Sun Microsystems Sun StorageTek T9840D User manual

Sun StorageTekTM T9840D
Tape Drive
Security Policy
Part Number 316055201
Revision: AA
Sun Microsystems, Inc.
February 5, 2010
Copyright Sun Microsystems 2009. May be reproduced only in its original entirety [without revision].

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy February 5, 2010
TABLE OF CONTENTS
1 MODULE OVERVIEW .............................................................................................................................. 4
2 SECURITY LEVEL ................................................................................................................................... 5
3 MODES OF OPERATION (AREA 1) ........................................................................................................ 6
3.1 APPRO ED ALGORITHMS ............................................................................................................................ 6
3.2 NON-APPRO ED ALGORITHMS ...................................................................................................................... 7
3.3 DETERMINING FIPS MODE ......................................................................................................................... 7
3.4 CONFIGURING THE DRI E IN FIPS MODE ........................................................................................................ 8
4 PORTS AND INTERFACES ................................................................................................................... 10
5 IDENTIFICATION AND AUTHENTICATION POLICY ............................................................................ 12
5.1 ASSUMPTION OF ROLES ............................................................................................................................. 12
6 DEFINITION OF CRITICAL SECURITY PARAMETERS (CSPS) .......................................................... 14
6.1 DEFINITION OF PUBLIC KEYS ...................................................................................................................... 15
ACCESS CONTROL POLICY ................................................................................................................ 15
7.1 ROLES AND SER ICES .............................................................................................................................. 15
8 OPERATIONAL ENVIRONMENT (AREA 6) .......................................................................................... 18
9 SECURITY RULES ................................................................................................................................. 18
9.1 FIPS 140-2 SECURITY REQUIREMENTS ...................................................................................................... 18
10 PHYSICAL SECURITY ......................................................................................................................... 19
10.1 PHYSICAL SECURITY MECHANISMS ............................................................................................................ 19
11 MITIGATION OF OTHER ATTACKS POLICY ..................................................................................... 19
12 REFERENCES ...................................................................................................................................... 19
13 DEFINITIONS AND ACRONYMS ......................................................................................................... 21
Page 2

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy February 5, 2010
TABLE OF TABLES
TABLE 1: MODULE SECURITY LEVEL SPECIFICATION........................................................................5
TABLE 2: PORTS AND INTERFACES DESCRIPTION............................................................................10
TABLE 3: ROLES AND REQUIRED IDENTIFICATION AND AUTHENTICATION...................................12
TABLE 4: STRENGTHS OF AUTHENTICATION MECHANISMS............................................................13
TABLE 5: DESCRIPTION OF CRITICAL SECURITY PARAMETERS (CSPS)........................................14
TABLE 6: DESCRIPTION OF PUBLIC KEYS WITHIN THE ETD.............................................................15
TABLE : SERVICES AUTHORIZED FOR ROLES..................................................................................15
TABLE 8: UNAUTHENTICATED SERVICES............................................................................................18
Release History
Date Rev Description Name
02/05/10 AA Initial version of Security Policy. Engineering Change: EC001056 Matt Ball
Page 3

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
1 Module Overview
The Sun StorageTekTM T9840D Tape Drive (“Encrypting Tape Drive”, or ETD) (HW P/N:315479501;
Firmware ersion: 1.44.710) is a hardware cryptographic module with a multi-chip standalone physical
embodiment as defined by FIPS 140-2. The primary purpose of this device is to provide FIPS 140-2 Level
1 security to data on magnetic tape.
The ETD is intended to be used in conjunction with the Sun Key Management System (KMS), which
provides centralized key management. The Sun StorageTek Crypto Key Management System (version
2.1 and higher), consists of two or more Key Management Appliances (KMAs). Key Management
Appliances are the individual components within the system and in the context of this FIPS 140-2 Security
Policy, can be viewed as Key Loaders. For more information on these system components please see the
website http://docs.sun.com and browse under Hardware->Tape Storage->Tape Drives.
The cryptographic boundary of the ETD is the external surface of the tape drive’s commercial-grade
metallic enclosure. Figure 1.1 and Figure 1.2 illustrate the cryptographic boundary as defined:
Feb 5, 2010 Part 316055201, Rev: AA Page 4
Figure 1.1: Front, side, and top of T9840D

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
Note: Figure 1.2 appears to be upside-down to show bottom plate.
2 Security Level
The ETD meets the overall requirements applicable to Level 1 security of FIPS 140-2, as is detailed in
Table 1.
Table 1: Module Security Level Specification
Security Requirements Section Level
Cryptographic Module Specification 3
Module Ports and Interfaces 1
Roles, Services and Authentication 1
Finite State Model 1
Physical Security 1
Operational Environment N/A
Cryptographic Key Management 1
EMI/EMC 1
Feb 5, 2010 Part 316055201, Rev: AA Page 5
Figure 1.2: Back, side and bottom cover of T9840D

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
Security Requirements Section Level
Self-Tests 1
Design Assurance 1
Mitigation of Other Attacks N/A
3 Modes of Operation (Area 1)
3.1 Approved Algorithms
Once configured per the procedures as defined in Section 3.4 the module is only able to operate in a FIPS
140-2 Approved Mode of operation. Within the FIPS 140-2 Approved Mode of operation the following
Approved algorithms are available:
•AES CCM supporting 256-bit keys in both hardware (AES Certificate # 495) and firmware (AES
Certificate # 1063)
•AES ECB encryption (AES Certificate # 1059) as used in CCM encryption in firmware (AES
Certificate # 1063)
•RSASSA-PKCS1-v1_5 supporting 2048-bit keys (RSA Certificate # 503) for digital signature
verification (firmware load test)
•HMAC SHA-1 (HMAC Certificate # 597) to create the challenge response as part of the certificate
service of the KMS 2.x Agent Toolkit.
•SHA-1 (SHS Certificate # 1005) for the following:
oas part of digital signature verification for the firmware
oas part of HMAC-SHA-1 (HMAC certificate # 597)
ofor hashing passwords used for authentication
•AES ECB (AES Certificate # 1060) supporting 256-bit keys. Used as part of the AES Key Wrap
algorithm to securely establish keying material.
•SP 800-90 CTR DRBG (DRBG Certificate # 11) for generating random numbers used for nonce
values and cryptographic keys
•AES CTR (AES Certificate # 1061) as part of the SP 800-90 CTR DRBG.
•AES CBC mode with 256-bit key (AES Certificate # 1062), used within TLS session between ETD
and KMS 2.x.
•HMAC-SHA-1 (HMAC Certificate # 598)with 160-bit key used to protect the integrity of TLS
communications between the ETD and KMS 2.x.
•SHA-1 (SHS Certificate #1006)
oas part of the TLS Key Derivation Functionality
oas part of HMAC SHA-1 (HMAC Certificate # 598)
3.2 Non-Approved Algorithms
The cryptographic module supports the following Non-Approved algorithms that are allowed for use within
FIPS Approved mode: MD5 as used within the TLS1.0 Key Derivation Function. (see [TLS1.0])
•AES Key Wrap (AES Certificate #1060) used to securely establish media keys ( endor Affirmed,
Feb 5, 2010 Part 316055201, Rev: AA Page 6

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
key establishment methodology provides 256 bits of strength)
•RSAES-PKCS1- 1_5 supporting 2048-bit keys, for RSA public key encryption used to provide
FIPS 140-2 allowed key transport within the TLS protocol. Key establishment methodology
provides 112 bits of security.
•Non-Deterministic Random Number Generator (NDRNG) (provides entropy input to the SP800-90
DRBG, and random values for use within the TLS protocol)
•MD5, as used in the TLS protocol.
3.3 Determining FIPS Mode
The user can determine whether the ETD is operating in FIPS mode by examining the OP ( irtual
Operator Panel). OP is an external software application and the primary ETD remote management tool.
OP utilizes ETD services remotely. OP is described in more detail in the document " irtual Operator
Panel User's Guide" (see [ OPUG]).
Figure 3.1 shows the " iew Current Drive Settings" of the OP application (Drive Operations → iew
Drive Data). The user can tell if the ETD has selected an Approved mode of operation by verifying that
the labels "Encryption active" and "Running in FIPS mode" are both set to "Yes". If either of these labels
is set to "No" then the ETD is not in a FIPS Approved mode.
Feb 5, 2010 Part 316055201, Rev: AA Page 7

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
3.4 Config ring the Drive in FIPS mode
An ETD can only be configured for FIPS mode as a one-time decision taken during the encryption
enrollment process. Once an ETD is licensed for encryption, it will remain in either FIPS mode or non
FIPS compliant mode.
FIPS 140-2 configuration of ETD with OP requires the presence of both a Sun service representative
and the customer. In addition they will need to follow the licensing process as outlined in [KMS2IM] (KMS
2.x Installation and Service Manual), under “License and Enroll the Tape Drives” in Chapter 3 “T-Series
Tape Drives”.
Feb 5, 2010 Part 316055201, Rev: AA Page 8
Figure 3.1: VOP: View Current Drive Settings

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
Both the Sun service representative and the customer (in the role of the Crypto-Officer) shall perform the
following actions to enable FIPS mode through OP:
1. The service representative shall examine the hardware part number on the rear label of the Tape
Drive to ensure that it matches the part number as listed in Section 1 of this document.
2. The service representative shall, using OP, click on the menu item Drive Operations → iew
Drive Data.
3. The service representative shall select the ersion Tab and verify that the firmware version listed
is that listed in Section 1 of this document.
4. The service representative shall license the tape drive for encryption using the process from
[KMS2IM].
5. The service representative shall set the drive offline by selecting Drive Operations → Set Offline.
6. The service representative shall add the ETD to the KMS 2.x cluster (see [KMS2IM]).
7. The service representative shall bring up the “Configure Drive Parameters” Window (see Figure
3.2) by selecting “Drive Data” from the Configure menu of the main OP window, and in this
window the customer (in the role of the Crypto-Officer) shall perform the following:
a) Set the ”Encryption Mode” field to “Yes”.
b) Set the “Permanently encrypting” field to “Yes”.
c) Set the “Set FIPS mode(permanent)” field to “On”.
d) Enter a valid Agent ID, Pass Phrase, and KMS 2.x IP address (see [KMS2IM]).
8. Click on the “Commit” button. The ETD will then reboot and come up in permanent FIPS mode.
9. erify that FIPS mode was correctly set by examining the FIPS status (see 3.3 ).
Feb 5, 2010 Part 316055201, Rev: AA Page 9

Sun Microsystems Sun StorageTe ™ T9840D Tape Drive Security Policy
4 Ports and Interfaces
This section describes all ports and interfaces supported by the Encrypting Tape Drive. Table 2 below
provides a listing of the following physical ports and logical interfaces(see [ETDOG] for details).
Table 2: Ports and Interfaces Description
Physical Port Qty Logical interface
definition
Technical Specification
DB15(RS232) 1 data output,
status output,
control input
Primarily used for tape library communications.
Feb 5, 2010 Part 316055201, Rev: AA Page 10
Figure 3.2: VOP: "Configure Drive Parameters" Window