Forum Discussion
Cory_50405
May 23, 2014Noctilucent
I have some FIPS boxes and here's what I've found from testing. If you run 'fipsutil info' from bash shell, there can be two results:
Uninitialized FIPS card will present an error like this:
fipsutil error (line 1159): Library Initialization : 0x05 : Undefined Error Code
Initialized FIPS card will display something like this:
Label: F5FIPS
HSM Serial Number: xxxxxxx
Hardware ID: 0x0
Firmware Version: 4.7.1
Total FLASH: 14286412
Free FLASH: 14239436
Total SRAM: 16984736
Free SRAM: 16979488
As Kevin states though, keys don't have to be stored in the HSM even though it's initialized. You can create keys without putting them in the HSM. You can also move them to the HSM at a later point if you so choose.
- Chris_FPMay 23, 2014CirrusI ran the fipsutil info command on some other boxes and it didn't show the error code but the info. However I know for a fact that the fips card wasn't initialised as I put the boxes in and I specifically didn't initialise them - maybe they were done by F5 before shipping? My follow up question is:- Does that mean that all SSL is being processed by the FIPS card, even though no cert/key are stored there or is SSL still being processed by the dedicated [F5] SSL hardware
- Cory_50405May 23, 2014NoctilucentI suppose it's possible as part of their testing before shipping the device that they initialized the FIPS HSM to ensure there were no hardware issues. Would make sense. We've had to RMA a couple of 6900s due to faulty FIPS HSMs. If you don't have the key stored in the FIPS HSM, then the key isn't protected according to NIST standards. You can still use FIPS approved encryption algorithms to build SSL connections without having the key stored in the HSM though.
- Chris_FPMay 23, 2014Cirrusthanks Cory. It's not so much the "is it protected by FIPS", more the "which SSL 'engine' will be used to process SSL requests - The FIPS card or the F5 SSL card". It was my understanding that if the FIPS card is initialised then all SSL goes via the FIPS card and thus the SSL performance for an 8900 drops from 10,000 TPS to 4,000 TPS. This is the crucial bit as we're expecting around 6-7,000 TPS
- Cory_50405May 23, 2014NoctilucentThat's a good question Chris. I would expect that the HSM wouldn't be used unless the key is stored there. Perhaps someone in the community can confirm or deny.