FIPS and Certified Cryptography
Configure FIPS 140-3 with the OpenSSL provider, or use the legacy FIPS 140-2 parameters for existing deployments.
When FIPS Mode Is Required
Enable the applicable FIPS mode when required by organizational policy, procurement, or regulation. Confirm the Oracle Database 19c release update, platform, cryptographic provider, allowed algorithms, and module validation status with the compliance owner.
FIPS Support by Cryptographic Provider
Oracle Database 19c supports FIPS 140-2 with the legacy MES provider and FIPS 140-3 with the next-generation OpenSSL provider. Only one provider can be active in a database instance.
| Cryptographic provider | FIPS standard | Configuration |
|---|---|---|
| Next-generation OpenSSL provider | FIPS 140-3 | Set FIPS_140=TRUE and FIPS_140_3=TRUE in fips.ora. |
| Legacy Dell BSAFE Crypto-C Micro Edition Suite (MES) provider | FIPS 140-2 | Use the legacy parameters for TDE and DBMS_CRYPTO, TLS, and native network encryption. |
FIPS and post-quantum cryptography (PQC) address different requirements. FIPS concerns use of a validated cryptographic module. PQC concerns resilience against future quantum attacks.
Configure FIPS 140-3 with the OpenSSL Provider
For new FIPS deployments, use the next-generation OpenSSL provider and configure FIPS 140-3 in fips.ora. Before changing the parameters, switch the database to the next-generation provider.
-
In
fips.ora, set the following parameters:FIPS_140=TRUE FIPS_140_3=TRUE -
Restart the database instance and Oracle Net listener.
FIPS_140_3=TRUE enables FIPS 140-3 mode with the OpenSSL FIPS provider. FIPS_140_3 does not enable FIPS mode by itself; set both parameters.
Note: Do not use FIPS_140 and FIPS_140_3 to configure FIPS 140-2 with the legacy provider. Use the legacy parameters instead.
Use Legacy FIPS 140-2 Parameters
FIPS 140-2 remains supported with the legacy MES provider. Use the following parameters for existing deployments, and for Oracle Database versions that use the legacy provider.
DBFIPS_140=TRUEis an initialization parameter that enables FIPS 140-2 mode for Transparent Data Encryption (TDE) andDBMS_CRYPTO.SSLFIPS_140=TRUEinfips.oraenables FIPS 140-2 mode for Transport Layer Security (TLS). When using Oracle Instant Client, also setSSLFIPS_LIBto the FIPS library location.SQLNET.FIPS_140=TRUEinsqlnet.oraenables FIPS 140-2 mode for native network encryption.
Restart the database and affected Oracle Net services after changing FIPS configuration.
Note: The legacy parameters are deprecated when the next-generation provider is active. Use FIPS_140 and FIPS_140_3 for FIPS 140-3 with the OpenSSL provider.