Versions Compared

Old Version 1

changes.mady.by.user Hiromi Takahashi

Saved on

compared with

New Version Current

changes.mady.by.user Izabela Jarosz

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • bc-fips-<VERSION>.jar (tested with version 2.1.13)
  • bctls-fips-<VERSION>.jar (tested with version 2.1.2024)
  • bcutil-fips-<VERSION>.jar (tested with version 2.1.47)

You can place these libraries wherever you choose. This location will be referred to as <BC_DIR> below.

...

  1. Copy bc-fips-<VERSION>.jar, bctls-fips-<VERSION>.jar and bcutil-fips-<VERSION>.jar into the <DOTTEST_INSTALL_DIR>/bin/dottest/java/jars directory.

  2. Use keytool to convert the cacerts file to the FIPS-compliant BCFKS format.
    1. Open the console and execute the following commands:
      Code Block
      cd <DOTTEST_INSTALL_DIR>

move bin\dottest\Jre_x64\lib\security\cacerts bin\dottest\Jre_x64\lib\security\cacerts.pkcs12 

bin\dottest\Jre_x64\bin\keytool.exe -importkeystore -srckeystore bin\dottest\Jre_x64\lib\security\cacerts.pkcs12 -srcstoretype PKCS12 -destkeystore bin\dottest\Jre_x64\lib\security\cacerts -deststoretype BCFKS -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath bin\dottest\java\jars\bc-fips-<VERSION>.jar -srcstorepass changeit -deststorepass changeit

    2. Open the dottestcli.jvm file in the <DOTTEST_INSTALL_DIR>\etc directory, and insert the following line:

      Code Block
      -Djavax.net.ssl.trustStorePassword=changeit


  3. Save your changes.

  4. Open the java.security file in the <DOTTEST_INSTALL_DIR>/bin/dottest/Jre_x64/conf/security/ directory and make the following changes: 

    1. Set the list of security providers by commenting out all existing properties named security.provider.<number>. and inserting the following lines:

      Code Block
      security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
security.provider.3=SUN

    2. Change key and trust manager factory algorithms for the javax.net.ssl package to PKIX.

      Code Block
      ssl.KeyManagerFactory.algorithm=PKIX
ssl.TrustManagerFactory.algorithm=PKIX

    3. Change the default keystore type to fips and disable the compatibility mode for JKS and PKCS12 keystore types.

      Code Block
      keystore.type=fips
keystore.type.compat=false

    4. (Linux only) Add the NativePRNGNonBlocking algorithm to the list of known strong SecureRandom implementations:

      Code Block
      securerandom.strongAlgorithms=NativePRNGNonBlocking:SUN,NativePRNGBlocking:SUN,DRBG:SUN

    5. Allow only FIPS-approved algorithms:

      Code Block
      org.bouncycastle.fips.approved_only=true
  5. Save your changes.

  6. Open the java.policy file in the <DOTTEST_INSTALL_DIR>/bin/dottest/Jre_x64/conf/security/ directory and insert the following permissions into the default domain:

    Code Block
    permission java.lang.RuntimePermission "accessClassInPackage.sun.security.internal.spec";
permission org.bouncycastle.crypto.CryptoServicesPermission "tlsAlgorithmsEnabled";
  7. Save your changes.

  8. Open the logging.properties file in the <DOTTEST_INSTALL_DIR>/bin/dottest/Jre_x64/conf/ directory and insert the following Bouncy Castle logger configuration:

    Code Block
    org.bouncycastle.jsse.provider.DisabledAlgorithmConstraints.level=SEVERE
org.bouncycastle.jsse.provider.PropertyUtils.level=SEVERE
org.bouncycastle.jsse.provider.ProvTlsClient.level=SEVERE

  9. Save your changes.

...

  1. Use keytool to convert the cacerts file to the FIPS-compliant BCFKS format. Open the console and execute the following commands:
    Code Block
    cd <JAVA_HOME>

mv lib/security/cacerts lib/security/cacerts.pkcs12

./bin/keytool -importkeystore -srckeystore lib/security/cacerts.pkcs12 -srcstoretype PKCS12 -destkeystore lib/security/cacerts -deststoretype BCFKS -providername BCFIPS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath <BC_DIR>/bc-fips-<VERSION>.jar -srcstorepass changeit -deststorepass changeit
  2. Save your changes.

  3. Open the java.security file in the <JAVA_HOME>/conf/security directory and make the following changes: 

    1. Set the list of security providers by commenting out all existing properties named security.provider.<number> and fips.provider.<number>, then inserting the following lines:

      Code Block
      security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
security.provider.3=SUN

    2. Change key and trust manager factory algorithms for the javax.net.ssl package to PKIX.

      Code Block
      ssl.KeyManagerFactory.algorithm=PKIX
ssl.TrustManagerFactory.algorithm=PKIX

    3. Change the default keystore type to fips and disable the compatibility mode for JKS and PKCS12 keystore types.

      Code Block
      keystore.type=fips
keystore.type.compat=false

    4. (Linux only) Add the NativePRNGNonBlocking algorithm to the list of known strong SecureRandom implementations:

      Code Block
      securerandom.strongAlgorithms=NativePRNGNonBlocking:SUN,NativePRNGBlocking:SUN,DRBG:SUN
    5. Allow only FIPS-approved algorithms:
      Code Block
      org.bouncycastle.fips.approved_only=true
  4. Save your changes.

  5. Open the java.policy file in the <JAVA_HOME>/conf/security directory and insert the following permissions into the default domain:

    Code Block
    permission java.lang.RuntimePermission "accessClassInPackage.sun.security.internal.spec";
permission org.bouncycastle.crypto.CryptoServicesPermission "tlsAglorithmsEnabledtlsAlgorithmsEnabled";
  6. Save your changes.

  7. Open the logging.properties file in the <JAVA_HOME>/conf directory and insert the following Bouncy Castle logger configuration:

    Code Block
    org.bouncycastle.jsse.provider.DisabledAlgorithmConstraints.level=SEVERE
org.bouncycastle.jsse.provider.PropertyUtils.level=SEVERE
org.bouncycastle.jsse.provider.ProvTlsClient.level=SEVERE
  8. Save your changes.

  9. Add the option that points to the Bouncy Castle FIPS libraries and the option that specifies the password required to access the trust store to your Java command line:

    Code Block
    --module-path=<BC_DIR> -Djavax.net.ssl.trustStorePassword=changeit

    Info

    You can use the PTESTCOV_OPTS environment variable to do that, or modify the Java command line in the dottestcov.bat/dottest.sh script.

...