Dell W-AP224 and W-AP225 Wireless Access Points with Dell AOS FIPS Firmware Non-Proprietary Security Policy FIPS 140-2 January 26, 2015 This is to advise that the Aruba Networks document entitled “FIPS 140-2 Non-Proprietary Security Policy for Aruba AP-224 and AP-225 Wireless Access Points” Version 2.3, dated June 2014, applies to Dell W-AP224 and W-AP225 Wireless Access Points with Dell AOS FIPS Firmware.
Dell Networking W-AP224 and W-AP225 Product Image: Aruba Networks AP-224 and AP-225 Product Image: If you have questions or concerns, please contact Dell Technical Support at www.dell.com/support, additional product documentation is also available by device under user manuals.
FIPS 140-2 Non-Proprietary Security Policy for Aruba AP-224 and AP-225 Wireless Access Points Version 2.3 June 2014 Aruba Networks™ 1322 Crossman Ave.
Copyright © 2013 Aruba Networks, Inc. Aruba Networks trademarks include ,Aruba Networks®, Aruba Wireless Networks®, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management System®, Mobile Edge Architecture®, People Move. Networks Must Follow®, RFProtect®, Green Island®. All rights reserved. All other trademarks are the property of their respective owners.
1 INTRODUCTION .................................................................................................................................5 1.1 2 ACRONYMS AND ABBREVIATIONS ................................................................................................... 5 PRODUCT OVERVIEW ......................................................................................................................6 2.1 AP-224...............................................................................
8 SECURE OPERATION ......................................................................................................................
1 Introduction This document constitutes the non-proprietary Cryptographic Module Security Policy for the Aruba AP224 and AP-225 Wireless Access Points with FIPS 140-2 Level 2 validation from Aruba Networks. This security policy describes how the AP meets the security requirements of FIPS 140-2 Level 2, and how to place and maintain the AP in a secure FIPS 140-2 mode. This policy was prepared as part of the FIPS 1402 Level 2 validation of the product.
2 Product Overview This section introduces the various Aruba Wireless Access Points, providing a brief overview and summary of the physical features of each model covered by this FIPS 140-2 security policy. 2.1 AP-224 This section introduces the Aruba AP-224 Wireless Access Point (AP) with FIPS 140-2 Level 2 validation. It describes the purpose of the AP, its physical attributes, and its interfaces. The Aruba AP-224 is high-performance 802.11ac (3x3:3) MIMO, dual-radio (concurrent 802.
The module provides the following power interfaces: 48V DC via Power-over-Ethernet (POE) 12V DC power supply 2.1.1.
2.2 AP-225 This section introduces the Aruba AP-225 Wireless Access Point (AP) with FIPS 140-2 Level 2 validation. It describes the purpose of the AP, its physical attributes, and its interfaces. The Aruba AP-225 is high-performance 802.11ac (3x3:3) MIMO, dual-radio (concurrent 802.11a/n/ac + b/g/n/ac) indoor wireless access points capable of delivering combined wireless data rates of up to 1.9 Gbps.
2.2.1.
3 Module Objectives This section describes the assurance levels for each of the areas described in the FIPS 140-2 Standard. . 3.
Allow 24 hours for the TEL adhesive seal to completely cure. Record the position and serial number of each applied TEL in a security log. Once applied, the TELs included with the AP cannot be surreptitiously broken, removed or reapplied without an obvious change in appearance: Each TEL has a unique serial number to prevent replacement with similar label. To protect the device from tampering, TELs should be applied by the Crypto Officer as pictured below: 3.2.
Figure 2: AP-224/225 Back/Bottom View 3.2.3 Inspection/Testing of Physical Security Mechanisms Table 4 - Inspection/Testing of Physical Security Mechanisms Physical Security Mechanism Recommended Test Frequency Guidance Tamper-evident labels (TELs) Once per month Examine for any sign of removal, replacement, tearing, etc. See images above for locations of TELs.
3.4 Logical Interfaces The physical interfaces are divided into logical interfaces defined by FIPS 140-2 as described in the following table. Table 5 - Logical Interfaces FIPS 140-2 Logical Interface Data Input Interface Data Output Interface Control Input Interface Status Output Interface Power Interface Module Physical Interface 10/100/1000 Ethernet Ports 802.11a/b/g/n/ac Antenna Interfaces USB 2.0 port 10/100/1000 Ethernet Ports 802.11a/b/g/n/ac Antenna Interfaces USB 2.
4 Roles, Authentication and Services 4.1 Roles The module supports the roles of Crypto Officer, User, and Wireless Client; no additional roles (e.g., Maintenance) are supported. Administrative operations carried out by the Aruba Mobility Controller map to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the module, including the configuration, loading, and zeroization of CSPs.
4.1.3 Wireless Client Authentication The wireless client role defined in each of FIPS approved modes authenticates to the module via WPA2. Please notice that WEP and TKIP configurations are not permitted in FIPS mode. In advanced Remote AP configuration, when Remote AP cannot communicate with the controller, the wireless client role authenticates to the module via WPA2-PSK only. 4.1.
4.2 Services The module provides various services depending on role. These are described below. 4.2.1 Crypto Officer Services The CO role in each of FIPS modes defined in section 3.3 has the same services. Table 7 - Crypto Officer Services Service Description CSPs Accessed (see section 6 below for complete description of CSPs) FIPS mode enable/disable The CO selects/de-selects FIPS mode as a configuration option. None.
4.2.3 Wireless Client Services The following module services are provided for the Wireless Client role in each of FIPS approved modes defined in section 3.3. Table 11 - Wireless Client Services Service Description CSPs Accessed (see section 6 below for complete description of CSPs) Generation and use of 802.11i cryptographic keys In all modes, the links between the module and wireless client are secured with 802.11i.
5 Cryptographic Algorithms FIPS-approved cryptographic algorithms have been implemented in hardware and firmware. The firmware supports the following cryptographic implementations. ArubaOS OpenSSL Module implements the following FIPS-approved algorithms: o AES (Cert. #2680) o CVL (Cert. #152) o DRBG (Cert. #433) o ECDSA (Cert. #469) o HMAC (Cert. #1666) o KBKDF (Cert. #16) o RSA (Cert. #1379) o SHS (Cert. #2249) o Triple-DES (Cert. #1607) o RSA (Cert.
FIPS186-2: ALG[ANSIX9.31]: Key(gen)(MOD: 1024 PubKey Values: 65537) ALG[RSASSA-PKCS1_V1_5]: SIG(gen): 1024, SHS: SHA-1/SHA-256/SHA384/SHA-512, 2048, SHS: SHA-1 o ECDSA (Cert. #466; non-compliant with the functions from the CAVP Historical ECDSA List) FIPS186-2: SIG(gen): CURVES(P-256 P-384), SHS: SHA-1 ArubaOS UBOOT Bootloader implements the following FIPS-approved algorithms: o RSA (Cert. #1380) o SHS (Cert.
6 Critical Security Parameters The following Critical Security Parameters (CSPs) are used by the module: Table 12 - Critical Security Parameters # Name CSPs type Generation Storage and Zeroization Use 1 Key Encryption Key (KEK) Triple-DES 168-bit key Hardcoded during manufacturing Stored in Flash. Zeroized by using command ‘ap wipe out flash’ Encrypts IKEv1/IKEv2 Preshared key, ECDSA private key and configuration parameters.
7 RNG seed key FIPS 186-2 RNG Seed key (512 bits) Derived using NONFIPS approved HW RNG Stored in plaintext in volatile memory. Zeroized on reboot. Seed 186-2 General purpose (x-change Notice); SHA-1 RNG 8 Diffie-Hellman private key Diffie-Hellman private key (224 bits) Generated internally during Diffie-Hellman Exchange Stored in the volatile memory. Zeroized after the session is closed.
14 IKEv1/IKEv2 Preshared key 8-64 character preshared key CO configured Stored encrypted in Flash with the KEK. Zeroized by changing (updating) the preshared key through the User interface. 15 skeyid HMAC-SHA1/256/384 (160/256/384 bits) Established during IKEv1 negotiation Stored in plaintext in Key agreement in volatile memory. IKEv1 Zeroized when session is closed.
21 RSA Private Key RSA 2048 bits private key Generated at time of manufacturing by the TPM. Stored in non-volatile memory (Trusted Platform Module). Zeroized by physical destruction of the module. 22 RSA public key RSA 2048 bits public key Generated at time of manufacturing by the TPM. Stored in non-volatile Used by memory. Zeroized by IKEv1/IKEv2 for physical destruction of device authentication the module.
30 802.11i Group Transient Key (GTK) 256-bit shared secret used to derive group (multicast) encryption and integrity keys 31 802.11i Group AESCCM Data Encryption/MIC Key 32 Factory CA Public Key Internally derived by AP which assumes “authenticator” role in handshake Stored in plaintext in volatile memory; zeroized on reboot Used to derive multicast cryptographic keys 128-bit AES-CCM key Derived from 802.
7 Self Tests The module performs the following Self Tests after being configured into either Remote AP mode or Remote Mesh Portal mode. The module performs both power-up and conditional self-tests. In the event any self-test fails, the module enters an error state, logs the error, and reboots automatically.
o ArubaOS Crypto Module o o o CRNG Test to Approved RNG (FIPS 186-2 RNG) ECDSA Pairwise Consistency Test RSA Pairwise Consistency Test o ArubaOS Uboot BootLoader Module o Firmware Load Test - RSA PKCS#1 v1.5 (2048 bits) signature verification o CRNG tests to non-approved RNGs These self-tests are run for the Freescale hardware cryptographic implementation as well as for the Aruba OpenSSL and ArubaOS cryptographic module implementations. Self-test results are written to the serial console.
8 Secure Operation The module can be configured to be in the following FIPS approved modes of operations via corresponding Aruba Mobility Controllers that have been certificated to FIPS level 2: • Remote AP FIPS mode – When the module is configured as a Remote AP, it is intended to be deployed in a remote location (relative to the Mobility Controller). The module provides cryptographic processing in the form of IPSec for all traffic to and from the Mobility Controller.
Select that AP, click the “Provision” button, which will open the provisioning window. Now provision the AP as Remote AP by filling in the form appropriately. Detailed steps are listed in section entitled “Provisioning an Individual AP” in the ArubaOS User Guide. Click “Apply and Reboot” to complete the provisioning process. a. 9.
a. 9. For CPSec AP mode, the AP always uses certificate based authentication to establish IPSec connection with controller. AP uses the RSA key pair assigned to it at manufacturing to authenticate itself to controller during IPSec. Refer to “Configuring Control Plane Security” Section in Aruba OS User Manual for details on the steps to provision an AP with CPSec enabled on controller.
