Skip to content

Commit 2580835

Browse files
taoliulttaoliult
committed
Update OpenJCEPlusFIPS Strict and Weakly-Enforced profiles
The Strict profile for FIPS 140-3 which only allows the approved cryptography in the OpenJCEPlusFIPS provider along with other non-cryptographic algorithms commonly used. The Weakly-Enforced profile for FIPS 140-3 which allows for all algorithms within the OpenJCEPlusFIPS provider. Also, update the profile disabledAlgorithms with non-FIPS ciphers. Signed-off-by: Tao Liu <[email protected]>
1 parent 23d6aaf commit 2580835

File tree

1 file changed

+135
-3
lines changed

1 file changed

+135
-3
lines changed

‎src/java.base/share/conf/security/java.security‎

Lines changed: 135 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,34 @@ RestrictedSecurity.NSS.140-2.securerandom.algorithm = PKCS11
155155
#endif
156156

157157
#if defined aix-ppc || defined linux-ppc || defined linux-s390 || defined linux-x86 || defined windows
158+
#
159+
# Strict Restricted Security mode profile for FIPS 140-3. This policy represents only allowable
160+
# approved cryptography in the OpenJCEPlusFIPS provider along with other non-cryptographic algorithms
161+
# commonly used. Please note that the following constraints represent algorithms no longer allowable
162+
# within this strict profile for the OpenJCEPlusFIPS provider as compared to the
163+
# "RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced" profile defined below.
164+
# {AlgorithmParameterGenerator, DiffieHellman, *}, \
165+
# {AlgorithmParameters, DiffieHellman, *}, \
166+
# {KeyAgreement, DiffieHellman, *}, \
167+
# {KeyFactory, DiffieHellman, *}, \
168+
# {KeyGenerator, HmacSHA3-224, *}, \
169+
# {KeyGenerator, HmacSHA3-256, *}, \
170+
# {KeyGenerator, HmacSHA3-384, *}, \
171+
# {KeyGenerator, HmacSHA3-512, *}, \
172+
# {KeyPairGenerator, DiffieHellman, *}, \
173+
# {MessageDigest, MD5, *}, \
174+
# {MessageDigest, SHA-1, *}, \
175+
# {MessageDigest, SHA-512/224, *}, \
176+
# {MessageDigest, SHA-512/256, *}, \
177+
# {Signature, NONEwithDSA, *}, \
178+
# {Signature, NONEwithRSA, *}, \
179+
# {Signature, RSAforSSL, *}, \
180+
# {Signature, SHA1withRSA, *}
181+
#
158182
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.name = OpenJCEPlusFIPS Cryptographic Module FIPS 140-3
159-
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.default = true
183+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.default = false
160184
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.fips = true
161-
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.hash = SHA256:c0f81edb5bbd6a17a3ebbe7aa459441d6b1c77fc02773b8ecc79b4d996c3d055
185+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.hash = SHA256:e71c49d65fd291efe75993ccbe6999e6cfb26bf9ef3e8424cb086c7e2a225ce6
162186
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.number = Certificate #XXX
163187
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.policy = https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/
164188
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.sunsetDate = 2026-09-21
@@ -171,6 +195,7 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.disabledAlgorithms = \
171195
DES, \
172196
DH keySize < 2048, \
173197
EC keySize < 224, \
198+
ECDH, \
174199
MD5withRSA, \
175200
NULL, \
176201
RC4, \
@@ -181,6 +206,12 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.disabledAlgorithms = \
181206
TLS_DHE_DSS_WITH_AES_256_CBC_SHA, \
182207
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, \
183208
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, \
209+
TLS_DHE_RSA_WITH_AES_128_CBC_SHA, \
210+
TLS_DHE_RSA_WITH_AES_256_CBC_SHA, \
211+
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, \
212+
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, \
213+
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, \
214+
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, \
184215
TLS_EMPTY_RENEGOTIATION_INFO_SCSV, \
185216
TLS_RSA_WITH_AES_128_CBC_SHA, \
186217
TLS_RSA_WITH_AES_128_CBC_SHA256, \
@@ -194,9 +225,80 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.disabledAlgorithms = \
194225
X448
195226
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.ephemeralDHKeySize =
196227
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.legacyAlgorithms =
228+
197229
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.certpath.disabledAlgorithms =
198230
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.legacyAlgorithms =
199-
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.1 = com.ibm.crypto.plus.provider.OpenJCEPlusFIPS
231+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.1 = com.ibm.crypto.plus.provider.OpenJCEPlusFIPS [ \
232+
{AlgorithmParameterGenerator, AESGCM, *}, \
233+
{AlgorithmParameterGenerator, CCM, *}, \
234+
{AlgorithmParameterGenerator, EC, *}, \
235+
{AlgorithmParameterGenerator, GCM, *}, \
236+
{AlgorithmParameters, AES, *}, \
237+
{AlgorithmParameters, CCM, *}, \
238+
{AlgorithmParameters, DSA, *}, \
239+
{AlgorithmParameters, EC, *}, \
240+
{AlgorithmParameters, GCM, *}, \
241+
{AlgorithmParameters, OAEP, *}, \
242+
{AlgorithmParameters, RSAPSS, *}, \
243+
{Cipher, AES, *}, \
244+
{Cipher, AES/CCM/NoPadding, *}, \
245+
{Cipher, AES/GCM/NoPadding, *}, \
246+
{KeyAgreement, ECDH, *}, \
247+
{KeyFactory, DSA, *}, \
248+
{KeyFactory, EC, *}, \
249+
{KeyFactory, RSA, *}, \
250+
{KeyFactory, RSAPSS, *}, \
251+
{KeyGenerator, AES, *}, \
252+
{KeyGenerator, HmacSHA224, *}, \
253+
{KeyGenerator, HmacSHA256, *}, \
254+
{KeyGenerator, HmacSHA384, *}, \
255+
{KeyGenerator, HmacSHA512, *}, \
256+
{KeyGenerator, kda-hkdf-with-sha224, *}, \
257+
{KeyGenerator, kda-hkdf-with-sha256, *}, \
258+
{KeyGenerator, kda-hkdf-with-sha384, *}, \
259+
{KeyGenerator, kda-hkdf-with-sha512, *}, \
260+
{KeyGenerator, SunTls12KeyMaterial, *}, \
261+
{KeyGenerator, SunTls12MasterSecret, *}, \
262+
{KeyGenerator, SunTls12Prf, *}, \
263+
{KeyGenerator, SunTls12RsaPremasterSecret, *}, \
264+
{KeyGenerator, SunTlsKeyMaterial, *}, \
265+
{KeyGenerator, SunTlsMasterSecret, *}, \
266+
{KeyGenerator, SunTlsPrf, *}, \
267+
{KeyGenerator, SunTlsRsaPremasterSecret, *}, \
268+
{KeyPairGenerator, EC, *}, \
269+
{KeyPairGenerator, RSA, *}, \
270+
{KeyPairGenerator, RSAPSS, *}, \
271+
{Mac, HmacSHA224, *}, \
272+
{Mac, HmacSHA256, *}, \
273+
{Mac, HmacSHA3-224, *}, \
274+
{Mac, HmacSHA3-256, *}, \
275+
{Mac, HmacSHA3-384, *}, \
276+
{Mac, HmacSHA3-512, *}, \
277+
{Mac, HmacSHA384, *}, \
278+
{Mac, HmacSHA512, *}, \
279+
{MessageDigest, SHA-224, *}, \
280+
{MessageDigest, SHA-256, *}, \
281+
{MessageDigest, SHA-384, *}, \
282+
{MessageDigest, SHA-512, *}, \
283+
{MessageDigest, SHA3-224, *}, \
284+
{MessageDigest, SHA3-256, *}, \
285+
{MessageDigest, SHA3-384, *}, \
286+
{MessageDigest, SHA3-512, *}, \
287+
{SecretKeyFactory, AES, *}, \
288+
{SecureRandom, SHA256DRBG, *}, \
289+
{SecureRandom, SHA512DRBG, *}, \
290+
{Signature, NONEwithECDSA, *}, \
291+
{Signature, RSAPSS, *}, \
292+
{Signature, SHA224withDSA, *}, \
293+
{Signature, SHA224withECDSA, *}, \
294+
{Signature, SHA224withRSA, *}, \
295+
{Signature, SHA256withDSA, *}, \
296+
{Signature, SHA256withECDSA, *}, \
297+
{Signature, SHA256withRSA, *}, \
298+
{Signature, SHA384withECDSA, *}, \
299+
{Signature, SHA384withRSA, *}, \
300+
{Signature, SHA512withECDSA, *}, \
301+
{Signature, SHA512withRSA, *}]
200302
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.2 = sun.security.provider.Sun [ \
201303
{CertificateFactory, X.509, ImplementedIn=Software}, \
202304
{CertPathBuilder, PKIX, ValidationAlgorithm=RFC5280:ImplementedIn=Software}, \
@@ -206,9 +308,39 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.2 = sun.security.provi
206308
{Configuration, JavaLoginConfig, *}, \
207309
{Policy, JavaPolicy, *}]
208310
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.jce.provider.3 = sun.security.ssl.SunJSSE
311+
209312
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.javax.net.ssl.keyStore = NONE
210313
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.securerandom.provider = OpenJCEPlusFIPS
211314
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.securerandom.algorithm = SHA512DRBG
315+
316+
# Weakly-Enforced Restricted Security mode profile for FIPS 140-3. This profile allows for all algorithms
317+
# within the OpenJCEPlusFIPS provider to be callable, even though algorithms may or may not be allowable
318+
# according to the security policy described in the strict profile being extended and depending on how
319+
# algorithms are used. This profile also includes non-cryptographic algorithms and common configuration
320+
# options that MAY be allowable under certain NIST circumstances depending on application deployments.
321+
# For example, PKCS12 files are pre-configured.
322+
#
323+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.desc.name = Weakly-Enforced OpenJCEPlusFIPS Cryptographic Module FIPS 140-3
324+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.desc.default = true
325+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.extends = RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3
326+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.tls.disabledAlgorithms = + \
327+
TLS_CHACHA20_POLY1305_SHA256, \
328+
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, \
329+
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, \
330+
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
331+
332+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.1 = com.ibm.crypto.plus.provider.OpenJCEPlusFIPS
333+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.2 = sun.security.provider.Sun
334+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.3 = sun.security.rsa.SunRsaSign
335+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.4 = sun.security.ec.SunEC
336+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.5 = sun.security.ssl.SunJSSE
337+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.6 = com.sun.crypto.provider.SunJCE
338+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.7 = sun.security.jgss.SunProvider
339+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.8 = com.sun.security.sasl.Provider
340+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.9 = org.jcp.xml.dsig.internal.dom.XMLDSigRI
341+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.10 = sun.security.smartcardio.SunPCSC
342+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.11 = sun.security.provider.certpath.ldap.JdkLDAP
343+
RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3-Weakly-Enforced.jce.provider.12 = com.sun.security.sasl.gsskerb.JdkSASL
212344
#endif
213345

214346
#

0 commit comments

Comments
 (0)