Federal Information Processing Standards
Federal Information Processing Standards (FIPS) are standards and guidelines issued by the United States National Institute of Standards and Technology (NIST) for federal government computer systems. FIPS are developed when there are compelling federal government requirements for standards, such as for security and interoperability, but acceptable industry standards or solutions do not exist.WebSphere Portal tolerates WAS's support of FIPS 140-2. WAS integrates cryptographic modules such as Java Secure Socket Extension (JSSE) and Java Cryptography Extension (JCE), which are FIPS 140-2 certified. Throughout the documentation and the product, the FIPS 140-2 certified IBM JSSE and JCE modules are called as IBMJSSEFIPS and IBMJCEFIPS, which distinguishes the FIPS-certified modules from the prior, non-certified IBM JSSE and IBM JCE modules.
The FIPS 140-2 compliant toleration means that WebSphere Portal will continue to work after WAS is configured to activate FIPS 140-2 compliant security modules. The WebSphere Portal product has no self-contained Cryptographic Support and as a result is unaware of the module differences. Functions in WebSphere Portal that use encryption include:
- SSL connections inbound from clients (but this is basically the WAS and HTTP Server support for SSL connections, and is not apparent to WebSphere Portal)
- Internal connections between WebSphere Portal administrative functions and WAS administrative services (started, for example, when deploying a portlet which must create a web application in WAS)
All connections listed in this document are carried over SSL using FIPS-compliant encryption. Without FIPS 140-2 support, connections might not be encrypted.
Limitations
There are some restrictions in the level of support that WebSphere Portal provides in using FIPS-certified modules:
- By default, Microsoft Internet Explorer might not have TLS enabled. To enable TLS, open the Internet Explorer browser and click Tools > Internet Options. On the Advanced tab, select the Use TLS 1.0 check box.
- The IBM Tivoli Directory Server provides the Use FIPS certified implementation option, which enables the directory server the FIPS-certified encryption algorithms uses. For information, see "Setting the level of encryption" within the IBM Tivoli Directory Server Administration Guide.
- We can use FIPS-certified JSSE providers if the servers and clients are using WAS.
- If we are trying to enable FIPS processing mode with GSKit bundled with ITDS, see technote 1578181.
Parent: Security and authentication considerations
Related:
Authentication
Plan for single sign-on
Secure communications using SSL
Credential Vault
Caching considerations
Related:
Enable FIPS