FIPS 140–2 Compliance for Database Encryption
On specific platforms, InterSystems IRIS® data platform supports FIPS 140–2 compliant cryptography for database encryption. (FIPS 140–2 refers to Federal Information Processing Standard Publication 140-2, which is available at https://csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf. )
InterSystems IRIS supports FIPS 140-2–compliant cryptography for database encryption on Red Hat Enterprise Linux 7 for x86-64. For each supported version, Red Hat has a certificate of validation for the OpenSSL libcrypto.so and libssl.so libraries; this certificate is available at the site listed below.
The libraries are libcrypto.so.1.0.1e and libssl.so.1.0.1e
The certificates are https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/2441, https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3538, and https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3867.
The libraries are libcrypto.so.1.0.2k and libssl.so.1.0.2k
InterSystems IRIS does not support FIPS 140-2–compliant cryptography on Red Hat 8.
For information about Red Hat support for government standards, see https://access.redhat.com/articles/2918071.
Enabling FIPS Support
To enable InterSystems IRIS support for FIPS 140–2 compliant cryptography for database encryption, do the following:
Download and install the openssl package from the Red Hat repository (rhel-7-server-rpms).
Enable FIPS mode for the operating system. For information, see https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/chap-Federal_Standards_and_Regulations.html.
Be sure to reboot and to check that FIPS mode is enabled.
Check the directory /usr/lib64 for the following symbolic links. If these do not exist, create them:
The symbolic link libssl.so should point to the appropriate file (such as libssl.so.1.0.2k), in the same directory.
The symbolic link libcrypto.so should point to the appropriate file (such as libcrypto.so.1.0.2k), in the same directory.
In InterSystems IRIS, specify the FIPSMode CPF parameter as True (1). To do so:
Open the Management Portal.
Select System Administration > Configuration > Additional Settings > Startup.
Here you will see a row for FIPSMode.
Specify the value for FIPSMode as True and save your change.
Restart InterSystems IRIS.
Enable and configure encrypted databases as outlined in Using Encrypted Databases.
Startup Behavior and messages.log
When InterSystems IRIS is started:
If FIPSMode is 0, InterSystems IRIS native cryptography is used, including optimized assembly code using Intel AES-NI hardware instructions, if supported by the CPU. In this mode, InterSystems IRIS writes the following to messages.log upon startup:
FIPS 140-2 compliant cryptography for database encryption is not configured in iris.cpfCopy code to clipboard
If FIPSMode is 1, InterSystems IRIS attempts to resolve references to functions in the /usr/lib64/libcrypto.so FIPS-validated library, and then attempts to initialize the library in FIPS mode. If these steps are successful, InterSystems IRIS writes the following to messages.log:
FIPS 140-2 compliant cryptography for database encryption is enabled for this instance.Copy code to clipboard
If FIPSMode is 1, but the initialization of the library is unsuccessful, InterSystems IRIS does not start. In this case, messages.log contains the following message:
FIPS 140-2 compliant cryptography for database encryption initialization failed. Aborting.Copy code to clipboard
On platforms that do not support FIPS-compliant cryptography, if FIPSMode is 1, InterSystems IRIS native cryptography is used, and InterSystems IRIS writes the following to messages.log:
FIPS 140-2 compliant cryptography for database encryption is not supported on this platform.Copy code to clipboard