1

I was tasked to implement FIPS certified providers in Java in our Docker images. We are going with Bouncy Castle's bc-fips. I see many providers listed in java.security:

security.provider.1=SUN                                                                                                               
security.provider.2=SunRsaSign                                                                                                        
security.provider.3=SunEC                                                                                                             
security.provider.4=SunJSSE                                                                                                           
security.provider.5=SunJCE                                                                                                            
security.provider.6=SunJGSS                                                                                                           
security.provider.7=SunSASL                                                                                                           
security.provider.8=XMLDSig                                                                                                           
security.provider.9=SunPCSC                                                                                                           
security.provider.10=JdkLDAP                                                                                                          
security.provider.11=JdkSASL                                                                                                          
security.provider.12=SunPKCS11 

Should I remove all other providers and add only the two the Bouncy Castle provides to be FIPS compliant?

2

Based on the Bouncy Castle user guide, you can definitely update the security providers list to include BC FIPS.

As the JSSE requires the presence of the SUN provider in FIPS mode, the minimal static provider configuration to support the JSSE is:

security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider security.provider.2=com.sun.net.ssl.internal.ssl.Provider BCFIPS security.provider.3=sun.security.provider.Sun

If you remove other entries, then "other" Java programs in your Docker container won't be able to use those security providers. If everything uses the BCFIPS provider, it makes sense to remove others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.