Chapter 3. FIPS automation in Red Hat build of OpenJDK 17
This chapter describes how the FIPS automation is implemented in Red Hat build of OpenJDK 17 and how FIPS automation might impact your applications.
3.1. Security providers
When FIPS mode is enabled, Red Hat build of OpenJDK 17 replaces the installed security providers with a constrained list. Some security services and algorithms might be dropped, so that only a FIPS-certified module performs cryptographic operations. The following list describes installed security providers, services, algorithms and enabled configurations:
- SunPKCS11-NSS-FIPS
Initialized with the NSS software token, which is the service provider’s
PKCS#11back end, in accordance with the configuration found at$JRE_HOME/conf/security/nss.fips.cfg:-
name = NSS-FIPS -
nssLibraryDirectory = /usr/lib64 -
nssSecmodDirectory = ${fips.nssdb.path} -
nssDbMode = readWrite -
nssModule = fips -
attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
NoteChanges to this configuration are discouraged.
All cryptographic services are enabled. These include
AlgorithmParameters,Cipher,KeyAgreement,KeyFactory,KeyGenerator,KeyPairGenerator,KeyStore,Mac,MessageDigest,SecretKeyFactory,SecureRandom, andSignature.-
- SUN
-
Only X.509 certificate-related (
CertificateFactory,CertPathBuilder,CertPathValidator,CertStore),AlgorithmParameterGenerator,AlgorithmParameters, andKeyStore(JKS,PKCS12) services are enabled. - SunEC
-
Only
AlgorithmParametersandKeyFactoryservices are enabled. - SunJSSE
-
Only TLS-related services (
KeyManagerFactory,SSLContext,TrustManagerFactory) andKeyStore(PKCS12) are enabled. - SunJCE
-
Only
AlgorithmParameterGenerator,AlgorithmParameters,KeyFactory, andSecretKeyFactory(exceptBKDF2algorithms) services are enabled. - SunRsaSign
-
Only
AlgorithmParametersandKeyFactoryservices are enabled. - XMLDSig
-
All services are enabled. These include
TransformService,KeyInfoFactory, andXMLSignatureFactory.
3.2. Crypto-policies
In FIPS mode, Red Hat build of OpenJDK 17 takes the list of disabled cryptographic algorithms and other configurations from the global FIPS crypto-policy in RHEL. You can find these values at /etc/crypto-policies/back-ends/java.config. You can use the update-crypto-policies tool from RHEL to consistently manage crypto-policies.
A crypto-policies approved algorithm might not be usable when Red Hat build of OpenJDK is configured in FIPS mode. This occurs when a FIPS-certified implementation is not available in the NSS software token or when it is not supported in the SunPKCS11 security provider.
3.3. Trust Anchor certificates
In FIPS mode, Red Hat build of OpenJDK 17 uses the global Trust Anchor certificates repository by default. This behavior is equivalent to non-FIPS mode. This repository is located at /etc/pki/java/cacerts. Use the update-ca-trust tool from RHEL to consistently manage certificates. Optionally, you can store Trust Anchor certificates in your own PKCS12 and PKCS11 keystores, and use them for TLS communication. For more information, see the TrustManagerFactory::init documentation.
When the javax.net.ssl.trustStoreType system property is not set and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically sets this system property to the value of the keystore.type security property. This behavior is equivalent to non-FIPS mode.
3.4. Keystores
In FIPS mode, Red Hat build of OpenJDK 17 enables the use of the PKCS12 and PKCS11 keystore types. PKCS12 is used by default. You can change the default keystore type by using the fips.keystore.type security property. An application can also select which keystore type to use when invoking KeyStore.getInstance(<type>).
When opening a PKCS11 keystore, Red Hat build of OpenJDK 17 uses the SQLite NSS DB located at /etc/pki/nssdb. This NSS DB might be unsuitable to store keys. You can specify a different database by setting a value for the fips.nssdb.path property. For more information and security considerations, see FIPS settings in Red Hat build of OpenJDK 17.
When you set the fips.keystore.type security property to PKCS11 and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically assigns the javax.net.ssl.keyStore system property to a value of NONE. This behavior facilitates the use of PKCS#11 keystores by saving a manual configuration step. For more information, see JDK-8238264.
Revised on 2024-05-28 07:35:02 UTC
