Authentication Mechanisms
The Aruba Controller supports role-based authentication. Role-based authentication is performed before
the Crypto Officer enters privileged mode using admin password via Web Interface or SSHv2 or by
entering enable command and password in console. Role-based authentication is also performed for
User authentication.
This includes password and RSA/ECDSA-based authentication mechanisms. The strength of each
authentication mechanism is described below.
Table 5 Estimated Strength of Authentication Mechanisms
Authentication Type
Role
Strength
Password-based authentication
Crypto Officer
Passwords are required to be a minimum of eight characters and a
maximum of 32 with a minimum of one letter and one number. If six
(6) integers, one (1) special character and one (1) alphabet are used
without repetition for an eight (8) digit PIN, the probability of
randomly guessing the correct sequence is one (1) in 251,596,800
(this calculation is based on the assumption that the typical standard
American QWERTY computer keyboard has 10 Integer digits, 52
alphabetic characters, and 32 special characters providing 94
characters to choose from in total. The calculation should be 10 x 9 x
8 x 7 x 6 x 5 x 32 x 52 = 251, 595, 800). Therefore, the associated
probability of a successful random attempt during a one-minute
period is approximate 1 in 251,596,800, which is less than 1 in
100,000 required by FIPS 140-2.
Password-based authentication
(WPA2-PSK)
User
Same authentication mechanism strength as CO role above.
Password-based authentication
(IKEv1)
User
A 64 ASCII (128 HEX) character pre-shared string is randomly
chosen by the administrator. It may consist of upper and lower case
alphabetic characters, numeric characters and 32 special characters.
The probability of randomly guessing the correct sequence is one (1)
in 94^64. This calculation is based on the assumption that the
typical standard American QWERTY computer keyboard has 10
Integer digits, 52 alphabetic characters, and 32 special characters
providing 94 characters to choose from in total. Therefore, the
associated probability of a successful random attempt is
approximately 1 in 94^64, which is less than 1 in 1,000,000 required
by FIPS 140-2.
RSA-based authentication
(IKEv1, IKEv2 and TLS)
User
The module supports 2048-bit RSA keys authentication during
IKEv1, IKEv2 and TLS. RSA 2048 bit keys correspond to 112 bits of
security. Assuming the low end of that range, the associated
probability of a successful random attempt is 1 in 2^112, which is
less than 1 in 1,000,000 required by FIPS 140-2.
18
|
Aruba 7XXX Series Controllers FIPS 140-2 Level 2 Security Policy