Joint Interoperability Test Command
●
JITC overview............................................................................................................... 387
JITC overview
The Joint Interoperability Test Command (JITC) mode on a FastIron device is compliant with the
standards established by JITC, a United States military organization that tests technology pertaining to
multiple branches of the armed services and the government.
The JITC mode implemented on a FastIron device enforces default behavior for some features to
ensure strict JITC certification compliance.
AES-CTR encryption mode support for SSH
The Advanced Encryption Standard - Cipher Block Chaining (AES-CBC) encryption mode for Secure
Shell (SSH) is vulnerable to certain plain-text attacks. The JITC mode uses AES-CTR (Counter)
encryption mode for SSH instead of AES-CBC mode for enhanced security.
In the JITC mode, by default, the AES-CBC encryption mode for SSH is disabled and the AES-CTR
(Counter) encryption mode is enabled. The
ip ssh encryption disable-aes-cbc
command that disables
the AES-CBC mode can be seen in the running configuration. The encryption algorithms such as
aes256-ctr, aes192-ctr, or aes128-ctr are enabled and the CBC mode ciphers are removed.
The AES-CBC mode can be re-enabled by issuing the
no ip ssh encryption disable-aes-cbc
command, which will bring back the pre-existing CBC ciphers (aes256-cbc, aes192-cbc, aes128-cbc,
and 3des-cbc) along with the CTR ciphers.
NOTE
The AES-CTR mode must be configured both on the client and server sides to establish an SSH
connection.
SHA1 authentication support for NTP
In the JITC mode, the symmetric key scheme supported for cryptographic authentication of messages
uses the SHA1 keyed hash algorithm instead of the MD5 authentication scheme. The MD5
authentication for Network Time Protocol (NTP) is disabled by default in the JITC mode and the
disable
authentication md5
command can be seen in the running configuration. Only the SHA1 authentication
scheme is available to define the authentication key for NTP in the JITC mode. SHA1 authentication
must be enabled manually using the
authentication-key key-id
command. In the JITC mode, only the
SHA1 option is available.
The MD5 authentication scheme can be re-enabled by issuing the
no disable authentication md5
command. By doing so, the default JITC mode behavior is overridden.
FastIron Ethernet Switch Administration Guide
387
53-1003625-01