Area 3 - Roles and Services

What is the formula for determining needed strength of authentication method?

(Pool of selectable characters) ^ (characters or digits of password) = total possible combinations. 1/total possible combinations < 1/1,000,000 (if greater than, no good)

Formula for determining needed strength of authentication method time requirement.

(rate of allowed attempts)/(Pool of selectable characters) ^ (characters or digits of password) = (rate of allowed attempts)/(total possible combinations)

If the module offers a bypass mode, what 3 "states" can the module's bypass capabilities be in?

1.) Bypass capability is not activated. 2.) Bypass capability is activated, and module is exclusively providing services without cryptographic processing. 3.) Bypass capability is alternately activated and deactivated and the module is providing some services with cryptographic processing and some without.

Define service outputs.

All data and status outputs that result from services, operations, or functions initiated or obtained by service inputs.

Define service inputs.

All data or control inputs to the cryptographic module that initiate or obtain specific services, operations, or functions.

Define services as it applies to FIPS.

All of the services, operations, or functions that can be performed by the cryptographic module.

What two roles must a cryptographic module support?

Crypto Officer Role and User Role (1,2,3,4)

What is the main difference between level 1 and 2,3,4 in terms of authentication requirements?

Level 1 has no authentication requirements.

Role based authentication applies to what level?

Level 2

Role based authentication is required for which levels?

Levels 2

Identity based authentication applies to what level?

Levels 3 & 4

Identity based authentication is required for which levels?

Levels 3 & 4

Give some examples of what actions would be performed by the crypto officer role.

Module initialization, input/output of cryptographic keys and CSPs, and audit functions.

Define Show Status.

Provides the current status of the cryptographic module.

Describe the Crypto Officer role.

Role assumed to perform a set of cryptographic initialization or management functions.

The cryptographic module shall provide the following services to operators:

Show Status, Perform Self-Tests, Perform Approved Security Function. (1,2,3,4)

What must be ensured and documented if the module supports any unauthenticated services?

That these services do not disclose, modify, or substitute CSP, use approved security functions, or otherwise affect the security of the cryptographic module. (1,2,3,4)

Describe the User role.

The role assumed to perform general security services, including cryptographic operations and other approved security functions.

Define Zeroize

This service actively destroys all plaintext critical security parameters.

Define Self-Tests

This service executes the suite of self-tests required by FIPS 140-2.

What is required during bypass mode to help prevent the accidental bypass of plaintext data due to a single error?

Two independent internal actions.

All plain text secret and private keys and unprotected CSPs shall be zeroized when...

entering and exiting the maintenance role. (1,2,3,4)

If module has a maintenance interface then...

module must support a maintenance role. (1,2,3,4)

Feedback provided to an operator during an attempted authentication shall...

not weaken the strength of the authentication mechanism.

For each attempt to use the authentication mechanism, the probability shall be less than....

one in 1,000,000

For multiple attempts to use the authentication mechanism during a one-minute period, the probability shall be less than...

one in 100,000

Each service input shall result in a service...

output. (1,2,3,4)

When the cryptographic module is powered off and powered back on...

previous authentications shall not be maintained.

At level 1, the module has no authentication, but should...

require that one or more roles be either implicitly or explicitly selected by the operator.

Feedback of authentication data to an operator....

shall be obscured during authentication (e.g., ******** for password dialogue) (2,3,4)

Authentication data...

shall be protected against unauthorized disclosure, modification, or substitution.

If module supports concurrent roles...

the module shall internally maintain a separation of the roles assumed by each operator and the corresponding services. (1,2,3,4)

If a module allows an operator to change roles, then...

the operator must re-authenticate to any new role he or she assumes. (Level 2) Verify the authorization of the identified operator for L3 & L4.

Factory set or default authentication data can be used...

to control access to the module and to initialize the authentication modules.