FIPS and Certified Cryptography

Configure FIPS mode with the next-generation cryptographic provider, or use the legacy FIPS 140-2 parameters for existing deployments.

When FIPS Mode Is Required

Enable the applicable FIPS mode when required by organizational policy, procurement, or regulation. Confirm the Oracle Database 19c release update, platform, cryptographic provider, allowed algorithms, and module validation status with the compliance owner.

FIPS Support by Cryptographic Provider

Starting with Oracle Database 19.32, Oracle Database 19c supports FIPS 140-3 with the next-generation cryptographic provider. Oracle Database 19c supports FIPS 140-2 with both the next-generation and legacy providers. Only one provider can be active in a database instance.

Cryptographic provider	FIPS standard	Configuration
Next-generation cryptographic provider	FIPS 140-2 and FIPS 140-3	Set `FIPS_140=TRUE` in `fips.ora` for FIPS 140-2. Set both `FIPS_140=TRUE` and `FIPS_140_3=TRUE` in `fips.ora` for FIPS 140-3.
Legacy provider	FIPS 140-2	Use the legacy parameters for TDE and `DBMS_CRYPTO`, TLS, and native network encryption.

FIPS and post-quantum cryptography (PQC) address different requirements. FIPS concerns use of a validated cryptographic provider. PQC concerns resilience against future quantum attacks.

Configure FIPS 140-3 with the Next-Generation Cryptographic Provider

For new FIPS deployments, use the next-generation cryptographic provider. To configure FIPS 140-3, set the required parameters in fips.ora. Before changing the parameters, switch the database to the next-generation provider.

In fips.ora, set the following parameters:
```
FIPS_140=TRUE
FIPS_140_3=TRUE
```
Restart the database instance and Oracle Net listener.

FIPS_140_3=TRUE enables FIPS 140-3 mode with the next-generation cryptographic provider. FIPS_140_3 does not enable FIPS mode by itself; set both parameters.

Note: Do not use FIPS_140 and FIPS_140_3 to configure FIPS 140-2 with the legacy provider. Use the legacy parameters instead. The SSLFIPS_140 parameter remains supported but is deprecated when the next-generation provider is active.

Use Legacy FIPS 140-2 Parameters

FIPS 140-2 remains supported with the legacy provider. Use the following parameters for existing deployments, and for Oracle Database versions that use the legacy provider.

DBFIPS_140=TRUE is an initialization parameter that enables FIPS 140-2 mode for Transparent Data Encryption (TDE) and DBMS_CRYPTO.
SSLFIPS_140=TRUE in fips.ora enables FIPS 140-2 mode for Transport Layer Security (TLS). When using Oracle Instant Client, also set SSLFIPS_LIB to the FIPS library location.
SQLNET.FIPS_140=TRUE in sqlnet.ora enables FIPS 140-2 mode for native network encryption.

Restart the database and affected Oracle Net services after changing FIPS configuration.

Note: The legacy parameters are deprecated when the next-generation provider is active. Use FIPS_140 and FIPS_140_3 for FIPS 140-3 with the next-generation cryptographic provider.

Configure FIPS Mode for OraPKI

Configure OraPKI for FIPS 140-2 or FIPS 140-3 through the java.security file, command-line options, or the fips.ora file.

Configure FIPS Mode in java.security

Set the Java security property for the required FIPS mode and configure the FIPS provider.

In java.security, set oracle.security.crypto.jce.mode to the value for the required mode.

For FIPS 140-2, use:
```
oracle.security.crypto.jce.mode=fips140
```
For FIPS 140-3, use:
```
oracle.security.crypto.jce.mode=fips140_3
```
Add the following entry at the top of the provider list, and renumber the remaining providers so that each has a unique number:
```
security.provider.1=com.rsa.jsafe.provider.JsafeJCE
```
Add the FIPS provider JAR files to the classpath. OraPKI selects the appropriate JAR files based on the value of oracle.security.crypto.jce.mode.

Configure FIPS Mode on the Command Line

Use the -fips140_mode option with an orapki command to select the FIPS mode for the operation.

For FIPS 140-2, specify -fips140_mode without an additional argument.
For FIPS 140-3, specify -fips140_mode FIPS_140_3.

For example, to display a wallet in FIPS 140-3 mode, run the following command, replacing wallet_directory with the wallet location:

orapki wallet display -wallet wallet_directory -fips140_mode FIPS_140_3

Configure FIPS Mode in fips.ora

To enable FIPS 140-2 for OraPKI, set the following parameter in fips.ora:

FIPS_140=TRUE

To enable FIPS 140-3, set both parameters on separate lines:

FIPS_140=TRUE
FIPS_140_3=TRUE

Setting FIPS_140_3=TRUE alone does not enable FIPS 140-3 mode.

Enable FIPS 140-3 with enable_fips.py

The enable_fips.py script accepts the FIPS_140_3 argument to enable FIPS 140-3 mode.

From the directory that contains the script, run:

python enable_fips.py FIPS_140_3

Create Self-Signed Certificates

Use the orapki utility to create self-signed certificates for testing purposes. See Example: Wallet with a Self-Signed Certificate and Export of the Certificate.