Hewlett Packard Enterprise Aruba AP-325, Manual

Page: 37 / 58

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |37
Table 16 – Critical Security Parameters
# Name CSPs type Generation
Storage and
Zeroization
Use
9 Crypto Officer
Passwords Password
(12 -32 characters)
CO configured Stored in Flash and
obfuscated by the
KEK. Zeroized by
executing the CO
command ‘write erase
all reboot’. Authentication for
accessing the
management
interfaces
10 SSHv2 Session Keys AES CBC/CTR
(128/192/256 bits)
Derived in the module
using SP800-135 KDF
during SSHv2 key
exchange Stored in plaintext in
volatile memory.
Zeroized when the
session is closed. Secure SSHv2 traffic
11 SSHv2 Session
Authentication Key HMAC-SHA-1/256/512
(160/256/512 bits)
Derived in the module
using SP800-135 KDF
during SSHv2 key
exchange Stored in plaintext in
volatile memory.
Zeroized when the
session is closed. Secure SSHv2 traffic
12 TLS Pre-Master
Secret Secret
(48 bytes)
Externally generated Stored in plaintext in
volatile memory.
Zeroized when the
session is closed. TLS key agreement
13 TLS Master Secret Secret
(48 bytes) This key is derived via
the key derivation
function defined in
SP800-135 KDF (TLS)
using the TLS Pre-
Master Secret. Stored in SDRAM
memory (plaintext).
Zeroized by rebooting
the module. TLS key agreement
14
TLS Session
Encryption Key
AES CBC
(128/192/256 bits)
Derived in the module
using SP800-135 KDF
during EAP-TLS
service implementation Stored in plaintext in
volatile memory.
Zeroized when the
session is closed. TLS session
encryption
15 TLS Session
Authentication Key HMAC-SHA-1/256/384
(160/256/384 bits)
Derived in the module
using SP800-135 KDF
during EAP-TLS
service implementation Stored in plaintext in
volatile memory.
Zeroized when the
session is closed. TLS session
authentication
16 RSA Private Key RSA Private Key
(2048 bits)
This key is entered by
the CO via SSH (CLI)
and/or TLS (for the
GUI). Stored in Flash and
obfuscated by KEK.
Zeroized by the CO
command ‘write erase
all reboot’.
Used by TLS and
EAP-TLS/PEAP
protocols during the
handshake.
17 RSA Public Key RSA Public Key
(2048 bits)
This key is entered by
the CO via SSH (CLI)
and/or TLS (for the
GUI). Stored in Flash and
obfuscated by KEK.
Zeroized by the CO
command “write erase
all reboot”.
Used by TLS and
EAP-TLS/PEAP
protocols during the
handshake.