Power-On Self Tests; Conditional Tests; Fips Mode Configuration - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

Table 42 Zeroization Behavior (continued)
Keys
SSH Session Key
SSH RSA private Key
RNG Seed Key
Passwords
TLS private keys
TLS pre-master secret
TLS session key
TLS authentication key
RADIUS secret

Power-on self tests

POSTs are invoked by powering on the switch in FIPS mode and do not require operator intervention. These
POSTs perform power-on self-tests. If any KATs fail, the switch goes into a FIPS Error state which reboots the
system to start the tests again. If the switch continues to fail the FIPS POSTs, you will need to boot into
single-user mode and perform a recovery procedure to reset the switch. For more information on this
procedure, see the Fabric OS Troubleshooting and Diagnostics Guide.

Conditional Tests

Conditional tests are executed to verify that the randomness of the random number generator. The
conditional tests are executed prior to using a random number provided by the random number generator.
The results of all self-tests, both power-up and conditional, are recorded in the system log or are output to
the local console. This includes logging both passing and failing results. See the Fabric OS
Troubleshooting and Diagnostics Guide for recovery instructions if your system cannot get out of the
conditional test mode.

FIPS mode configuration

By default, the switch comes up in non-FIPS mode. You can run the fipsCfg
to enable FIPS mode, but you need to configure the switch first. Self-tests mode must be enabled before
FIPS mode can be enabled. A set of prerequisites as mentioned in
to enter FIPS mode. To be FIPS-compliant, the switch must be rebooted. KATs are run on the reboot. If the
KATs are successful, the switch enters FIPS mode. If KATs fail, the switch reboots until the KATs succeed. If
the switch cannot enter FIPS mode and continues to reboot, you must access the switch in single-user mode
to break the reboot cycle. For more information on how to fix this issue, see the Fabric OS Troubleshooting
and Diagnostics Guide.
Zeroization CLI
No CLI required
No CLI required
No CLI required
passwddefault
fipscfg –-zeroize
seccertutil delkey
No CLI required
No CLI required
No CLI required
aaaconfig –-remove
Description
Generated for each SSH session that is established
to and from the host. Automatically zeroizes on
session termination.
Key-based SSH authentication is not used for SSH
sessions.
/dev/urandom is used as the initial source of
seed for RNG. RNG seed key is zeroized on every
random number generation.
Removes user-defined accounts in addition to
default passwords for the root, admin, and user
default accounts. However, only root has
permissions for this command. So securityadmin
and admin roles need to use fipsCfg
–-zeroize, which in addition to removing user
accounts and resetting passwords, also does the
complete zerioization of the system.
The command secCertUtil delkey is used
to zeroize these keys.
Automatically zeroized on session termination.
Automatically zeroized on session termination.
Automatically zeroized on session termination.
The aaaConfig --remove zeroizes the secret
and deletes a configured server.
Table 43 must be satisfied for the system
Fabric OS 6.2 administrator guide 155
enable fips command
--