[
https://issues.apache.org/jira/browse/QPID-8773?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Partha Sarathy Maripini updated QPID-8773:
------------------------------------------
Description:
*Motivation:*
Deploying Apache Qpid Broker-J in enterprise and regulated environments (such
as govcloud) requires strict FIPS 140 compliance. Currently, Broker-J relies on
standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not FIPS
140 certified.
*Proposed Solution:*
1. Provide support for registering the Bouncy Castle FIPS provider
(org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider) dynamically in
[SSLUtil.java|https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117]
and related TLS security modules.
2. Introduce a configuration property (e.g.,
qpid.security.tls.enableFIPSMode=true) to enable FIPS provider registration
when configured.
3. Allow substituting standard bc-prov dependencies with bc-fips at
build/deploy time.
*Impact:*
This enables Qpid Broker-J to run in FIPS-validated environments while leaving
default functionality unchanged for existing standard deployments.
*Note:* I am actively working on this change and will submit a Pull Request
shortly.
was:
Motivation:
Deploying Apache Qpid Broker-J in enterprise and regulated environments (such
as govcloud) requires strict FIPS 140 compliance. Currently, Broker-J relies on
standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not FIPS
140 certified.
Proposed Solution:
1. Provide support for registering the Bouncy Castle FIPS provider
(org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider) dynamically in
[SSLUtil.java|https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117]
and related TLS security modules.
2. Introduce a configuration property (e.g.,
qpid.security.tls.enableFIPSMode=true) to enable FIPS provider registration
when configured.
3. Allow substituting standard bc-prov dependencies with bc-fips at
build/deploy time.
Impact:
This enables Qpid Broker-J to run in FIPS-validated environments while leaving
default functionality unchanged for existing standard deployments.
Note: I am actively working on this change and will submit a Pull Request
shortly.
> Support for FIPS 140 compliance using Bouncy Castle FIPS (bc-fips)
> ------------------------------------------------------------------
>
> Key: QPID-8773
> URL: https://issues.apache.org/jira/browse/QPID-8773
> Project: Qpid
> Issue Type: Improvement
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
> Labels: FIPS, Security
>
> *Motivation:*
> Deploying Apache Qpid Broker-J in enterprise and regulated environments (such
> as govcloud) requires strict FIPS 140 compliance. Currently, Broker-J relies
> on standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not
> FIPS 140 certified.
> *Proposed Solution:*
> 1. Provide support for registering the Bouncy Castle FIPS provider
> (org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider) dynamically in
> [SSLUtil.java|https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117]
> and related TLS security modules.
> 2. Introduce a configuration property (e.g.,
> qpid.security.tls.enableFIPSMode=true) to enable FIPS provider registration
> when configured.
> 3. Allow substituting standard bc-prov dependencies with bc-fips at
> build/deploy time.
> *Impact:*
> This enables Qpid Broker-J to run in FIPS-validated environments while
> leaving default functionality unchanged for existing standard deployments.
> *Note:* I am actively working on this change and will submit a Pull Request
> shortly.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
