[
https://issues.apache.org/jira/browse/QPID-8773?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18125657#comment-18125657
]
Daniil Kirilyuk commented on QPID-8773:
---------------------------------------
Hi Partha,
Thanks for preparing a contribution!
You can submit a pull request from your fork without waiting for JIRA
contributor permissions or issue assignment. The contribution workflow is
described in the [Quick Start
Guide|https://github.com/apache/qpid-broker-j/blob/main/doc/developer-guide/src/main/markdown/quick-start.md#how-to-contribute-changes-to-qpid-broker-j].
Please also review the [Coding
Standards|https://github.com/apache/qpid-broker-j/blob/main/doc/developer-guide/src/main/markdown/code-guide.md],
as Broker-J follows some project-specific Java conventions.
Reviews may involve several reviewers and can take a couple of weeks or longer,
depending on the scope of the changes and reviewer availability.
Please reference the Jira ticket in your PR description (see e.g.
[#450|https://github.com/apache/qpid-broker-j/pull/450] as an example) - then
ASF GitHub Bot will reference it in a comment to this JIRA.
Kind regards,
Daniil Kirilyuk
> Support for FIPS 140 compliance using Bouncy Castle FIPS (bc-fips)
> ------------------------------------------------------------------
>
> Key: QPID-8773
> URL: https://issues.apache.org/jira/browse/QPID-8773
> Project: Qpid
> Issue Type: Improvement
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
> Labels: FIPS, Security
>
> *Motivation:*
> Deploying Apache Qpid Broker-J in enterprise and regulated environments (such
> as govcloud) requires strict FIPS 140 compliance. Currently, Broker-J relies
> on standard Bouncy Castle libraries (bc-prov / bcprov-jdk18on), which are not
> FIPS 140 certified.
> *Proposed Solution:*
> 1. Provide support for registering the Bouncy Castle FIPS provider
> (org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider) dynamically in
> [SSLUtil.java|https://github.com/apache/qpid-broker-j/blob/49098be941a6e6c5c5fc17759c30e0e1e0331c80/broker-core/src/main/java/org/apache/qpid/server/transport/network/security/ssl/SSLUtil.java#L117]
> and related TLS security modules.
> 2. Introduce a configuration property (e.g.,
> qpid.security.tls.enableFIPSMode=true) to enable FIPS provider registration
> when configured.
> 3. Allow substituting standard bc-prov dependencies with bc-fips at
> build/deploy time.
> *Impact:*
> This enables Qpid Broker-J to run in FIPS-validated environments while
> leaving default functionality unchanged for existing standard deployments.
> *Note:* I am actively working on this change and will submit a Pull Request
> shortly.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
