{"id":1196,"date":"2009-08-12T23:57:21","date_gmt":"2009-08-13T04:57:21","guid":{"rendered":"http:\/\/www.coresecuritypatterns.com\/blogs\/?p=1196"},"modified":"2009-08-12T23:57:21","modified_gmt":"2009-08-13T04:57:21","slug":"enabling-java-with-fips-140-compliant-ssltls-solution","status":"publish","type":"post","link":"https:\/\/websecuritypatterns.com\/blogs\/2009\/08\/12\/enabling-java-with-fips-140-compliant-ssltls-solution\/","title":{"rendered":"Enabling FIPS-140 compliance for Java based SSL\/TLS applications"},"content":{"rendered":"<p style=\"30px\"><a href=\"http:\/\/java.sun.com\/javase\/6\/docs\/technotes\/guides\/security\/jsse\/JSSERefGuide.html\"><img loading=\"lazy\" decoding=\"async\" class=\"alignright\" src=\"http:\/\/java.sun.com\/javase\/6\/docs\/images\/javalogo52x88.gif\" alt=\"\" width=\"52\" height=\"88\" \/><\/a>FIPS-140* compliance\u00a0has gained overwhelming attention these days and it has\u00a0become a mandatory requirement for several security sensitive applications (mostly in Government and Security solutions and recently with select finance\u00a0industry solutions and particularly for achieving compliance with regulatory mandates such as PCI DSS, FISMA, HIPPA, etc\u00a0). FIPS-140 also helps defining security requirements for supporting integration with cryptographic hardware and software\u00a0tokens.\u00a0 Ensuring FIPS compliance\u00a0to Java based application security has been one of demanding needs of security enthusiasts but unfortunately neither Sun JCE or JSSE\u00a0is not yet\u00a0FIPS-140 certified &#8211; hopefully soon !\u00a0 Sun JDK 6 (and\u00a0above)\u00a0has also\u00a0introduced several enhancements including support for enabling FIPS-140 compliance for Sun JSSE using FIPS-140 certified cryptographic providers for supporting SSL\/TLS communication and associated cryptographic operations. To accomplish this, Java 6\u00a0uses the PKCS#11 support\u00a0for JSSE to integrate with PKCS#11 based FIPS-140 cryptographic token.<\/p>\n<p style=\"30px\">\u00a0<\/p>\n<p>Lately I worked on a security solution using SunJSSE with NSS as a software cryptographic token&#8230; and here is my tipsheet for those keen on playing FIPS conformance with SunJSSE.<\/p>\n<p>\u00a0<\/p>\n<ul>\n<li>SunJSSE\u00a0can be\u00a0configured to\u00a0run on\u00a0FIPS-140 compliant mode as long as it uses a FIPS-140 certified cryptographic hardware or software provider that implements all cryptographic algorithms required by JSSE\u00a0 (ex. Network Security Services &#8211; NSS, Sun Cryptographic Accelerator 6000, nCipher, etc).<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<ul>\n<li>To enable FIPS mode, edit the file <code>${java.home}\/lib\/security\/java.security<\/code> and modify the line that lists <code>com.sun.net.ssl.internal.ssl.Provider<\/code> and associate the name of the FIPS-140 cryptographic provider (ex. SunPKCS11-NSS). The name of the provider is a string that concatenates the prefix <code>SunPKCS11-<\/code>\u00a0with the name of the specified\u00a0PKCS#11 provider in its configuration file.<\/li>\n<\/ul>\n<p style=\"90px;\"><em>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0security.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS<\/em><\/p>\n<p style=\"90px;\"><em><\/em>\u00a0<\/p>\n<ul>\n<li>\n<div style=\"90px;\">In case\u00a0of using NSS as\u00a0cryptographic software token\u00a0(Make use of NSS 3.1.1. or above), assuming the libraries\u00a0are located\u00a0under the <em>\/opt\/nss\/lib<\/em> directory and its key database\u00a0files\u00a0 (with the suffix .db) are under the <em>\/opt\/nss\/fipsdb<\/em> directory, the sample configuration for representing NSS will be as follows:<\/div>\n<\/li>\n<\/ul>\n<address>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Use NSS as a FIPS-140 compliant cryptographic token\u00a0<br \/>\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#\u00a0SunPKCS11-NSS<br \/>\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 name = NSS<br \/>\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0nssLibraryDirectory = \/opt\/nss\/lib<br \/>\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 nssSecmodDirectory = \/opt\/nss\/fipsdb<br \/>\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0nssModule = fips<\/address>\n<ul>\n<li>In FIPS mode, SunJSSE will perform SSL\/TLS 1.0 based communication and cryptographic operations including symmetric and asymmetric encryption, signature generation and verification, message digests and message authentication codes, key generation and key derivation, random number generation, etc.<\/li>\n<li>To refer to the SunJSSE supported Ciphersuites suites refer to the <a title=\"Sun JSSE\" href=\"http:\/\/java.sun.com\/javase\/6\/docs\/technotes\/guides\/security\/jsse\/JSSERefGuide.html\" target=\"_blank\">Sun JSSE&#8217;s documentation<\/a>\u00a0and notes for <a href=\"http:\/\/java.sun.com\/javase\/6\/docs\/technotes\/guides\/security\/jsse\/FIPS.html\" target=\"_blank\">FIPS guidance<\/a>.<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<address><em>* FIPS-140 is a\u00a0US\u00a0Federal data security standard\u00a0approved by the National Institute of Standards and Technology (NIST) &#8211; The current version is FIPS-140-2. All US government agencies are mandated to use only FIPS-conformant\/validated products for deploying security sensitive applications and solutions.<\/em><\/address>\n","protected":false},"excerpt":{"rendered":"<p>FIPS-140* compliance\u00a0has gained overwhelming attention these days and it has\u00a0become a mandatory requirement for several security sensitive applications (mostly in Government and Security solutions and recently with select finance\u00a0industry solutions and particularly for achieving compliance with regulatory mandates such as PCI DSS, FISMA, HIPPA, etc\u00a0). FIPS-140 also helps defining security requirements for supporting integration with cryptographic hardware and software\u00a0tokens.\u00a0 Ensuring&#8230; <a href=\"https:\/\/websecuritypatterns.com\/blogs\/2009\/08\/12\/enabling-java-with-fips-140-compliant-ssltls-solution\/\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4,21,6,8,9,11],"tags":[28,30,39,40,57,62],"class_list":["post-1196","post","type-post","status-publish","format-standard","hentry","category-compliance","category-java-security","category-main","category-pki-main","category-security","category-smartcards-pki","tag-compliance-main","tag-fips-140","tag-java","tag-java-security","tag-pki-main","tag-security"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts\/1196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/comments?post=1196"}],"version-history":[{"count":0,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/posts\/1196\/revisions"}],"wp:attachment":[{"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/media?parent=1196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/categories?post=1196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/websecuritypatterns.com\/blogs\/wp-json\/wp\/v2\/tags?post=1196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}