FipsRequired (MQLONG)

IBM MQ can be configured with cryptographic hardware so that the cryptography modules used are those provided by the hardware product; these can be FIPS-certified to a particular level depending on the cryptographic hardware product in use. Use this field to specify that only FIPS-certified algorithms are used if the cryptography is provided in IBM MQ-provided software.

When IBM MQ is installed an implementation of TLS cryptography is also installed which provides some FIPS-certified modules.

The values can be:

    MQSSL_FIPS_NO
    This is the default value. When set to this value:

    • Any CipherSpec supported on a particular platform can be used.
    • If run without use of cryptographic hardware, the following CipherSpecs run using FIPS 140-2 certified cryptography on the IBM MQ platforms:

      • TLS_RSA_WITH_3DES_EDE_CBC_SHA
      • TLS_RSA_WITH_AES_128_CBC_SHA
      • TLS_RSA_WITH_AES_256_CBC_SHA

    MQSSL_FIPS_YES
    When set to this value, unless you are using cryptographic hardware to perform the cryptography, we can be sure that

    • Only FIPS-certified cryptographic algorithms can be used in the CipherSpec applying to this client connection.
    • Inbound and outbound TLS channel connections only succeed if one of the following Cipher Specs are used:

      • TLS_RSA_WITH_3DES_EDE_CBC_SHA
      • TLS_RSA_WITH_AES_128_CBC_SHA
      • TLS_RSA_WITH_AES_256_CBC_SHA

Notes:

  1. CipherSpec TLS_RSA_WITH_3DES_EDE_CBC_SHA is deprecated.
  2. Where possible, if FIPS-only CipherSpecs are configured then the MQI client rejects connections which specify a non-FIPS CipherSpec with MQRC_SSL_INITIALIZATION_ERROR. IBM MQ does not guarantee to reject all such connections and it is your responsibility to determine whether your IBM MQ configuration is FIPS-compliant.