The CO selects/de-selects FIPS mode as a configuration option.
Service Description CSPs Accessed (see section 6 below for complete description of CSPs) Creation/use of secure management session between module and CO Creation/use of secure mesh channel System Status The module supports use of IPSec for securing the management channel. The module requires secure connections between mesh points using 802.
Service Description CSPs Accessed (see section 6 below for complete description of CSPs) Use of WPA pre-shared key for establishment of IEEE 802.11i keys When the module is in mesh configuration, the inter-module mesh links are secured with 802.11i. This is authenticated with a shared secret 802.11i AES-CCM key 802.11i GMK 802.11i GTK WPA2 PSK 4.2.
System status – SYSLOG and module LEDs 802.11 a/b/g/n FTP TFTP NTP GRE tunneling of 802.
5 Cryptographic Algorithms FIPS-approved cryptographic algorithms have been implemented in hardware and firmware. The firmware supports the following cryptographic implementations. ArubaOS OpenSSL AP Module implements the following FIPS-approved algorithms: o AES (Cert. #1851) o HMAC (Cert. #1099) o RNG (Cert. #970) o RSA (Cert. #934) o SHS (Cert. #1628) o Triple-DES (Cert. #1199) ArubaOS Module implements the following FIPS-approved algorithms: o AES (Cert.
6 Critical Security Parameters The following Critical Security Parameters (CSPs) are used by the module: STORAGE CSP CSP TYPE GENERATION And USE ZEROIZATI ON Key Encryption (KEK) Key Triple-DES 168-bits key Hard-coded Stored in flash, zeroized by the ‘ap wipe out flash’ command.
STORAGE CSP CSP TYPE GENERATION And USE ZEROIZATI ON IKEv1/IKEv2 DiffieHellman Private key 1024-bit DiffieHellman private key Generated internally during IKEv1/IKEv2 negotiation Stored in plaintext in volatile memory; zeroized when session is closed or system is powered off Used in establishing the session key for IPSec IKEv1/IKEv2 DiffieHellman shared secret 128 bit Octet Generated internally during IKEv1/IKEv2 negotiation Stored in plaintext in volatile memory; zeroized when session is closed
STORAGE CSP CSP TYPE GENERATION And USE ZEROIZATI ON WPA2 PSK 16-64 character shared secret used to authenticate mesh connections and in remote AP advanced configuration 802.11i Pairwise Master Key (PMK) 512-bit shared secret used to derive 802.11i session keys 802.11i Pairwise Transient Key (PTK) 512-bit shared secret from which Temporal Keys (TKs) are derived 802.11i Encrypted in flash using the KEK; zeroized by updating through administrative interface, or by the ‘ap wipe out flash’ command.
STORAGE CSP CSP TYPE GENERATION And USE ZEROIZATI ON 802.11i Group Master Key (GMK) 256-bit secret used to derive GTK Generated from approved RNG Stored in plaintext in volatile memory; zeroized on reboot Used to derive Group Transient Key (GTK) 802.
7 Self Tests The module performs the following Self Tests after being configured into either Remote AP mode or Remote Mesh Portal mode. The module performs both power-up and conditional self-tests. In the event any self-test fails, the module enters an error state, logs the error, and reboots automatically.
Self-test results are written to the serial console. In the event of a KATs failure, the AP logs different messages, depending on the error. For an ArubaOS OpenSSL AP module and ArubaOS cryptographic module KAT failure: AP rebooted [DATE][TIME] : Restarting System, SW FIPS KAT failed For an AES Atheros hardware POST failure: Starting HW SHA1 KAT ...Completed HW SHA1 AT Starting HW HMAC-SHA1 KAT ...Completed HW HMAC-SHA1 KAT Starting HW DES KAT ...Completed HW DES KAT Starting HW AES KAT ...