For up-to-date product documentation, see the IBM MobileFirst Foundation Developer Center.

Configure FIPS 140-2 mode for HTTPS and JSONStore encryption

Learn about settings to configure FIPS 140-2 for encrypting data for HTTPS and JSONStore.

For iOS apps, FIPS 140-2 is enabled through the iOS FIPS libraries. It is enabled by default, so no action is required to enable or configure it.

The following code snippet is populated into a new IBM MobileFirst™ Platform Foundation application for the Android operating system in the initOptions.js file for configuring FIPS 140-2:

var wlInitOptions = {
  ...
  // # Enable FIPS 140-2 for data-in-motion (network) and data-at-rest (JSONStore) on Android.
  //   Requires the FIPS 140-2 optional feature to be enabled also.
  // enableFIPS : false
  ...
};

The default value of enableFIPS is false for the Android operating system. To enable FIPS 140-2 for both HTTPS and JSONStore data encryption, uncomment and set the option to true. After you set the value of enableFIPS to true, you should listen for the FIPS ready JavaScript event by creating a listening event similar to the following sample:

document.addEventListener('WL/FIPS/READY', 
    this.onFipsReady, false);

onFipsReady: function() {
  // FIPS SDK is loaded and ready
}

After you set the value of the enableFIPS property, create an Android environment, and build the environment.

Note: You must install the FIPS Cordova plugin before you set the enableFIPS property value to true. Otherwise, a warning message is logged that states the initOption value is set, but the optional feature was not found. The FIPS 140-2 and JSONStore features are both optional on the Android operating system. FIPS 140-2 affects JSONStore data encryption only if the JSONStore optional feature is also enabled. If JSONStore is not enabled, then FIPS 140-2 does not affect JSONStore. In iOS, the FIPS 140-2 optional feature is not required for JSONStore FIPS 140-2 (data at rest) or HTTPS encryption (data in motion) because they are both handled by iOS. In Android, we must enable the FIPS 140-2 optional feature if we want to use JSONStore FIPS 140-2 or HTTPS encryption.

[WARN] FIPSHttp feature not found, but initOptions enables it on startup

After completing the procedure in Enabling FIPS 140-2 and this procedure in your Android environment, it automatically applies the FIPS 140-2 compliance to the JSONStore plug-in when you install it.

Parent topic: FIPS 140-2 support