Oracle^® SuperCluster M8 and SuperCluster M7 Security Guide

FIPS-140-2 Level 1 Compliance

The cryptographic applications hosted on SuperCluster rely on the Cryptographic Framework feature of Oracle Solaris, which is validated for FIPS 140-2 Level 1 compliance. The Oracle Solaris Cryptographic Framework is the central cryptographic store for Oracle Solaris, and it provides two FIPS 140–verified modules that support the user-space and kernel-level processes. These library modules provide encryption, decryption, hashing, signature generation and verification, certificate generation and verification, and message authentication functions for applications. User-level applications that call into these modules run in FIPS 140 mode.

In addition to the Oracle Solaris Cryptographic Framework, the OpenSSL object module bundled with Oracle Solaris is validated for FIPS 140-2 Level 1 compliance, which supports the cryptography for applications based on the Secure Shell and TLS protocols. The cloud service provider can choose to enable the tenant hosts with FIPS 140–compliant modes. When running in FIPS 140–compliant modes, Oracle Solaris and OpenSSL, which are FIPS 140-2 providers, enforce the use of FIPS 140– validated cryptographic algorithms.

Also see (If Required) Enable FIPS-140 Compliant Operation (Oracle ILOM).

This table lists FIPS approved algorithms that are supported by Oracle Solaris on SuperCluster M8 and SuperCluster M7.

Key or CSP Certificate Number v1.0 v1.1 Symmetric Key AES: ECB, CBC, CFB-128, CCM, GMAC, GCM, and CTR modes for 128-, 192-, and 256-bit key sizes #2311 #2574 AES: XTS mode for 256- and 512-bit key sizes #2311 #2574 TripleDES: CBC and ECB mode for keying option 1 #1458 #1560 Asymmetric Key RSA PKCS#1.5 signature generation/verification: 1024-, 2048-,bit (with SHA-1, SHA-256, SHA-384, SHA-512) #1194 #1321 ECDSA signature generation/verification: P-192, -224, -256, -384, -521; K-163, -233, -283, -409, -571; B-163, -233, -283, -409, -571 #376 #446 Secure Hashing Standard (SHS) SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 #1425 #1596 (Keyed-) Hash-based Message Authentication HMAC SHA-1, HMAC SHA-224, HMAC SHA-256, HMAC SHA-384, HMAC SHA-512 #1425 #1596 Random Number Generators swrand FIPS 186-2 Random Number Generator #1154 #1222 n2rng FIPS 186-2 Random Number Generator #1152 #1226

Oracle Solaris offer two providers of cryptographic algorithms that are validated for FIPS 140-2 Level 1.

• The Cryptographic Framework feature of Oracle Solaris is the central cryptographic store on an Oracle Solaris system and provides two FIPS 140 modules. The userland module supplies cryptography for applications that run in user space and the kernel module provides cryptography for kernel-level processes. These library modules provide encryption, decryption, hashing, signature generation and verification, certificate generation and verification, and message authentication functions for applications. User- level applications that call into these modules run in FIPS 140 mode, for example, the passwd command and IKEv2. Kernel-level consumers, for example Kerberos and IPsec, use proprietary APIs to call into the kernel Cryptographic Framework.

• The OpenSSL object module provides cryptography for SSH and web applications. OpenSSL is the Open Source toolkit for the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, and provides a cryptography library. In Oracle Solaris, SSH and the Apache Web Server are consumers of the OpenSSL FIPS 140 module. Oracle Solaris ships a FIPS 140 version of OpenSSL with Oracle Solaris 11.2 that is available to all consumers but the version shipped with Oracle Solaris 11.1 is available to Solaris SSH only. Because FIPS 140-2 provider modules are CPU intensive, they are not enabled by default. As the administrator, you are responsible for enabling the providers in FIPS 140 mode and configuring consumers.

For more information on enabling FIPS-140 providers on Oracle Solaris, refer to the document titled Using a FIPS 140 Enabled System in Oracle Solaris 11.2, available under the Securing the Oracle Solaris 11 Operating System heading at: http://docs.oracle.com/cd/E36784_01.