FIPS Mode for TLS in TimesTen

TimesTen supports Federal Information Processing Standard (FIPS) 140-2 and FIPS 140-3 modes for cryptographic operations used by Transport Layer Security (TLS). Set the ssl_fips_140 parameter in the TimesTen instance configuration file (timesten.conf) to select the mode used for client/server and replication TLS operations.

Table 4-1 shows the values supported by the ssl_fips_140 parameter in the timesten.conf file.

Table 4-1 Supported Values for ssl_fips_140

Value	Meaning
0	FIPS mode is disabled. This is the default when ssl_fips_140 is omitted.
1	Use the TimesTen default for FIPS mode. The default is FIPS 140-3.
2	Use FIPS 140-2.
3	Use FIPS 140-3.

Values 1 and 3 both select FIPS 140-3. TimesTen preserves the configured value so that status interfaces can distinguish the default selection (1) from an explicit FIPS 140-3 selection (3). If your deployment requires FIPS 140-2, specify 2 explicitly.

FIPS mode is disabled by default. Selecting a FIPS mode does not enable TLS. You must also configure wallets, encryption requirements, and a common FIPS-supported cipher suite for the participating endpoints.

Configure ssl_fips_140 on each participating TimesTen instance. For client/server connections, configure the intended mode on both the client and server. For replication, configure it on each instance whose replication agent or utility participates in the TLS connection. TimesTen does not silently change the selected mode or fall back to another FIPS standard. An invalid value, or a requested mode that is unavailable in the installed cryptographic libraries, causes initialization or the requested operation to fail.

Note:

Use FIPS 140-3 mode only on platforms and TimesTen installations for which FIPS 140-3 support is listed. See Platforms and Configurations in Oracle TimesTen In-Memory Database Release Notes.

See TimesTen Instance Configuration File in Oracle TimesTen In-Memory Database Reference.