FIPS self-tests

To ensure correct operation of cryptography modules, FIPS provides self-test mechanisms, including power-up self-tests and conditional self-tests.

If a power-up self-test fails, the device where the self-test process exists reboots. If a conditional self-test fails, the system outputs a self-test failure message.


[NOTE: ]

NOTE:

If a self-test fails, contact Hewlett Packard Enterprise Support.


Power-up self-tests

The power-up self-test examines the availability of FIPS-allowed cryptographic algorithms.

The device supports the following types of power-up self-tests:

The power-up self-test examines the cryptographic algorithms listed in Table 32.

Table 32: Power-up self-tests list

Type

Operations

KAT

Tests the following algorithms:

  • SHA1, SHA224, SHA256, SHA384, and SHA512.

  • HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512.

  • AES.

  • RSA (signature and authentication).

  • ECDH.

  • DRBG.

  • GCM.

  • GMAC.

PWCT

Tests the following algorithms:

  • RSA (signature and authentication).

  • RSA (encryption and decryption).

  • DSA (signature and authentication).

  • ECDSA (signature and authentication).

Conditional self-tests

A conditional self-test runs when an asymmetrical cryptographic module or a random number generator module is invoked. Conditional self-tests include the following types: