Partha Sarathy Maripini created QPID-8773:
---------------------------------------------
Summary: Support for FIPS 140 compliance using Bouncy Castle FIPS
(bc-fips)
Key: QPID-8773
URL: https://issues.apache.org/jira/browse/QPID-8773
Project: Qpid
Issue Type: Improvement
Components: Broker-J
Reporter: Partha Sarathy Maripini
Motivation:
Deploying Apache Qpid Broker-J in enterprise and regulated environments (such
as govcloud) requires strict FIPS 140 compliance. Currently, Broker-J relies on
standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not FIPS
140 certified.
Proposed Solution:
1. Provide support for registering the Bouncy Castle FIPS provider
(org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider) dynamically in
[SSLUtil.java|https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117]
and related TLS security modules.
2. Introduce a configuration property (e.g.,
qpid.security.tls.enableFIPSMode=true) to enable FIPS provider registration
when configured.
3. Allow substituting standard bc-prov dependencies with bc-fips at
build/deploy time.
Impact:
This enables Qpid Broker-J to run in FIPS-validated environments while leaving
default functionality unchanged for existing standard deployments.
Note: I am actively working on this change and will submit a Pull Request
shortly.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
