Forum Discussion

Chris_FP's avatar
Chris_FP
Icon for Cirrus rankCirrus
May 23, 2014

FIPS card - How to tell if it has been initialised

We have some 8900 LTM's that have a FIPS card installed. Long story short is that we need to re-use these boxes in a non-FIPS mode. The boxes have never been put live but they are installed and on the network.

 

What we're not sure of is if a previous, now left, staff member actually initialised the FIPS card or not. There does not appear to be an easy way to determine this (sho sys crypto fips key shows no keys in the FIPS card but that doesn't guarantee it hasn't been intialised).

 

Anybody know a way to check the intialisation state of a FIPS card (without activating it :) )

 

application delivery
deployment
LTM
TMSH

10 Replies

Sort By
  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    May 23, 2014

    There are a few fips* utilities in the shell. I don't have a FIPS platform in front of me to test now, but try fipscheck and fipsutil.

     

    I'd also note that you shouldn't have to use FIPS if it was enabled. You can selectively use or not use the FIPS HSM to store private keys.

     

  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    May 23, 2014

    I have some FIPS boxes and here's what I've found from testing. If you run 'fipsutil info' from bash shell, there can be two results:

    Uninitialized FIPS card will present an error like this:

    fipsutil error (line 1159): Library Initialization : 0x05 : Undefined Error Code

    Initialized FIPS card will display something like this:

     

    Label:             F5FIPS
HSM Serial Number: xxxxxxx
Hardware ID:       0x0
Firmware Version:  4.7.1
Total FLASH:       14286412
Free FLASH:        14239436
Total SRAM:        16984736
Free SRAM:         16979488

     

    As Kevin states though, keys don't have to be stored in the HSM even though it's initialized. You can create keys without putting them in the HSM. You can also move them to the HSM at a later point if you so choose.

    • Chris_FP's avatar
      Chris_FP
      Icon for Cirrus rankCirrus
      May 23, 2014
      I ran the fipsutil info command on some other boxes and it didn't show the error code but the info. However I know for a fact that the fips card wasn't initialised as I put the boxes in and I specifically didn't initialise them - maybe they were done by F5 before shipping? My follow up question is:- Does that mean that all SSL is being processed by the FIPS card, even though no cert/key are stored there or is SSL still being processed by the dedicated [F5] SSL hardware
    • Cory_50405's avatar
      Cory_50405
      Icon for Noctilucent rankNoctilucent
      May 23, 2014
      I suppose it's possible as part of their testing before shipping the device that they initialized the FIPS HSM to ensure there were no hardware issues. Would make sense. We've had to RMA a couple of 6900s due to faulty FIPS HSMs. If you don't have the key stored in the FIPS HSM, then the key isn't protected according to NIST standards. You can still use FIPS approved encryption algorithms to build SSL connections without having the key stored in the HSM though.
    • Chris_FP's avatar
      Chris_FP
      Icon for Cirrus rankCirrus
      May 23, 2014
      thanks Cory. It's not so much the "is it protected by FIPS", more the "which SSL 'engine' will be used to process SSL requests - The FIPS card or the F5 SSL card". It was my understanding that if the FIPS card is initialised then all SSL goes via the FIPS card and thus the SSL performance for an 8900 drops from 10,000 TPS to 4,000 TPS. This is the crucial bit as we're expecting around 6-7,000 TPS
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    May 28, 2014

    I would expect that the HSM wouldn't be used unless the key is stored there.

    Cory is correct (this is correct).

    by the way, fipsutil init will report an error if card is already initialized.

    e.g.

     

     tmsh

root@(B6900-R69-S5)(cfg-sync Standalone)(Active)(/Common)(tmos) run util fips-util init
fipsutil error (line 1302): HSM already initialized

 fipsutil

[root@B6900-R69-S5:Active:Standalone] config  fipsutil init
fipsutil error (line 1302): HSM already initialized

     

  • bcrogerz's avatar
    bcrogerz
    Icon for Cirrus rankCirrus
    Sep 08, 2014

    the above command works on a v11 box , on v10 the info command fails. any other way to check if FIPS card is initialized on v10.2.x box 'without actually initializing it' ?

     

    • LoyalSoldier's avatar
      LoyalSoldier
      Icon for Altostratus rankAltostratus
      Oct 23, 2018

      You can go into bash and type "fipscheck". I'm running 12.1.2 and mine gave me:

       

      usage: fipscheck 
fips mode is off

       

  • Neha_51838's avatar
    Neha_51838
    Historic F5 Account
    Dec 24, 2014

    To check the FIPS-card in v10, I think the easiest would be to try a FIPS key generation. The below output will be seen for an uninitialized FIPS card:

     

     fipskey generate test-fips 2048        
Key generation failed: error 18 - ERR_HSM_NOT_INITIALIZED

     

    While for an initialized FIPS card, the key generation will be successful, like so:

     

     fipskey generate test-fips 2048   
PUBLIC:      
      
PRIVATE: