Cambium Networks PTP 800 Compact Modem Unit (CMU)

Security PolicyPTP 800-06-02If the FIPS 140-2 Operational Mode Alarm is present in the Home page, take actiondepending upon the alarm setting as follows:(a)If the alarm is ‘FIPS mode is not configured’, then return to 3.2 Configuring theApproved Mode of Operation and check that all Security Wizard settings are correctfor FIPS 140-2.(b)If the alarm is ‘FIPS mode is configured, but not active’, then return to 3.2.8 Step 6:HTTP and Telnet Settings and set the following attributes to ‘No’: HTTP Access Enabled Telnet Access Enabled SNMP Control of HTTP And Telnet3.4 Approved and non-approved modes of operation3.4.1 Approved mode of operationIn the non-approved non-FIPS mode of operation, it is possible to use all the approvedalgorithms of FIPS mode and also to use in the clear management protocols. No CSPs areshared between these modes of operation. A zeroise CSPs is forced if a user causes the unitto transition between modes.In FIPS mode, the cryptographic module only supports FIPS Approved and allowedalgorithms as follows:Table 3 – FIPS Approved and allowed algorithmsAlgorithmNISTCertificateNumberSHA-1 and SHA-256 for hashing (b)1557DSA 2048/256 for digital signature verification of uploaded firmware556images. The DSA algorithm conforms to FIPS 186-3 (e).AES 128 & 256-bit firmware library DSP CBC, CTR and ECB modes1776used in TLS, SNMP, and DRBG.AES 128 & 256-bit keys for wireless link encryption engine1526implemented in FPGA ECB mode only.SP800-90 DRBG, CTR DRBG see (k) section 10.2.1phn-4410 000v001 – January 2017123Page 12 of 26

Security PolicyPTP 800-06-02AlgorithmNISTCertificateNumberTriple-DES 3-key used with TLS cipher suite1149HMAC-SHA-1 used within TLS for key establishment1041RSA 2048-bit for key unwrapping during TLS Handshake (keyN/Awrapping; key establishment methodology provides 112 bits ofencryption strength)Note that the AES certificate 1526 lists operation with 128-bit, 192-bit, and 256-bit keys,based on the underlying capabilities of the FPGA core used within the PTP 800 CMU. ThePTP 800 CMU application software allows a user to select only 128-bit or 256-bit operation.Table 4 – Management protocols in FIPS modeProtocolCipher Suites supported by theNotesmoduleTLS v1.0 &TLS RSA WITH 3DES EDE CBC SHAThe module acts as theHTTP over TLSTLS RSA WITH AES 128 CBC SHAserver endpoint in the TLS(HTTPS)TLS RSA WITH AES 256 CBC SHAcommunication. The clientsare authenticated at theapplication layer usingpasswords3.4.2 Non-FIPS modes of operationThe following algorithms and protocols are available in the Non-FIPS mode of operation:(a)Custom RNG 1(b)HTTP(c)Unencrypted Wireless1A custom RNG is included in the operational code. This RNG is not utilised in FIPS mode.phn-4410 000v001 – January 2017Page 13 of 26

Security Policy(d)MD5(e)RADIUSPTP 800-06-02The Custom RNG is used only when the CMU has no TLS private key. A TLS private key willalways be available when the CMU is in the FIPS approved mode of operation.MD5 is used as part of SNMPv3 and in the TLS protocol.RADIUS is used to provide remote authentication for users of the web (HTTP and HTTPS)interface. RADIUS must be disabled in the FIPS approved mode of operation.4 PORTS AND INTERFACESThe cryptographic module provides the following physical ports and logical interfaces:Table 5 – Ports and InterfacesPortData igabit/Fiber Gigabit ManagementIF Power /EarthingLEDsRecovery Buttonphn-4410 000v001 – January 2017Page 14 of 26

Security PolicyPTP 800-06-025 IDENTIFICATION AND AUTHENTICATION POLICY5.1 Assumption of RolesTable 6 – Roles and AuthenticationRoleType of AuthenticationAuthenticationMechanismSecurity Officer (Crypto-Username and passwordUsername and passwordOfficer)verificationentered over a TLS socketto the HTTPS server andverified by CMU.System AdministratorUsername and passwordUsername and passwordverificationentered over a TLS socketto the HTTPS server andverified by CMU.Read-only userUsername and passwordUsername and passwordverificationentered over a TLS socketto the HTTPS server andverified by wireless unit6 ACCESS CONTROL POLICY6.1 Authentication StrengthIn FIPS mode password complexity is enforced:The complexity rules are:The password must contain at least two characters for each of the four groups:(a)lowercase letter(b)uppercase letter(c)decimal numerals(d)special characters 2The password must have a minimum length of 10 characters2Allowable special characters are: !"# %&'()* ,-./:; ?@[\] { } phn-4410 000v001 – January 2017Page 15 of 26

Security PolicyPTP 800-06-02The passwords must not contain the user’s username.The maximum number of repeated characters in a password is 2.When passwords are changed at least four distinct character must changePassword must not be reused for the next 10 passwords.Only three authentication attempts are permitted for any user within any one minuteperiod.A password with minimum complexity can be constructed by selecting, 2 lowercase, 2uppercase, 2 special characters, and 4 numeric characters. The strength of thiscombination is calculated as follows:p 111 11. 2. 2. 4 226 26 32 104.7 1012Table 7 – Password strengthTestStrength1 in 100,000 in any minutePass strength is 1 in 4.7 x 10121 in 1,000,000 at any attemptPass strength is 1 in 1.5 x 10126.2 Roles and ServicesThe services available to authenticated users are summarised in Table 8 and Table 9.Table 8 also identifies the CSP access type for each CSP in braces after each CSP. {R}ead,{W}rite, {Z}eroize and {U} use internally but don’t output.RO – Read Only UserSA – System AdministratorCO - Cryptographic Officerphn-4410 000v001 – January 2017Page 16 of 26

Security PolicyPTP 800-06-02Table 8 – Services and CSP AccessRoleServiceCSPsRO, SA, COAuthenticationAuthenticate, password {R,W}, key of keys{U}The CO has R and W access to all userpasswords, CO password, SA password,and RO password.Users with the SA or RO role only has Rand W access to their associated passwordsSA, COFirmware UpgradeDSA Public key {U, W}COEncryptEncrypt / Decrypt wireless traffic usingwireless encryption key {U} , key of keys{U}RO, SA, COTLSAuthenticate and key exchange using TLSprivate key {U}, entropy seed {U}, key ofkeys {U}TLS pre-master secret {U, W}, TLS mastersecret {U} and TLS keyset {U}RO, SA, COCOZeroiseKey of keys {Z}Self-TestN/ACryptographic KeyKey of keys {U}, TLS X509 private keyManagement{W}, wireless link encryption key {W},entropy seed {W}CO, SAModuleN/AConfigurationCO, SARebootN/ACO, SA, ROView StatusN/ACO, SA, ROView ConfigurationN/Aphn-4410 000v001 – January 2017Page 17 of 26

Security PolicyPTP 800-06-02RoleServiceCSPsCO, SA, ROLogoutN/ATable 9 – Authenticated ServicesServiceRolePurposeAuthenticationCO, SA, ROAuthenticate user loginsFirmware UpgradeCO, SAUpgrade operational firmwareEncryptCOEncrypt / Decrypt wireless trafficZeroiseCO, SA, ROZeroise all CSPsCryptographic KeyCOCryptographic key data entry and CSPmanagementModule ConfigurationzeroisationCO, SAA selection of standard wireless unitconfiguration settingsRebootCO, SAReboot the wireless unitView StatusSA, CO, ROView module status including hardware andfirmware versionsView ConfigurationRO, SA, COView all system administrativeconfigurationLogoutRO, SA, COLogs out the authenticated operatorTLSRO, SA, COEstablish a secure TLS session to supportsecure authentication6.3 Unauthenticated Services:The services available to unauthenticated users are summarised in Table 10.phn-4410 000v001 – January 2017Page 18 of 26

Security PolicyPTP 800-06-02Table 10 – Unauthenticated ServicesServiceRolePurposeSelf-Test-This service executes a suite ofcryptographic self-tests as required by FIPS140-2 level 2.This service is initiated via module powercycleRecovery-Enter recovery modeSNMP-View status and configuration using theSNMP management protocol. It isimportant to note that no CSPs aretransported using the SNMP protocolVisual Status Indication-View module status using LEDs6.4 Service I/O SpecificationTable 11 – Specification of Service Inputs & OutputsServiceControl InputData InputData name &requestpasswordNoneStatus OK ifusername andpasswordmatch plaintext usernameand passwordCSPFirmwareUpgradePlaintextDSAStatus OK if ‘v’Upgraderequestheader verification ‘v’ ‘r’BZIP2vectorcompressedimagephn-4410 000v001 – January 2017Page 19 of 26

Security PolicyServicePTP 800-06-02Control InputData InputData e if key ofkeys removedfrom nonvolatilestorage andsystem rebootSelf-TestSystem rebootNoneNoneTrue ifalgorithm selftest successful.OtherwisefalseCryptographicData EntryKey of Keys,NoneTrue if keyKeyTLS X509correctlyManagementPrivate key,validated.TLS publicOtherwisecertificate,falseRNG entropy,passwordsModuleData EntryConfigurationWirelessNoneConfigurationTrue isefalseRebootData EntryNoneView StatusView eInformationRequestphn-4410 000v001 – January 2017Page 20 of 26

Security PolicyServicePTP 800-06-02Control InputData InputData OutputStatusOutputLogoutLogoutNoneNoneOKPDU dataPDU responsePDU StatusRequestSNMPPDU requestdataTLSSessionAuthenticationSession &Requests& payload datapayload dataSession statusresponsesRecoveryData bridgedEthernetpacketsbridgedpackets6.5 Definition of Critical Security ParametersThe following CSPs and public keys are contained in the modules FLASH memory. Theseare NOT read into SDRAM by the FIPS module.6.5.1 Key of KeysThe key of keys is stored as a 128/256-bit AES key and is stored in the CSP FLASH bank.The key of keys is read during the DMGR initialisation procedure and the key expansion isstored in SDRAM. All DMGR attributes that are marked as CSPs are encrypted/decrypted asthey are written/read from the configuration FLASH banks using the key expansion.The integrity of the key of keys is validated by the user with a CRC32.The key of keys can be configured or erased by a user with the security officer role.6.5.2 TLS X509 Private KeyTLS private key is used by the HTTPS server. The private key is designated as a DMGR CSPand is encrypted using the key of keys.A key size of 2048-bits is supportedEntered via a secure webpage uploadphn-4410 000v001 – January 2017Page 21 of 26

Security PolicyPTP 800-06-02Generated by a FIPS approved algorithm outside the moduleValidity checked by performing a modulus check on private and associated publiccertificate.The X.509 private key can be configured or erased by a user with the security officer role.6.5.3 RNG EntropySP800-90 DRBG entropy string is used by the TLS stack and other random processes. Theentropy string is designated as a DMGR CSP and is encrypted using the key of keys.A key size of 512-bits is supportedEntered via a secure webpage uploadGenerated by a FIPS approved algorithm outside the moduleThe entropy string can be configured by the security office.6.5.4 RNG Internal State VariablesSP800-90 DRBG algorithm internal state variable V.SP800-90 DRBG algorithm 128-bit AES key.6.5.5 Wireless Encryption KeyThe wireless encryption key (AES 128 or 256) is used to encrypt/decrypt all control anddata sent over the wireless MAC layer.The wireless encryption key can be configured by the security officer role.6.5.6 TLS Key SetThe TLS keyset comprises of the session keys. The TLS service is used for authenticity andprivacy when transporting CSPs from the user’s browser to PTP 800 module.The TLS keyset is generated by TLS ”Approved“ PRF with the help of TLS Master secretand server and client random.The server random is generated using the approved DRBG. The client random is generatedby the operator’s browser.6.5.7 TLS pre-master secret and TLS master secretThe 46 byte pre-master secret is generated by the operator’s browser, PCKS#1 v1.5encoded, wrapped with RSA 2048.The master-secret is generated using TLS PRF:phn-4410 000v001 – January 2017Page 22 of 26

Security PolicyPTP 800-06-02master secret PRF(pre master secret, "master secret", ClientHello.random ServerHello.random)6.5.8 PasswordsThe PTP 800 has 10 configurable user accounts. Each user account has an associatedpassword. All passwords are designated as DMGR CSPs and are encrypted using the key ofkeys.A user with the security officer role can reset all user account passwords. Users withsystem administrator or read only user roles can reset their own passwords6.5.9 CSP Encrypted by Key of KeysThe following CSPs are AES encrypted (i) using a key of keys approach and are notzeroised:(a)Wireless Encryption Key – This key is used for the Encryption/Decryption of all trafficover the wireless link.(b)System passwords(c)TLS X.509 private key(d)DRBG Entropy seed6.6 Definition of Public KeysThe following are the public keys contained in the module:(a)TLS X509 Public Certificate (located in the configuration FLASH bank). The certificatecan be modified by a user uploading a new valid certificate. The longevity of the key isencoded in the X509 certificate expiry time.(b)Firmware DSA 2048-bit public key (p, q, g, and y vectors) (located in the FIPS modulecode and defined as static const unsigned char arrays). The DSA public key cannot beerased and can only be replaced by upgrading the firmware.(c)TLS Public Certificatephn-4410 000v001 – January 2017Page 23 of 26

Security PolicyPTP 800-06-027 OPERATIONAL ENVIRONMENTThe FIPS 140-2 Area 6 Operational Environment requirements are not applicable becausethe PTP 800 device does not contain a modifiable operational environment.8 SECURITY RULESThis section documents the security rules enforced by the cryptographic module toimplement the security requirements of this FIPS 140-2 Level 1 module.(a)The cryptographic module shall provide four roles. Security administrator, systemadministrator, read-only user, SNMP user.(b)The cryptographic module shall provide identity based authentication.(c)The module supports no bypass states and no maintenance roles.(d)The cryptographic module shall perform the following power up self-tests listed inSection 8.1.(e)Status information does not contain CSPs or sensitive data that if misused could leadto a compromise of th

Figure 1 – PTP 800 CMU The purpose of this security policy is to validate the Cambium PTP 800 Series software Version PTP 800-06-02 submitted for FIPS 140-2 Level 1 validation. Three hardware revisions of the CMU are in use: Version 5.2, Version 5.3, and Version 6.6. The differences between these hardware revisions are minor, and unrelated to the