Built-in entropy source NEW

FortiOS includes a built-in entropy source, which eliminates the need for a physical USB entropy token when booting up in FIPS mode on any platform. This enhancement continues to meet the requirements of FIPS 140-3 Certification by changing the source of entropy to CPU jitter entropy.

The entropy-token parameter under config system fips-cc is removed if the FortiGate is a SoC3, SoC4, or CP9 device.

To verify that jitter entropy is used:

1. Enable FIPS-CC mode, which will cause the FortiGate to reboot:

   config system fips-cc
       set status enable
   end
   					
   Please enter admin administrator password:********
   Please re-enter admin administrator password:********
   
   Warning: most configuration will be lost,
   do you want to continue?(y/n) y
   The system is going down NOW !!
   
   Please stand by while rebooting the system.
   Restarting system.
   ...
   Reading boot image 2919154 bytes.
   Initializing firewall...
   System is starting...
   
   FIPS-CC mode: Starting self-tests.
   Running Configuration/VPN Bypass test...      passed
   Running AES test...                           passed
   Running SHA1-HMAC test...                     passed
   Running SHA256-HMAC test...                   passed
   Running SHA384/512-HMAC test...               passed
   Running RSA test...                           passed
   Running ECDSA test...                         passed
   Running TLS1.1-KDF test...                    passed
   Running TLS1.2-KDF test...                    passed
   Running SSH-KDF test...                       passed
   Running IKEv1-KDF test...                     passed
   Running IKEv2-KDF test...                     passed
   Running Primitive-Z test...                   passed
   Running Firmware integrity test...            passed
   Running RBG-instantiate test...               passed
   Running RBG-reseed test...                    passed
   Running RBG-generate test...                  passed
   Self-tests passed

2. Verify the entropy token user event logs:

   # execute log filter category event
   # execute log filter field logid 0102038012
   # execute log display
   
   3 logs found.
   3 logs returned.
   
   1: date=2023-07-18 time=20:27:56 eventtime=1689737275853093806 tz="-0700" logid="0102038012" type="event" subtype="user" level="notice" vd="root" logdesc="Seeding from entropy source" user="system" action="reseeding" msg="Reseeding PRNG from JitterEnt entropy"
   

   2: date=2023-07-18 time=20:26:56 eventtime=1689737146847643497 tz="-0700" logid="0102038012" type="event" subtype="user" level="notice" vd="root" logdesc="Seeding from entropy source" user="system" action="seeding" msg="Seeding PRNG from JitterEnt entropy"
   

   3: date=2023-07-18 time=19:29:25 eventtime=1689733702417108422 tz="-0700" logid="0102038012" type="event" subtype="user" level="notice" vd="root" logdesc="Seeding from entropy source" user="system" action="seeding" msg="Seeding PRNG from JitterEnt entropy"