FIPS 140-2 Security Policy for HiKey PKI Token Hardware Version: HiKey3.0-BK Firmware Version: HiKey COS V3.1 Chunghwa Telecom Co., Ltd. September 14th, 2016 ©Chunghwa Telecom Co., Ltd. All rights reserved. This document may be freely reproduced and distributed whole and intact including this copyright notice. 1 Introduction ............................................................................................................................................... 4 1.1 Security Levels ..................................................................................................................................... 4 Table 1 - Security Requirements Specific to FIPS 140-2. ............................................................................... 4 1.2 Acronyms and Abbreviations................................................................................................................. 5 2 Chunghwa Telecom HiKey PKI Token ..................................................................................................... 6 2.1 Functional Overview ............................................................................................................................. 6 2.2 Cryptographic Module Specification ...................................................................................................... 6 2.3 Operational Environment ...................................................................................................................... 7 2.4 Module Interfaces ................................................................................................................................. 7 2.4.1 PHYSICAL INTERFACE DESCRIPTION ........................................................................................ 7 2.4.2 SPECIFIC FUNCTIONS OF USB CONTACTS ............................................................................... 7 2.4.3 USB 1 SUPPLY CURRENT ............................................................................................................ 7 2.4.4 MODULE SECURITY AND KEY ACCESS COMMAND SET .......................................................... 7 2.4.5 HOST TO TOKEN COMMUNICATIONS PROTOCOL .................................................................... 8 2.4.6 DATA PATH ................................................................................................................................... 8 2.4.7 LOGICAL INTERFACE DESCRIPTION .......................................................................................... 8 2.4.8 EMI/EMC ........................................................................................................................................ 8 3 Roles, Services and Authentication ......................................................................................................... 8 3.1 Roles .................................................................................................................................................... 8 3.1.1 Cryptographic Officer Role ............................................................................................................. 9 3.1.2 User Role ....................................................................................................................................... 9 3.1.3 Unauthenticated Role ..................................................................................................................... 9 3.2 Module Services ................................................................................................................................... 9 3.2.1 Basic Module Services .................................................................................................................... 9 3.3 Authentication ..................................................................................................................................... 12 3.3.1 Mechanisms: ................................................................................................................................ 12 3.3.2 Strength: ....................................................................................................................................... 12 3.3.3 Strength for multiple attempts: ...................................................................................................... 13 4 FIPS Approved Mode of Operation ........................................................................................................ 14 5 Module Cryptographic Functions .......................................................................................................... 14 6 Cryptographic Key Management ............................................................................................................ 16 6.1 HiKey PKI Token Manufacturing Keys................................................................................................. 16 6.2 Secure messaging Keys ...................................................................................................................... 16 6.3 Authentication Keys ............................................................................................................................ 16 6.4 PKI Key Pairs ..................................................................................................................................... 16 6.5 NIST SP 800-90A DRBG V and C values ........................................................................................... 17 6.6 Token Holder PIN ............................................................................................................................... 17 6.7 Cryptographic Key Generation ............................................................................................................ 17 6.8 Cryptographic Key Entry ..................................................................................................................... 17 6.9 Cryptographic Key Storage ................................................................................................................. 18 6.10 Cryptographic Key Destruction ............................................................................................................ 18 7 Self Tests ................................................................................................................................................. 18 7.1 Power Up Self Tests ........................................................................................................................... 18 7.2 Conditional Tests ................................................................................................................................ 19 7.3 Error State when Self-Tests fail........................................................................................................... 20 7.4 Other Critical Functions ...................................................................................................................... 20 © Chunghwa Telecom Co., Ltd. All rights reserved. This document may be freely reproduced and distributed whole and intact including this copyright notice. 7.5 Bypass capability ................................................................................................................................ 20 8 Security Rules ......................................................................................................................................... 20 8.1 Operational Security Rules ................................................................................................................. 20 8.2 Physical Security Rules....................................................................................................................... 20 8.3 Mitigation of Attacks Security Policy ................................................................................................... 21 9 Security Policy Check List Tables ......................................................................................................... 22 9.1 Roles & Required Authentication ......................................................................................................... 22 9.2 Strength of Authentication Mechanisms .............................................................................................. 22 9.3 Mitigation of Other Attacks .................................................................................................................. 22 Cryptographic Module References ............................................................................................................... 24 10 Standard FIPS References ...................................................................................................................... 24 © Chunghwa Telecom Co., Ltd. All rights reserved. This document may be freely reproduced and distributed whole and intact including this copyright notice. Security Policy for HiKey PKI Token 1 Introduction This document is the Security Policy for the Chunghwa Telecom Co., Ltd. HiKey PKI Token which is embedded RS45C chip inside. This token, hereafter called the HiKey PKI Token is used to provide user authentication and cryptographic services. This Security Policy specifies the security rules under which the token must operate to meet the requirements of FIPS 140-2 Level 2. It describes how the token functions to meet the FIPS requirements, and the actions that operators must take to maintain the security of the token. This Security Policy describes the features and design of the Chunghwa