Chapter 3. FIPS automation in Red Hat build of OpenJDK 17 This chapter describes how the FIPS automation is implemented in Red Hat build of OpenJDK 17 and how FIPS automation might impact your applications. 3.1. Security providers When FIPS mode is enabled, Red Hat build of OpenJDK 17 replaces the installed security providers with a constrained list. Some security services and algorithms might be dropped, so that only a FIPS-certified module performs cryptographic operations. The following list describes installed security providers, services, algorithms and enabled configurations: SunPKCS11-NSS-FIPS Initialized with the NSS software token, which is the service provider's PKCS#11 back end, in accordance with the configuration found at USDJRE_HOME/conf/security/nss.fips.cfg : name = NSS-FIPS nssLibraryDirectory = /usr/lib64 nssSecmodDirectory = USD{fips.nssdb.path} nssDbMode = readWrite nssModule = fips attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true } Note Changes to this configuration are discouraged. All cryptographic services are enabled. These include AlgorithmParameters , Cipher , KeyAgreement , KeyFactory , KeyGenerator , KeyPairGenerator , KeyStore , Mac , MessageDigest , SecretKeyFactory , SecureRandom , and Signature . SUN Only X.509 certificate-related ( CertificateFactory , CertPathBuilder , CertPathValidator , CertStore ), AlgorithmParameterGenerator , AlgorithmParameters , and KeyStore ( JKS , PKCS12 ) services are enabled. SunEC Only AlgorithmParameters and KeyFactory services are enabled. SunJSSE Only TLS-related services ( KeyManagerFactory , SSLContext , TrustManagerFactory ) and KeyStore ( PKCS12 ) are enabled. SunJCE Only AlgorithmParameterGenerator , AlgorithmParameters , KeyFactory , and SecretKeyFactory (except BKDF2 algorithms) services are enabled. SunRsaSign Only AlgorithmParameters and KeyFactory services are enabled. XMLDSig All services are enabled. These include TransformService , KeyInfoFactory , and XMLSignatureFactory . 3.2. Crypto-policies In FIPS mode, Red Hat build of OpenJDK 17 takes the list of disabled cryptographic algorithms and other configurations from the global FIPS crypto-policy in RHEL. You can find these values at /etc/crypto-policies/back-ends/java.config . You can use the update-crypto-policies tool from RHEL to consistently manage crypto-policies. Note A crypto-policies approved algorithm might not be usable when Red Hat build of OpenJDK is configured in FIPS mode. This occurs when a FIPS-certified implementation is not available in the NSS software token or when it is not supported in the SunPKCS11 security provider. 3.3. Trust Anchor certificates In FIPS mode, Red Hat build of OpenJDK 17 uses the global Trust Anchor certificates repository by default. This behavior is equivalent to non-FIPS mode. This repository is located at /etc/pki/java/cacerts . Use the update-ca-trust tool from RHEL to consistently manage certificates. Optionally, you can store Trust Anchor certificates in your own PKCS12 and PKCS11 keystores, and use them for TLS communication. For more information, see the TrustManagerFactory::init documentation. When the javax.net.ssl.trustStoreType system property is not set and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically sets this system property to the value of the keystore.type security property. This behavior is equivalent to non-FIPS mode. 3.4. Keystores In FIPS mode, Red Hat build of OpenJDK 17 enables the use of the PKCS12 and PKCS11 keystore types. PKCS12 is used by default. You can change the default keystore type by using the fips.keystore.type security property. An application can also select which keystore type to use when invoking KeyStore.getInstance(<type>) . When opening a PKCS11 keystore, Red Hat build of OpenJDK 17 uses the SQLite NSS DB located at /etc/pki/nssdb . This NSS DB might be unsuitable to store keys. You can specify a different database by setting a value for the fips.nssdb.path property. For more information and security considerations, see FIPS settings in Red Hat build of OpenJDK 17 . When you set the fips.keystore.type security property to PKCS11 and FIPS mode is enabled, Red Hat build of OpenJDK 17 automatically assigns the javax.net.ssl.keyStore system property to a value of NONE . This behavior facilitates the use of PKCS#11 keystores by saving a manual configuration step. For more information, see JDK-8238264 . Revised on 2024-11-25 10:51:45 UTC

Commands: